Investigatory Powers Bill – Written Evidence

House of Commons Public Bill Committee – Investigatory Powers Bill

We are making this statement in the capacity of Scottish PEN, the Scottish centre of the world association of writers, PEN International. It is a charitable body for the advancement of the education of the public by the following means: i) The encouragement and promotion of writing in and about Scotland nationally and internationally; ii) The support of writers worldwide in the interest of freedom and artistic expression; iii) The fostering of international understanding through the appreciation of literature; iv) The attendance of Scottish PEN representatives at conferences, symposia and other meetings of writers worldwide; v) The organisation in Scotland of conferences and other literary events; vi) The undertaking of any legal activity to further these charitable objects provided that Scottish PEN shall in no circumstances engage in political activities.
INTRODUCTION

1. As an organisation charged with representing writers to ensure the fundamental freedoms to write, read and share thoughts, there are a number of aspects of the Investigatory Powers Bill that could threaten these freedoms were they to be made into law.

2. Prior to the joint parliamentary committee scrutinising the draft bill, we polled our membership of over 300 writers, including fiction, non-fiction, journalists and poets for their reactions to the enhanced surveillance proposals contained within the bill. The answers of the 22 respondents have informed this submission. The polling questions can be found in APPENDIX I (50-53)

3. Further to the supplying answers to the questionnaire, Scottish PEN members were given the opportunity to present a statement in relation to the then draft Investigatory Powers Bill (named or anonymous) these can be found in APPENDIX II (54-66)

4. This evidence follows up on our evidence submitted to the joint parliamentary committee, readdressing points that still represent a grave concern to Scottish PEN and our members, alongside new issues that have arisen as the bill progresses through Parliament.

5. The aspects within the bill that we are focusing on relate directly to the freedom of our membership and the broader writing community within Scotland to write and read. These aspects are: (1) privacy protections; (2) the retention of Internet Connection Records (ICRs) by telecommunications providers of every British citizen for 12 months that can be accessed by public bodies; (3) bulk & targeted powers; (4) the judicial and political oversight mechanisms; (5) technical capability and national security notices, that can give the Home Secretary increased capacity to pass on obligations to telecommunication operators; and (6) the prevalence of gag orders that restrict knowledge of the actions contained within the bill being shared with journalists, customers and the wider community. This can include the aforementioned technical capabilities notices; interception; equipment interference; and the retention of communications data.

6. We are highly critical of the vague and non-focused nature of the language used throughout the bill. This is an issue that requires clarity and exactitude to ensure the powers are clearly identified and established to ensure none are misused. We are concerned that the vagueness that defines the bill will enable the intelligence agencies to go beyond what was initially contained within the bill, as the parameters to their behaviour have not been clearly identified. Vague language at this time should not establish loopholes for the future.

PRIVACY PROTECTIONS

7. Scottish PEN condemns the cynical approach undertaken by the Home Office to enhance privacy protections when faced with calls from three parliamentary committees, legal experts, academics, privacy watchdogs and civil society more broadly. The addition of the word privacy in the title of Part 1 of the act is a superficial addition that attempts to mask the inadequate protections contained within the bill.

8. The protections outlined in part one are unclear on the available steps for recourse and fail to contain a tort for unlawful interception, leaving only criminal law protections. This seems to differ substantially from the Regulation of Investigatory Powers Act 2000 that contains a great deal of the existing UK’s surveillance powers.[1]

9. Recommended Amendment: We call on the government to take meaningful and substantial steps to follow the advice from the Intelligence & Security Committee who “recommended that the new legislation contains an entirely new Part dedicated to overarching privacy protections, which should form the backbone of the draft legislation around which the exceptional powers are then built. This will ensure that privacy is an integral part of the legislation rather than an add-on.” [2]

10. Recommended Amendment: Introduce a tort for unlawful interception as seen in RIPA 2000. This will give a meaningful avenue of recourse and act as a motivation to intelligence agencies, police forces and the government to ensure all interception is lawfully authorised and carried out.

