How nervous should we be about the government’s proposals to make it easier for the authorities to monitor online communications? Leave aside the formidable technical problems (as described by WMD Zone) – is there a solid objection in principle? Since they haven’t announced the details yet, here are some thoughts in general.
When I trained to be a lawyer no one told me how much time I would spend reading other people’s phone bills. Billing data is the staple of almost every criminal case of any substance. Information about who is talking or texting whom, how often, and where they are when they do it, can make a compelling circumstantial case to prove criminal activity – all the more so when combined with visual surveillance.
Criminals use phones to plan and carry out their crimes. Imagine a large drug trafficking business that could function without phones: impossible (although I was once in a drugs case which involved some dodgy-looking carrier pigeons). Or a planned shooting – the spotter follows the target, and at the critical moment calls in the shooter who is lurking nearby. By logging their calls and tracking their movements by cell-site (the mast that transmits the mobile signal) you can see them converge just before the shooting takes place, and move away afterwards.
Although the police and security services can lawfully tap suspects’ phones, the law has always prohibited the use in evidence of the ‘fruits’ of the interception – what the callers were actually saying. But a hidden microphone in their premises or cars which records them speaking into their phones or in face-to-face conversation, is frequently used to produce admissible evidence.
It would be hard to justify a ban on the police obtaining and making use of such evidence – provided its use is justified and subject to proper controls.
The Regulation of Investigatory Powers Act 2000 (‘RIPA’) provides a regulatory framework for monitoring online communications data, telephone interceptions, the use of bugs and microphones, ‘covert human intelligences sources’ (informants), and other ‘directed’ and ‘intrusive’ methods of surveillance by the authorities. RIPA was enacted largely as a result of criticisms by the Strasbourg Court of the previous ad hoc arrangements for the deployment of these techniques for spying by the state on its citizens. The Court held they were not ‘in accordance with the law’ – because there was no effective law, just a set of established procedures, and privacy rights under Article 8 of the European Convention were being breached. RIPA answered that complaint – how effectively continues to be a matter of debate. Some 60 public bodies have investigatory powers under the Act – including the power to demand communications data from internet service providers (ISPs). Part III of RIPA includes a power to demand the key to encrypted data on your computer, with a penalty of 2 years imprisonment for failure to disclose it. This power has been used in prosecutions of animal rights activists. RIPA also established the Investigatory Powers Tribunal to which members of the public can complain if they think they have been spied on in breach of the rules. According to the Tribunal’s 2011 Annual Report,(http://www.iptuk.com/docs/IPTAnnualReportFINAL.PDF), it received 210 complaints in 2010, and upheld six of them. Make of those figures what you will.
So the state has already taken great powers, and has regularly added to the number of public bodies which may exercise them. The present plan to extend those powers to monitor online activity may be the thin end of the wedge – but don’t forget that the thick end came first, with RIPA, in 2000.
There is a bigger question, about where the law ends. For reasons given in a different context in my statement to the Leveson Inquiry, I do not believe that what people do online is or should be exempt from the general law. This is hardly controversial – who would seriously suggest that there should be no remedy for potentially criminal conduct which happens to take place online rather than on the phone or in person? So once that is clear, it surely follows that law enforcement agencies should take an active interest in suspicious online activity – as they obviously do. If I am planning a drugs importation, or a bombing, or the abduction of young children, and I am doing it by reference to certain websites and by talking to fellow-criminals via a social network – shouldn’t the police be permitted to investigate? How can they investigate without having access to records of my online activity?
I have no idea how GCHQ operates but its monitoring systems must have alerts and triggers that identify internet or phone traffic of potential interest. It is inconceivable that every single email, phone call or access to websites is monitored, much less evaluated – even if the capacity to store and access all of them exists.
The last government proposed a massive central database in which everything would be stored forever: a grandiose and foolish scheme, beaten off by a coalition of people from the other parties, the IT industry and elsewhere. At present, ISPs must retain all their data for 12 months, and are then permitted to destroy it. The authorities can access it within that time, under the RIPA framework. Apparently, the new proposal is for them to monitor online communications in real time, as they are happening – as they do when they intercept phone calls or use bugs in cars or premises.
Now we should not place (too) much trust in the state or the goodwill of our elected and appointed officials. They have to be kept under close scrutiny at all times or they will abuse their powers. But a state whose institutions are subject to the rule of law is less likely to commit serious abuses against its citizens, or get away with them when it does. A police state is the opposite of a state based on law – where law implies more than obeying the rules through fear, but rather a complex texture of consent, dissent, argument, and impartial resolution of disputes. A police state will always be corrupt and will grant impunity to the corrupt; a state based on law will have the ability to call the corrupt to account. We do not live in a police state. If you can’t tell the difference, have a look at North Korea, Iran, or Belarus. It is certainly objectionable for jobsworths in the town hall to spy on people who disobey dustbin ordinances, but let’s keep it in proportion.
Agencies that have coercive powers and are permitted to intrude on private life need strict regulation. I would favour a presumption against interception of all private communications (phone calls, online, letters) without proof of a compelling and urgent reason, to be assessed by a Court rather than police officers, civil servants or ministers. There should be effective sanctions to punish those who breach the rules – immediate dismissal and prosecution would be a start.
Let’s wait and see what the eventual proposals look like, and what the safeguards are. Meanwhile, the Ministry of Justice’s plans – driven by the spy agencies – to hold civil trials in secret to avoid embarrassing the spies, is a far more sinister development, and far more inimical to the rule of law.