Anderson and surveillance: RIPA is still the law – and it’s being broken

The Anderson report on surveillance (according to the media) suggested that UK security services should “keep” their powers of bulk surveillance – the downloading and storing of communications and internet material, basically without limit except the limitations of the technology they have. The report has come out in the same week that the Metropolitan Police were unable to confirm or deny (for which read “confirmed”) that dummy mobile phone towers, or Stingers, were lifting material from the phones of passers-by, apparently ad hoc and without specific investigatory purpose.

But it is really not clear that bulk surveillance powers do have legal sanction in Britain – and nor does Anderson say unequivocally that they do. Which is why, under Theresa May’s new “snooper’s charter” (the draft investigatory powers bill), she will be seeking to legalise something she claims is perfectly legal already – but really isn’t.

So what is the law? The key piece of legislation is the Regulation of Investigatory Powers Act 2000 (RIPA) – which Anderson wants replaced. This is often referred to as source of surveillance powers for just about anyone from GCHQ to schools checking on the residency of parents of local authorities looking at our recyling.

In fact it is intended to control, curb, restrict and limit surveillance – and in particular it is intended to prevent the state’s (and private bodies’) disproportionate bulk downloading and retention of the private information – which is just what the security forces do now as far as they technically can and which they will be able to do far more effectively under the investigatory powers bill, requiring ISPs, Google and the rest to keep such information for them.

GCHQ surveillance illegal – but suddenly it’s not

So has GCHQ been found guilty of breaches in human rights law or not? You’d be right to be confused. The Investigatory Powers Tribunal (IPT) has issued a resumé of a judgment and news reports tended to take a negative line, saying things like “GCHQ unlawfully spied on British citizens“. The Guardian website started with “GCHQ mass internet surveillance was unlawful, court rules” later going with a more precise “UK-US surveillance was unlawful for seven years“.

Yet, on the face of it the IPT has given GCHQ a pretty clean bill of health in terms of its receipt of UK surveillance information from the National Security Agency (NSA). Up there at the top of the Tribunal’s release was this:

“Save in one possible (and to date hypothetical) respect … the current regime, both in relation to Prism and Upstream [US surveillance programmes] and to s.8(4), [of the Regulation of Investigatory Powers Act 2000 (RIPA)], when conducted in accordance with the requirements which we have considered, is lawful and human rights compliant.”

The Tribunal ruled the activities lawful now. But until now (or specifically until the IPT judgment in the Liberty v FCO case last December) they weren’t. What has made them legal now? Well, what made things unlawful previously was not, apparently, that GCHQ accessed (from US sources), downloaded and kept material from mass surveillance of UK emails, phone records and internet searches – but that it failed to tell us that it had accessed, downloaded and kept material from mass surveillance of emails, phone records and internet searches. It’s legal now, in part, thanks to the publicity surrounding this very judgment – from a Tribunal that actually sits in secret.

Mass surveillance in the UK: Charles Farr’s flawed arguments

Hang on! Just because UK government security official Charles Farr says GCHQ et al have done nothing unlawful in their mass digital surveillance, that’s no reason to believe him. You wouldn’t believe a burglar rifling through your drawers; why believe the spokesmen for the people rifling through your personal emails and internet searches?

Farr has put in a defence in the case brought by Privacy International against the Government, not a statement of the law, yet it is being treating as gospel truth. In particular people are demanding the law be changed – conceding that the surveillance is currently lawful (among them pro-security services types such as Lady Neville-Jones).

In fact a judge has not ruled in the case yet, and there are fundamental flaws in Farr’s argument that UK-originated digital material on overseas servers is fair game even though it originated in or returned to the “British Islands” (in the quaint formulation of the 2000 Regulation of Investigatory Powers Act).

For starters it is strongly arguable in law that nothing in the Act can sanction unreasonable mass surveillance – since that was not the purpose of the Act. RIPA was intended to enact a European Directive banning such downloading and storing of personal material and a judge will interpret it in that light. He or she is likely to take a dim view of any alleged “loopholes” in it. (This argument is made briefly below and at length here.)

But Farr’s case is further flawed – not least by a disingenuous attempt to claim parliamentary sanction for mass surveillance on the basis of an arcane exchange in the House of Lords one July evening in the year 2000.