Draft snooper's charter 'fails on spying powers and privacy protections'

Theresa May’s draft “snooper’s charter” bill fails to cover all the intrusive spying powers of the security agencies and lacks clarity in its privacy protections, a parliamentary committee has said.

The intelligence and security committee said the draft legislation published by the home secretary suffered from a lack of sufficient time and preparation. It was evident that even those working on the legislation had not always been clear about what it was intended to achieve, it said.

The unexpectedly critical intervention by the ISC, which is nominated by the prime minister and chaired by the former Conservative attorney general, Dominic Grieve, comes just two days before a key scrutiny committee of MPs and peers is to deliver its verdict on the draft legislation aimed at regulating the surveillance powers of the security agencies.

The draft investigatory powers bill will include new powers for the security agencies to access the web browsing histories of UK citizens for up to 12 months, as well as establishing a fresh legal framework for their existing capabilities to track web and phone use and engage in computer hacking.

The ISC said in its report that it supported the government’s intention to provide greater transparency around the security services’ intrusive powers in the aftermath of the Edward Snowden mass surveillance disclosures.

“It is nevertheless disappointing that the draft bill does not cover all the agencies’ intrusive capabilities – as the committee recommended last year,” Grieve said.

“This means that the various powers and authorisations remain scattered throughout different pieces of legislation and, as a result, the draft bill is limited in the extent to which it can provide a comprehensive legal framework. In our view it is a missed opportunity.”

The report said the bill failed to deliver the clarity needed in this area.

While the issues involved were undoubtedly complex, Grieve said, “it has been evident that even those working on the legislation have not always been clear as to what the provisions are intended to be”.

The committee members said they had expected to find universal privacy protections at the forefront of the bill but instead a piecemeal approach had been taken which “lacks clarity and undermines the importance of safeguards associated with these powers”. They suggest dedicated privacy protections be included to form the backbone of the legislation and ensure privacy was not just an add-on.

“Given the background to the draft bill and the public concern over the allegations made by Edward Snowden in 2013, it is surprising that the protection of people’s privacy – which is enshrined in other legislation – does not feature more prominently,” they said.

The ISC proposed three other major changes to the bill:

• On “equipment interference” or computer hacking powers, the ISC said the bill only covered the use of these powers to gather intelligence and did not regulate their use for attack purposes.
• On “bulk personal datasets” – data bought or obtained from other bodies – it said these included personal information about a large number of individuals that was sufficiently intrusive to require a specific warrant. The bill’s provision for “class bulk dataset warrants” should therefore be deleted.
• On “communications data”, it said the government’s approach was inconsistent and confusing and clear safeguards needed to be set out on the face of the bill.

“We consider these changes necessary if the government is to bring forward legislation which provides the security and intelligence agencies with the investigatory powers they require, while protecting our privacy through robust safeguards and controls,” Grieve said.