Mass surveillance in the United Kingdom
The practice of mass surveillance in the United Kingdom grew from wartime signal intelligence and pioneering code breaking. In the post-war period, the Government Communications Headquarters (GCHQ) was formed and participated in programmes such as the Five Eyes collaboration of English-speaking nations. This focused on the interception of electronic communications, with substantial increases in surveillance capabilities over time.
Today, the use of surveillance and mass surveillance in the United Kingdom is controlled by laws made in the UK Parliament. In addition European Union data privacy law applies in UK law. The United Kingdom exhibits governance and safeguards as well as use of mass surveillance.
- 1 Data Retention and Investigatory Powers Act 2014
- 2 Protection of Freedoms Act 2012
- 3 Regulation of Investigatory Powers Act 2000
- 4 Internet, fixed and mobile telephone communications
- 5 GCHQ programmes
- 6 National databases
- 7 CCTV networks
- 8 European Union
- 9 See also
- 10 References
- 11 External links
Data Retention and Investigatory Powers Act 2014
In April 2014, the European Court of Justice declared invalid the EU Data Retention Directive, which required telecoms firms to store citizens' communications data for up to two years. The Court said it violates two basic rights - respect for private life and protection of personal data.
Supported by all three major political parties, the UK Parliament passed the Data Retention and Investigatory Powers Act in July 2014 to ensure police and security services retain existing powers to access phone and internet records. No additional powers are granted but it will make clear legally that the requirements include foreign companies, based abroad, whose phone and internet services are used in the UK.
The data being retained does not include the content of messages and phone calls, just when and who the companies' customers called, texted and emailed. But the Act does clarify the law on bugging of suspects' phones by the police and security services, after the Home Secretary issues a warrant, following concerns service providers were turning down requests.
Steps were included to "increase transparency and oversight", including:
- The creation of a new Privacy and Civil Liberties Oversight Board to scrutinise the impact of the law on privacy and civil liberties.
- Annual government transparency reports on how these powers are used.
- The appointment of a senior former diplomat to lead discussions with the US government and internet firms to establish a new international agreement for sharing data between legal jurisdictions.
- A restriction on the number of public bodies, including Royal Mail, able to ask for communications data under the controversial Regulation of Investigatory Powers Act (RIPA).
- Termination clause ensuring these powers expire at the end of 2016.
- A wider review of the powers needed by government during the next parliament.
Protection of Freedoms Act 2012
A report by the House of Lords Constitution Committee, Surveillance: Citizens and the State, had warned in 2009 that increasing use of surveillance by the government and private companies was a serious threat to freedoms and constitutional rights, stating, "The expansion in the use of surveillance represents one of the most significant changes in the life of the nation since the end of the Second World War. Mass surveillance has the potential to erode privacy. As privacy is an essential pre-requisite to the exercise of individual freedom, its erosion weakens the constitutional foundations on which democracy and good governance have traditionally been based in this country."
A YouGov poll published in 2006 indicated that 79% of those interviewed agreed that Britain has become a 'surveillance society’ (51% were unhappy with this). In 2004 the Information Commissioner, discussing the proposed British national identity database gave a warning of this, stating, "My anxiety is that we don't sleepwalk into a surveillance society." Other databases causing him concern were the National Child Database (ContactPoint), the Office for National Statistics' Citizen Information Project (which subsequently became part of the national identity database), and the National Health Service National Programme for IT.
As part of the new measures announced by the government in 2010, the national identity database, including ContactPoint, was scrapped.
In addition, the Draft Communications Data Bill, which would have extended powers, for example to include web browsing history, was abandoned by the government in 2013 after opposition from the Deputy Prime Minister Nick Clegg.
The Protection of Freedoms Act 2012 includes several provisions related to controlling or restricting the collection, storage, retention, and use of information in government databases, specifically:
- Part 1, Chapter 1 requires that fingerprints, footwear impressions, and DNA profiles taken from persons arrested for or charged with a minor offence be destroyed following either a decision not to charge or following acquittal; amends the Police and Criminal Evidence Act 1984, and the Crime and Security Act 2010, relating to the retention of fingerprints; and instructs the Secretary of State to make arrangements for a "National DNA Database Strategy Board" to oversee the operation of a DNA database.
