Irish Senator on election of Donald Trump; and Trump's new gift, the Investigatory Powers Bill

Former Irish junior minister with health, justice and culture briefs, Aodhán Ó Ríordáin, reacted passionately to Donald Trump's election as US President, the seamless normalisation/acceptance of the international community of the new reality and the obsequious behaviour Irish government in particular.



No pulling of punches in this Senate tirade - ..

How are we, Mr Ó Ríordáin asks, supposed to deal with this monster who has just been elected President of America?

It would appear he doesn't believe in calling a spade an earth inverting horticultural implement.

A selection of other highlights...

"America has just selected a fascist and the best thing the good people of Ireland can do is to ring him up and ask him if it's ok to still bring the shamrock on St Patrick's Day. I'm embarrassed by the reaction of the Irish government to what's happened in America"

"Can the government not understand what's happening. We are at an ugly international crossroads. What's happening in Britain is appalling. What's happening across Europe is appalling. It has echoes form the 1930s and America, the most powerful country in the world, has just elected a fascist. And the best you can come out with from a government spokesperson is, well we have to talk about foreign direct investment. We have to be conscious of American investments in Ireland."

"There are 50 thousand Irish people illegal in America who I'm quite sure are fearful of their futures. When are we going to have the moral courage to speak in terms other than economy all the time and to realise what is happening?"

And that's the heart of it really. Power shifts to the scary. The elite, the corporate sector [nothing personal - it's just business], the privileged of every order shift our allegiance to the new masters because we'll be ok if we stay on the right side of those in charge won't we?

None of us pay heed to the warning of Martin Niemöller,

First they came for the Socialists, and I did not speak out—
Because I was not a Socialist.

Then they came for the Trade Unionists, and I did not speak out—
Because I was not a Trade Unionist.

Then they came for the Jews, and I did not speak out—
Because I was not a Jew.

Then they came for me—and there was no one left to speak for me.

Ó Ríordáin continues...

"I am... I am fr-frightened. I am absolutely frightened for what's happening to this world and what's happening to our inability to stand up for it...

I want to ask you leader to ask the Minister for Foreign Affairs into this House and to ask him how we are supposed to deal with this monster who has just been elected President of America; because I don't think any of us, in years to come, should look back on this period and not say that we did everything in our power to call it out for what it is."

Meanwhile UK parliament this week has quietly, without substantive opposition or media interest, passed the most pervasive and invasive mass surveillance legislation in history. The Investigatory Powers Bill is 304 pages of complex permissions for the UK intelligence and security services, police and other public bodies to engage in bulk

• interception
• acquisition 
• retention

of communications data of the entire population and all other communications traversing the UK, access to bulk personal datasets held by other individuals, communities, groups, public services, civil society or economic actors and bulk equipment interference (aka hacking).

The depth and reach of the legislation is quite staggering. That it has been slipped through in the wake of Mr Trump's election really should not escape notice. 

GCHQ, the junior partners of the NSA, shortly itself to come under the control of a short tempered 70 year old toddler ascending to the White House, have now been provided with the legislative surveillance architecture of a police state. Given the close cooperation of the UK and US intelligence services under the Five Eyes arrangement post World War II, that will put this apparatus in the hands of a US President who promised, on the campaign trail, to re-ignite, expand and intensify US engagement in torture.

Slavery, racism, apartheid, the holocaust, rape (a British woman who reported being raped is facing jail in Dubai, right now, after being charged with the crime of engaging in extramarital sex) , homophobia, discrimination of all kinds were and still are legal in some places. Mass surveillance on an unimaginable scale is just about to become legal - pending the mere technicality of Royal Assent - in the UK. That which is legal is not necessarily acceptable in an enlightened and/or civilised society.

How can the UK, with any credibility for example, criticise Russia for blocking LinkedIn because the company refuses to host servers containing personal data of Russia citizens within that jurisdiction, when the Investigatory Powers Act reaches the statute books? They are just, they argue, attempting to protect the privacy of their own people.

