Internet monitoring bill 'must do more to protect privacy'

Home Secretary Theresa May has faced criticism of her Investigatory Powers bill

Plans to authorise mass data collection and hacking by Britain's spies do not do enough to protect privacy, a watchdog has warned.

The extent of the intelligence agencies' computer and internet spying operation has recently become clear.

The draft Investigatory Powers Bill is meant to put it on a firm legal footing.

But the Intelligence and Security Committee says the bill lacks clarity and is a "missed opportunity".

'Exceptional powers'

"Given the background to the draft Bill and the public concern over the allegations made by Edward Snowden in 2013, it is surprising that the protection of people's privacy - which is enshrined in other legislation - does not feature more prominently," says the committee's report.

"One might have expected an overarching statement at the forefront of the legislation, or to find universal privacy protections applied consistently throughout the draft Bill.

"However, instead, the reader has to search and analyse each investigatory power individually to understand the privacy protections which may apply.

"This results in a lack of clarity which undermines the importance of the safeguards associated with these powers."

The new legislation was prompted, in part, by Edward Snowden's revelations

Committee chairman, Conservative MP Dominic Grieve, said: "We have therefore recommended that the new legislation contains an entirely new part dedicated to overarching privacy protections, which should form the backbone of the draft legislation around which the exceptional powers are then built. This will ensure that privacy is an integral part of the legislation rather than an add-on."

Mr Grieve added: "The draft bill appears to have suffered from a lack of sufficient time and preparation."

The Home Office is due to publish a final, amended version of the bill later this year.

The draft bill, which is one of the longest pieces of legislation to be considered by MPs in recent years, would force internet service providers to store web browsing records of everyone in the UK for a year.

This is meant to help the police and security services keep pace with technology being used by terrorists and organised criminals.

But security chiefs told the ISC, a cross-party committee of MPs and peers, that they already "have a range of other capabilities which enable them to obtain equivalent data" so this part of the bill will mainly be used by the police.

The ISC wants to restrict the scope of proposed "equipment interference" warrants, allowing spies to hack into suspects' smartphones and computers and download data from them. either within the UK or abroad.

Given that the "targeted" warrants could cover "a target as broad as an entire hostile foreign intelligence service" it is not clear why "bulk" warrants are also included in the bill, the committee says.

The committee is also concerned about the downloading of large databases, which might include medical or bank records, known as bulk personal data sets, to aid investigations.

Dominic Grieve said: "Given that each Bulk Personal Dataset potentially contains personal information about a large number of individuals - the majority of whom will not be of any interest to the agencies - the committee considers that each dataset is sufficiently intrusive that it should require a specific warrant.

"We therefore recommend that Class Bulk Personal Dataset warrants are removed from the legislation."

GCHQ's activities are coming under scrutiny from MPs

The draft bill allows the security services to hold - but not use - bulk personal data sets for a temporary period without a warrant in certain circumstances.

This could happen, the report says, when the data has been acquired "opportunistically," without the time to apply for a warrant, but it means the agencies could hold the data without authorisation indefinitely which was clearly "not appropriate".

The committee is also calling for more clarity about the privacy safeguards to be applied to the examination of material gathered by the trawling of internet traffic passing through the UK, a practice revealed by US whistleblower Edward Snowden.

Public confidence

The draft bill is being scrutinised by a joint parliamentary committee which is due to report on Thursday.

The ISC, which took evidence in private from Home Secretary Theresa May and the heads of MI5, MI6 and GCHQ, has confined its scrutiny to the parts of the bill that relate to secret intelligence material, which other committees cannot see.

Sir Francis Richards, a former head of GCHQ, said said the agencies already had most of the powers they needed but the bill was needed to increase transparency and public confidence in a "post-Snowden" world.

"The old legislation was designed to be obscure because there was not supposed to be any public understanding of the agencies' techniques," he told BBC Radio 4's the World at One.

There was now a need to "put the record straight" but the draft bill, in his view, struck the right balance between security and privacy.

The ISC report was welcomed by civil liberties campaigners.

Jim Killock, of the Open Rights Group, said: "Rushing through legislation has to stop. It's time for a proper debate about whether bulk surveillance powers are acceptable in a democracy like the UK."