Surveillance powers outlined in the the Investigatory Powers Bill represent a gross invasion of privacy which would create an outcry about if the Bill used clearer language.
That’s what Dr Joss Wright, Research Fellow, Oxford Internet Institute, told the House of Commons Science and Technology Committee whilst presenting evidence on the Investigatory Powers Bill.
It followed representatives from technology firms telling the MPs that the Bill risks putting British technology companies at a financial disadvantage because customers won’t want to use products the government has the right to hack into.
In the draft Bill recently reintroduced by Home Secretary Theresa May – dubbed the Snooper’s Charter by its critics – the government set out plans to force internet service providers (ISPs) to retain customer web usage data for at least a year, so that the security services can monitor the web sites people have been accessing.
The Bill also explicitly authorises security services’ powers to bulk-collect personal communications data.
The government likens the requirement to collect data about web communications to collecting information about phone calls, something which Dr Wright described as “ludicrous” as modern communication channels such as Facebook and WhatsApp are now for many an extension of their everyday lives and contain vast amounts of information.
“I think this fundamental issue of comparing it to telephony is ludicrous; it’s much closer in the modern world, particularly for younger people, to consider this an analogy of the real-world,” he told MPs and explained the vast swathes of information which could become available.
“When did you go into your house, when did you leave your house? Which friend did you meet? Which shop did you go into? Which newspaper did you read? What book did you buy?”
Wright argued that if the Bill explicitly stated it’d be able to track this information, there would be a massive backlash against it from the public.
“If we were asking for bulk collection, retention and access to that kind of data in the real world, there would be uproar,” he said, before questioning how “Somehow because this is the internet and it’s slotted under ‘just collecting communications’ this bill is not worrying”.
Dr Wright added that the language within the Bill needs to be more explicit in what it is recommending.
“I think the conceptualisation has to be clearer. I think there’s a fundamental misconceptualisation of what’s going on”.
Ross Anderson, professor of Security Engineering at the University of Cambridge, also warned the Science and Technology Committee that the language used in the Investigatory Powers Bill is ambiguous, so it could be used to collect exact information about people’s plans and movements.
For example, Google Calendar – or any other calendar application – could count as communications data under the definition of the Bill, he explained.
“A calendar says who met whom when, that falls under communications data. And what’s more, related communications data includes communications data which is extracted by mechanical means,” Professor Anderson said.
“If I send Ross an email saying see you at the pub at 9pm, then if you’re using a system like Google Plus, that will understand that and will remind you at 8:45pm that you’re seeing Ross at the pub,” he explained.
Essentially, Professor Anderson argued, information could be used to trace a person’s exact location under the terms of the Bill – and the authorities would almost certainly take that opportunity, as surveillance revelations have demonstrated.
“That becomes communications data even before it was in the body text of an email and the Snowden revelations show that these techniques aren’t just used by Google, they’re used by the NSA as well,” he said.
However, despite the concerns voiced by other members of the panel advising the Science and Technology Committee, Professor Sir David Omand, Visiting Professor at the Department of War Studies, King’s College London – and a former director of GCHQ – told MPs that the Bill doesn’t represent mass surveillance.
“In terms of the United Kingdom and the effect on UK legislation, bulk access to the internet communications isn’t the same mass surveillance. These are different concepts,” he said.
“Mass surveillance is the persistent observation of all or a large part of the population, that doesn’t take place in the United Kingdom,” Omand added.
The Investigatory Powers Bill has previously been described by critics as ‘profoundly wrong for treating everyone as a suspect’ and Shadow Home Secretary Andy Burnham has expressed concerns over a lack of safeguards within the Bill.