Hawktalk

Unfettered bulk data collection powers presage mass surveillance and a debate about haystacks

Note added 5th Jan 2016: my blog of this date augments the text below

Many commentators have said that identifying a likely bomber/terrorist is like looking for a needle in a haystack.  So what do you do?

The choices are:

(a) build the largest haystack about all the population because you know that the needle has to be in there “somewhere”; or

(b) have the powers to look at all the relevant smaller haystacks that are around when you have inkling as to what kind of needle you are looking for.

In Article 8 Human Rights terms, does Parliament enact legislation that allows the national security agencies to collect bulk personal data when there is no prior suspicion, so these agencies can do speculative searches in the hope they get lucky?  Or do you have the traditional civil liberties view that you need a modicum of prior suspicion before you go looking?

The Home Office prefer the former; the civil liberties lobby the latter - and that is one of the key divisive issues at the heart of the Draft Investigatory Powers Bill (“DIP”) published last week.

Clearly, David Anderson QC, who has looked at the issue of bulk data collection, recognises that the civil liberties stance that requires prior suspicion must adapt; this is because Annex 9 to his report lists half a dozen cases where access to bulk communications datasets have produced results. However, this does not mean the Home Office can use this support in order to propose draft legislation that goes off the scale in the other direction.

In summary, unfettered and mass personal data collection in the name of national security and serious crime is one of DIP’s main proposals.  The Home Office, perhaps sensing a chance to enhance the surveillance powers for the organisations that reporting to it, has drafted general provisions that gives the national security agencies (and police in the context of “serious crime”) the power to obtain any personal database.

Note that a proposal based on powers to obtain bulk personal dataset avoids all the legal problems associated by the forced retention of bulk personal dataset;  in effect, instead of retention the Home Office has suggested a power for the national security agencies to “obtain bulk personal datasets on demand”. 

The bulk personal dataset provisions in DIP 

First of all, a “bulk personal dataset” is flexibly defined.  Clause 150 of DIP says: 

“An intelligence service obtains a bulk personal dataset if—

(a) it obtains a set of information that includes personal data relating to a number of individuals,

(b) the nature of the set is such that it is likely that the majority of the individuals are not, and are unlikely to become, of interest to the intelligence service in the exercise of its functions, and

(c) if (after any initial examination of the contents) the intelligence service were to decide to retain the set for the purpose of the exercise of its functions, the set would be held electronically for analysis in the exercise of those functions”.

The explanatory notes state that “Examples of these datasets include the telephone directory or the electoral roll”.

For completeness: “Personal data” has the same meaning as in the Data Protection Act 1998 except that it also includes data relating to a deceased individual; in addition “data” is defined to include “any information which is not data”. (Those taking the BCS DP Practitioner exam should be able to explain why and understand that DIP powers apply to collections of personal information in manual records contrary to what other Home Office publications say).

Obtaining a bulk dataset is legitimised by warrant signed by the Secretary of State and is also approved by a Judge; a warrant can apply to a class of bulk datasets (e.g. all electoral rolls).  The key test applied by the Secretary of State is whether such data collection is “necessary” and “proportionate” in terms of operational requirements and of Article 8 of the Human Rights Act (soon to be modified by the Government); these tests are then confirmed by a senior judge.  Warrants are valid for six months but they can be renewed.

As far as I can see, the following appear to be targets for dataset acquisition (in whole or part):

• Databases that contains basic personal data about the population (e.g. Individualised Electoral Rolls, complete telephone directories, NHS spine; Credit reference, Census records).
• Databases that monitor movement (e.g. Passenger Name Records detailing flights; Automatic Number Plate Recognition datasets that monitor the movements of vehicles on major roads; Oyster card database in London).
• Databases to monitor spending (e.g. banking, credit card and cash withdrawal transactions).
• Databases in the hands of the State (e.g. Police National Computer databases, DWP, HMRC datasets and CCTV data collections).

DIP does not specifically exclude bulk personal datasets that contain Sensitive Personal Data; one thus has to assume that these can be the target of data collection too. 

