No Content: Metadata and the draft Investigatory Powers Bill

Puzzled and confused by the draft Investigatory Powers Bill? You are in good company, according to the House of Commons Science and Technology Committee which last week delivered a report on the technological issues raised by the draft Bill. Lack of clarity featured heavily in its concerns.

If that was the starter, this week we get the main course when the Joint Parliamentary Committee appointed to scrutinise the draft Bill delivers its report (Thursday 11 February, 9.30am). We await the results of its deliberations with anticipation.  It has received over 1,500 pages of written evidence as well as oral evidence from nearly 60 witnesses, no mean achievement in the abbreviated timetable allowed for its deliberations.

One of the many areas of controversy around the draft Bill is the proposal to extend the Home Secretary's existing power to require communications service providers to retain communications data. The power would go beyond retention into generating and obtaining data. This would include so-called Internet Connection Records (logs of visited websites) but is far broader than that, potentially reaching out into all aspects of our online lives and into the internet of things as it develops. The government suggests that ICRs are no more than the modern equivalent of an itemised phone bill, a comparison which really does not stand up to scrutiny.  

Communications data retention is itself part of a bigger picture regarding law enforcement and the intelligence agencies' acquisition and use of metadata. Metadata does not include the content of our communications, but the distinction seems to matter less and less when so much can be inferred about our lives from the breadcrumb trail that we leave behind us on the internet.

The Intelligence and Security Committee of Parliament reported in March last year that GCHQ found metadata more useful than content:

The Committee also noted that GCHQ obtained most of its communications data as a by product of bulk interception:

As for law enforcement, David Anderson reported in 'A Question of Trust' that "it was clear from my conversations with the most senior officers that law enforcement does want a record to exist of an individual’s interaction with the internet to which it can obtain access."

With all this in mind it will be especially interesting to see what the Joint Committee makes of the powers for acquisition and use of metadata. It is, be warned, a complicated topic even without uncertainties about the dividing line between content and metadata. Metadata could be acquired through different routes under the draft Bill and, depending in part on how it is acquired, could be used by different bodies for different purposes.  

So to whet your appetites, and in the hope that it might come in handy in understanding the debate that is about to take place, here is a one page (inevitably oversimplified, I am afraid) visualisation of how metadata fits in to the draft Bill. 

The warrants illustrated are all bulk warrants. While metadata can be acquired under targeted and themetic warrants, to include them would have rendered an already overcrowded graphic impossibly complex. Similarly warrants for Bulk Personal Datasets are not shown. Nor is the residual national security notice under clause 188.  

And if you want to know more about Related Communications Data, take a look at paragraphs 115 onwards in my evidence to the Joint Committee (PDF).