The Home Office has appointed David Anderson, the former independent reviewer of terrorism legislation, to review the UK’s surveillance law, the Investigatory Powers Act 2016 (IPA).
Anderson, a barrister and leading expert on surveillance law, has been asked to assess whether legislative changes are needed to the IPA, which gives extensive surveillance powers to police and intelligence agencies.
His appointment follows calls to review the act to consider whether intercept evidence should be admissible in criminal prosecutions, following a series of legal challenges over the National Crime Agency’s use of intercepted messages obtained from encrypted phones as evidence in prosecutions against alleged organised criminals.
Experts have also urged the government to review the law to take into account breakthroughs in artificial intelligence (AI) which have led to more intrusive surveillance, and to ensure that rulings by the European Court of Human Rights are reflected in the UK’s surveillance regime.
According to the Home Office, Anderson’s review will focus on the resilience and agility of warranty processes and the oversight regime overseen by the investigatory powers commissioner, Brian Leveson, and judicial commissioners.
The review will also look at the effectiveness of the UK’s bulk dataset regime, which gives government agencies access to databases of personal data on the public – the majority of which are of no policing or intelligence interest – including financial, travel, digital and communications records.
Anderson has also been asked to look at the criteria for obtaining internet connection records – databases recording every online activity of the public, including their use of online and mobile apps, and the suitability of “certain definitions” within the act.
His appointment comes as the Home Office holds discussions with the Council of Europe over proposals to strengthen safeguards in the Investigatory Powers Act to protect confidential journalistic material and journalistic sources.
Anderson will consult with law enforcement, the intelligence agencies and wider public authorities, as well as other external organisations and individuals.
“I look forward to engaging with experts from all quarters on these difficult and challenging issues,” Anderson wrote on Twitter.
The human rights group Liberty, which has brought a series of legal challenges against the Investigatory Powers Act and other surveillance legislation, said that while the review was welcome, the Home Office should go further to balance privacy with public safety.
Katy Watts, lawyer at Liberty said, “although we welcome the independent Anderson review into the IPA, this isn’t enough. Instead, the Government must urgently reassess the invasively wide powers it has to snoop on our lives, and develop proportionate surveillance measures that better balances public safety with respect for our privacy.”
Home Office review
Anderson’s review of the Investigatory Powers Act comes on top of a legal requirement for the home secretary, Suella Braverman, to conduct a review of the act.
Under Section 260 of the act, the secretary of state is required to prepare a report on the operation of the act during a six-month period between May 2022 and November 2022.
The Home Office said the home secretary’s report, along with Anderson’s terms of reference, would be published and laid before Parliament “in due course”, but has not given a date.
Confidential journalistic material
Lawyers and privacy groups argue that the IPA should be revisited in the light of decisions by the European Court of Human Rights (ECHR), which found serious failings in the UK’s previous surveillance regime, the Regulation of Investigatory Powers Act 2000 (Ripa).
A decision by the ECHR in the case of Big Brother Watch and others v the UK in 2020 raises questions over whether the Investigatory Powers Act provides adequate privacy safeguards during bulk surveillance operations and whether it adequately protects confidential journalistic material and sources.
The government has previously told the Council of Europe that it intends to update section 154 of the Investigatory Powers Act, which requires government agencies to inform the Investigatory Powers Commissioner’s Office (IPCO) if they obtain material related to confidential journalistic communications during bulk interception.
Under the proposed amendment, a security and intelligence agency that wishes to use search criteria that are intended or highly likely to select confidential journalistic material for examination or searches to confirm journalistic sources, must seek prior approval from the investigatory powers commissioner.
According to a letter from the Home Office’s Investigatory Powers Unit to the Council of Europe in December 2022, the government said that under its proposals the investigatory powers commissioner must have regard for the public interest in making a decision that affects journalistic material.
“This means requests must only be approved where the public interest in the security and intelligence agencies selecting for examination or retaining the material outweighs the public interest in ensuring the confidentiality of confidential journalistic material and the sources of journalist material,” it said.
Bulk surveillance
The government has also disclosed, in an action plan submitted to the Council of Europe, that it intends to change operating procedures to require government agencies to obtain internal authorisation before carrying out bulk interception operations that seek data linked to an identified individual.
The Home Office previously made amendments to the IPA, following the Court of Justice of the European Union’s (CJEU) ruling on the Tele2 and Watson case in 2016, which found that the scope of the UK’s data retention regime was too wide to be compatible with European Union (EU) law.
That led to the Home Office introducing the Data Retention and Acquisition Regulations 2018, which required law enforcement to seek independent authorisation from the Office for Communications Data Authorisations, part of IPCO, before accessing individuals’ communications data, and limited police access to cases of “serious crime”.
Under the regulations, intelligence agencies can self-authorise requests for communications data from telephone and internet service providers in matters relating to national security, and there is an exemption for police to self-authorise in urgent cases.
Communications data
Any government review would also be expected to assess the performance of the Office for Data Authorisations (OCDA), a body set up in March 2019 – after the IPA 2016 came into force – to review applications by government bodies to access data about individuals’ telephone, email and internet use from phone and internet companies.
The OCDA, which was set up to manage 200,000 requests a year from 600 public bodies to access communications data, which includes information such as the time and recipient of emails and phone calls, but not the content; mobile phone location data; and the URLs of websites visited, but not which page of the website.
The organisation employs around 100 people, at offices in Manchester and Birmingham, who act as a contact point for government agencies seeking communications data between 7am and 10pm seven days a week.
Anderson’s review may also consider the legal fall-out from Operation Venetic, which relied on the contents of millions of messages and photographs obtained by French police in 2020 from the supposedly secure encrypted phone network EncroChat.
The operation has led to legal challenges questioning the lawfulness of the warrants underpinning Venetic, in the Investigatory Powers Tribunal, the European Court of Human Rights and referrals to the court of appeal.
Investigatory powers reviews
Anderson, a barrister at Brick Court Chambers, previously held the post of independent reviewer of terrorism legislation for six years.
He carried out two influential reviews into investigatory powers – A question of trust in 2015 and the Bulk powers review in 2016.
In 2018, he was knighted for services to national security and civil liberties, and appointed to the House of Lords where he is as an independent cross-bench peer.
Following the announcement of the Anderson review, Katy Watts, lawyer at Liberty said that the IPA allows the state to collect the “messages, location, and browsing history of all of us without grounds for suspicion”.
She said that surveillance safeguards can only protect the public if they work in practice, but Liberty’s own legal challenges of the IPA have shown them to be ineffective at protecting rights.
“These dangerous mass surveillance powers do not keep us safe, instead they breach our privacy and undermine core pillars of democracy,” she said.
Read More
Rubi Buresh