https://www.theregister.com/2024/04/26/investigatory_powers_bill/ # # Sign in / up The Register(r) -- Biting the hand that feeds IT # # # Topics Security Security All SecurityCyber-crimePatchesResearchCSO (X) Off-Prem Off-Prem All Off-PremEdge + IoTChannelPaaS + IaaSSaaS (X) On-Prem On-Prem All On-PremSystemsStorageNetworksHPCPersonal TechCxOPublic Sector (X) Software Software All SoftwareAI + MLApplicationsDatabasesDevOpsOSesVirtualization (X) Offbeat Offbeat All OffbeatDebatesColumnistsScienceGeek's GuideBOFHLegalBootnotesSite NewsAbout Us (X) Special Features Special Features All Special Features Cloud Infrastructure Week Cybersecurity Month Blackhat and DEF CON Sysadmin Month The Reg in Space Emerging Clean Energy Tech Week Spotlight on RSA Energy Efficient Datacenters Vendor Voice Vendor Voice Vendor Voice All Vendor Voice Amazon Web Services (AWS) Business Transformation Amazon Web Services (AWS) New Horizon in Cloud Computing DDN Google Cloud Data Transformation Hewlett Packard Enterprise: AI & ML solutions Hewlett Packard Enterprise: Edge-to-Cloud Platform Intel vPro VMware (X) Resources Resources Whitepapers Webinars & Events Newsletters [front] Security 44 comment bubble on white UK's Investigatory Powers Bill to become law despite tech world opposition 44 comment bubble on white Only minor changes from original proposals that kicked up privacy storm icon Connor Jones Fri 26 Apr 2024 // 12:00 UTC # The UK's contentious Investigatory Powers (Amendment) Bill (IPB) 2024 has officially received the King's nod of approval and will become law. Dubbed the "snooper's charter" by critics, it aims to widen the digital surveillance powers of the existing Investigatory Powers Act 2016 (IPA) used by UK intelligence services, the police, government, and some emergency services. Before the latest amendments came into force, the IPA already allowed authorized parties to gather swathes of information on UK citizens and tap into telecoms activity - phone calls and SMS texts. [front] The IPB's amendments add to the Act's existing powers and help authorities trawl through more data, which the government claims is a way to tackle "modern" threats to national security and the abuse of children. [front] [front] "The world-leading Investigatory Powers regime is crucial to keeping the public safe," said security minister Tom Tugendhat. "That's why we're making urgent, targeted changes to the Investigatory Powers Act to ensure our laws keep pace with rapidly changing technology and to guard against modern threats to national security. "These changes mean that not only will our citizens be better protected from serious dangers such as terrorism and child sexual abuse online - their privacy will be better protected too." [front] The UK government has positioned the changes, which include an expanded remit to collect data on UK citizens en masse, as a means to afford intelligence agencies and the National Crime Agency (NCA) "greater agility and speed" in responding to threats. Among those alterations is the ability for authorities to surveil targets by gathering their internet connection records. This will allow investigators to determine who connected to what service - such as an app or website - what phone number they dialed, where they were at the time, and when they did so. The amendments also expand authorities' ability to gather bulk datasets of personal information on individuals who have a low or no expectation of privacy. This includes data such as CCTV footage or images posted to social media. [front] There was hope among the Bill's opposers that some of the more controversial changes would be repealed following loud concerns over privacy infringements, but the UK's hardline stance on national security has prevailed. Will Richmond-Coggan, privacy and data protection partner at national law firm Freeths, told The Register: "The amendments made to the Investigatory Powers (Amendment) Bill were ultimately welcomed by the House of Lords, but are unlikely to be welcomed by campaigners or tech companies who were concerned about the wide-ranging scope of notice provisions in relation to the introduction of new privacy-enhancing technologies which would also have the effect of impeding lawful surveillance. "Additional safeguards have been introduced - notably, in the most recent round of amendments, a 'triple-lock' authorization process for surveillance of parliamentarians - but ultimately, the key elements of the Bill are as they were in early versions - the final version of the Bill still extends the scope to collect and process bulk datasets that are publicly available, for example." Naturally, privacy campaigners strongly oppose the IPB and the changes that it brings to UK law, saying they expand an already robust arsenal of tools to collect data on UK citizens in bulk. Tech trade body techUK said in a March statement that it had "substantial concerns" about the Bill, which was being "rushed" through parliament without proper scrutiny. It believes the IPB will weaken the safety rails that guide the intelligence services when collecting data in bulk, and that it could lead to the wider data harvesting of millions of facial images, internet records, and social media data. techUK told The Register this week: "As the Investigatory Powers (Amendment) Bill receives Royal Assent, we are disappointed that the government did not address the widespread concerns about its potential negative impacts. "We remain concerned that these reforms will weaken privacy protections, expand surveillance powers, hinder security innovation, and risk exacerbating international conflicts of law without sufficient safeguards. "As we look towards the next steps for this legislation, with consultations on how these regulations will work in