Lifelong, genuinely committed intelligence and security services and other government officials, who have supported the expansion of Investigatory Powers Bill type laws on the other side of the Atlantic pond, for years, are nervous about serving in a Trump administration. Can any of the MPs, who were conspicuous by their continual absence from parliamentary debates about the Investigatory Powers Bill but, like well trained puppies, showed up when the division bell ping-ponged, to vote it through its multiple stages, in accordance with party instructions, seriously suggest they would be happy to have these powers in the hands of a dangerous or reckless US president? 

The chairman of the US Nazi party is pleasantly surprised at the president elect's pick for chief White House strategist. The Nazis. As for the opposition in the US congress, the probable minority leader for the Democrats in the US Senate will be Chuck Schumer, a man who reportedly supported the Iraq war, torture and the Patriot Act - the US's original legislative foray into mass surveillance.

Openly racist, homophobic, mysogynist, xenophobic, hate inciting bigots might not be as bad in government as they sounded on the election trail; but we should be very very very wary of smoothly handing them the controls of the infrastructure, the well oiled, indiscriminate, tools and unrestrained tentacles of a an all seeing, all hearing, ubiquitously observing police state. If the temptation to abuse these powers was irresistible when the good guys were in power, what's it going to be like if Trump uses them to follow through with even some of the hateful promises he made in the run up to the election?

Trump is inheriting extraordinary powers. Don't be surprised if he and/or the more extreme elements of his cortege decide to exercise them. As Daniel Miessler and many civil liberties advocates have said for generations, we need to be very careful about building all powerful mass surveillance tools because you never know who is going to get the keys. We gave up our rights under Bush, Blair and their successors because we were told to be scared of terrorism and the other horsemen of the infocalypse. We now bestow the powers decimating those rights to a Donald Trump administration, by proxy, through the US intelligence agencies close relationship with their counterparts in the UK.

Update: An edited version of this post has been published by New Scientist (Registration required for access). New Scientist YouTube video here.

Response from Nicola Blackwood on Investigatory Powers Bill

I wrote to the chair of the Science and Technology Committee, Nicola Blackwood, at the beginning June 2016, expressing concerns about the Investigatory Powers Bill.

Dear Nicola Blackwood MP,

The Investigatory Powers Bill will be debated by the House of Commons on Monday and Tuesday next week. I am concerned about several aspects of the Bill. As my MP, I want you to attend the debate and support the following amendments:
#Notification for individuals
NC1 or NC16
These amendments ensure individuals subjected to intrusive investigatory powers will be notified after the fact where it would not jeopardise ongoing investigations and operations. This mechanism provides greater transparency and accountability for the use of these powers.
#Removal of bulk powers and Bulk Personal Datasets
390, 391, 392, 393, 394, 295, 396, 397, 398, 153, 154, 401, 402, 403, 404, 405, 406, 407, 408, 409, 410, 411, 412, 413, 414, 155, 156, 417, 418, 419, 420, 421, 422, 423, 424, 425, 426, 427, 428, 429, 430, 431, 433, 434, 157, 158, 437, 438, 439, 440, 441, 442, 443, 444, 445, 446, 447, 448, 449, 450, 451, 452, 453, 454, 455, 456, 159, 160, 459, 460, 461, 462, 463, 464
Bulk suspicionless surveillance is unlawful, unnecessary, and a disproportionate interference with everyone's right to live a private life. These amendments remove the bulk powers from the bill.
# Review of the operation of the act
NC17
The rushing through of the bill, and the ever-changing technology that the Bill relates to makes it essential that this Bill is reviewed every two years to ensure the balance of providing security and privacy is met.

Yours sincerely,
Ray Corrigan

I just received the following response:

"Dear Mr Corrigan,

Thank you for contacting me about the Investigatory Powers Bill. Please accept my apologies for the delay in getting back to you.

I certainly appreciate the strength of feeling on a Bill as important as this, and it is undoubtedly crucial that it receives all proper scrutiny.

