UK surveillance laws need total overhaul, says landmark report

Britain’s laws governing the intelligence agencies and mass surveillance require a total overhaul to make them more transparent, comprehensible and up to date, parliament’s intelligence and security committee (ISC) has said in a landmark report prompted by the revelations of Edward Snowden, the former US National Security Agency (NSA) contractor.

The 18-month inquiry finds that existing laws are not being broken by the agencies and insists the bulk collection of data by the government does not amount to mass surveillance or a threat to individual privacy.

But it also says the legal framework is unnecessarily complicated and – crucially – almost impenetrable. The current laws could be construed as providing the agencies with a “blank cheque to carry out whatever actives they deem necessary”, it says.

The leading Labour member on the ISC, Hazel Blears, said: “What we’ve found is that the way in which the agencies use the capabilities they have is authorised, lawful, necessary and proportionate.

“But what we’ve also found is there is a degree of confusion and lack of transparency about the way in which this is authorised in our legal system. It is that lack of transparency that leads to people reaching the conclusion that there is blanket surveillance, indiscriminate surveillance.”

New surveillance methods uncovered

In the single most important revelation, the report reveals for the first time that the agencies have had the capability to trawl through personal records and form and examine “bulk personal datasets” without any statutory oversight.

David Cameron, the prime minister, rushed out a statement saying the intelligence services commissioner, Sir Mark Waller, would be given “statutory powers of oversight of use of bulk personal datasets”.

In a heavily censored section of the report, the committee reveals these datasets containing personal information about a wide range of people vary in size from hundreds to millions of records, adding there is no legal constraint on storage, restraint, retention, sharing and destruction. Surveillance agencies do not require ministerial authorisation to access the information.

Blears was reluctant to disclose the nature of the information, but likened the datasets to a telephone directory and added they applied only to people in a certain category of interest to the agencies.

Committee members said the information gathered in the bulk personal datasets is not necessarily gathered by the agencies, implying it may have been gathered by either commercial organisations or other government agencies for other purposes, and then handed to the intelligence agencies.

The datasets are acquired through overt and covert channels, the committee discloses, and are not derived from any specific legal power.

Blears said: “We have seen the datasets and concluded they are necessary and proportionate. All of these issues in order to be lawful have to be necessary and proportionate and not indiscriminate.”

Asked whether Snowden, whose leak of the work of the American security services triggered the report, had done anything wrong, Blears said: “The committee would take the view that stealing classified information and releasing it across the world is not helpful. But this report is not about Edward Snowden.”

Legal overhaul

In what it describes as its key recommendation, it calls for all the current legislation governing the intrusive capabilities of the security and intelligence agencies to be replaced by a new, single act of parliament.

The report finds: “The legal framework has developed piecemeal and is unnecessarily complicated. We have serious concerns about the resulting lack of transparency, which is not in the public interest.”

It says: “The lack of clarity in existing laws and the lack of transparent policies beneath them has not only fuelled suspicions and allegations but has also meant the agencies could be open to challenge for failing to meet their human rights obligations.”

The proposed new legal framework should for the first time explicitly set out surveillance capabilities, detailing the authorisation procedures, privacy constraints, transparency requirements, targeting criteria, sharing arrangements, oversight, and other safeguards.

The ISC report will form a central pillar of the discussions in the next parliament on how to redraft UK surveillance laws, including a report from the Royal United Services Institute (Rusi) commissioned by Nick Clegg and work being undertaken by the commissioner on intelligence law.

Defence of bulk data collection

The inquiry, disrupted by the last-minute resignation of the committee chairman, Sir Malcolm Rifkind, over allegations concerning cash for influence, gives a lengthy defence of the bulk collection of data, one of the chief Snowden revelations, and concludes this does not amount to mass surveillance since the agencies have neither the resources nor desire to examine all the information they gather.

It says of the 100,000 bearers which make up the core infrastructure of the internet, GCHQ could theoretically access communications traffic from a small percentage, chosen on the basis of the possible intelligence value of the traffic they carry.

But in a controversial move, the committee redacts the percentage of items that transit the internet in one day that are ever selected to be read by a GCHQ analysts, emphasising: “They will have gone through several stages of targeting filtering and searching so they are believed to be the ones of the very highest intelligence value.”

It adds: “The current legal framework of external and internal communications has led to much confusion. However, we have established that bulk interception cannot be used to target the communications of an individual in the UK without a specific authorisation naming the individual signed by a secretary of state.”

The committee says: “GCHQ requires access to internet traffic through bulk interception primarily in order to uncover threats – whether that might be cyber-criminals, nuclear weapons proliferators or Isil [Islamic State] terrorists.

“They need to find patterns and associations, in order to generate initial leads. This is an essential first step before the agencies can then investigate those leads through targeted interception.”

Reforms to the security services

Despite the tone of reassurance over the conduct of the agencies, the committee details a succession of reforms designed to constrain the security services. It says: “We consider the communications of UK nationals abroad should receive the same level of protection under the law irrespective of where the person is located. The interception and communication of data should be authorised through an individual warrant signed by a secretary of state.”

It also recommends that misuse of GCHQ’s interception capabilities should become a criminal offence. It calls for commissions responsible for overseeing the activities of the agencies to be put on a statutory footing since the current non-statutory framework is “unsatisfactory and inappropriate”.

It also finds it unacceptable that MI6 undertakes intrusive operations abroad but is under no requirement to keep comprehensive and accurate records of when it uses these powers.

In a major reform the committee recommends new privacy constraints on the communications data that goes beyond the narrow definition of “what, when, where of communications”, such as web domains visited or location tracking information in a smartphone.

It says such information, while not containing the actual content of a communication, has “the potential to reveal a great deal about a person’s private life – his or her habits, tastes and preferences – and should be subject to new safeguards”. Such information must be protected, the report says.

The report rejects proposals for the responsibility to issue intrusive warrants to be taken from ministers and handed to judges.

Reactions

The senior Labour committee member, the shadow home secretary, Yvette Cooper, said: “This important ISC report now needs to be considered, alongside the independent review into Ripa to be published by David Anderson shortly, so we can update the legal framework to cope with fast-changing technology.

“Sticking-plaster legislation – as the government put forward last summer – just isn’t good enough . We need a serious and sustainable framework that will command consent for years to come.”

Sir Richard Butler said there had been a mistaken confusion in the reporting in the wake of the Snowden revelations in assuming that the bulk collection of data amounted to mass surveillance.

Shami Chakrabarti, director of Liberty, said: “The ISC has repeatedly shown itself as a simple mouthpiece for the spooks – so clueless and ineffective that it’s only thanks to Edward Snowden that it had the slightest clue of the agencies’ antics.

“The committee calls this report a landmark for ‘openness and transparency’ – but how do we trust agencies who have acted unlawfully, hacked the world’s largest sim card manufacturer and developed technologies capable of collecting our login details and passwords, manipulating our mobile devices and hacking our computers and webcams?

“No doubt it would be simpler if we went along with the spies’ motto of ‘no scrutiny for us, no privacy for you’ – but what an appalling deal for the British public.”

The executive director of Open Rights Group, Jim Killock, said: “The ISC should have apologised to the nation for their failure to inform parliament about how far GCHQ’s powers have grown.

“This report fails to address any of the key questions apart from the need to reform our out-of-date surveillance laws. This just confirms that the ISC lacks the sufficient independence and expertise to hold the agencies to account.”