 | ||
The use of electronic surveillance by the United Kingdom grew from the development of signal intelligence and pioneering code breaking during the Second World War. In the post-war period, the Government Communications Headquarters (GCHQ) was formed and participated in programmes such as the Five Eyes collaboration of English-speaking nations. This focused on intercepting electronic communications, with substantial increases in surveillance capabilities over time. A series of media reports in 2013 revealed bulk collection and surveillance capabilities, including collection and sharing collaborations between GCHQ and the United States' National Security Agency. These were commonly described as mass surveillance. Similar capabilities exist in other western European countries, such as France.
Contents
- Legal framework for lawful interception
- Compatibility with human rights law
- Investigatory Powers Act 2016
- Data Retention and Investigatory Powers Act 2014
- Context
- Legislation
- Regulation of Investigatory Powers Act 2000
- Safeguards
- Telecommunications Act 1984
- GCHQ programmes
- Legislation and governance
- Reforms
- National databases
- CCTV networks
- Number of cameras
- References
Surveillance of electronic communications in the United Kingdom is controlled by laws made in the UK Parliament. In particular, access to the content of private messages (that is, interception of a communication such as an email or telephone call) must be authorised by a warrant signed by a Secretary of State. In addition European Union data privacy law applies in UK law. The law provides for governance and safeguards over the use of electronic surveillance. Further oversight including a requirement for judges to review warrants authorised by a Secretary of State, as well as new surveillance powers, were introduced by the Investigatory Powers Act 2016.
The judicial body which oversees the intelligence services in the United Kingdom, the Investigatory Powers Tribunal, ruled that the legislative framework in the United Kingdom does not permit mass surveillance and that while GCHQ collects and analyses data in bulk, its practices do not constitute mass surveillance. Other independent reports, including one by the Intelligence and Security Committee of Parliament, also came to this view although they found past shortcomings in oversight and disclosure, and said the legal framework should be simplified to improve transparency. However, notable civil liberties groups and broadsheet newspapers continue to express strong views to the contrary, while UK and US intelligence agencies and others have criticised these viewpoints in turn.
Various government bodies maintain databases about citizens and residents of the United Kingdom. These include "bulk data sets" such as medical records. In January 2016 the Home Secretary stated she would neither restrict the data sets that might be accessed for such purposes, nor state whether or not communications protected from law enforcement access such as journalist's sources and legal privilege had been accessed covertly. Although the use of video surveillance cameras in the United Kingdom is common, as it is in many countries, its prevalence is often overstated. Legal provisions exist that control and restrict the collection, storage, retention, and use of information in government databases, and require local governments or police forces operating video surveillance cameras to comply with a code of conduct.
Legal framework for lawful interception
The legal framework in the United Kingdom for lawful interception and storage of communications data and, when a warrant exists, the content of electronic communications is based on the Regulation of Investigatory Powers Act 2000 and several other pieces of legislation. The Data Retention and Investigatory Powers Act (DRIPA) 2014 deals with the retention of certain types of communications data (not the content of messages). It was brought into effect after the European Union's Data Retention Directive was declared invalid. The Telecommunications Act 1984 has also been used by the government to facilitate bulk communications data collection. The Protection of Freedoms Act 2012 includes several provisions related to controlling or restricting the collection, storage, retention, and use of information in government databases. The Human Rights Act 1998 requires the intelligence agencies, including GCHQ, to respect citizens' rights as enumerated in the European Convention on Human Rights.
Compatibility with human rights law
The Investigatory Powers Tribunal ruled in December 2014 that the legal frameworks in the United Kingdom governing the bulk interception of data and intelligence sharing with agencies in other countries do not breach the European Convention on Human Rights, and are compliant with Articles 8 (right to privacy) and 10 (freedom of expression) of the European Convention on Human Rights. However, the Tribunal stated that one particular aspect of intelligence sharing, the data-sharing arrangement that allowed UK Intelligence services to request data from the US surveillance programmes Prism and Upstream, had been in contravention of human rights law until two paragraphs of additional information, providing details about the procedures and safeguards, were disclosed to the public in December 2014.