Indeed, I am confident that this is the case. The Bill passed its Second Reading in the House of Lords on 27th June, and further detailed examination will now take place in the House of Lords, via Committee, on the 11th, 13th, 18th and 20th of July. This highlights how seriously Parliament is taking this Bill, and the extent to which it is deemed vital to ensure that the final legislation is robust but balanced.

More broadly, I have consistently said that it is essential that powers to monitor communications are confined to what is entirely necessary and proportionate to protect our national security. Accountability is a key factor in this respect.

You may be interested to know that the Science and Technology Committee, of which I am Chair, conducted an inquiry into the technological aspects of the Draft Bill earlier this year. It is clear that new tools are needed to fight terrorism and crime in the twenty-first century, but the potential impact that the draft Bill will have on our communication sector must be carefully scrutinised. Our inquiry, exploring the technological implications of the new powers proposed by the Home Secretary, and their consequences for privacy and data security, is vital to ensuring we have robust mechanisms and safeguards in place. Our report, Investigatory Powers Bill: technology issues, was published on 19 January 2016. I hope you find this reassuring.

Furthermore, there have been three independent reviews of investigatory powers: by David Anderson; the Intelligence and Security Committee of Parliament; and the Royal United Services Institute (RUSI). All have agreed that agencies should have the power to acquire and use data in bulk. The Home Secretary has also emphasised that the Investigatory Powers Bill will not mean that security services have full access to look through an individual’s browsing content, but rather would be able to access the domains that have been visited i.e. ‘bbc.co.uk’ but not the page itself. The broad range of evidence the Committee received from differing areas of industry highlighted the issues we face with this Bill, including definitions of ‘communications data’ and Internet Connection Records (ICRs), which could be seen to make it difficult to assess which data could fall into these categories. It is of course vital that we analyse this and assess whether access requirements and safeguards are appropriate.

However, and perhaps most importantly, there will now be an independent review of the operational case for bulk powers, led by David Anderson QC. The team, hand-picked by Mr Anderson, will consist of a security cleared barrister who has significant experience working as a special advocate acting against the Government in terrorism cases; a technical expert who supported Mr Anderson on his investigatory powers review; and a former senior law enforcement officer with significant operational experience and knowledge of the use of a wide range of investigatory techniques. Groups such as Liberty and the Don’t Spy On Us Coalition have also been consulted on design ideas for the process itself.

This review will be assessing the specific question of whether bulk capabilities, as provided for in the Bill, are necessary. The review team will critically appraise the need for bulk capabilities, which will include an assessment of whether the same result could be achieved through alternative, and ultimately less intrusive methods.

I have also received assurances from ministers that access to the data itself will be tightly controlled. The Home Secretary has announced that there will be a ‘double-lock’ authorisation process, meaning that warrants for the most intrusive powers available to the agencies (such as the interpretation of communications) will be subject to approval by a judge as well as by the Secretary of State.

I would add that in response to concerns expressed during the Commons Committee Stage, the Government tabled an amendment which made clear that when carrying out their review of the decision to issue any warrant, the Judicial Commissioner must do so with a sufficient degree of care, so as to ensure that the Commissioner complies with their duties under clause five (general duties in relation to privacy). I was pleased to see that there was strong support from across the House for this amendment.

Thank you again for taking the time to contact me and I hope you are reassured by my response. I would encourage you to read our report, and I will also be monitoring the progress of this Bill very closely to ensure that all appropriate safeguards are in place. You can track the progress of the Bill here.

And of course, please don’t hesitate to contact me again if you have any further questions.

Kind regards,

Nicola

Nicola Blackwood MP

Member of Parliament for Oxford West and Abingdon"

 

The tyranny of the algorithm yet again...

I was reminded yet again, over the weekend, how easy it is to get branded persona non grata in the age of the judgmental algorithm.

A search for "Isis Close" via any popular search engine throws up a significant collection of such streets, primarily in the Thames Valley region, in places like Long Hanborough, Aylesbury, Oxford, Abingdon and Putney, amongst others.

