Presentation to LINX Draft Investigatory Powers Bill Workshop, London, 23 February 2016

1. Draft Investigatory Powers Bill
– Legal View
Graham Smith, Bird & Bird LLP
@cyberleagle
LINX Workshop
23 February 2016

2. Page 2
© Bird & Bird LLP 2016
Interception
Comms Data
Retention
Comms Data
Acquisition
Equipment
interference
Journalistic
privilege
Encryption
Six strands of #IPBill
RIPA ISA 1994 TA 1984 RIPA DRIPA RIPA

3. Page 3
© Bird & Bird LLP 2016
"comprehensive and
comprehensible"
2015 "RIPA, obscure since its inception, has been
patched up so many times as to make it incomprehensible
to all but a tiny band of initiates" A Question of Trust

4. Page 4
© Bird & Bird LLP 2016
Beware, it's only a draft

5. Broad categorisation of draft #IPBill changes
● Explicit powers re-enacted
● Semi-explicit powers (scale of use
hidden) now made explicit
● Opaque powers now made explicit
● Opaque powers still opaque
● New and extended powers
● Definitions and tweaks
Page 5
© Bird & Bird LLP 2016
Interception
(targeted)
Comms Data
Retention
(inc ICRs)
Comms Data
Acquisition
(bulk)
Equipment
interference
(targeted,
thematic)
Journalistic
and legal
privilege
Encryption
Interception
(bulk)
Interception
(thematic)
Equipment
interference
(bulk)
Interception
(related
communications
data)
Request
filter
Extraterritor
iality
Technical
capability
notices
Comms
service
providers
Content,
comms data
● Authorisation and oversight – 'double lock'
Comms Data
Extraction

6. Page 6
© Bird & Bird LLP 2016
1. Against whom can each
power be exercised?

7. Page 7
© Bird & Bird LLP 2016
Against whom can powers be exercised?
Power Current IPBill
Data retention notice Public telecommunications operator
(DRIPA)
Telecommunications operator
Communications data
acquisition notice
Provider of a telecommunications
service (RIPA)
Telecommunications operator
Interception warrant (1) Public telecommunications service
(2) telecommunication system wholly
or partly within UK (RIPA)
Telecommunications operator
Interception
capability notice
Public telecommunications services (>
10,000 persons in UK) (RIPA + regs)
Telecommunications service
provider ('relevant operator')
Other technical
capability notices
None Telecommunications service
provider (some UK enforceable only)
Equipment
interference warrant
? (ISA) (1) Public telecommunications
service provider (2) controls public
telecommunications system wholly
or partly within UK
Bulk communications
data acquisition
warrant
Public electronic communications
network providers (TA 1984)
Telecommunications operator (UK
enforceable only)
National security
notice
Public electronic communications
network providers (TA 1984)
UK telecommunications operator

8. Page 8
© Bird & Bird LLP 2016
'Telecommunications operator'
● IPBill
● DRIPA

9. Page 9
© Bird & Bird LLP 2016
'Telecommunications service'
● IPBill facially = RIPA as amended by DRIPA
● But

10. Page 10
© Bird & Bird LLP 2016
'Telecommunications service'
● And

11. Page 11
© Bird & Bird LLP 2016
2. How would data retention
change?

12. Page 12
© Bird & Bird LLP 2016
How would data retention change?
● DRIPA + CTSA + ICRs + ............?
● Home Office:

13. Page 13
© Bird & Bird LLP 2016
But the draft Bill goes further

14. Page 14
© Bird & Bird LLP 2016
Clause 71 – the data retention power
● "Relevant communications data"
● So what is "communications data"?

15. Page 15
© Bird & Bird LLP 2016
Communications data
● So what are Entity data and Events data?

16. Page 16
© Bird & Bird LLP 2016
Communications data
● Events data

17. Page 17
© Bird & Bird LLP 2016
Communications data
● Entity data

18. Page 18
© Bird & Bird LLP 2016
Communications data
● Entity and events data ~Subscriber
data
~Traffic
data
~Service
usage data

19. Page 19
© Bird & Bird LLP 2016
Content v communications data
● Content is king

20. Page 20
© Bird & Bird LLP 2016
Content v communications data
● "Content"

21. Page 21
© Bird & Bird LLP 2016
Content v communications data
● "Content" – the Joint Committee

22. Page 22
© Bird & Bird LLP 2016
Content v communications data
● Up to the first slash?
● Home Office evidence:
● How do these map on to definitions?
● So back to "relevant communications data"…

23. Page 23
© Bird & Bird LLP 2016
Relevant Communications Data
● Clause 71 data retention power > DRIPA + ICRs
● "Relevant communications data"

24. Page 24
© Bird & Bird LLP 2016
"Relevant communications data"
● Clause 71 IP address
resolution?
ICRs
ANY
communication
ANY
communication
ANY
communication
ANY
communication

25. Page 25
© Bird & Bird LLP 2016
"Relevant communications data"
● Compare:

26. Page 26
© Bird & Bird LLP 2016
3. Internet Connection Records

27. Page 27
© Bird & Bird LLP 2016
Internet Connection Records
● Clause 71: Power to direct retention
● Clause 46: Authorisations to obtain CD
● Clause 47: Restrictions on obtaining ICRs
Explanatory Note to Clause 71:

28. Page 28
© Bird & Bird LLP 2016
Internet Connection Records Data v
comms data
Data v
comms dataService v
apparatus

29. Page 29
© Bird & Bird LLP 2016
4. Beyond retention

30. Page 30
© Bird & Bird LLP 2016
Beyond retention
● Cl 71 Retention power: Generate, Obtain, Retain
Customer
IDs?

31. Page 31
© Bird & Bird LLP 2016
5. 3rd party data retention?

32. Page 32
© Bird & Bird LLP 2016
3rd party data retention?
● Home Office ICRs evidence to Joint Committee
● How does that map on to definitions?

33. Page 33
© Bird & Bird LLP 2016
DRIPA 2014 IPBill
Notice Secretary of State Notice
+ CTSA 2015
Comms Data
Retention
IP resolution data ‘Relevant Communications
Data’
Retention Generated or processed in UK Retention
Obtaining
Generation
E-mail, SMS,
internet access
‘Relevant Communications
Data’
‘Internet Connection
Records’
Limited
access
Summary

34. Next?
Page 34
© Bird & Bird LLP 2016

35. Watch out for…
Future proofing
● Technological neutrality v intrusion/privacy
balance
Insight
● Secret legal interpretations
Data Protection Seminar 26 June 2014
Page 35
© Bird & Bird LLP 2016

36. Graham Smith
graham.smith@twobirds.com
@cyberleagle
Bird & Bird is an international legal practice comprising Bird & Bird LLP and its affiliated and associated businesses.
Bird & Bird LLP is a limited liability partnership, registered in England and Wales with registered number OC340318 and is authorised and regulated by the
Solicitors Regulation Authority. Its registered office and principal place of business is at 15 Fetter Lane, London EC4A 1JP. A list of members of Bird & Bird LLP and
of any non-members who are designated as partners, and of their respective professional qualifications, is open to inspection at that address.
twobirds.com
Thank you