Privacy and civil liberties advocates such as Liberty and Privacy International, who brought a legal case against the government to force the judgement, continue to oppose to the temporary bulk collection of data, powers to access this and retain selected data, as well as intelligence sharing relationships; they intend to appeal the judgement to the European Court of Human Rights. Intelligence agencies and MPs have criticised the viewpoint of privacy campaigners on this issue.
Following the publication of a special report by the Intelligence and Security Committee of Parliament in March 2015, which identified shortcomings in past oversight and potential improvements to the legislative framework, the Prime Minister David Cameron initiated an inquiry into the legalisation governing the interception powers of the intelligence agencies.
A third independent report into surveillance in the UK published in July 2015 found the intelligence agencies are not knowingly carrying out illegal mass surveillance of British citizens. However, it did say the laws governing the agencies' powers to intercept private communications need a significant overhaul. This view is consistent with separate reports by the Interception of Communications Commissioner.
In October 2016, the Investigatory Powers Tribunal ruled British security services had, in secret, unlawfully collected citizens' information, including financial information, individual phone and web use, and other confidential personal data, without adequate safeguards or supervision for 17 years. The tribunal found that from its inception in 1998 until its public acknowledgement in 4 November 2015, this bulk collection was in breach of article 8 of the European convention on human rights.
After a high court victory by two MPs challenging the legality of DRIPA, the UK government appealed to the ECJ, but in December 2016 the verdict of the national court was upheld. The ECJ ruled that general and indiscriminate retention of emails and electronic communications by governments is illegal, opening the way to challenges against the UK’s new Investigatory Powers Act (2016), which replaced DRIPA.
Investigatory Powers Act 2016
As of 4 November 2015 the Investigatory Powers Bill was published for scrutiny. The bill would introduce new powers, as well as restate existing ones, for targeted interception of communications, bulk collection of communications data, and bulk interception of communications. New oversight procedures would be introduced, including a requirement for a judge to review a warrant signed by a Minister for interception of communications, that is reading the content of messages. The bill would require Internet connection records – which websites were visited but not the particular pages and not the full browsing history – to be kept by Internet Service Providers for one year. Police and intelligence officers would be able to seek approval to see the Internet connection records without a warrant (but not the content of messages) as part of a targeted and filtered investigation.
On November 16th 2016, the Investigatory Powers Bill had passed both houses of parliament and is scheduled to become law.
Data Retention and Investigatory Powers Act 2014
In April 2014, the European Court of Justice ruled that the European Union's Data Retention Directive was invalid. Since October 2007, telecommunication companies had been required to keep records of phone calls and text messages for a minimum of 6 months and at most 24 months under this directive. The European Court of Justice found it violates two basic rights, respect for private life and protection of personal data.
Supported by all three major political parties in the UK, Parliament passed the Data Retention and Investigatory Powers Act in July 2014 to ensure the police and security services retained their existing powers to access telephone and internet records. No additional powers were granted by the legislation, but it did make clear that the requirements also apply to foreign companies, based abroad, whose telephone and internet services are used in the UK.
The data being retained does not include the content of messages and telephone calls, just metadata describing when and who the users contacted by email, telephone, or text message. In circumstances when the Home Secretary issues a warrant for intercepting the content of private messages, the Act clarifies the law with which internet services providers must comply.
Provisions were included in the Act to "increase transparency and oversight"; the BBC reported that this included the following:
In July 2015, the High Court issued an order that parts of the Act were unlawful, and to be disapplied, suspended until 31 March 2016, thereby giving the government a deadline to come up with alternative legislation which is compatible with EU law.
Context
Following the 2010 general election the new government stated it would take measures to "reverse the substantial erosion of civil liberties and roll back state intrusion".