INTERNET CONNECTION RECORDS (ICRS)

11. Scottish PEN represents writers and readers who, at times, research and read challenging material that represents a broad and diverse set of values that do not at any given time fully or accurately represent their own personally held political, social or religious beliefs.

12. We seek clarification as to whether this power enables the state to construct remote profiles from Internet usage. We believe this could adversely affect writers and readers who research challenging and divisive content; we are not what we search.

13. In the polling of Scottish PEN members, over half of respondents answered that the retention of ICRs will change how they conduct their research and source information online. Encouraging writers and readers to engage in self-censorship to ‘escape’ surveillance cannot ensure the free expression that defines a modern democracy.

14. In 2015, PEN International commissioned a study into the impact of mass surveillance on writers around the world: “The survey findings demonstrate that increasing levels of surveillance in democracies are seriously damaging freedom of expression and thought, the free flow of information, and creative freedom around the world.”[3]

15. These findings supported the findings of the PEN American Center who commissioned a similar study of US based writers in 2013 who found that “1 in 6 writers has avoided writing or speaking on a topic they thought would subject them to surveillance”[4]

16. We are concerned that this power impinges on the rights of individuals in the UK to “receive and impart information and ideas without interference by public authority”[5] as identified in Article 10(1) of the Human Rights Act 1998. This is further challenged by the lack of definitions for terms such as ‘national security’, which undermines the ability to identify any necessary limitations to free expression as outlined in Art. 10(2) of the same act.

17. This invasive power – none of our international partners or other members of the “five eyes” group currently have this power – currently lacks any independent judicial oversight, instead depending on authorisations gained from a ‘designated senior officer’ from within the same authority requesting access.

18. Following the TalkTalk hacks, we seek clarification and reassurances that the government has identified necessary funds and resources to ensure the data held by internet service providers at the government’s request is secure enough to protect the privacy and data of internet users across the UK.

19. Recommended Amendment: Requiring public bodies to seek approval through a designated senior officer and not a warrant signed by a judge removes a much-needed level of oversight to ensure that they are independently judged to be acting in a “necessary and proportionate” manner. Authorisation for the obtaining of ICRs should be incorporated within a truly independent judicial oversight framework (see para. 30-34).

20. Recommended Amendment: The publication of a list of justifications (to supplement Schedule 4) offering further detail as to why the identified public authorities require access to ICRs. This way we can ensure that potential usage is in line with the justification for the bill as identified by the Home Secretary.

21. Recommended Amendment: Key aspects and definitions of ICRs are not contained in the bill but are found in the codes of practice. This raises a number of questions as to whether definitions can be revisited without parliamentary scrutiny, as well as only operating as an aid to interpretation. Important definitions and limits to power should be contained within the bill and debated accordingly.

22. Recommended Amendment: An independent review should be carried out prior to the publication of the law to analyse and report on the technical barriers to ensuring data can be held by telecommunication operators in a safe and secure manner. This should include a timeline for compliance and a fully costed breakdown as to the financial support offered by the government.

BULK & TARGETED POWERS

23. Scottish PEN’s deeply held reservations regarding bulk powers are shared by a large number of academics, NGOs, legal professionals, parliamentarians and the UN Special Rapporteur on the Right to Privacy, who stated that: “the SRP invites the UK Government to show greater commitment to protecting the fundamental right to privacy of its own citizens and those of others and also to desist from setting a bad example to other states by continuing to propose measures, especially bulk interception and bulk hacking, which prima facie fail the standards of several UK Parliamentary Committees, run counter to the most recent judgements of the European Court of Justice and the European Court of Human Rights, and undermine the spirit of the very right to privacy.”[6]

24. Our concerns over the reach of targeted warrants were also highlighted by the Scottish National Party (SNP) Spokesperson on Justice and Home Affairs, Joanna Cherry QC MP who stated: “targeted interception warrants may apply to groups of persons or more than one organisation or premises. Bulk interception warrants lack specificity and lack any requirement for reasonable suspicion, giving licence for speculative surveillance.”[7]