- Part 1, Chapter 2 requires schools and colleges to obtain consent of one parent of a child under 18 before acquiring and processing the child's biometric information, gives the child rights to stop the processing of their biometric information regardless of any parental consent, and requires that if any parent of the child objects to the processing of biometric information, it must be discontinued.
- Part 6 extends the existing Freedom of Information Act 2000 and amends the role of the Information Commissioner, including widening the rules on applying for and receiving datasets from public authorities for re-use. And, while the Information Commissioner was already independent of Government in making regulatory decisions, the Act takes steps to further enhance the day-to-day corporate and administrative independence of the Commissioner.
Part 2, Chapter 1 of the Protection of Freedoms Act 2012 creates a new regulation for, and instructs the Secretary of State to prepare a code of practice regarding the use of closed-circuit television and automatic number plate recognition.
Regulation of Investigatory Powers Act 2000
The Regulation of Investigatory Powers Act 2000 (RIP or RIPA) is significant piece of legislation that granted and regulated the powers of public bodies to carry out surveillance and investigation. Activities covered by the Act include the interception of the content of telephone, internet, and postal communications; collection of information about, but not the content of, telephone, Internet, and postal communications (type of communication, caller and called telephone numbers, Internet addresses, domain names, postal addresses, date, time, and duration); use of agents, informants, undercover officers; electronic surveillance of private buildings and vehicles; following people; and gaining access to encrypted data.
RIPA allows certain public bodies:
- to demand that an ISP provide access to a customer's communications in secret;
- to engage in mass surveillance of communications in transit;
- to demand ISPs fit equipment to facilitate surveillance;
- to demand that someone hand over encryption keys or passwords to protected information;
- to monitor people's Internet activities;
- to prevent the existence of interception warrants and any data collected from being revealed in court.
The powers granted by RIPA can be invoked by government officials on the grounds of national security, for the purposes of preventing or detecting crime or serious crime, preventing disorder, protecting public safety or health, in the interests of the economic well-being of the United Kingdom, assessing or collecting any tax, duty, levy or other imposition, contribution or charge payable to a government department, or in an emergency, preventing or mitigating death, injury, or any damage to a person’s physical or mental health. Some of the powers granted by the Act are available to a relatively short list of from 5 to 12 government bodies, while others are available to longer lists of over 40 bodies.
The 2000 Act received Royal Assent on 28 July 2000 and Commencement Orders bringing provisions within this Act into force were issued between 2002 and 2012. Where prior legislation exists, the 2000 Act works in conjunction with that legislation, in particular the Intelligence Services Act 1994, the Police Act 1997, and the Human Rights Act 1998. The Act has been amended several times, to both extend and restrict the powers granted.
The Data Protection Act 1998 requires a formal warrant before private data may be gathered by the government. Warrants authorising interception of the content of electronic communications can only be issued by a democratically elected Member of Parliament, usually the Home Secretary, or another Secretary of State.
The Regulation of Investigatory Powers Act established the Investigatory Powers Tribunal to hear complaints about surveillance by public bodies. The Tribunal replaced the Interception of Communications Tribunal, the Security Service Tribunal, and the Intelligence Services Tribunal on 2 October 2000. Between 2000 and 2009 the Tribunal had upheld 4 out of the 956 complaints received.
Internet, fixed and mobile telephone communications
In 2002 the UK government announced plans to extend the Regulation of Investigatory Powers Act (RIPA), so that at least 28 government departments would be given powers to browse citizens' web, e-mail, telephone and fax records, without a warrant and without a subject's knowledge. Public and security authorities made a total of 440,000 requests to monitor people's phone and internet use in 2005-2006. In the period 11 April to 31 December 2006 the UK government issued 253,557 requests for communication data, which as defined by the RIPA includes who you phoned, when they phoned you, how long they phoned you for, subscriber information and associated addresses.
