PROVISION OF REAL-TIME INTERCEPTION ASSISTANCE
REGULATION OF INVESTIGATORY POWERS ACT 2000
The Regulation of Investigatory Powers Act 2000 (RIPA) gives senior cabinet ministers the power to authorise the interception of a person’s communications following an application made by an intelligence or law enforcement agency (LEA).
Under s.5 RIPA any Secretary of State can issue an intercept warrant where the Secretary of State in question believes it is necessary in the interests of national security, for the purpose of preventing or detecting serious crime or for the purpose of safeguarding the economic well-being of the United Kingdom and where they believe that the conduct authorised by the warrant is proportionate to its intended purpose.
An interception warrant must name or describe either one person as the interception subject or a single set of premises as the premises in relation to which the relevant interception is to take place (s.8 (1) RIPA).
However under s.8 (4) (b) RIPA the relevant Secretary of State has broader authority in relation to external communications. He or she may issue a certificate accompanying an interception warrant relating to external communications that provides for the interception of material described in such certificate that s/he considers it necessary to examine. RIPA defines the term ‘external communication’ as a communication sent or received outside the British Islands (s.20 RIPA). The Interception of Communications Code of Practice (IOC COP) states that an external communication does not include communications both sent and received in the British Islands, even if they pass outside the British Islands (p.22 of IOC COP).
s.11 (4) RIPA establishes a general requirement on public telecommunication service providers in the UK to take all reasonably practical steps requested by the relevant LEA to give effect to an interception warrant.
In addition to the general requirement to provide assistance in giving effect to a warrant under s.11 (4) the Secretary of State may, under s.12 RIPA, order a public telecommunications service provider to maintain an interception capability. Under s.12 RIPA and the Regulation of Investigatory Powers (Maintenance of Interception Capability) Order 2002 (SI 2002/1931) the relevant Secretary of State has the authority to order a public telecommunications service provider to maintain the practical capability to provide assistance in relation to intercept warrants. The order is exercisable by the giving of a notice in accordance with such order to the relevant service provider. The powers in question only apply to providers of a public telecommunications service whose service is intended to be provided to more than 10,000 people.
INTELLIGENCE SERVICES ACT 1994
Under s.5 of the Intelligence Services Act 1994 (“ISA”) the Secretary of State may, on an application made by the Security Service, the Intelligence Services or GCHQ, issue a warrant in respect of any property so specified or in respect of wireless telegraphy. There is the possibility that this power is broad enough to permit government direct access to Vodafone’s network by the Security Services in some instances. Although large parts of ISA have been repealed, s.5 is still in force.
A warrant under s.5 ISA will be granted by the Secretary of State if he is satisfied that the taking of the action by the Security Service, the Intelligence Service or GCHQ is: necessary for the purpose of assisting the particular agency to carry out any of its statutory functions; that the activity is necessary and proportionate to what the agency seeks to achieve and it could not reasonably be achieved by other (less intrusive) means; and that satisfactory arrangements are in place to ensure that the agency shall not obtain or disclose information except insofar as necessary for the proper discharge of one of its functions.
s.11 (1) (a) RIPA provides for the possibility that an intercept warrants can be effected by the LEA or intelligence agency that applied for it without the provision of any assistance. One interpretation of this is that in instances where interception takes place via a pre-existing intercept capability, the LEA or intelligence agency need not inform the service provider in question that the intercept has occurred.
DISCLOSURE OF COMMUNICATIONS DATA
REGULATION OF INVESTIGATORY POWERS ACT 2000
RIPA gives LEAs, intelligence agencies and a wide range of other public authorities the legal authority to acquire the metadata relating to customer communications. The powers require anyone who provides a telecommunications service to disclose customer metadata they possess or are capable of obtaining. The powers relate to traffic data, service use information and subscriber information, but not the content of the communications.
Under s.22 (4) of RIPA a notice may be issued by a person holding a prescribed office, rank or position within a relevant public authority designated with the power to acquire communications data by order under s.25 (2) and under the Regulation of Investigatory Powers (Communications Data) Order 2010 (SI 2010/480).
Under s.22 (3) of RIPA persons within a public authority may be given an authorisation to directly obtain the communications data in question in certain circumstances, for example where notification may prejudice an investigation or operation. Under s.22 (2) of RIPA the designated person can only issue a notice or an authorisation where they believe it is necessary on one of eight grounds. These include for the interests of national security, for the purpose of preventing or detecting crime or preventing disorder, in the interests of the economic well-being of the United Kingdom, in the interests of protecting public safety or for the purpose of protecting public health. The designated person must believe that the conduct authorised by the notice or authorisation is proportionate.