A report by the House of Lords Constitution Committee, Surveillance: Citizens and the State, had warned in 2009 that increasing use of surveillance by the government and private companies was a serious threat to freedoms and constitutional rights, stating, "The expansion in the use of surveillance represents one of the most significant changes in the life of the nation since the end of the Second World War. Mass surveillance has the potential to erode privacy. As privacy is an essential pre-requisite to the exercise of individual freedom, its erosion weakens the constitutional foundations on which democracy and good governance have traditionally been based in this country."
A YouGov poll published in 2006 indicated that 79% of those interviewed agreed that Britain has become a 'surveillance society' (51% were unhappy with this). In 2004 the Information Commissioner, discussing the proposed British national identity database gave a warning of this, stating, "My anxiety is that we don't sleepwalk into a surveillance society." Other databases causing him concern were the National Child Database (ContactPoint), the Office for National Statistics' Citizen Information Project (which subsequently became part of the national identity database), and the National Health Service National Programme for IT.
As part of the new measures announced by the government in 2010, the national identity database, including ContactPoint (and the Citizen Information Project), was scrapped.
In addition, the Draft Communications Data Bill, which would have extended powers, for example to include web browsing history, was abandoned by the government in 2013 after opposition from the Deputy Prime Minister Nick Clegg and his party of Liberal Democrats.
Legislation
The Protection of Freedoms Act 2012 includes several provisions related to controlling or restricting the collection, storage, retention, and use of information in government databases, specifically:
Part 2, Chapter 1 of the Protection of Freedoms Act 2012 creates a new regulation for, and instructs the Secretary of State to prepare a code of practice regarding the use of closed-circuit television and automatic number plate recognition.
Regulation of Investigatory Powers Act 2000
The Regulation of Investigatory Powers Act 2000 (RIP or RIPA) is significant piece of legislation that granted and regulated the powers of public bodies to carry out surveillance and investigation. Activities covered by the Act include the interception of the content of telephone, internet, and postal communications; collection of information about, but not the content of, telephone, Internet, and postal communications (type of communication, caller and called telephone numbers, Internet addresses, domain names, postal addresses, date, time, and duration); use of agents, informants, undercover officers; electronic surveillance of private buildings and vehicles; following people; and gaining access to encrypted data.
RIPA allows certain public bodies:
The powers granted by RIPA can be invoked by government officials on the grounds of national security, for the purposes of preventing or detecting crime or serious crime, preventing disorder, protecting public safety or health, in the interests of the economic well-being of the United Kingdom, assessing or collecting any tax, duty, levy or other imposition, contribution or charge payable to a government department, or in an emergency, preventing or mitigating death, injury, or any damage to a person's physical or mental health. Some of the powers granted by the Act are available to a relatively short list of from 5 to 12 government bodies, while others are available to longer lists of over 40 bodies.
The 2000 Act received Royal Assent on 28 July 2000 and Commencement Orders bringing provisions within this Act into force were issued between 2002 and 2012. Where prior legislation exists, the 2000 Act works in conjunction with that legislation, in particular the Intelligence Services Act 1994, the Police Act 1997, and the Human Rights Act 1998.
The Act has been amended several times, to both extend and restrict the powers granted. In 2002 the UK government announced plans to extend the Regulation of Investigatory Powers Act so that at least 28 government departments would be given powers to access metadata about citizens' web, e-mail, telephone and fax records, without a warrant and without a subject's knowledge. Public and security authorities made a total of 440,000 requests to monitor people's phone and internet use in 2005–2006. In the period 11 April to 31 December 2006 the UK government issued 253,557 requests for communication data, which as defined by the RIPA includes who you phoned, when they phoned you, how long they phoned you for, subscriber information and associated addresses.
Safeguards
RIPA and the Data Protection Act 1998 require a formal warrant before private data may be gathered by the government. Warrants authorising interception of the content of electronic communications can only be issued by a democratically elected Member of Parliament, usually the Home Secretary, or another Secretary of State. RIPA imposes constraints to ensure the activities authorised meet the requirements of the European Convention on Human Rights (ECHR), in particular that they are necessary and proportional. The Intelligence and Security Committee reported that GCHQ applies these standards to all of its work, not just activities governed by RIPA, to act as a check over all of its activities being necessary and proportional as required by the ECHR.