Safeguards in DIP 

Assuming there is an operational requirement to obtain a bulk personal dataset, the DIP safeguards appear to be as follows: 

• The obtaining and subsequent processing of a bulk personal dataset is subject to Home Secretary sign-off and a judicial oversight with respect to necessity and proportionality– repeated every six months if need be.
• Bulk dataset holdings have to be reported to the relevant Secretary of State (who signed the warrant) and there will be an internal review process where senior managers, legal advisors etc will audit or review bulk dataset collections in terms of necessity and proportionality (i.e. I have to admit that this looks like “marking your own homework” to me).
• There will be a Code of Practice which outlines an alternative regime to the Data Protection Principles; these outline data processing rules under which bulk personal datasets are to be used, accessed and disclosed.
• A new Investigatory Powers Commissioner who will oversee compliance with this Code and can inspect documents etc to see if the Code is being applied properly.
• Any private misuse (e.g. by a member of staff) of a bulk dataset is an offence (e.g. up to 12 months imprisonment).

In further detail, Schedule 6, paragraph 3(2) of DIP specifies the data processing rules in the Code that apply to the processing of communications personal data. I mention these because there are no provisions that apply to bulk personal datasets (the inference being, that a wide embracing exemption Certificate under Section 28 of the Data Protection Act will be applied to bulk personal data).

With respect of communications data (i.e. including those data that are also personal data), the Code of Practice will include provisions about:

“(a) why, how and where the data is held,

(b) who may access the data on behalf of the authority,

(c) with whom, and under what conditions, the data may be disclosed,

(d) the processing of the data for purposes otherwise than in connection with the purposes for which it was obtained or retained,

(e) the processing of the data together with other data,

(f) the processes for determining how long the data should be held and for the destruction of the data.”

Finally, the Home Office assert on the face of DIP (without evidence so far) that their proposals are “necessary” and “proportionate” mainly because, I suspect, these are the responsibilities of the Secretary of State and the senior judge as part of their warrant signing/approval procedures.

Missing (and really obvious) safeguards

The following safeguards do not feature in DIP (and remember that “the majority of the individuals are not, and are unlikely to become, of interest to the intelligence service”):

• There is no role for Data Protection Principles; the national security agencies prefer their own version as identified above in Schedule 6, paragraph 3(2) and this has consequences that I describe in the next section.
• The Code is not supported by penalties if there is a major transgression.
• Onward data sharing of personal data for a purpose unconnected to national security and serious crime is permissible under the heading “the processing of the data for purposes otherwise than in connection with the purposes for which it was obtained or retained”.
• Data matching across any combination of bulk datasets is permissible (and this should be considered in the context of onward data sharing of the product of data matching - see above).
• There is no exclusion for some kinds of records (e.g. mass collection from medical records databases) on the face of the Bill  (any exclusion is decided by the warranting procedure).
• Personal data can be retained for longer than would be permissible under the Fifth Data Protection Principle (explained in the next section).
• There is no provision that considers lawful processing, fair processing, excessive processing, transfers outside the EEA or security of personal data specified in the text of Schedule 6, paragraph 3(2); hence the Intelligence Services Commissioner cannot consider them.
• The new Intelligence Services Commissioner has no role in handling or investigating complaints from data subjects (remember the majority of data subjects are “not of interest” to the intelligence service).
• Bulk dataset holdings are not reported to the Investigatory Powers Commissioner; I think all elements associated with “marking your own homework” proposed in DIP should really be transferred to the Intelligence Services Commissioner and his staff.
• Organisations that are required to provide bulk datasets cannot raise a formal complaint to the Investigatory Powers Commissioner that the warrant provides for disproportionate data sharing (i.e. organisations should be able to ask for a review of a warrant if they have concerns over proportionality).
• The Investigatory Powers Commissioner has no role in assessing whether datasets, once accessed, have proved to be useful; he ought to be able to establish Key Performance Indicators that demonstrate that bulk access is worthwhile (with the implication that if access is not worthwhile, the warrant becomes void and the datasets destroyed).
• There are no rights for data subjects even when a bulk personal dataset is of no further interest to the authorities. For instance, I cannot see why the product of a Subject Access request cannot be at the very least deferred until that point when a dataset is deleted (i.e. when a dataset is deleted, the product of an earlier Subject Access request from someone who is of no interest to the intelligence services can be released).
• Much of the above also applies to communications personal data.

In addition, existing routes for the national security agencies to obtain bulk personal datasets are not closed.  For example, Schedule 1 of Counter-Terrorism Act 2008 which modifies the “Representation of the People (England and Wales) Regulations 2001 (S.I. 2001/341)” is not repealed.  This modification includes Regulation 108A which is entitles the “Supply of full register etc to the security services”.  All other access routes to datasets should be closed if DIP is to progress.