That these place names exist won't be a surprise to anyone familiar with English limnology - the study of rivers and inland waters. As Wikipedia helpfully tells us, "The Isis is the name given to the part of the River Thames above Iffley Lock which flows through the university city of Oxford". In at least one local primary school I'm familiar with, the classes are called Windrush, Cherwell, Isis and Thames.

Unfortunately for those who live in an Isis Close, Street, Road or other equivalent, the label Isis has been appropriated by or conferred upon (by the media) a bunch of murderous extremists in the Middle East. So the word "Isis" has become somewhat toxic in the West.

Now PayPal has decided that they are not prepared to facilitate payments for goods to be delivered to an address which includes the word "Isis".

An Isis street resident ran into some unexpected difficulties when attempting to purchase a small quantity of haberdashery on the internet with the aid of a PayPal account. The transaction would not process. In puzzlement she eventually got irritated enough to brave the 24/7 customer support telephone tag labyrinth. The short version of the response from the eventual real person she managed to get through to was that PayPal have blacklisted addresses which include the name "Isis". They will not process payments for goods to be delivered to an Isis related address, whatever state of privileged respectability the residents of such properties may have earned or inherited in their lifetimes to this point.

Who knows if the "avoid Isis" algorithm was added by a low level techie, a policy decision within PayPal driven by risk averse lawyers or some other process. Whatever the process, the result is that people with an Isis address have been tagged with a "do not touch" label on the internet.

We rarely understand that the poor, the mentally or physically disabled, ethnic and religious minorities, and every other collective marginalised group that privileged society discriminates against already live in a dystopian world. A world full of legal, environmental, economic and societal strictures and attitudes that make life difficult. We rarely understand, either, how easy it is, in a world full of big data, wielded by commerce and governments alike, to be cast out from our world of privilege to that of the marginalised.

So what are residents of "Isis" addresses to do. Interestingly enough, PayPal are not so wedded to their dissociation from "Isis" that they are banning this particular brand of humanity from holding PayPal accounts. The marginalised are still potentially profitable fodder. The organisation is merely concerned with not facilitating transactions which result in goods or services being delivered to those addresses. So Isis addressees could

• have their orders delivered to an alternative address for collection
• apply to the local council to have the name of their street changed
• move house

The first is a serious inconvenience. The latter two options rather extreme and even then, given the tendency of unwelcome labels to hang around people on the internet and in big databases, there's no guarantee that a change of street name or address, drastic as they are, would entirely rid the people concerned of the tyranny of the algorithm.

Being unable to buy a sewing kit on the internet might seem like a minor middle class inconvenience but metadata, like details of someone's address, matters. It's only two years since the former US National Security Agency and CIA chief, General Michael Hayden, went on record with his "We kill people based on metadata" comment. Metadata is used to categorise and discriminate. We have no control over what commercial organisations or government or other economic actors and indeed criminals do with it.

With the UK Investigatory Powers Bill heading for the statute books, and the government taking little or no notice of the serious criticism it has received, this state of affairs is not primed to improve any time soon. Could I remind the reader of this simple engineer's perspective of the meaning of s78 alone in this large and complex law - it looks a bit like this:

I leave you to decide whether the government and its institutions will be able or willing to use this unimaginably gigantic collection of data in the public interest and without doing too much collateral damage to the sifted and categorised populace along the way.

Update: A stark example of where the tyranny of the algorithm does real damage - software used across the US to predict future criminals and it’s biased against black people.

Liberty confront people directly with implications Investigatory Powers Bill

Liberty, with an aggressive confrontational 2 minute video opposing the provisions of the Investigatory Powers Bill, have been demonstrating that when people are accosted directly and immediately with the reality of personal data collection and intrusive privacy invasion, we do not like it.



"Would you let a stranger into your phone? The snoopers' charter won't give you a choice" reads their tag line. Posted earlier today it's only got 89 viewers so far.

Why, then, is it somehow acceptable if mass privacy invasion or bulk data collection/retention/ interception happens silently or invisibly or unobtrusively in the background whilst we don't pay attention? Might Liberty actually be suggesting that we have been a passively tolerant society for too long?

