New privacy fears as IT challenges delay surveillance oversight body by a year

Police use 29 versions of software

The Home Office official said the OCDA needs access to the IT systems of every public body requesting communications data, which means its own IT systems must be “consistent” with a wide range of incompatible IT systems that are used to process requests to access phone and internet records.

The OCDA will need to integrate its IT systems with those of at least 80 government organisations, many of which will use incompatible software. Police forces, for example, use 29 different versions of software developed by three different suppliers to manage requests for communications data up to the security classification of “official sensitive”, Scurry revealed.

Police forces and other public bodies will also need to update their IT systems, which were developed under the previous surveillance regime, the Regulation of Investigatory Powers Act, to make them compatible with the requirements of the Investigatory Powers Act 2016.

The OCDA will need to invest in specialised computer systems to access secret or top secret material, based on terminals held in a secure environment, which will need to be linked using highly secure cabling.

IT integration most difficult task

“The IT integration is a really significant task,” said Scurry. “It is probably the most difficult part of setting up OCDA. If OCDA were to take shortcuts…it is highly likely that there would be an increase in errors which infringed individuals’ privacy rights.”

Using workarounds, such as rekeying data, was likely to lead to errors, said Scurry. For example, wrongly typing a digit in a telephone number could result in an innocent person having their phone records accessed, showing who they called, when, how often, and potentially a record of their location history from their mobile phone. “Anything that does not involve an existing automated system is more likely to generate errors,” he said.

The OCDA cannot begin work on its IT systems until it finds premises capable of securely storing and handling sensitive material, including top secret material. The building will need to be fitted with secure networks, which may require permission from the Highways Agency to dig up the roads to install the cabling, according to the Home Office evidence. A suitable building has only just been identified, said Fulford.

The OCDA will also need to recruit about 100 staff, who will need to be trained in how to use the new IT systems, and will have to go through security clearance processes, before it can begin its work.

Also, thousands of staff employed by the police and other government agencies, who are familiar with the Regulation of Investigatory Powers Act, will need training in the news processes contained in the Investigatory Powers Act.

Start date impossible to achieve

Scurry added: “As we have looked in more detail at what the IT requirements are, and understood fully how many different systems there are, and what their separate requirements are, and as the planning of sequencing has developed, it has become clear that the initial estimate of the anticipated start date is impossible to achieve.”

The government proposed creating the OCDA, along with other amendments to the Investigatory Powers Act, following a ruling by the European Court of Justice that found that near-identical powers in the UK government’s previous surveillance law, the Data Retention and Investigatory Powers Act (Dripa), were unlawful.

The OCDA will act as an independent body to pre-authorise access to data retained by telephone and internet companies as a result of government retention orders. It will limit the ability of senior police officers, and officials at the Department for Work and Pensions and HM Revenue and Customs, to authorise their own access to communications data.

It was one of a series of amendments to the Investigatory Powers Act on 30 November 2017, which were put to public consultation for eight weeks in a move the government said would address the Act’s “shortcomings”. The amendments have yet to be enacted by parliament.

Corey Stoughton, advocacy director at Liberty, said the government had been unlawfully ordering the retention of sensitive communications data on the UK population for 14 months, and that a delay of another year was a breach of democratic rights.

“The government has admitted that without the independent review the Office for Communications Data Authorisations provides, its regime for holding data on the who, when and where of millions of people’s communications violates our right to privacy,” said Stoughton. “A court ruling made this clear over a year ago.

“It is therefore disturbing that – for no clear reason – the government is asking us to wait yet another full year for it to stop violating our rights. It’s time ministers recognised they aren’t above the law and got on with building a targeted surveillance regime that keeps us safe and protects our democratic rights.”