Has the government found a balance between privacy and security with the Investigatory Powers Bill?by Joshua Rozenberg / January 21, 2016 / Leave a comment
Read a further piece on the tension between security and privacy, also published in the February 2016 issue of Prospect
For Islamist terrorists, the prospect of prosecution and punishment is no deterrent. They expect to be killed, either by their own bombs or by those enforcing the law. So public protection depends on thwarting potential terrorists before they can attack. And that, in turn, depends on intelligence—much of it obtained through covert means.
Improving the UK’s intelligence gathering was a priority for Alex Carlile QC, a Liberal Democrat member of the House of Lords, immediately after the Paris attacks on 13th November last year. Between 2001 and 2011, he acted as the government’s independent reviewer of terrorism legislation and called on parliament to pass the Investigatory Powers Bill before the end of 2015.
But that was never going to happen. The government had published a draft of its bill a few days earlier, to allow plenty of time for parliamentary scrutiny. More to the point, the bill adds relatively little to the powers that the UK’s security and intelligence agencies already have at their disposal. Its aim is to modernise those powers, make them easier to understand and to strengthen oversight.
“Until recently, the intelligence services could have traced your contacts by asking your phone provider for your billing records”
But one new power involves what the bill calls internet connection records. These are records of the internet services a specific device has connected to, such as a website or instant messaging application. They could be used to demonstrate that a certain device had accessed an online communications service but not to identify what the user did on that service. While there is currently no requirement for communications service providers to keep these records, in future they will be required to retain them for up to 12 months so that they can be disclosed to law enforcement agencies if the request is considered necessary and proportionate.
Until recently, it was still possible to identify individuals from the unique Internet Protocol (IP) address that was assigned to every device on the internet, rather like looking up the names of suspects from their phone numbers. Nowadays, though, scarce IP addresses may be shared among as many as 5,000 users…