In a contentious move, King Charles III announced the government’s intention to expand the powers of the controversial 2016 Investigatory Powers Act during the State Opening of Parliament.

The Act, commonly known as the “snoopers’ charter” is made up of a range of provisions, such as requiring broadband internet service providers and mobile operators to log internet connection records (ICRs) for up to 12 months. As it stands, the ICRs are made up of IP addresses, visited servers, and timestamps, but are considered not to contain the content of communications made. 

Now, due to the evolved nature of threats facing the UK since 2016, the government is proposing changes to grant broader investigative powers to security and law enforcement agencies, allowing deeper scrutiny of online activities.

“At a time when threats to national security are changing rapidly due to new technology, my Ministers will give the security and intelligence services the powers they need and will strengthen independent judicial oversight,” said the King during his address.

The proposed Investigatory Powers Bill outlines several key changes, including:

• Making changes to the bulk personal dataset regime to allow intelligence agencies to more effectively utilize less sensitive data, subject to safeguards.
• Expanding oversight to support the Investigatory Powers Commissioner in carrying out their role, with some functions placed on a statutory basis.
• Reforming the notices regime to anticipate risks to public safety posed by technology that hinders lawful access to data.
• Updating the conditions for the use of Internet Connection Records to detect serious criminal activity and national security threats, supported by robust independent oversight.
• Increasing the resilience of warrant authorization processes to ensure timely access to information for security and intelligence agencies, as well as the National Crime Agency.

The government still has not provided specific details about changes to existing ICR conditions, or a definition of ‘less sensitive data.’ However, it did note that the existing law already sets certain thresholds for the use of ICRs such as when illicit websites have been accessed, and by whom. 

Recommended

• Amazon Echo Security Vulnerabilities Highlighted at Def Con 2018
• Human Rights Group Challenges ‘Snooper’s Charter’
• Police Fall Under Spotlight of Privacy International for Data Harvesting Again

The original passage of the Investigatory Powers Act in 2016 was lengthy and complex, marked by many legal challenges and subsequent amendments. The updated rules will likely be the cause of much debate and scrutiny. 

According to the Open Rights Group (ORG), the amendments could mean that global tech companies will be forced to get permission from the UK government if they want to make changes to security features of their products and services. 

“End-to-end encryption keeps our data and our communications safe and secure. The proposed reforms to the Investigatory Powers Act are the government’s latest attack on this technology,” said Abigail Burke, platform power programme manager for ORG.

“If enacted, these reforms pose a threat to companies’ ability to keep our data safe and increase the risk of criminal attacks. We urge the government to engage with civil society and tech companies, and to reconsider these potentially dangerous proposals.”

As the government seeks to strike a balance between national security and individual privacy in the digital age, the upcoming debates in Parliament will be crucial in determining the future of the UK’s surveillance framework.