Since October 2007 telecommunication companies have been required to keep records of phone calls and text messages for twelve months under the Data Retention Directive. Though all telecoms firms already keep data for a period, the regulations are designed to ensure a uniform approach across the industry. This has enabled the Government and other selected authorities within the UK such as Police and Councils amongst others to monitor all phone calls made from a UK landline or Mobile upon request.
In 2008 plans were being made to collect data on all phone calls, e-mails, chat room discussions and web-browsing habits as part of the Government's Interception Modernisation Programme, thought likely to require the insertion of thousands of black box probes into the country’s computer and telephone networks. The proposals were expected to be included in the Communications Data Bill 2008. The "giant database" was to include telephone numbers dialed, the websites visited, and addresses to which e-mails are sent, but not the content of e-mails or telephone conversations. Chris Huhne, Liberal Democrat Home affairs spokesman, said, "The government's Orwellian plans for a vast database of our private communications are deeply worrying." In November 2009, ministers confirmed that the estimated £2 billion project would proceed as planned. A consultation found that 40% of people were against the plans which would also include monitoring communications in online games.
The police have used mobile phones to track suspects. Some shopping centres have also tracked customers through mobile phone signals. A system can tell when people enter the centre, how long they stay in a particular shop, and what route each customer takes. The system works by monitoring the signals produced by mobile handsets and then locating the phone by triangulation.
In 2013, issues regarding the possible discovery of "storage chips" in commercial keyboard, touchpad and LCD controller semiconductors on devices such as laptops and desktops have been raised by the destruction of these components at the Guardian newspaper after the revelations of leaked documents. It appears that this is a cross platform issue as both iOS and Windows host devices use similar chips that in some cases store 4MB of data for diagnostic purposes and firmware storage which is both closed source and confidential.
|Part of a series on|
A series of media reports in 2013 revealed mass surveillance programmes and techniques involving GCHQ such as Tempora and its component programmes Mastering the Internet and Global Telecoms Exploitation. Other programmes operated jointly with the NSA include MUSCULAR, Dishfire, and Stateroom.
ECHELON is a signals intelligence collection and analysis network operated on behalf of the five signatory states to the UKUSA Security Agreement, Australia, Canada, New Zealand, the United Kingdom, and the United States.
Edgehill is a code name for a clandestine, highly classified decryption programme run by GCHQ, similar to the BULLRUN programme in the US.
Legislation and Governance
GCHQ's functions are set out in the Intelligence Services Act 1994. Interception of communications operations are authorised under the Regulation of Investigatory Powers Act 2000. Warrants authorising such interception can only be issued by a Secretary of State. The Human Rights Act 1998 requires public bodies, like GCHQ, to protect citizens' rights under the European Convention on Human Rights.
The Parliament of the United Kingdom appoints an Intelligence and Security Committee. The remit of the Committee includes oversight of intelligence and security activities and reports are made directly to Parliament.
- The nine members of the committee are still nominated by the Prime Minister, but the House of Commons has the power veto the Prime Minister's suggestions. Previously, Parliament had no power to block such appointments.
- The panel now probes recent operations by the agencies. Before, its remit had only been for “resources, policy and administration” and it had seldom looked at specific operations.
- Officials acting for the committee are able to enter the premises of the intelligence agencies to inspect files and decide what the panel needs to see.
- Agencies are “required” to publish information unless handing over such details would compromise national security and they can obtain permission from the Prime Minister. Previously, the committee only had the power to “request” information.
- To signify the panel’s new status, its name was changed to the “Intelligence and Security Committee of Parliament”.
Fingerprints and DNA
The British Police hold records of 5.5 million fingerprints and over 3.4 million DNA samples on the National DNA Database. There is increasing use of roadside fingerprinting, using new police powers to check identity. Concerns have been raised over the unregulated use of biometrics in schools, affecting young children.
Across the country efforts have been increasingly under way to track road vehicle movements, initially using a nationwide network of roadside cameras connected to automatic number plate recognition systems. These have tracked, recorded, and stored the details of journeys undertaken on major roads and through city centres with the information is stored for two years. In the future, mandatory onboard vehicle telematics systems have been suggested, to facilitate road charging (see vehicle excise duty).