Privacy International & CassetteBoy v The Snoopers' Charter

CassetteBoy has made an amusing 2 minute video for Privacy International on the Investigatory Powers Bill.



Bill documents and the written evidence (that submitted by original 23 March 2016 deadline) to the Public Bill Committee examining the Bill are available here.

Investigatory Powers Bill 2nd Reading Part 3: Joanna Cherry

The SNP's Joanna Cherry QC's speech in the debate on the day of the 2nd reading of the Investigatory Powers Bill in the House of Commons on 15 March 2016 began at 3.04pm. The SNP are substantively opposed to the Bill in its current form but abstained the vote later in the day.

Ms Cherry opened by expressing grave concerns about the Bill whilst noting the law in this area needs a thorough overhaul and that the police and security services need appropriate powers to fight terrorism and serious crime. These powers have to be necessary, proportionate and compatible with the rule of law and the right to privacy. The IPBill is seriously deficient on all these fronts and hence the SNP could not support it.

She went on to note the SNP feel the IP Bill is a "rush job" being pressed forward with insufficient time for scrutiny, when the ink was barely dry on the three parliamentary reports criticising the draft Bill. Just the previous week, the UN's special rapporteur on the right to privacy published a report seriously and specifically questioning the IP Bill (paragraphs 39 to 42) and its failure to meet standards set out in judgments of both the European Court of Human Rights and The Court of Justice of the European Union. The Tory jeering squad got lively at this point and Ms Cherry cheerily admonished them suggesting they might like to read the special rapporteur's report. It contains a careful explanation of recent case law and can't simply be dismissed lightly.

Good practice suggests surveillance should be targeted and facilitating warrants should be focused, specific and rooted (nearly said "rotted" there which would have been an unfortunate slip) in reasonable suspicion. Yet the so-called targeted interception warrants enable spying on groups of people or multiple organisations or premises. Bulk interception warrants require neither specificity nor reasonable suspicion. We're not talking merely about mass surveillance with this Bill but suspicionless surveillance. The national security test in the Bill doesn't actually even require a national security threat.

The powers to retain internet connection records and other bulk powers in the IP Bill go way beyond what other western democracies do and will set a very bad precedent likely to be copied elsewhere. Denmark's equivalent of ICRs didn't work and were abandoned. The US found bulk data collection unconstitutional and ineffective for counter terrorism. The government have to justify - and have failed to do so - why it alone should be allowed powers way beyond those available to other western governments.

The SNP, Ms Cherry continued, did not believe the government were providing sufficient time for consideration of the Bill. The Home Office published about 1200 pages of documents relating to the IPBill on 1 March. The suspicion was they were dumping large tranches of documents and rushing the parliamentary process to avoid proper parliamentary scrutiny.

The Home Secretary interrupted, rather irritated, complaining that she had made an effort to publish all necessary documents because opposition parties are always moaning the government fails to do so when publishing Bills. Ms Cherry responded that Mrs May misunderstood her concern - not that the documents had been published but that insufficient time was being given to scrutinise them. The SNP would not be bullied into supporting a mass surveillance Bill of dubious legality just to avoid being labelled soft on terror. They would not tolerate bogus charges of this nature for the crime of requiring proper parliamentary scrutiny of and justification for expansive surveillance powers.

The SNP's concerns, Ms Cherry said, were widely shared by many MPs on all sides, parliamentary committees, industry and the UN special rapporteur and 200+ lawyers that wrote to the Guardian. Another interruption came at this point from the government benches declaring the lawyers wrong. Ms Cherry suggested a look at the distinguished list of signatories, experts whose opinion deserves some respect.

That letter to the Guardian highlighted the problem of bulk interception. Generalised initial interception is the issue - this generality, lack of focus and specificity is what the lawyers are worried about.

Dominic Grieve intervened to agree if what was happening was the kind of generalised interception of electronic communications in bulk, outlined in the Guardian letter, it would be "a very serious matter indeed". He does not believe that this is what the IP Bill facilitates.