Data Protection Principles not welcome here

Note that the Section 28 National Security Certificate regime has to remain in place in order to ensure the Principles and rights granted by the Data Protection Act are negated and the Code's description of them in Schedule 6, paragraph 3(2) prevails; this has unfortunate consequences.

For instance, the Second Principle requires a data controller not to disclose personal data for an incompatible purpose.  So if the national security agencies wanted only to disclose or use the communications personal data for compatible purposes, then there would be no need for the text in Schedule 6, paragraph 3(2)(c) that allows them to decide “with whom, and under what conditions, the data may be disclosed” or paragraph 3(2)(d) “the processing of the data for purposes otherwise than in connection with the purposes for which it was obtained or retained”.  

All you need to do is incorporate into Schedule 6, paragraph 3(2) is the text of the Second Principle.  By eschewing this Principle, DIP is thereby (inadvertently one hopes) legitimising processing of communications personal data for incompatible purposes.

Similarly, the absence of the text of the Fifth Principle sends the message that this Principle is too restrictive for the needs of the national security agencies.  If the personal data were to be retained by the national security agencies for “no longer than is necessary”, then the wording of Schedule 6, paragraph 3(2)(f) would be otiose.  In other words, the fact that the Fifth Principle is absent from Schedule 6, paragraph 3(2),  implies the Fifth Principle is too restrictive for DIP and, by implication, the national security agencies want to retain personal data for longer than the Principle would allow.

The same unfortunate inference arises with other Principles; the text of the Principles are not found in the Code because the requirements they impose are too onerous.

Concluding comments

Parliament should at least learn from the bulk communications data acquisition which was legitimised under section 94 of the Telecommunications Act 1984 (see last blog on Section 94); these general DIP bulk personal dataset collection powers do not have any kind of “sunset” arrangements.  This is alarming, given that future technological developments are likely to allow for the collection of more intrusive personal datasets not less.

The proposed changes to Article 8 of the Human Rights Act should be considered in the context of this Bill; there is a risk that any change to Article 8 by the Government could move the goal posts in terms of “necessity” and “proportionality” (i.e. the key warranting safeguards in DIP).  That is why the Government should publish the legal advice that shows that DIP’s bulk dataset provisions are Article 8 compliant.

As I said before, the national security agencies need to embrace the Data Protection Principles and the types of safeguards I have identified above.  If not, bulk personal dataset collection and mass surveillance are indistinguishable.

Note: text updated on 8 Dec 2015 as I had the references in the draft IP Bill wrong (sorry - they are correct now); and some provisions only apply to communications data that are also personal data.

Publicity

BCS DP Practitioner Qualification (starting London on Jan 26) or BCS Foundation DP Qualification (starting in London on Jan 19; ideal for those who help a Data Protection Officer). Details of these courses are accessible by clicking the relevant buttons on the Amberhawk home page: www.amberhawk.com. 

References

The Data Protection Principles can restore public trust in bulk data collection: http://amberhawk.typepad.com/amberhawk/2015/03/intelligence-and-security-committee-ignore-the-data-protection-principles-in-its-attempt-to-restore-public-trust-in-bulk-data.html

Should Section 28 national security certificates exclude the Data Protection Principles (this is the position in DIP): http://amberhawk.typepad.com/amberhawk/2014/02/should-national-security-certificates-exclude-the-data-protection-principles.html

Last blog on Section 94: http://amberhawk.typepad.com/amberhawk/2015/11/section-94-of-the-telecommunications-act-1984-a-warning-from-history.html

Annex 9 of Anderson Report “A Question of Trust”; https://terrorismlegislationreviewer.independent.gov.uk/wp-content/uploads/2015/06/IPR-Report-Web-Accessible1.pdf

Wider use of electoral roll: http://amberhawk.typepad.com/amberhawk/2012/05/fines-for-non-registration-with-the-police-reforms-permit-enhanced-secondary-use-of-electoral-rolls.html

Confidentiality of Census: http://amberhawk.typepad.com/amberhawk/2011/03/the-confidentiality-of-personal-data-in-the-census-2011-is-not-guaranteed.html

Bulk data sets: Home Office https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/473750/Factsheet-Bulk_Personal_Datasets.pdf

All DIP Bill publications: https://www.gov.uk/government/publications/draft-investigatory-powers-bill 

Should national security certificates exclude the Data Protection Principles (this is the position in DIP): http://amberhawk.typepad.com/amberhawk/2014/02/should-national-security-certificates-exclude-the-data-protection-principles.html

 

Section 94 of the Telecommunications Act 1984: a warning from history

This blog explains the extent to which the national security agencies have been collecting bulk Communications Data using powers which are being exercised in a way that were never subject to Parliamentary scrutiny.  Such data collection is neither subject to the relevant Code of Practice covering communications data nor to scrutiny from the Regulator who was specifically tasked by Parliament to supervise the use of communications data.