In London, the Oyster card payment system can track the movement of individual people through the public transport system, although an anonymous option is available, while the London congestion charge uses computer imaging to track car number plates.
In February 2009 it emerged that the government was planning a database to track and store records of all international travel into and out of the UK. The database would retain record of names, addresses, telephone numbers, seat bookings, travel itineraries and credit card details, which would be kept for 'no more than 10 years'.
The Identity Documents Act 2010 repealed the Identity Cards Act of 2006, scrapping the mandatory ID card scheme and associated National Identity Register that had been in use on a limited or voluntary basis since November 2008, but which was never fully implemented. The National Identity Register was destroyed on 10 February 2011.
Foreign nationals from outside the European Union continue to require an ID card for use as a biometric residence permit under the provisions of the UK Borders Act 2007 and the Borders, Citizenship and Immigration Act 2009. Although the 2010 Act ended the validity of ID cards as travel documents, no action was taken to withdraw the National Identity Cards already issued.
The combination of CCTV and facial recognition could be considered a form of mass surveillance, but has not been widely used. This type of system has been trialled at airports to compare faces with biometric passports, but such an application is comparable to existing identification checks at borders.
The vast majority of CCTV cameras are not operated by the UK Government, but by private companies, especially to monitor the interiors of shops and businesses. According to 2009 Freedom of Information Act requests, the total number of local authority operated CCTV cameras was around 60,000 over the entirety of the UK.
In 2005 the City of Westminster trialled microphones fitted next to CCTV cameras. Westminster council explained the microphones are part of an initiative to tackle urban noise and will not "be used to snoop", but comments from a council spokesman appear to imply they could capture an audio stream alongside the video stream, rather than simply reporting noise levels. The trials were discontinued in 2008 with no further plans for use.
A study produced by Dr. Antony Brooks of the University of Liverpool examined, as of February 2010, some cities' use of CCTV which allowed an operator who saw something illegal or troubling to speak via loudspeaker into the street; some operators also had microphones to hear audio along with the video. Dr. Brooks disputed the statistics produced supporting the relevance of the technology for the UK's major cities, stating "...the crime is merely observed, yet not prevented."
The Home Office published a code of practice in 2013 for the use of surveillance cameras, including automatic number plate recognition systems, by local and government authorities. The aim of the code is to help ensure CCTV use is "characterised as surveillance by consent, and such consent on the part of the community must be informed consent and not assumed by a system operator. Surveillance by consent should be regarded as analogous to policing by consent."
As a member of the European Union, the United Kingdom is subject to EU policies and directives on mass surveillance and participates in its programmes.
- Clean IT project, a project to define an Internet censorship and mass surveillance framework for the European Union.
- Internet censorship in the United Kingdom
- List of government surveillance projects
- "The Law". GCHQ. Retrieved 17 December 2013.
- "Statement on GCHQ’s Alleged Interception of Communications under the US PRISM Programme". Intelligence and Security Committee of Parliament. 17 July 2013. Retrieved 17 December 2013.
- "Privacy and Security Inquiry – Call for Evidence". Intelligence and Security Committee of Parliament. 11 December 2013. Retrieved 17 December 2013.
- "Intelligence and Security Committee open evidence session". UK Parliament. 7 November 2013. Retrieved 18 December 2013.
- "Spy chiefs public hearing: as it happened". The Telegraph. 7 November 2013. Retrieved 18 December 2013.
- "Britain’s spy chiefs will be questioned in public for the first time, under radical reforms of the way Parliament monitors the intelligence agencies". The Telegraph. 10 November 2012. Retrieved 18 December 2013.
- "Top EU court rejects EU-wide data retention law". BBC. 8 April 2014. Retrieved 7 September 2014.
- "Commons passes emergency data laws despite criticism". BBC. 15 July 2014. Retrieved 27 September 2014.
- "Parliament passes emergency Data Retention Bill". BBC. 17 July 2014. Retrieved 27 September 2014.
- "Emergency phone and internet data laws to be passed". BBC. 10 July 2014. Retrieved 7 September 2014.
- "The Coalition: our programme for government". HM Government. p. 11. Retrieved 25 August 2014.