Ms Cherry accepted his sincere belief to that effect but disagreed with his interpretation of the Bill as do the 200+ lawyers and many others. And if she and many respected lawyers can have varied interpretations of such critical laws it highlights the importance of having clear and focused language on the face of the Bill. Vague language poorly understood can be twisted to the desires of those in authority in future and has been in this area in the past.

If the government want "world beating" legislation they can't simply go around violating international standards. The UK is still bound by the European Court of Justice and the European Court of Human Rights and the IP Act as it will become will likely be challenged and possibly struck down in those arenas. The government and their supporters may choose to follow Russia's approach from December 2015 and pass a law to avoid complying with international human rights standards but Ms Cherry wouldn't recommend it.

Ms Cherry challenged the oft repeated notion that we gain more security by sacrificing privacy. It is simply not backed up by any evidence. The government responded to the Intelligence and Security Committee call for privacy to form the backbone of the Bill by adding the word privacy to the title of part 1. That comes across as somewhat cynical. And mass data collection is ineffective and counter-productive. Swamping electronic haystacks with more hay makes it harder for analysts to find the needles. We need to do security more intelligently not blanket data collection and suspicionless surveillance.

The SNP have many problems with the IP Bill in its current form but she wanted to focus on four of these given her limited time.

1. the legal thresholds for surveillance
2. the authorisation process
3. the provision for the collection of internet connection records
4. bulk powers

Regarding legal thresholds for surveillance, the Government essentially want to subsume RIPA’s three broad, vague and "dangerously undefined" grounds for surveillance into the IP Bill. She welcomed the move in the direction of some judicial oversight but want the commissioners to have substantive oversight, not just judicial review, powers - not a double lock but an equal lock process. In technical legal terms she is concerned a less intensive standard of judicial review will be applied—more Wednesbury reasonableness than strict necessity and proportionality. Why not go as far as other countries like Australia, Canada and the US on judicial oversight? This would additionally help solicit cooperation from the big US technology firms.

There is a false assertion made repeatedly that ministers are accountable to parliament in the issuing of warrants. That is not the case and won't be here because warrants are generalised and will not be disclosed. Besides, disclosing the existence of a warrant is and will be a criminal offence under the IPBill. And requests in the House of Commons for information on warrants are brushed off with the national security excuse. Ministers are not accountable to the parliament for warrants, practically politically or democratically. So she doubts the IP Bill authorisation of warrants processes meet European court standards requiring independent judicial supervision.

On internet connection records, the case made for their collection and retention in bulk is fatally flawed. ICRs cannot be equated to itemised phone bills. ICRs are quite fantastically intrusive and David Anderson has pointed out they would not be countenanced in Germany, Canada or the US.

"What the internet connection records will show is a detailed record of all of the internet connections of every person in the United Kingdom. There would be a 12-month log of websites visited, communication software used, system updates downloaded, desktop widgets, every mobile app used and logs of any other devices connected to the internet. I am advised that that includes baby monitors, games consoles, digital cameras and e-book readers. That is fantastically intrusive. As has been said, many public authorities will have access to these internet connection records, including Her Majesty’s Revenue and Customs, and the Department for Work and Pensions, and it will be access without a warrant. Do we really want to go that far? There is no other “Five Eyes” country that has gone as far. David Anderson QC said: 

“Such obligations were not considered politically conceivable by my interlocutors in Germany, Canada or the US”
and therefore, he said, “a high degree of caution” should be in order."

Finally she turned to bulk power, suggesting they are a radical departure from both common law and human rights law. Parliament has never before been asked to vote on or approve bulk powers of this nature. They have been deployed in secret, something we only became aware of because of Edward Snowden. Whatever you think of Snowden, she shares the serious concerns of the UN Special Rapporteur on Privacy that these bulk powers are probably the most worrying part of the IP Bill. She quotes from paragraph 39 of his report:

