The Investigatory Powers Act 2016 became law on 29 November, when it received Royal Assent.  It is currently being brought into force in stages.

This post, originally composed on 3 December 2016, is my big-picture reaction to the Act, which was influenced by my reports A Question of Trust (June 2015) and Report of Bulk Powers Review (August 2016).

Advantages

The Act gets the big things right.

  • It introduces world-leading standards of transparency (for example in relation to “equipment interference” or Government hacking, a widespread practice which few countries even acknowledge in their law).
  • It gives legal sanction to a range of powers which have already proved their worth, whether in warfare, cyber-defence, counter-terrorism or the fight against sexual exploitation and serious and organised crime.  These include powers of bulk collection exercised by the security and intelligence agencies.
  • It provides much enhanced safeguards, including the requirement of judicial approval before warrants enter into force, additional protection for privileged or sensitive material and new penalties for the wrongful examination of data.
  • It is couched in technology-neutral language which, notwithstanding the breakneck pace of change, should last – with judicious amendment – for 10 or 15 years.

All in all, more than 90% of the 124 recommendations in my 2015 report A Question of Trust are reflected in the new Act, together with one communicated to the Prime Minister in a private letter and the sole recommendation of the 2016 report of my Bulk Powers Review.  The Act updates the law not only to the internet age, but to an era when popular trust can no longer be secured by bland assurances.

Reservations

I don’t like everything about the Act.

  • The “dual lock” system for authorising warrants is unnecessarily cumbersome: the Secretary of State need not have been involved in the classic judicial function of assessing whether the phone of a suspected drug dealer needs to be intercepted.
  • It is legitimate to ask whether there are adequate advance safeguards on the exercise of some of the very extensive powers now spelled out for the first time: most obviously, the practice of large-scale “thematic” equipment interference or hacking, which is entrusted not only to intelligence agencies but to the police.  Some light may be shed on this question by a judgment expected on 21 December in a case brought last year by Tom Watson MP and David Davis MP.
  • An opportunity was missed to recognise in statute what will surely be known as the Investigatory Powers Commission, and to reflect in its name the reality that its functions extend to intelligence supervision even outside the area of investigatory powers.

Other things I had no opportunity to evaluate for myself.  The power to require the retention of internet connection records (or “web logs“), the most substantial new power in the Act, was one for which no adequate operational case had been made when I reported (9.51-9.61) in 2015.  Even if “a sufficiently compelling operational case” was in the future made out, I recommended that “a rigorous assessment should then be conducted of the lawfulness, likely effectiveness, intrusiveness and cost of requiring such data to be retained” (A Question of Trust, Recommendation 15 on p. 288).

(Such an exercise was subsequently conducted (see paras 89-158) by a parliamentary committee, guided not only by extensive evidence but by clerks knowledgeable in the field.  Anyone who doubts the strength and independence of such committees should reflect on the fate of the Communications Data Bill 2012, which was strongly criticised by the equivalent committee and then withdrawn.)

In a few respects, the jury remains out pending implementation of the Act.

  • Wise judicial decisions on warrant approval will depend not only on the work of the Technology Advisory Panel, which has been provided for as I recommended (9.25-9.32) in the report of my Bulk Powers Review, but on the ability of Judicial Commissioners in difficult or sensitive cases to call upon security-cleared lawyers to perform an amicus role.   The Government has promised (p. 70) a budget “for Counsel to be appointed and consulted when the Commissioner feels it is necessary“.  The Chief Judicial Commissioner (who I anticipate will be a senior, full-time, serving Judge) needs to use that budget imaginatively.
  • The Government must publicise (or the new Commission must prise out of it) its internal interpretations of technical or controversial concepts in the new law.  We cannot revert to a world in which Government understands and applies the law in ways that were not foreseeable to the rest of us – still less to a world in which our freedoms depend on the potentially harmful activities of whistleblowers.
  • More generally, the new supervisory body needs to develop a culture of high-level technical understanding, intellectual enquiry, openness and challenge.  It has some good models on which to build, both at home and abroad.

Parliamentary scrutiny

Above all, the Act is a victory for democracy and the rule of law.  Not everyone will approve of its content.  But it does everything possible to ensure that intelligence agencies and law enforcement use only such powers as Parliament has approved after a careful and well-informed debate.

It is easy to be cynical about parliamentary democracy.  Evidently to anyone who followed the proceedings, not every participant in every debate was a technical expert.  But it needs to be acknowledged that:

  • Three independent reports, of which “A Question of Trust” was one, formed the basis for the draft Bill of November 2015.
  • Three parliamentary committees (Intelligence and Security, Science and Technology, Joint Bill Committee) reported on the draft Bill in February 2016.  The evidence before the Joint Bill Committee alone, which looked at the issues with rigour and whose 150 or so recommendations were largely accepted, occupies 2,364 pages.  Much of it came from NGOs and from technical experts who were given every opportunity to communicate their concerns.
  • A Public Bill Committee then considered the Bill over 16 half-day sittings between March and June 2016.
  • Three further Parliamentary committees (Human Rights, Constitution, Delegation and Regulatory Reform) reported on the Bill in June and July 2016.
  • The whole process was illuminated by the prompt publication of all debates, evidence and reports, by the submission to Parliament in draft of huge quantities of explanatory material, including detailed Codes of Practice, and by the multiple research briefings of the House of Commons and House of Lords Libraries.

In short, as a number of parliamentarians stated during debates, this is one of the most carefully-scrutinised laws of  recent times.  Nor will scrutiny end with its enactment:

  • The Investigatory Powers Commission will flag any unsatisfactory features of the Act, for the attention of the Government and if necessary of Parliament, in its annual reports.
  • The operation of the Act must be reviewed within six years: if the Government is wise, it will incorporate a strong independent element into that review.
  • The NGO Liberty has already indicated that parts of the Act will be subjected to judicial review in the UK, to add to the cases currently pending before both the EU Court of Justice and the European Court of Human Rights.

The July 2017 edition of Prospect printed a letter from me, responding to an article by Martha Spurrier of Liberty in the May 2017 edition, which referred to the detailed scrutiny by parliamentary committees and to the Bulk Powers Review before concluding:

“Spurrier and I agree that even useful powers should be denied to the authorities if they intrude too far into our freedoms.  But in concluding that this was not the case here, Parliament was starved neither of time nor of information.”

Conclusion

This Act may not be “the turning-point that policymakers have looked for and missed ever since 9/11“.  But it provides both the powers that are needed to keep us safe, and the mechanisms that are needed to verify that those powers are properly exercised.  It has also put Parliament back in charge.  For all those reasons, it deserves our trust.

Further discussion

I discussed the Act this week in a 30-minute programme on Radio 4 (The Briefing Room) and in evidence before a Committee of the Bundestag in Berlin: see my opening remarks at 17.50 and further interventions at 59.40 (bulk collection, international cooperation), 1:24.20 (surveillance of external communications, Brexit) and 1:34.30 (summary of the Bill).

[Edited 26 June 2017 to add reference to letter in July 2017 edition of Prospect]