- Surveillance: Citizens and the State, HL 18-I (report) and HL 18-II (evidence), House of Lords Constitution Committee, 6 February 2009. Retrieved 8 February 2009.
- John Oates (6 February 2009). "Lords say surveillance society erodes foundations of UK". The Register. Retrieved 8 February 2009.
- "YouGov / Daily Telegraph Survey Results". YouGov. 2006. Retrieved 15 September 2013.
- "Watchdog's Big Brother UK warning", BBC News, 16 August 2004. Retrieved 17 September 2013.
- "Nick Clegg: No 'web snooping' bill while Liberal Democrats are in government". BBC. 25 April 2013. Retrieved 11 September 2014.
- "Protection of Freedoms Bill", Home Office, 11 February 2011. Retrieved 28 September 2013.
- "Regulation of Investigatory Powers Act 2000", 2000 Chapter 23, UK Government Legislation. Retrieved 28 September 2013.
- "Commencement Orders bringing provisions within this Act into force", Statutory Instruments, Investigatory Powers Tribunal. Retrieved 28 September 2013.
- "Changes to legislation", Regulation of Investigatory Powers Act 2000, UK Government Legislation. Retrieved 28 September 2013.
- "THE ANDREW MARR SHOW INTERVIEW: THERESA MAY, MP HOME SECRETARY". BBC. 23 November 2014. Retrieved 6 December 2014.
Well I guess what he’s talking about is the fact that for certain aspects and certain of the more intrusive measures that our security service and police have available to them – i.e. Intercept, intercepting people’s telephones and some other intrusive measures – the decision is taken by the Secretary of State, predominantly me. A significant part of my job is looking at these warrants and signing these warrants. I think it’s ... Some people argue that should be to judges....I think it’s very important that actually those decisions are being taken by somebody who is democratically accountable to the public. I think that’s an important part of our system. I think it’s a strength of our system.
- "Reports of the Interception of Communication Commissioner". Investigatory Powers Tribunal. Retrieved 19 January 2011.
- "'Massive abuse' of privacy feared". BBC News. 11 June 2002. Retrieved 5 April 2010.
- "Interception figures could mask monitoring of millions", Out-law.com (Pinsent Masons), 21 February 2007. Retrieved 17 September 2013.
- John Oates (29 January 2008). "UK gov issued 250k phone tap licences in nine months". The Register. Retrieved 17 September 2013.
- Out-Law.com (Pinsent Masons) (16 May 2008). "Government orders data retention by ISPs". The Register. Retrieved 17 October 2008.
- Out-Law.com (Pinsent Masons) (27 July 2007). "UK phone records to be kept for a year". The Register. Retrieved 4 October 2007.
- Leppard, David (5 October 2008). "There’s no hiding place as spy HQ plans to see all". The Sunday Times (London). Retrieved 8 February 2009.
- "Giant database plan 'Orwellian'". BBC News. 15 October 2008. Retrieved 15 October 2008.
The government's own reviewer of anti-terror laws, Lord Carlile, said: 'The raw idea of simply handing over all this information to any government, however benign, and sticking it in an electronic warehouse is an awful idea if there are not very strict controls about it.'
- "Giant database plan 'Orwellian'". BBC News. 15 October 2008. Retrieved 17 October 2008.
Lib Dem home affairs spokesman Chris Huhne said: 'The government's Orwellian plans for a vast database of our private communications are deeply worrying.' 'I hope that this consultation is not just a sham exercise to soft-soap an unsuspecting public.'
- Casciani, Dominic (9 November 2009). "UK surveillance plan to go ahead". BBC News. Retrieved 5 April 2010.
- Stewart Mitchell (20 February 2012). "Anger over mass web surveillance plans". PC Pro. Dennis Publishing Limited. Retrieved 17 September 2013.
- Odell, Mark (1 August 2005). "Use of mobile helped police keep tabs on suspect". Financial Times. Retrieved 14 March 2009.
- Richards, Jonathan; Francisco, San (16 May 2008). "Shops secretly track customers via mobile phone". The Times (London). Retrieved 5 April 2010. Alternate link.