The Regulation of Investigatory Powers Act established the Investigatory Powers Tribunal to provide judicial oversight and hear complaints about surveillance activities by intelligence agencies and other public bodies. The Tribunal replaced the Interception of Communications Tribunal, the Security Service Tribunal, and the Intelligence Services Tribunal on 2 October 2000. Between 2000 and 2009 the Tribunal had upheld 4 out of the 956 complaints received.
Telecommunications Act 1984
The use of the Telecommunications Act 1984 for communications data collection, and the lack of oversight of this capability, was highlighted in the April 2014 report of the Home Affairs Committee of the House of Commons on Counter-terrorism. This was reiterated in the March 2015 report of the Intelligence and Security Committee of Parliament on Privacy and Security. Section 94 of the Telecommunications Act 1984 allows a Secretary of State to give providers of public electronic communications networks "directions of a general character… in the interests of national security", which may be protected from disclosure. The Act also gives the government certain powers to block foreign involvement in the critical national infrastructure of the United Kingdom. In November 2015, it was revealed MI5 had been using the Telecommunications Act 1984 to collect phone data in bulk for a decade.
GCHQ programmes
A series of media reports in 2013 revealed bulk collection and surveillance capabilities involving GCHQ in the United Kingdom such as Tempora and its component programmes Mastering the Internet and Global Telecoms Exploitation. The Tempora programme involves a large-scale buffer for storing internet content for 3 days and metadata for 30 days. A number of other GCHQ operations were revealed, including hacking into telecoms equipment, access to fibre-optic cables and programmes operated jointly with the NSA.
GCHQ was originally established after the First World War as the Government Code and Cypher School (GC&CS) and was known under that name until 1946. During the Second World War, staff including Alan Turing worked on decoding the German Enigma machine, and many other foreign systems. In 1940, GC&CS was working on the diplomatic codes and ciphers of 26 countries, tackling over 150 diplomatic cryptosystems.
After the Second World War, the United Kingdom and the United States signed the bilateral UKUSA Agreement in 1948. It was later broadened to include Canada, Australia and New Zealand, as well as co-operation with several "third-party" nations. This became the cornerstone of Western intelligence gathering and the "Special Relationship" between the UK and the USA. ECHELON is a code name often used for this global signals intelligence collection and analysis network.
Legislation and governance
GCHQ was placed on a statutory footing for the first time by the Intelligence Services Act 1994. Activities that involve interception of communications were legislated for under the Regulation of Investigatory Powers Act 2000; this kind of interception can only be carried out after a warrant has been issued by a Secretary of State, usually the Home Secretary. The Human Rights Act 1998 requires the intelligence agencies, including GCHQ, respect citizens' rights as enumerated in the European Convention on Human Rights.
The Prime Minister nominates cross-party Members of Parliament to an Intelligence and Security Committee (ISC). The remit of the Committee includes oversight of intelligence and security activities and reports are made directly to Parliament. A special report on Privacy and Security, published by the ISC in March 2015, found that although GCHQ collects and analyses data in bulk, it does not conduct mass surveillance. It did identify past shortcomings in oversight and said the legal framework should be simplified to improve transparency.
The UK also has an independent Intelligence Services Commissioner and Interception of Communications Commissioner, both of whom are former senior judges. Annual reports by the Interception of Communications Commissioner have found the use of interception powers by the intelligence agencies comply with existing legislation.
Judicial oversight of GCHQ's conduct is provided by the Investigatory Powers Tribunal (IPT). The IPT ruled in December 2014 that the legislative framework in the United Kingdom does not permit mass surveillance and that while GCHQ collects and analyses data in bulk, it does not practice mass surveillance.
Reforms
The Justice and Security Act 2013 included a range of reforms to the Intelligence and Security Committee to provide for further access and investigatory powers. The Telegraph reported that this included the following:
National databases
Various government bodies maintain databases about citizens and residents of the United Kingdom. Under the Protection of Freedoms Act 2012, legal provisions exist that control and restrict the collection, storage, retention, and use of information in government databases.