"It would appear that the serious and possibly unintended consequences of legitimising bulk interception and bulk hacking are not being fully appreciated by the UK Government. Bearing in mind the huge influence that UK legislation still has in over 25% of the UN’s members states that still form part of the Commonwealth, as well as its proud tradition as a democracy which was one of the founders of leading regional human rights bodies such as the Council of Europe, the SRP encourages the UK Government to take this golden opportunity to set a good example and step back from taking disproportionate measures which may have negative ramifications far beyond the shores of the United Kingdom.  More specifically, the SRP invites the UK Government to show greater commitment to protecting the fundamental right to privacy of its own citizens and those of others and also to desist from setting a bad example to other states by continuing to propose measures, especially bulk interception and bulk hacking, which prima facie fail the standards of several UK Parliamentary Committees, run counter to the most recent judgements of the European Court of Justice and the European Court of Human Rights, and undermine the spirit of the very right to privacy."

She then concluded:

"The SNP is in favour of targeted surveillance. We welcome the double lock on judicial authorisation as an improvement, but it does not go far enough. Our concern is, quite clearly, that many of the powers sought in this Bill are of dubious legality and go further than other western democracies without sufficient justification. It is for that reason that we cannot give this Bill, in its current form, our full support. We will work with others to attempt to amend it extensively. Today, we shall abstain, but if the Bill is not amended to our satisfaction, we reserve the right to vote it down at a later stage." 

Evidence to Public Committee examining Investigatory Powers Bill

There seem to have been 38 submissions of written evidence to the Public Parliamentary Committee scrutinising the Investigatory Powers Bill. Almost all raise significant concerns about the Bill. My tuppence worth has been published by the committee, much of it said here before.

Contributions from Center for Democracy & Technology (IPB36), Kevin Cahill (IPB37), the Bar Council (IPB38), Internet Service Providers Association (ISPA) (IPB31), Annie Machon (IPB16), Adrian Kennard (IPB13), Dr Paul Bernal, the Muslim Council of Britain, IT-Political Association of Denmark (IPB20), Big Brother Watch, techUK (IPB27) are particularly recommended. I suspect the submission from Apple, Facebook, Google, Microsoft, Twitter and Yahoo (IPB21) will receive the most publicity.

Copy below of my contribution focusing primarily on the disproportionate nature of indiscriminate bulk personal data collection and retention. Excuse the dodgy formatting - Microsoft Word, in which I was obliged to submit the evidence, doesn't play nicely with Google's Blogger.

Submission to Investigatory Powers Bill Committee, 23 March, 2016

My name is Ray Corrigan. I’m a Senior Lecturer in the Maths, Computing & Technology Faculty of The Open University, though I write to you in a personal capacity.

Summary

1.       The Investigatory Powers Bill Public Committee is being required to analyse the long and complex Draft Investigatory Powers Bill in an unreasonably short timescale.

2.       I will focus this submission on one issue – the disproportionate nature of bulk collection and retention of communications data proposed in the Bill

Bulk collection & retention of communications data: circles of suspicion

1.       There is a fundamental misunderstanding at large in Westminster – the idea that collecting and retaining bulk personal data is acceptable as long as most of the data is only “seen” by computers and not human beings; and it will only be looked at by persons with the requisite authority with the aid of the Investigatory Powers Bill “filter” if it is considered necessary.  This is a seriously flawed but widely accepted line that has been promoted by successive governments for some years.

2.       The logical extension of such an argument is that we should place multiple sophisticated electronic audio, video and data acquisition recording devices in every corner of every inhabited or potentially inhabited space; thereby assembling data mountains capable of being mined to extract detailed digital dossiers on the intimate personal lives of the entire population. They won’t be viewed by real people unless it becomes considered necessary.

3.       Indeed with computers and tablets in many rooms in many homes, consumer health and fitness monitoring devices, interactive Barbie dolls, fridges, cars and the internet of things lining up every conceivable physical object or service to be tagged with internet connectivity, we may not be too far away from such a world already.[1]

4.       In the past two years both the Court of Justice of the European Union[2] and the European Court of Human Rights[3] have repeatedly rejected bulk indiscriminate personal data collection, retention and dissemination as incompatible with international human rights obligations.