practice, we look forward to further engagement to ensure a more workable and proportionate regime." * UK Online Safety Bill to become law - and encryption busting clause is still there * Wah, encryption makes policing hard, cries UK's National Crime Agency * UK admits 'spy clause' can't be used for scanning encrypted chat - it's not 'feasible' * Letters prove GCHQ bends laws to spy at will. So what's the point of privacy safeguards? Privacy International said: "Sadly, but not surprisingly, [the IPB] has changed little from the government's original proposal, which means its becoming law is a major concern. "The Bill waters down already insufficient safeguards in the Investigatory Powers Act. It makes mass surveillance easier and gives the UK the option to attempt to control, and perhaps lessen, the security and privacy of internet services used by billions of people around the world." Potential threat to security updates in commercial software Other key concerns revolve around the IPB's amendment that would force tech companies to consult the UK government before rolling out security updates to software. It's a big one that opposers of the Bill think will undermine the security posture of the UK, and potentially lead to unnecessarily protracted delays in rolling out key security features, thus making the country a more popular target for cybercriminals. Apple, for example - a company that famously refused to bend even to the FBI after they wanted to crack open the San Bernadino shooter's iPhone, said it would consider pulling iMessage and FaceTime from the UK over fears they would be forced to weaken security. The company branded the IPB's rule "an unprecedented overreach by the government," adding it believes the changes are an "attempt to secretly veto new user protections globally, preventing us from ever offering them to customers." Abigail Burke, platform power program manager at the Open Rights Group, previously told The Register, before the IPB was debated in parliament, that the proposals amounted to an "attack on technology." The IPB, of course, goes hand-in-hand with the long-running calls to break end-to-end encryption (E2EE), which the government also claims impedes its efforts to tackle national security threats. It once again echoed these views [PDF] just this week, in fact. The Online Safety Bill was also passed last year after a rocky process that garnered equally loud concerns from privacy campaigners about a so-called "spy clause" that aimed to capture encrypted private messages. Although the UK government admitted that scanning encrypted chats wasn't "technically feasible", it didn't rule out the possibility of invoking a request for companies to do so in the future, perhaps at a time when, or if, E2EE becomes illegal in the UK, for example. (r) Get our Tech Resources # Share More about * Parliament of the United Kingdom * Privacy More like these x More about * Parliament of the United Kingdom * Privacy Narrower topics * cookies * Privacy Sandbox Broader topics * United Kingdom More about # Share 44 comment bubble on white COMMENTS More about * Parliament of the United Kingdom * Privacy More like these x More about * Parliament of the United Kingdom * Privacy Narrower topics * cookies * Privacy Sandbox Broader topics * United Kingdom TIP US OFF Send us news --------------------------------------------------------------------- Other stories you might like US legislators propose American Privacy Rights Act - and it looks quite good After two decades of calls for national protections, something may actually happen Public Sector9 Apr 2024 | 39 Lawsuit accuses Grindr of illegally sharing users' HIV status LGBTQ+ dating app's maker previously denied selling sensitive user data Applications22 Apr 2024 | 5 Google cools on cookie phase-out while regulators chew on plans Privacy Sandbox slips into 2025 after challenges from UK authorities Security24 Apr 2024 | 10 Industrial systems integrating digitalisation Huawei solutions designed to speed up digital and intelligent transformation across key vertical industries Sponsored Feature [front] If Britain is so bothered by China, why do these .gov.uk sites use Chinese ad brokers? Exclusive One wonders why are there adverts on public-sector portals at all Research24 Apr 2024 | 100 Europol now latest cops to beg Big Tech to ditch E2EE Don't bore us, get to the chorus: You need less privacy so we can protect the children Security22 Apr 2024 | 24 96% of US hospital websites share visitor info with Meta, Google, data brokers Could have been worse - last time researchers checked it was 98.6% Research11 Apr 2024 | 13 FYI: This site claims to have harvested 4B+ Discord chats, today all yours for a price Updated Of course there's an enterprise plan for the Feds and AI trainers Personal Tech16 Apr 2024 | 18 Kaiser Permanente handed over 13.4M people's data to Microsoft, Google, others Ouch! CSO26 Apr 2024 | 2 White House tweaks HIPAA to shield medical files of those seeking reproductive care In theory, this should make it harder for states to compel data-sharing to enforce anti-abortion laws Personal Tech24 Apr 2024 | 21 US House passes fresh TikTok ban proposal to Senate Sadly no push to end stupid TikTok dances, but ByteDance would have year to offload app stateside Security22 Apr 2024 | 37 Academics probe Apple's privacy settings and get lost and confused Just disabling Siri requires visits to five submenus Security5 Apr 2024 | 30 The Register icon Biting the hand that feeds IT About Us* * Contact us * Advertise with us * Who we are Our Websites* * The Next Platform * DevClass * Blocks and Files Your Privacy* * Cookies Policy * Privacy Policy * Ts & Cs * Do not sell my personal information Situation Publishing Copyright. All rights reserved (c) 1998-2024 no-js