- "Shops are secretly tracking your every move by snooping on your mobile - WITHOUT asking permission", Daily Mail, 29 November 2011. Retrieved 8 September 2013.
- "Mastering the internet: how GCHQ set out to spy on the world wide web". The Guardian. 21 June 2013. Retrieved 18 December 2013.
- "GCHQ does not breach human rights, judges rule". BBC. 5 December 2014. Retrieved 6 December 2014.
- "The Intelligence and Security Committee of Parliament". Retrieved 14 December 2013.
- "Intelligence Commissioners". Retrieved 14 December 2013.
- "Motorists to give fingerprints". BBC News. 22 November 2006. Retrieved 5 April 2010.
- "The issue - Biometric identification", TES Connect (Times Educational Supplement), 13 August 2010. Retrieved 18 September 2013.
- "Paying billions for our database state", Henry Porter and Afua Hirsch, Liberty Central Blog, The Guardian, 24 April 2009. Retrieved 18 September 2013.
- "Fears over privacy as police expand surveillance project", Paul Lewis, The Guardian, 14 September 2008. Retrieved 18 September 2013.
- Scullion, Aaron (25 September 2003). "Smart cards track commuters". BBC News.
- Sheth, Niraj (2 November 2007). "London's Congestion Fee Begets Pinched Plates". Wall Street Journal. Retrieved 2 November 2007.
- Robert Dex (8 February 2009). "Government compiles travel records database". The Independent (London). The Press Association. Retrieved 18 September 2013.
- Paul Lewis; Marc Vallée (6 March 2009). "Revealed: police databank on thousands of protesters". The Guardian (London). Retrieved 10 March 2009.
Police are targeting thousands of political campaigners in surveillance operations and storing their details on a database
- "Bill stages — Identity Documents Act 2010", UK Parliament, 21 December 2010. Retrieved 28 September 2013.
- "Identity Cards Bill", House of Lords, 30 January 2006. Retrieved 28 September 2013.
- "Quick answer: Identity cards", UK Government, 30 May 2013. Retrieved 28 September 2013.
- Espiner, Tom (11 February 2011), Government destroys final ID cards data, ZDNet UK, 10 February 2011. Retrieved 13 June 2011.
- "Comment: ID cards by the backdoor?", Ian Dunt, Politics.co.uk, 6 June 2010. Retrieved 7 June 2010.
- "Automatic Face Recognition In UK Airports". European Digital Rights. 7 May 2008. Retrieved 1 December 2013.
- "Using e-passport gates". UK Border Agency. Retrieved 1 December 2013.
- "The Price of Privacy: Councils Spend Half a Billion Pounds on CCTV in Four Years", Big Brother Watch (London), 21 February 2012. Retrieved 17 September 2013.
- "Council plans to listen in on street life", David Derbyshire, The Telegraph (UK), 4 May 2005. Retrieved 17 September 2013.
- "Westminster pulls CCTV microphones". V3. 31 January 2008. Retrieved 1 December 2013.
- "Surveillance Camera Code of Practice". UK Government Home Office. June 2013. p. 5. Retrieved 1 December 2013.
- "New government's Great Repeal Bill can help repair Labour's damage to our liberties", Philip Johnston, The Telegraph (UK), 12 May 2010.
- "Norwich Police/Norwich City Council CCTV Cameras", use of Google Maps to plot an entire CCTV network in the UK, 20 March 2009.
- "The Rise of the Information State: The Development of Central State Surveillance of the Citizen in England, 1500 - 2000", Edward Higgs, in Twenty Years of the Essays on the British State, Volume 1, Y.-S. Wong and D. Sayer (eds), Blackwell Publishing Ltd. (UK), 2008, ISBN 9781405179331.
- "Is business the real Big Brother?", Adam Harcourt-Webster, BBC News, 25 May 2006.
- Identity Cards report of the UK House of Commons Home Affairs Select Committee, 30 July 2004.
- "Knowing me, knowing you: Bigger databases may mean greater efficiency for the state and private sector, but they could also mean more unwelcome intervention into our personal lives", SA Mathieson, The Guardian, 23 June 2004.