Regulator to take tough line on UK snooping activities

The Investigatory Powers Commissioner’s Office (IPCO) has released an Advisory Notice detailing how it will limit investigatory powers of the spooks and attempt to maintain privacy rights where possible.

The Notice is an attempt to create accountability, justification and responsibility around potential controversial snooping activities. The intelligence community has been under a spotlight for the last couple of years owing to a number of different whistle blowers exposing some drastic abuses of privacy, but introducing accountability is a tricky task; at some point, security concerns outweigh an individual’s right to privacy, but when is that point?

Over the last two years, the UK has attempted to introduce various laws which would allow for greater supervision and freedoms for spooks, but there is a risk of going too far. Efforts to rid the UK of encryption techniques protecting messaging apps is one of these suspect instances. Privacy cannot be sacrificed for security, but the job of the IPCO will be to judge when warrants to monitor the communications of an individual are appropriate. This is of course only one of the roles of the body, but we feel it is one of the most important and relevant to our industry.

The IPCO will participate in what will be known as ‘Double-lock’, a two-step authorization to issue warrants for the interception of communications, retention of data and examination of information. Previously, different Secretary for State’s were solely responsible for authorization, but now any signature will require second approval from one of the IPCO’s 15 judicial commissioners. By having two signatures you would hope that such snooping would only happen when absolutely necessary. The Notice itself appears to lay out quite a stringent approach to when this permission will be granted.

Some of the conditions which will be assessed by the commissioners include:

Privacy is a very sensitive subject, especially when new laws have not been appropriately stress-tested. Various different laws have been introduced around the world, but this is still the toe-dipping stage of legislation. Politicians are trying to figure out how far they can push out, while advocacy groups are perhaps overclaiming how much the consumers care. Some rules will get scrapped while other expanded.

Unfortunately this puts the IPCO in a bit of a difficult position. The fluidity of public opinion does not help industry watchdogs establish any form of consistency so toeing the line between privacy and public interest is going to be a very difficult job. The overall approach does seem to be to tie the grey areas up in red tape, but in this case, we don’t mind the bureaucratic minefield which has been laid in front of the intelligence agencies.

More often than not we are highly critical of red-tape and over-regulation but in this instance it is quite appropriate. Invasion of privacy should be a last resort. Principles have to be maintained unless there are truly exceptional circumstances and intelligence agencies should be tasked with proving these exceptional circumstances beyond reasonable doubt. Hard-line conservatives might argue liberals are preventing the intelligence community from keeping the country safe, but we’ve already seen in numerous circumstances that some will act irresponsibly when accountability is not held so stringently.

What is the Investigatory Powers Commissioner’s Office (IPCO)

The Investigatory Powers Commissioner, Lord Justice Fulford, and his Judicial Commissioners are responsible for overseeing the use of investigatory powers by public authorities which include law enforcement, the intelligence agencies, prisons, local authorities and other government agencies (e.g. regulators). In total over 600 public authorities and institutions have investigatory powers.

Of course it will take some time for the IPCO to find its feet however. We had a brief chat with Neil Brown of decoded:Legal, a firm focusing on advising on communications regulation, privacy, security, and Internet/technology law, who highlighted us that the IPCO is being positioned as a supervisory body as opposed to an enforcement one. It is a slight nuance, but an important one. It will perform a crucial role in the digital economy, but don’t expect the body to be dishing out fines.

The idea here is to encourage accountability and necessity. The IPCO will be proactive and part of the process, as opposed to other watchdogs who react to developments in the industry. The Advertising Standards Authority (ASA), for example, rules on incidents reactively. This would not be good enough for the IPCO as a single unnecessary violation of privacy rights is one case too many. Being a supervisor as opposed to an enforcer allows the body to be influential in real-time as opposed to tackling problems of the past.

As with all these watchdogs there is a risk the influence might not be as prominent as we would hope. The challenge with making the IPCO a supervisory board is that it can’t hand out weighty punishments. The cynic in us wonders how much of a concern there would be if rules are broken. If there is little risk of punishment from the IPCO, will the snooping participants be bothered by its opinion?

It certainly is a tricky balance to strike. Being a supervisory body could mean real-time participation, but could make the IPCO a toothless watchdog. On the other side, becoming an enforcer means the body is constantly being reactive and out of touch. It is a very tough tight-rope to walk.

Your correspondent is very pro-privacy and believes any violation of these principles should only come with incredibly high-justification. These should be very rare exceptions, otherwise the participants will become comfortable with violating privacy principles. Becoming comfortable with an action will encourage anyone to push the boundaries further and this could lead to a dilution of justification. This would be disastrous for any society which builds itself on democratic principles.

We certainly hope the IPCO succeeds, as the framework and intentions of the organizations are incredibly positive. And it has come at a very apt time. 2017 saw various politicians, Home Secretary Amber Rudd being one of the main protagonists, stretch what would be deemed ethical. Perhaps the IPCO can steer the UK back onto the right path.