25. There are widely held beliefs that the use of bulk interception warrants, as well as both thematic and bulk equipment interference warrants as outlined in this bill warrants mass surveillance and compromises the right to privacy and are thusly deemed to be illegal within our existing legal structure. This significantly undermines the Home Secretary’s assertions that “the UK does not undertake mass surveillance – we have not and we do not.”[8]

26. The use of equipment interference raises distinct concerns for writers, journalists and researchers who have to communicate with a wide range of individuals and organisations as part of their academic or professional work. The ability of the state to access hard drives, calendars and email inboxes undermines any writer’s ability to keep secure sensitive details and data. The impact of this could be the closing up of communications channels with sources, whistle blowers and other experts reluctant to reach out if the security of the channel or system cannot be guaranteed.

27. Intended intrusion or the ability to hack systems or computers of individuals “who are not intelligence targets”[9] to access other connected systems may severely hinder the willingness of individuals to connect with others for the fear of coming under enhanced scrutiny by the intelligence agencies. This can severely hinder the networks necessary to share information and data that is the bedrock of the academic, journalistic and creative industries.

28. Recommended Amendment: Bulk powers should be named as such. In this manner, targeted interception warrants should remain targeted and specific in nature and should not be able to apply to groups of people, organisations or premises.

29. Recommended Amendment: Bulk interception and bulk equipment interference should be removed from this bill if it is deemed to undermine the right to privacy and other existing legislation. This bill cannot advocate the use of illegal powers irrespective of its stated aims.

OVERSIGHT MECHANISM

30. The oversight mechanism outlined in the bill goes some distance to incorporate judicial oversight mechanisms, but Scottish PEN does not believe it to go far enough to ensure oversight is robust enough to protect against unlawful interception and the misuse of powers.

31. The “double-lock” process, which involves the sign off of a Secretary of State before being reviewed and approved by a judicial commissioner, cannot be defined as such as it suggests a balanced process, representing both political and legal views equally. David Davis MP highlighted this at the draft stage: “this is not the judge checking the evidence, it is the judge checking the correct procedure has been followed…[the Home Secretary] would had to have behaved in an extraordinary manner for her decision to be blocked by a judge”[10].

32. Judges should have access to the evidence contained in every warrant or request. This would constitute true authorisation as opposed to a review process that we currently see in the legislation.

33. Recommended Amendment: We should look to the models employed around the world by both allies and intelligence partners, and depend on a “single-lock” system that only requires judicial authorisation. This will be a more straightforward and independent system. Short of this, the “double-lock” mechanism should be modified to be that of an “equal-lock” process that enables judicial commissioners to interrogate the substance of the warrants as opposed to merely reviewing the process followed.

TECHNICAL CAPABILITY & NATIONAL SECURITY NOTICES

34. Section 217 outlines how the Secretary of State can “give a relevant operator a notice (a “technical capability notice”)— (a) imposing on the relevant operator any applicable obligations specified in the notice, and (b) requiring the person to take all the steps specified in the notice for the purpose of complying with those obligations.”

35. Scottish PEN is deeply troubled by the vague language (both for s.217 “technical capability notices” and s.216 “national security notices”) that appears to offer the Secretary of State unknown and unidentified broad powers that fall outside any possible scrutiny at this current stage. Powers as significant as these should be identified in a clear and exhaustive list that outlines the parameters of the secretary’s powers outlined in this section.

36. “Regulations under this section may specify an obligation that may be imposed on any relevant operators only if the Secretary of State considers it is reasonable to do so.” This subsection continues to identify broad sweeping powers that depend only on the consideration of the Secretary of State alone.

37. Section 217 (5) (a-d) identifies the bodies that the Secretary of State must consult prior to making any regulations on this section and we are concerned that none of these are representatives of the judicial commissioners outlined in different sections of this bill.

