Investigatory Powers Bill – Changes to Protection for Journalists’ Sources

The House of Lords has debated and voted upon the Investigatory Powers Bill (the “IPB”), the proposed legislation first tabled in March that sets out the legal framework of the government’s investigatory powers and authority to retain data acquired through interception. The IPB is controversial due to its wide-ranging powers to intercept data and metadata from people’s computers, mobile phones, and other devices. Amendments were introduced as late as 11 October 2016, which included express protections for journalistic material and other confidential information. The House of Commons will now vote to ratify these amendments and any further amendments will bounce between the two houses until ratified by both.

How much protection has this soon-to-be act of parliament afforded us after a year of debate and criticism?

Improving the Current Regime

The IPB “places into primary legislation for the first time the requirement for all public authorities to obtain judicial approval for an authorisation to acquire communications data to identify or confirm a journalistic source,” Earl Howe, the Deputy Leader of the House of Lords proclaimed in October this year in support of various amendments adding journalistic protections. According to the IPB, a current or former High Court judge will decide each application for authorisation to identify or confirm a journalist’s source. The judicial commissioner will weigh the public interest in protecting the source against the public interest in approving the application. In addition to judicial commissioners, the IPB creates an Investigatory Powers Commissioner who will provide statutory oversight and an annual report that will cover the use of “safeguards protecting confidential journalistic material and sources”, among other issues, according to Earl Howe. Also, the IPB explicitly compels public authorities to consider various matters when exercising powers granted to them, including “whether what is sought to be achieved by an authorisation may reasonably be achieved by other, less intrusive means and the public interest in the protection of privacy.”

Not Enough Improvement

The IPB still enables the government to be deeply intrusive. The IPB grants the government the power to compel telecoms companies to keep for a log of communications metadata which records every website a user has visited. For instance, the communications service provider you are using right now will keep (for one year) a record that you visited www.ackmedialaw.com at this time and date, and where from. Under the IPB, police do not need independent authorisation to access communications data. Furthermore, the IPB does not go far enough to address and manage the abuse of collected information and interception powers by intelligence and security personnel (a confirmed phenomenon revealed by recent legal challenges). The IPB allows security and intelligence agencies to cast a net to obtain data about large groups of people, and allows the police and intelligence agencies to legally hack into communications devices so long as they have a warrant. For instance, the police could obtain a warrant to hack all the phones within a particular location (e.g. all phones in Liverpool). The IPB grants authorities the ability to serve a “technical capability notice” that would require them to remove any “electronic protection” (i.e. encryption) on communications. If companies must have the ability to remove any electronic protection, it leaves the encryption weaker and open to potential exploitation by non-governmental individuals.

With respect to journalistic material and confidential sources, the IPB requires applications for warrants to acquire information about journalistic material. Where a relevant authority applies for a warrant to obtain confidential journalistic material, the application for the warrant needs to contain a statement saying so. However, it is unclear what the consequence would be for not declaring this in the warrant application or how anyone would find out that it should have been declared.

Julian Huppert, a Lecturer at the University of Cambridge and former Member of Parliament for the Liberal Democrats, criticised the IPB stating, “The evidence that these powers are all needed is thin indeed. However, the cost to all of our privacy is huge." Privacy International, the charity responsible for much of litigation which led to recent revelations of unlawful government spying has lamented that “the Bill would codify a practice of mass, untargeted surveillance by the UK intelligence services that treat everyone as suspects. These powers are not lawful, nor necessary or proportionate.”

Context

The IPB has been drafted within the context of various judicial decisions and also significant revelations of government spying. In 2014, the Digital Rights Ireland case (CJEU case no. C-293/12) struck down Directive 2006/24/EC, which required communications service providers in the EU to retain communications data for between 6 months and 2 years, citing violations of Articles 7 and 8 of the EU Charter of Fundamental Rights. The current legislation that governs data retention, the Data Retention and Investigatory Powers Act 2014 (“DRIPA”), was widely criticised for being rushed into existence after the Digital Rights Ireland case and eventually, in 2015, the High Court found sections 1 and 2 of DRIPA to be unlawful. DRIPA expires at the end of December 2016 and the government wants the IPB to be in place before then.

In February 2015, the Investigatory Powers Tribunal ruled that British intelligence and security agencies acted unlawfully in accessing millions of people’s personal communications. This decision was the first time that the IPT ever ruled against the intelligence and security agencies. More recently on 17 October 2016, just a few weeks before this article was written, a decision by the Investigatory Powers Tribunal found that the British intelligence and security agencies unlawfully collected bulk communications data and bulk person datasets for 17 years in contravention of the Article 8 right to privacy under the ECHR. The ruling also revealed that information was being abused by intelligence and security workers who accessed information on friends, family, and public figures. The tribunal confirmed, however, that since a code of conduct and legislation were both put in place in 2015, the spying subsequently undertaken has been lawful.

The revelations of Edward Snowden, various reports from the Interception of Communications Commissioner (“IOCCO”), and the Independent Reviewer of Terrorism Legislation all added further pressure on the government as it pushed the bill through both houses. Hopefully that pressure yields a law that will not suffer the damaging inadequacies and legal challenges of its predecessors.

UPDATE 21 November 2016 The IPB has passed through both houses of Parliament and awaits the formality of Royal Assent to become the Investigatory Powers Act 2016.