Investigatory Powers Act: Home Office proposes rethink of safeguards on bulk data collection

IPA is limiting digital transformation

The Home Office argues that rapid changes in technology coupled with limitations in the Investigatory Powers Act are inhibiting the UK’s intelligence community from exploiting digital technology “required to keep the country safe”.

In 2020, the government increased the budget of the UK Intelligence Community (UKIC) by £173m, to £3.1bn, in part to fund a "digital transformation programme" for intelligence agencies.

The government’s Integrated Review the following year found that the UK is facing a period of rapid technological change, that will bring benefits but also increased competition.

“This pace of change, coupled with limitations within the Act, is inhibiting UKIC’s ability to maximise the benefits of digital transformation, stay ahead of adversaries, and ultimately keep the country safe,” the Home Office said in its review of the IPA.

The Home Office claims that the exceptional growth in the volume and type of data across globally since the Act entered into force has impacted UKIC’s ability to work and collaborate at the "necessary operational pace".

Bulk personal datasets

This has impacted the intelligence agencies’ use of bulk personal datasets (BPDs), which can include people's financial, travel or communications data, the majority of which is of no interest to the intelligence services.

“The BPD safeguards in the current statutory framework are disproportionate for some types of data, creating a negative impact on operational agility, while also harming capability development,” said the review.

The Home Office says existing safeguards limiting the use and acquisition of bulk personal datasets do not take into account the extent to which cloud and commercially available tools now made powerful analysis of datasets possible.

The safeguards also fail to take into account the fact that most data can, in theory, now be resolved to real-world identities, which means that datasets not previously considered to fall within the protections of the IPA now constitute BPDs.

Reform to Part 7 of the IPA, which governs the use of BPDs, would enable intelligence agencies to take a more robust response to the “deteriorating global security environment” and adapt to a wider range of technology-enabled threats, the Home Office claims.

Among other changes, it says there is a need to increase the duration of warrants for bulk personal datasets so that they do not require renewing every six months. The intrusion caused by the retention and examination of BPDs is often more static and predictable than for other IPA data types where warrants authorise the continuous acquisition of data, it said.

Internet connection records

The Home Office also calls for a rethink on safeguards that limit access by law enforcement and intelligence agencies to internet connection records (ICRs).

The Investigatory Powers Act gave public authorities access to ICRs held by telecommunications operators for the first time, when it became law in 2016.

ICRs include records of websites visited by individuals but not the information searched for; records of new sites visited, but not the articles read; and records of people accessing mobile phone apps, but not what activities they carried out using the app.

The National Crime Agency has carried out a trial of ICRs, working with a "small number" of telecoms operators, the Home Office review reveals. The trial focused on access to websites whose sole purpose was to provide access to illegal images of children.

“Over 120 subjects of interest (SOIs) have been identified accessing one or more of these sites. Intelligence checks suggested that only four of these SOIs could be positively confirmed as previously known to authorities,” it said.

But the Home Office said that the conditions laid down by Parliament to strike a balance between intrusion and privacy, need to be revisited.

“ICRs appear to be currently out of reach for some potentially key investigations, such as those seeking to identify individuals involved in some of the most serious crimes,” it said.

Technical capability notices

Other recommendations from the Home Office include a requirement for telecoms companies and other organisations that provide internet services, to install specific technology to retain telecoms records or intercept their content.

Under the IPA, government departments can issue Data Retention Notices, which require telecoms companies to retain records of their customers’ communications, and Technical Capability Notices (TCNs) to require companies to install an interception capability.

TCNs can require companies to create and install a permanent capability for government to remotely intercept and interfere with their networks, Computer Weekly has previously reported.

Universities and schools, Wi-Fi service operators, or app developers whose app includes a communications service that customers could use, are classed alongside traditional internet and telephone companies which can be served with TCNs.

Under existing arrangements, the government reimburses telecoms operators for 100% of the capital and operation costs for Data Retention Notices. Organisations that receive TCNs qualify for refunds of their operational costs.

Companies are free to install their own technology, but the Home Office argues that costs could become prohibitive unless the government has powers to mandate what technologies telecoms companies install.

“Without the ability to levy technical requirements on telecoms operators, or to benchmark the level of government reimbursement, there is a continuing risk that capabilities become prohibitively expensive as technology continues to evolve,” the Home Office review said.

International co-operation

The Home Office said that data on UK citizens was increasingly held by service providers outside the UK. The UK and US agreed a Data Access Agreement, which came into force on 3 October 2022, that will provide UK law enforcement agencies access to data held on UK citizens in the US, subject to US freedom of speech laws, for investigations relating to serious crimes and terrorism.

It will also enable the US to access data on US citizens in the UK, provided the information is not used to prosecute the death penalty in the US.

The Data Access Agreement will be overseen by the Office of the Investigatory Powers Commissioner (IPCO), which published guidelines today.

March deadline

Anderson has asked for comments for his independent review of the Investigatory Powers Act by 10 March 2023 at the latest.

“Constraints related to the timetable for possible future legislation means that the timescale for comment must of necessity be short,” he wrote on his blog.

Anderson, a barrister at Brick Court Chambers, previously held the post of independent reviewer of terrorism legislation for six years. He carried out two influential reviews into investigatory powers – A question of trust in 2015 and the Bulk powers review in 2016.

In 2018, he was knighted for services to national security and civil liberties, and appointed to the House of Lords where he is as an independent cross-bench peer.