The blog comprises yet another lesson in the dangers of leaving wide ranging powers on the statute book.  It also provides the explanation why the collection of bulk communications data is believed by Ministers to be lawful.

The draft Investigatory Powers Bill (“IP Bill”) published earlier this week refers to how bulk communications data have been collected by the national security agencies from telecommunications providers.  It states:

“b. Bulk Communications Data Acquisition – currently provided for under section 94 of the Telecommunications Act 1984, this is used to identify subjects of interest within the UK and overseas, and to understand relationships between suspects in a way that would not be possible using only targeted communications data powers”. (page 20) 

To set the scene with respect to technology, the Telecommunications Act was enacted in the same year as the Data Protection Act 1984.  At that time, computers were not networked in any significant way (except in Research Labs, perhaps via Arpanet etc).

Indeed  I can remember the problems caused to the draft Data Protection Bill by the arrival of the first personal computer to be sold in the UK. (This was the “Pet” computer; 2KB of memory and a printer. It retailed at 499 guineas and gave rise to the hastily introduced “word processor exemption”;  a guinea was 21 shillings for the benefit of the younger reader).

Section 94 of the Telecommunications Act 1984 identified in the IP Bill documents reads as follows: 

S.94(1) states that “The Secretary of State may, after consultation with a person to whom this section applies, give to that person such directions of a general character as appear to the Secretary of State to be necessary in the interests of national security or relations with the government of a country or territory outside the United Kingdom”  

S.94(8) states that “This section applies to….providers of public electronic communications networks”. 

Section 94 was updated in a very minor way by paragraph 70 of Schedule 17 ("Minor and Consequential Amendments") of the Telecommunications Act 2003; for instance, replacement of the words “requisite or expedient” by the word “necessary” in Section 94.  The reason why I have delved into such minutae is merely to explain that an opportunity to provide a full explanation to Parliament of the intended impact of Section 94 was not taken by the then Home Secretary (prop. David Blunkett).

So, back to 1984. The impact of S.94(1) was to allow Secretary of State to give general “directions” to the newly privatised  telecoms sector in the interests of national security.   As there were few networked computers in 1984, there could have been no Parliamentary discussions about communications data collection in terms of the Internet or modern day networked computers.

Yet, according to the IP Bill document, all the national security agencies still rely on S.94(1) and “directions given by the Secretary of State” to the current day.  As with Certificates under S.28 of the Data Protection Act, these “directions” are timeless, general, surrounded by secrecy and not reviewed independently. Additionally, one does not know what the directions do. Is it to install some code into an App? A back door for the authorities?  A request for a database?

Section 94(4) of the 1984 Act states that: 

“The Secretary of State shall lay before each House of Parliament a copy of every direction given under this section unless he is of opinion that disclosure of the direction is against the interests of national security or relations with the government of a country or territory outside the United Kingdom, or the commercial interests of any person”. 

I have searched the Parliamentary database for several hours and I am unable to find any deposited papers on the subject.  So, I am fairly convinced that Parliament was deliberately kept in the dark about bulk acquisition of communications data by all Secretaries of State in the last two decades (until the Snowden revelations put them on the agenda).

In fact, in his review of law (A Question of Trust: Report of the Investigatory Powers Review; chapter 6, page 100) David Anderson reports Section 94 as being of incidental importance when the opposite appears to be the case.  He writes that there are “Three important general observations arise in connection with non-RIPA investigatory powers” such as S.94.

These observations are:

“(a) There is little or nothing in the public domain that explains how frequently (if at all) they are used.

(b) It appears that at least some (perhaps many) Agencies and Departments exercise these powers without any published Code of Practice in place.