NATIONAL SECURITY AND EMERGENCY POWERS
TELECOMMUNICATIONS ACT 1984
Under Section 94 of the Telecommunications Act 1984 (“Section 94”) the Secretary of State may after consultation with OFCOM and/or providers of public electronic communications networks, give OFCOM or the network provider directions of a general character as appear to the Secretary of State to be necessary in the interests of national security or relations with the government of a country or territory outside the United Kingdom. Although the Communications Act 2003 superseded most of the Telecommunications Act 1984, Section 94 is still in force.
Under Section 94, if a network provider is given directions to do or not do something as directed by the Secretary of State they shall not disclose this direction if the Secretary of State has notified them that he is of the opinion that disclosure is against the interests of national security or relations with the government of a country or territory outside the United Kingdom. The Secretary of State may, with the approval of the Treasury, make grants to providers of public electronic communications networks for the purposes of defraying or contributing towards any losses the network provider may sustain by reason of compliance with the directions under Section 94.
COMMUNICATIONS ACT 2003
Under Section 132 of the Communications Act 2003 the Secretary of State may require OFCOM, the UK’s communications regulator, to give a direction to suspend or restrict the network, services or facilities of an electronic communications network provider or an electronic communications service provider to protect the public from any threat to public safety or public health or in the interests of national security.
CIVIL CONTINGENCIES ACT 2004
Under the Civil Contingencies Act 2004 (the “CCA”) the government is given broad powers for a limited period of time during civil emergencies. This includes the authority to protect or restore systems of communications such as Vodafone’s network. The government’s emergency powers could in theory extend to other actions in relation to Vodafone’s network.
As an operator of a public electronic communications network that makes telephone services available (whether for spoken communication or for the transmission of data), Vodafone would be classified as a Category 2 Utility Responder under the CCA (Schedule 1 Part 3 of the CCA).
Under s.1 and s.19 of the CCA disruption to a system of communication may constitute an emergency for the purposes of Part 1 of the Act. Part 1 addresses local arrangements for civil protection. Part 2 addresses emergency powers.
Under s.6 (1) of the CCA the government may require or permit Vodafone to disclose information on request to another organisation or person designated as an emergency responder under the CCA in connection with their functions in the emergency.
Under s.20 and s.22 of the CCA the Queen or senior Cabinet ministers (in practice the Home Secretary) may make emergency regulations for protecting or restoring a system of communication if they are satisfied that this is appropriate for the purpose of preventing, controlling or mitigating an aspect or effect of the emergency in question.
OVERSIGHT OF THE USE OF POWERS
The judiciary plays no role in the authorisation of interception warrants under RIPA. The Interception of Communications Commissioner, appointed under s.57 (1) RIPA, keeps under review the exercise and performance of the interception powers granted under RIPA. These include the power of the Secretaries of State to issue intercept warrants and the procedures of the agencies involved in conducting interception. The Commissioner presents an annual report to the Prime Minister which is published on the website of the Interception of Communications Commissioner’s Office.
The Investigatory Powers Tribunal, established under RIPA s.65, hears complaints in relation to powers granted under RIPA. It is also the only forum that hears complaints about any alleged conduct by or on behalf of the British intelligence agencies (MI5, MI6 and GCHQ). It may award compensation, quash intercept warrants or authorisations and order the destruction of any records obtained by an intercept warrant or authorisation. The decisions of the Tribunal are not subject to appeal or questioning by any court in the UK. A decision by the Tribunal not to uphold a claim based on the Human Rights Act 1998 could be taken to the European Court of Human Rights in Strasbourg if certain conditions of that Court were satisfied.
If a public telecommunications service provider believes that a s.12 RIPA notice places unreasonable technical and/or financial demands on it, it may refer the issue to a specialist panel of advisers that is set up under s.13 RIPA called the Technical Advisory Board (TAB). The TAB reports its conclusions to the relevant Secretary of State, who may either withdraw the notice or issue a new notice. Note that the s.12 order and notice procedure is outside the remit of the Interception of Communications Commissioner (s.57 (2) (a) RIPA).
Regarding the disclosure of communications data, under s.37 of the Protection of Freedoms Act 2012 and s.23A and s.23B of RIPA local authorities are required to gain judicial approval from a local magistrate for an authorisation or notice to acquire communications data. There is no judicial oversight in relation to the approval of notices or authorisations issued by law enforcement agencies or intelligence agencies.
The judiciary plays no role in the authorisation of interception warrants under s.5 ISA. The Intelligence Services Commissioner, appointed under s.59 (1) RIPA, keeps under review the exercise and performance of the powers granted by s.5 ISA. The Commissioner presents an annual report to the Prime Minister, who lays it before the Houses of Parliament and which is published on the Commissioner’s Office website.
There is governmental oversight in relation to the directions given under Section 94, as the Secretary of State shall lay before each House of Parliament a copy of every direction given, unless he is of the opinion that disclosure of the direction is against the interests of national security or relations with the government of a country or territory outside the United Kingdom, or commercial interests of some other person.
