New UK prime minister Theresa May is not the best-known politician on the international stage. But she has already been in the global spotlight for a controversial surveillance bill, which united an unusual collection of organizations in opposition, from Silicon Valley corporate giants to international privacy activists.
As home secretary, in Dec. 2015 May introduced the Investigatory Powers bill, which is currently making rapid progress through the legislature. The government surveillance law would allow for bulk data interception and government hacking.
When the bill was initially introduced as a draft, generals counsel at Silicon Valley’s biggest companies immediately made their opposition known: Dozens of submissions were received by the parliamentary committee overseeing the draft, including from Apple, Google, Facebook, Twitter, Microsoft, and Yahoo. Europe’s major carriers, including Vodafone and EE, also voiced their dissatisfaction.
Perhaps the most damning assessment of May’s surveillance ambitions came from the United Nations special rapporteur on the right to privacy, Joseph Cannataci. The UN official in charge of scrutinizing privacy policy used his first annual report to lambast the Investigatory Powers bill, as undermining “the spirit of the very right to privacy.”
Extraterritorial jurisdiction
Apple opposed the “extraterritorial jurisdiction” the bill would confer on the British government, allowing it to intercept or demand data from foreign companies with a British presence—from Apple, for example, because it has an Irish subsidiary. ”The draft bill makes explicit its reach beyond UK borders to, in effect, any service provider with a connection to UK consumers,” Apple wrote (pdf) to the parliamentary committee. ”In short, we believe this will lead to major issues for businesses and could ultimately put UK users at greater risk.”
Equipment interference
May also wanted to enshrine in law hacking by government agencies, or “equipment interference” by intelligence and law-enforcement agencies. This opens the door to tech companies being forced to insert spyware in their products, as the maker of the Firefox browser Mozilla pointed out in its submission (pdf). It could allow sweeping surveillance, such as letting agencies hack every phone and laptop in a township.
“We believe the UK is the first national government to attempt to provide a legislative basis for equipment interference,” wrote Apple’s legal representatives (pdf).
Technical feasibility
There’s even a question of whether any of the bill’s demands are technically feasible. In their submissions, domestic carriers Vodafone and EE pointed out that it would probably be impossible for them to decrypt much information flowing through their networks. Much of the traffic sent by the world’s biggest platforms, including Facebook and Google, are encrypted for security reasons by default. “Removal of this third-party encryption is likely to be close to impossible from a technical perspective,” Vodafone pointed out (pdf).
But none of these arguments appear to have slowed the bill’s momentum. Amendments were made to the bill in March, in response to the submissions, but some privacy groups say they’re still inadequate. The bill went on to the House of Commons, which voted in favor of the bill in March. It’s now being debated in the House of Lords, where the usual warnings have been sounded.
Theresa May’s most significant piece of surveillance legislation as home secretary is currently just two parliamentary stages away from being written into law. It’s up against a December deadline, because that’s when its predecessor’s powers run out. With Brexit posing more urgent problems to occupy politicians, the tech companies, the media, and the public at large, it may not encounter any more significant resistance, which means Prime Minister May could well receive the spying powers she believes Britain deserves.