38. We are concerned by the dependence on the Technical Advisory Board (TAB) who has, according to investigative journalist, Duncan Campbell: “never met once in the past 15 years ‘to perform its advisory function’”[11]. We remain unconvinced that such a pivotal and vital role should be assigned to a board that is yet to justify its capacity to fulfil its existing duties, let alone these new powers suggested in the bill.

39. While there has been limited progress in limiting the power to undermine encryption to only the “removal by a person of electronic protection applied by or on behalf of that person”, here at Scottish PEN, we do not believe this to be adequate protections against a wide variety of obligations that are currently left unidentified in the bill.

40. Recommended Amendment: All powers given to the Secretary of State by both technical capability notices and national security notices should be outlined in the bill (not hived off to a codes of practice) so each can be viewed and debated by parliament.

41. Recommended Amendment: Representatives of the judiciary should be consulted by the Secretary of State to authorise any and all powers that fall within this section of the bill.

42. Recommended Amendment: An independent review should be authorised and carried out on the Technical Advisory Board prior to this bill being made law to ensure it has the capacity and willingness to carry out the powers identified above.

GAG ORDERS

43. A “duty not to make unauthorised disclosures”, many punishable by up to 12 months imprisonment and/ or a fine, is found throughout the bill including:

• 49 – Targeted interception warrants;
• 136 (2) – Bulk interception warrants;
• 73 – Obtaining communication data;
• 84 (2) – Retention of communication data notices;
• 114 – Targeted equipment interference warrants;
• 172 – Bulk equipment interference warrants;
• 152 (1) – Bulk acquisition warrants;
• 218 (8) – National security and technical capability notices

44. Scottish PEN is deeply concerned that the severity of these punishments will dissuade whistle-blowers and journalists from speaking out in the public interest, further limiting the flow of information to the public.

45. The inability of telecommunications operators to communicate actions carried out as part of this bill makes it impossible for customers, including writers, readers and researchers, to make an informed decision as to whether to continue to use platforms that may have been compromised by the security services.

46. In the questionnaire to Scottish PEN members, respondents reacted to this breach of trust in a manner that significantly undermines their trust with key institutions. When asked whether the inability of telecommunications providers or journalists to share information surrounding key aspects of the bill affected their trust of key bodies, 77% of respondents stated that they would severely distrust the UK government, 68% answered the same in regards to telecommunications providers and 59% said that they would severely distrust writers and journalists as a result of their inability to report accurately on the contents of the bill.

47. Recommended Amendment: All gag-orders should be removed from the legislation to ensure the public is informed of the sweeping powers contained within this bill and can take an active role in choosing to avoid platforms the security of which has been undermined. It is the government’s responsibility to ensure their powers do not threaten the competitiveness of the UK tech sector and damage the economic prospects of companies acting under notices. This cannot be used as an excuse to severely hamper free expression as protected in article 10 of the Human Rights Act 1998.

ANNEX I: Questionnaire to Scottish PEN Members

49. The draft Investigatory Powers Bill includes a legal obligation of telecommunications services to hold Internet Connection Records of every British citizen for 12 month to be accessed by public bodies without a warrant. Will this change how you conduct your research and source information online?

Yes

No

Other

50. If a platform that you use on a regular basis (such as social media platforms, emails, online shopping, banking…) had been compromised by the intelligence agencies, would you continue to use it?

Yes

No

Not sure

Other

51. If your email platform had been compromised by the intelligence agencies, would this affect your communication with the following individuals or groups?

Publishers:

Colleagues in the UK:

Colleagues abroad:

Friends & Family:

52. If the government was able to access private services (such as social media platforms, emails, online shopping, banking…) and journalists and the telecommunication providers themselves were unable to openly share information about this, how would this affect your trust in the following services?