The British Police hold records of 5.5 million fingerprints and over 3.4 million DNA samples on the National DNA Database. There is increasing use of roadside fingerprinting, using new police powers to check identity. Concerns were raised in 2010 over the unregulated use of biometrics in schools, affecting young children. Subsequently, the government introduced legal duties on schools, if they wish to use biometric information about pupils, in the Protection of Freedoms Act 2012.
Across the country efforts have been increasingly under way to track road vehicle movements, initially using a nationwide network of roadside cameras connected to automatic number plate recognition systems. These have tracked, recorded, and stored the details of journeys undertaken on major roads and through city centres with the information is stored for two years. In the future, mandatory onboard vehicle telematics systems have been suggested, to facilitate road charging (see vehicle excise duty).
In London, the Oyster card payment system can track the movement of individual people through the public transport system, although an anonymous option is available. The London congestion charge uses computer imaging to track car number plates.
In February 2009 it emerged that the government was planning a database to track and store records of all international travel into and out of the UK. The database would retain record of names, addresses, telephone numbers, seat bookings, travel itineraries and credit card details, which would be kept for 'no more than 10 years'. In April 2015, passport exit checks began at UK borders and data will be stored on all travellers as they leave the UK.
Police Forward Intelligence Teams have conducted surveillance of political and environmental protestors and of journalists. The information they gathered has been stored in the crimint database.
CCTV networks
The combination of CCTV and facial recognition could be considered a form of mass surveillance, but has not been widely used. This type of system has been trialled at airports to compare faces with biometric passports, but such an application is comparable to existing identification checks at borders.
In 2005 the City of Westminster trialled microphones fitted next to CCTV cameras. Westminster council explained the microphones are part of an initiative to tackle urban noise and will not "be used to snoop", but comments from a council spokesman appear to imply they could capture an audio stream alongside the video stream, rather than simply reporting noise levels. The trials were discontinued in 2008 with no further plans for use.
The Home Office published a code of practice in 2013 for the use of surveillance cameras, including automatic number plate recognition systems, by local and government authorities. The aim of the code is to help ensure CCTV use is "characterised as surveillance by consent, and such consent on the part of the community must be informed consent and not assumed by a system operator. Surveillance by consent should be regarded as analogous to policing by consent."
Number of cameras
The vast majority of CCTV cameras are not operated by government bodies, but by private individuals or companies, especially to monitor the interiors of shops and businesses. According to 2011 Freedom of Information Act requests, the total number of local government operated CCTV cameras was around 52,000 over the entirety of the UK.
An article published in CCTV Image magazine estimated the number of private and local government operated cameras in the United Kingdom was 1.85 million in 2011. The estimate was based on extrapolating from a comprehensive survey of public and private cameras within the Cheshire Constabulary jurisdiction. This works out as an average of one camera for every 32 people in the UK, although the density of cameras varies greatly from place to place. The Cheshire report also claims that the average person on a typical day would be seen by 70 CCTV cameras.
The Cheshire figure is regarded as more dependable than a previous study by Michael McCahill and Clive Norris of UrbanEye published in 2002. Based on a small sample in Putney High Street, McCahill and Norris extrapolated the number of surveillance cameras in Greater London to be around 500,000 and the total number of cameras in the UK to be around 4,200,000. According to their estimate the UK has one camera for every 14 people. Although it has been acknowledged for several years that the methodology behind this figure is flawed, it has been widely quoted. Furthermore, the figure of 500,000 for Greater London is often confused with the figure for the police and local government operated cameras in the City of London, which was about 650 in 2011.
The CCTV User Group estimated that there were around 1.5 million private and local government CCTV cameras in city centres, stations, airports, and major retail areas in the UK. This figure does not include the smaller surveillance systems such as those that may be found in local corner shops and is therefore broadly in line with the Cheshire report.
Research conducted by the Scottish Centre for Crime and Justice Research and based on a survey of all Scottish local authorities, identified that there are over 2,200 public space CCTV cameras in Scotland.