David Anderson KC to review UK surveillance laws

Home Office review

Anderson’s review of the Investigatory Powers Act comes on top of a legal requirement for the home secretary, Suella Braverman, to conduct a review of the act.

Under Section 260 of the act, the secretary of state is required to prepare a report on the operation of the act during a six-month period between May 2022 and November 2022.

The Home Office said the home secretary’s report, along with Anderson’s terms of reference, would be published and laid before Parliament “in due course”, but has not given a date.

Confidential journalistic material

Lawyers and privacy groups argue that the IPA should be revisited in the light of decisions by the European Court of Human Rights (ECHR), which found serious failings in the UK’s previous surveillance regime, the Regulation of Investigatory Powers Act 2000 (Ripa).

A decision by the ECHR in the case of Big Brother Watch and others v the UK in 2020 raises questions over whether the Investigatory Powers Act provides adequate privacy safeguards during bulk surveillance operations and whether it adequately protects confidential journalistic material and sources.

The government has previously told the Council of Europe that it intends to update section 154 of the Investigatory Powers Act, which requires government agencies to inform the Investigatory Powers Commissioner’s Office (IPCO) if they obtain material related to confidential journalistic communications during bulk interception.

Under the proposed amendment, a security and intelligence agency that wishes to use search criteria that are intended or highly likely to select confidential journalistic material for examination or searches to confirm journalistic sources, must seek prior approval from the investigatory powers commissioner.

According to a letter from the Home Office’s Investigatory Powers Unit to the Council of Europe in December 2022, the government said that under its proposals the investigatory powers commissioner must have regard for the public interest in making a decision that affects journalistic material.

“This means requests must only be approved where the public interest in the security and intelligence agencies selecting for examination or retaining the material outweighs the public interest in ensuring the confidentiality of confidential journalistic material and the sources of journalist material,” it said.

Bulk surveillance

The government has also disclosed, in an action plan submitted to the Council of Europe, that it intends to change operating procedures to require government agencies to obtain internal authorisation before carrying out bulk interception operations that seek data linked to an identified individual.

The Home Office previously made amendments to the IPA, following the Court of Justice of the European Union’s (CJEU) ruling on the Tele2 and Watson case in 2016, which found that the scope of the UK’s data retention regime was too wide to be compatible with European Union (EU) law.

That led to the Home Office introducing the Data Retention and Acquisition Regulations 2018, which required law enforcement to seek independent authorisation from the Office for Communications Data Authorisations, part of IPCO, before accessing individuals’ communications data, and limited police access to cases of “serious crime”.

Under the regulations, intelligence agencies can self-authorise requests for communications data from telephone and internet service providers in matters relating to national security, and there is an exemption for police to self-authorise in urgent cases.

Communications data

Any government review would also be expected to assess the performance of the Office for Data Authorisations (OCDA), a body set up in March 2019 – after the IPA 2016 came into force – to review applications by government bodies to access data about individuals’ telephone, email and internet use from phone and internet companies.

The OCDA, which was set up to manage 200,000 requests a year from 600 public bodies to access communications data, which includes information such as the time and recipient of emails and phone calls, but not the content; mobile phone location data; and the URLs of websites visited, but not which page of the website.

The organisation employs around 100 people, at offices in Manchester and Birmingham, who act as a contact point for government agencies seeking communications data between 7am and 10pm seven days a week.

Anderson’s review may also consider the legal fall-out from Operation Venetic, which relied on the contents of millions of messages and photographs obtained by French police in 2020 from the supposedly secure encrypted phone network EncroChat.

The operation has led to legal challenges questioning the lawfulness of the warrants underpinning Venetic, in the Investigatory Powers Tribunal, the European Court of Human Rights and referrals to the court of appeal.

Investigatory powers reviews

Anderson, a barrister at Brick Court Chambers, previously held the post of independent reviewer of terrorism legislation for six years.

He carried out two influential reviews into investigatory powers – A question of trust in 2015 and the Bulk powers review in 2016.

In 2018, he was knighted for services to national security and civil liberties, and appointed to the House of Lords where he is as an independent cross-bench peer.

Following the announcement of the Anderson review, Katy Watts, lawyer at Liberty said that the IPA allows the state to collect the “messages, location, and browsing history of all of us without grounds for suspicion”.

She said that surveillance safeguards can only protect the public if they work in practice, but Liberty’s own legal challenges of the IPA have shown them to be ineffective at protecting rights.

“These dangerous mass surveillance powers do not keep us safe, instead they breach our privacy and undermine core pillars of democracy,” she said.

Update:

Security Minister Tom Tugendhat told Parliament on 23 January 2020, that the Home Office had carried out and an internal review into the operation of the Investigatory Powers Act 2016 in 2022 to inform the Home Secretary’s Report as required by Section 260.

“This Report aims to assess, as far as possible, the extent to which the objectives of the Act continue to be met and whether any changes are required to ensure it remains fit for purpose,” he said in response to a Parliamentary question from Stuart McDonald, Scottish National Party MP.

A final copy of the report will be shared with the Investigatory Powers Commissioner and Intelligence and Security Committee ahead of publication, he said.

He told the Commons that Lord Anderson KBE KC would conduct a separate review into ‘aspects’ of the Act to inform any potential legislative change.

“Lord Anderson will carry out his own consultation with law enforcement, the intelligence agencies, and wider public authorities, as well as other external organisations and individuals with an interest in this work,” he said.