UK Government:

Press & Journalists:

Service Providers:

APPENDIX II: Written Statements from Scottish PEN Members

53. I am for the highest degree of openness and transparency compatible with safeguarding security. Public acknowledgment in due course by service providers of such intrusions should therefore be normal. –Professor Richard H. Roberts

54. It is must be inferred that the encroachments proposed by the current government on public and private media, services, platforms and providers will do little to combat organized crime or terrorism. Any such offender with a smidgen of nous, and surely that means most, will keep abreast of developments of this kind and take appropriate measures to ensure safe passage and unobserved action. As the present government acts to reduce the range and volume of the state, layer by layer, what parts of it remain will become increasingly vulnerable to access by corporate interest, in other words by global companies whose command of advanced technology will eclipse anything the intelligence services, dependent on relatively small state budgets, will be able to muster. As that fulcrum is reached, all data previously encrypted by government services, as well as data the present government wishes to access and more, will be available for exploitation, including sell-on to interested parties. Not only the current capabilities and practices of specialized hackers but also the political history of our own era post-1933 already show that it is essential for the public to take special care to protect its data and ultimately personal safety as well as the existence of civil society in all its remaining forms against the actions of future (at present unimagined) governments, state and military agencies, and corporate interest. The present government believes it needs more information to fight our enemies. In fact, the opposite is true: the more information generated and retained, the more vulnerable our societies become. –Iain Galbraith

55. Targeted investigatory powers are essential in some cases but it is “overkill” to introduce such elastic and invasive powers for everyone. –A Connolly

56. I oppose any measures designed to limit the level of confidentiality between providers and users such as the Internet Connection Record. The test of reasonableness would need strict definition. My opposition applies to proposed measures emanating from both Westminster and Holyrood. –Anonymous

57. Anyone who assumes privacy in cyberspace is a fool. It’s all compromised already. No I am not paranoid. I am a Computer Science academic. Anything digital can be seamlessly copied and transmitted. There is no encryption that can’t be broken. Really. If you need secrecy use the postal services. It takes far more human effort to open and read a letter than to scan a digital artefact. And after a letter is destroyed it can’t be copied. When you delete email what has actually been deleted? And from where? –Anonymous

58. As I understand them, the provisions are so loosely defined that they invite abuse. The assumption that everyone has to be watched is very disturbing. –Anonymous

59. I think it compromises citizens’ rights to free speech, free interchange of ideas, and private communication. I don’t want to live under surveillance, and I don’t believe it ultimately makes anyone any safer. –Anonymous

60. The Bill is like using a sledgehammer to crack a marshmallow. –Anonymous

61. The Bill extends powers to the State which are not obviously different from those in regimes recognised as repressive and are of a piece with current government encouragement to eg teachers to report ‘subversive’ activity or views among their pupils. Of course the state needs to protect its citizens but it is arguable that sufficient means to do that exist already. For instance the identities of the ringleaders of the recent Paris attacks were apparently known to the international police and the problem was a failure to act on information not a failure of surveillance. A key consideration with me is that however apparently benign the intention in setting up further and far-reaching means of surveillance, once such mechanisms are set up and accepted it is easy for them to be misused. It could be the first step to the UK becoming a police state. –Anonymous

62. This doesn’t significantly change my view of the state nor will it significantly alter my behaviours. I have nothing to hide and know that openness is the best policy. I’m sure they would find most of my communications boring. –Anonymous

63. This change to the law represents a major intrusion into civil liberties, and a huge addition to the powers of surveillance by the state. A writer’s thoughts and the ways he/she has to generate new work – and also the way he/she communicates, and who with – must be kept private in order to produce the work. I completely oppose this bill. –Anonymous

64. I am very concerned about the undemocratic and sweeping nature of the powers this bill suggests. I am also extremely concerned about the appalling short time for its consideration. –Anonymous

65. It’s an infringement of civil liberties, taking us back to feudal times. –Anonymous

The post Investigatory Powers Bill – Written Evidence appeared first on Scottish Pen.