(c) As to the exercise of concurrent RIPA and non-RIPA powers, the position is a little clearer in respect of communications data than it is in relation to interception.  The Acquisition Code states (at para 1.3) that public authorities should not use other statutory powers to obtain communications data from a postal or telecommunications operator unless that power explicitly provides that they may obtain communications data (or they are authorised to do so by a warrant or order from the Secretary of State or a person holding judicial office)”. (my emphasis). 

Clearly Anderson’s assumption that “that public authorities should not use other statutory powers to obtain communications data from a postal or telecommunications operator…” does not apply to the national security agencies and the comment “there is little or nothing in the public domain…” is clearly correct.

In addition the national security agencies “…are not authorised to do so by a warrant or order from the Secretary of State or a person holding judicial offical”  because, with respect to section 94, Ministerial directions are given to the person operating the telecoms service and not to the public authority wanting to obtain the communications data.

We can now see the impact of section 94; it allows the national security agencies to obtain communications data in circumstances that are additional to the exercise of RIPA powers without regard to the Home Office’s own statutory Code of Practice on the Acquisition of Communications Data.

This fact is confirmed by the Annual Report of the Interception of Communications Commissioner (2015) where he says in the Introduction to his report that: 

 “In addition I have recently been asked by the Prime Minister and have agreed to formally oversee directions under Section 94 of the Telecommunications Act 1984”. 

Can we pause for a moment here?  S.94 has just been placed under review of a regulator;this is confirmation that Ministerial powers to direct were not independently reviewed before.  This in turn means the following: 

• Section 94 of the Telecommunications Act 1984 has permitted the national security agencies to lawfully collect Communications Data outside RIPA powers, unhindered by the Home Office’s statutory Code of Practice on Communications Data Acquisition. 
• Since 2000, the national security agencies have been collecting Communications Data outside the specific scheme of regulation established by Parliament for Communications Data acquisition 
• Ministers, for their part, have knowingly legalised the above activities using old legislation containing wide Ministerial Powers, undebated in Parliament in the context in which these powers are used, and with considerable secrecy (i.e. Parliamentary opportunities to explain matters properly have not been taken). 

In his half yearly report (July 2015), the Interception of Communications Commissioner states reviewing the directions is challenging because:

"... the directions are secret as allowed for by statute, can be given by any Secretary of State and do not automatically expire after a certain period. There does not appear to be a comprehensive central record of the directions that have been issued by the various Secretaries of State"

It is important to note that both the recent reports from the Parliamentary Intelligence and Security Committee and the RUSI report commissioned in by the Deputy Prime Minister failed to report that Section 94 of Telecommunications Act provided the legitimate basis for the collection of bulk data collection.  This undermines their general conclusions of both reports as one wonders how this important legislative issue was missed (assuming, of course, it was missed rather than suppressed).

In conclusion, one often sees statements from Ministers and MPs who wonder publicly why trust in the national security agencies has been lost.  Perhaps, this blog explains why this is the case. 

Publicity:

BCS DP Practitioner Qualification (starting in London on Nov 16) or BCS Foundation Qualification in Information Security Management (starting in London on Dec 1; ideal for DPOs wanting to get an overview of Information Security).  Details of these courses are accessible by clicking the relevant buttons on the Amberhawk home page: www.amberhawk.com. 

References: 

Home Office Code of Practice:  “Acquisition and Disclosure of Communications Data”: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/426248/Acquisition_and_Disclosure_of_Communications_Data_Code_of_Practice_March_2015.pdf

Page 4 of the Annual Report of the Interception of Communications Commissioner (2015) which shows the Commissioner now has oversight of : http://iocco-uk.info/docs/IOCCO%20Report%20March%202015%20(Web).pdf and http://www.iocco-uk.info/docs/2015%20Half-yearly%20report%20(web%20version).pdf

The David Anderson report “A Question of Trust”; https://terrorismlegislationreviewer.independent.gov.uk/wp-content/uploads/2015/06/IPR-Report-Web-Accessible1.pdf

The ISC Report (“Privacy and Security: A modern and transparent legal framework”) fails to link S.94 with bulk data collection: accessible from http://isc.independent.gov.uk/committee-reports/special-reports

The RUSI Report:  “A Democratic Licence to Operate”; https://www.rusi.org/sites/default/files/20150714_whr_2-15_a_democratic_licence_to_operate.pdf

Some Section 28 Certficates under the DPA from 2001 that are still current: http://amberhawk.typepad.com/amberhawk/2014/02/should-national-security-certificates-exclude-the-data-protection-principles.html