The CCA sets limits on the emergency regulations that can be made under it (CCA. S.23). For example, any emergency regulations must be laid before, and approved by, Parliament as soon as practicable after first being made and in any event they automatically lapse after thirty days (s.26 (1) (a) and s.27 CCA). Emergency regulations may not amend the Human Rights Act 1998 (s.23 (5) (a) CCA). The Houses of Parliament may pass resolutions cancelling the emergency regulations, or amending them (s.27 CCA).
CENSORSHIP RELATED POWERS
Shut-down of network and services
Communications Act 2003
Under Section 132 of the Communications Act 2003 the Secretary of State may require OFCOM, the UK’s communications regulator, to give a direction to suspend
or restrict the network, services or facilities of an electronic communications network provider or an electronic communications service provider to protect the public from any threat to public safety or public health or in the interests of national security.
Blocking of URLs & IP addresses
Terrorism Act 2006
Although the government does not have the legal authority to require Vodafone to block IP addresses, a process exists
under Section 3 of the Terrorism Act 2006 which allows a police constable to require the removal or modification of terrorism-related material. This provision is designed to apply
to the providers of hosting services, rather than those carrying communications and, as such, it is unlikely to apply in relation to Vodafone’s electronic communications network or the provision of electronic communications services.
Where a police constable believes illegal terrorism related material is available on a website he may serve notice on the person(s) responsible for that material requiring the material’s removal or modification within two working days. According to official guidance on notices issued under Section 3, such notices can be served on anyone involved in the provision
or use of electronic services, including the content provider, hosting internet service providers (except where they are acting as ‘mere conduits’) and webmaster. Therefore Vodafone
could be required by the police to remove or modify illegal terrorism related material where Vodafone hosts that content. In respect of its network, Vodafone is likely to be considered a ‘mere conduit’.
The effect of failure to comply with a notice served under Section 3 is that the person on whom the notice is served will not be capable of using the defence of non-endorsement contained in sections 1 and 2 of the Terrorism Act 2006 should prosecution ensue under those sections. Therefore if Vodafone did not comply with a police notice, it would potentially incur criminal liability.
Power to take control of Vodafone’s network
Civil Contingencies Act 2004
Under the Civil Contingencies Act 2004 the government is given broad powers for a limited period of time during civil emergencies. This includes the authority to protect or restore
systems of communications such as Vodafone’s network. The government’s emergency powers could in theory extend to other actions in relation to Vodafone’s network. Part 1 of the
Civil Contingencies Act 2004 addresses local arrangements for civil protection; Part 2 addresses emergency powers.
An emergency is defined in Sections 1 and 19 as an event or situation which threatens serious damage to human welfare in a place in the United Kingdom; serious damage to the environment of a place in the United Kingdom; or war, or terrorism, which threatens serious damage to the security of the United Kingdom. Disruption to a system of communication
(for example a mobile network) may constitute an emergency for these purposes.
The Mobile Telecommunication Privileged Access Scheme (MTPAS)is an agreed protocol between network operators and the police. MTPAS is designed to address the issue that,
when a major emergency incident occurs, mobile networks tend to experience abnormally high concentrations of calls; jeopardizing the network itself (since the network may not be
able to cope with the high volumes of traffic). MTPAS ensures that those providing support to the scene of the emergency incident (such as police and ambulance services) are able to
continue using the network.
Under MTPAS, when a major emergency incident occurs, the Police Gold Commander in charge of responding to that incident can notify network operators (including Vodafone) that a major incident has occurred. A provider would then take steps to ensure that the mobile network continues to operate and does not break under the increased volumes of traffic made by ordinary network users in response to the incident. Individuals with privileged access to the network consist of Category 1 and 2 Responders (as defined in the Civil Contingencies Act 2004) and partner organisations directly supporting them at the scene of the incident.
Oversight of the use of powers
Communications Act 2003
Where a provider of a public electronic communications network or service receives a direction under s132 Communications Act 2003, that provider may appeal that direction to the Competition Appeals Tribunal.
More broadly, a provider may have the right to seek judicial review of the Secretary of State’s direction to Ofcom.
Terrorism Act 2006
Part 1 of the Terrorism Act 2006 (including Section 3) is subject to annual review by the Independent Review of Terrorism Legislation. The role of the Independent Reviewer of Terrorism Legislation is to inform the public and political debate on anti-terrorism law in the United Kingdom, in particular through regular reports which are prepared for the Home Secretary or Treasury and then laid before Parliament.
Civil Contingencies Act 2004
The Civil Contingencies Act 2004 sets limits on the emergency regulations that can be made under it. For example, under Section 27 any emergency regulations must be laid before, and approved by, Parliament as soon as practicable after first being made and Parliament may pass resolutions amending or cancelling those emergency regulations. Section 23 provides that emergency regulations may not amend the Human Rights Act 1998. Emergency regulations automatically lapse after thirty days pursuant to Section 26.