5.       In Zakharov v Russia (2015) the European Court of Human Rights said authorisation for surveillance of phone communications “must clearly identify a specific person … or a single set of premises” and “that a system of secret surveillance … may undermine or even destroy democracy under the cloak of defending it”.

6.       In Szabo & Vissy v Hungary (2016) the European Court of Human Rights ruled those authorising surveillance must “verify whether sufficient reasons for intercepting a specific individual’s communications exist in each case.”

7.       Targeted not bulk surveillance is required.

8.       Leaving aside the legal situation, it is reasonable to suggest the guilty forfeit their right to privacy in connection with their nefarious activities. Authorities are entitled, also, to collect and peruse the data of the suspicious. Those in the suspicious category may be innocent but if law enforcement and the security services have a justifiable cause to harbour suspicion, they have a duty to investigate such persons. In the approach of the Investigatory Powers Bill the data of the innocent gets swept up in all this too. But that's not a problem, the government assures us, since law enforcement and the security services are not interested in the innocent.

9.       What do these circles of suspicion look like, however, if we consider relative proportions of guilty v suspicious v innocent by throwing some hypothetical numbers at the problem? Since successive government spokespersons for the past 16 years have talked in terms of thousands of dangerous individuals here, let’s start with the hypothesis that there might be 6,000 dangerous people and 600,000 suspicious types resident in the UK, in a population of a little over 60 million. If that is anywhere close to the real numbers the relative areas of our guilty, suspicious and innocents' circles look like this (with the innocent circle drawn first and the suspicious and guilty circles thrown on top) –

10.    So the collection – and/or the forced industry collection and retention for perusal by government authorities through the Investigatory Powers Bill “filter” – of everyone's data, in bulk, for investigatory purposes, begins to look somewhat disproportionate. And it is not just industry that may be obliged to collect this data. Data retention and other powers demands may even be visited upon those running private and home networks. (And equipment interference warrants - targeted, thematic and bulk – may also be targeted at private/home networks but that’s a whole other discussion which I’d recommend talking to Graham Smith, partner at Bird & Bird LLP, about). If the numbers of guilty rise to 600,000 and the suspicious to 6 million the picture changes again -

11.    By playing around with the relative numbers we can get a picture of how big we think the guilty and suspicious circles have to get, before we consider it proportionate to justify the bulk data collection and retention powers in the Investigatory Powers Bill.

12.    Even in that third scenario where it was assumed there were 600,000 guilty and 6 million suspicious, it doesn't look reasonable that the remaining 54 million or so innocents get dragged into the digital net of suspicion.

13.    The bottom line is that we only start to get a real picture of what the Investigatory Powers Bill bulk data collection and retention powers mean when we get into the detail of how they will operate or are expected to operate in practice.

14.    Internet connection records (ICRs) are one specific area of interest here, though it is still not clear, from the Bill or government explanations or associated documents, what exactly ICRs will be in practice. Government, or industry and others on government’s behalf, should not be collecting, indiscriminately, for perusal and analysis, primarily electronic or otherwise, the reading, viewing and listening lists and other online activities of the entire population. Especially not those of tens of millions of innocents. It constitutes an unnecessary and disproportionate abuse of power.

15.    I will conclude by drawing your attention to clause 78 of the latest version of the Bill, in which “relevant communications data” appears to be a catch all to cover the collection of just about any data. May I commend to you Graham Smith’s pictorial representation of what this appears to mean available with an informative commentary at http://cyberleagle.blogspot.co.uk/2016/03/relevant-communications-data-revisited.html

16.    As an engineer, s78 looks, to me, like this –

17.    Indiscriminate bulk personal data collection and retention should be removed in all its forms from the Bill.

---

[1] Executive Office of the President President’s Council of Advisors on Science and Technology Report to the President, [May, 2014], Big Data and Privacy: A Technological Perspective

[2] Digital Rights Ireland (C-293/12 AND 594/12, 2014), Google Spain v Gonzales (C-131/12, 2014), Schrems (C-362/14, 2015)

[3] Zakharov v Russia (Application no. 47143/06, 2015), Szabo & Vissy v Hungary (Application no. 37138/14, 2016)