As promised, here is my submission to the Joint Parliamentary Committee considering the UK government’s Draft Communications Bill:
1. The UK government’s Draft Communications bill is based on two flawed premises. The first is that communications information can be separated from content. That is manifestly not true when dealing with Web sites, since the address is almost invariably descriptive, and provides a great deal of information (and that’s assuming that the UK government will not require individual Web page addresses to be stored, which would give even more details.)
2. For example, suppose somebody visited several sites about mental health problems: the mere fact of visiting them would of course give rise to the suspicion that he or she was experiencing some problems in this area. Now imagine that person had a role in government, or some role that required them to make life-or-death decisions: clearly, the fact that they had visited mental health sites could place their careers in jeopardy.
3. The other assumption is even more seriously erroneous: that a series of distributed databases holding local stores of information about individuals is far less problematic than a centralised system. The reason for this is that computing has moved on to such an extent that it is now relatively easy to carry out searches across huge numbers of databases; this means that there is no practical difference between the two.
4. It is these cross-database searches that are the real problem with the proposed surveillance scheme – the “filters” as they are called in the Bill. Computing power is so great now that it is relatively easy to carry out complex cross-database searches that link together apparently disparate information: call it the Googlisation of surveillance. Just as we can find links between areas that might seem quite unrelated, thanks to the power of Google’s databases, so all kinds of connections will be found through the use of filters. In particular, it will be possible to map out practically any aspect of anyone’s life by framing the right filters. Far from offering a very limited view of what people are doing online, the proposed databases will effectively know everything about everyone.
5. This brings me to perhaps the most problematic issue for the current proposals. In her introduction, the Home Secretary writes: “Communications technologies and services are changing fast. More communications are taking place on the internet using a wider range of services. As criminals make increasing use of internet based communications, we need to ensure that the police and intelligence agencies continue to have the tools they need to do the job we ask of them: investigating crime and terrorism, protecting the vulnerable and bringing criminals to justice.” The basic premise is that the current proposals are simply bringing police and intelligence powers “up to date”. This is not the case.
6. Instead, the ability to carry out cross-database searches using filters represents a massive and unprecedented extension of powers. It will allow the most intimate corners of people’s lives to be interrogated by piecing together tiny scraps of apparently trivial information to form a complete portrait of their daily lives. Once local databases are in place, and can be searched in a unified way, it is inevitable that levels of information will be obtained far beyond the very simple options available today.
7. That is clearly problematic for a democratic society. It potentially gives governments unprecedented information – and hence control – about every citizen at all times, and in near real time. But there are other dangers.
8. As we know from the recent News International scandals, whenever confidential information is available, even to a limited range of vetted personnel, there will always be corruption that allows unauthorised access to that information. Even assuming the databases could be made secure – and in fact that’s not possible, as any security expert will tell you – the weakest link remains the human one. Even when people are not corrupt, they may be open to blackmail or threats. Creating these databases inevitably means that the information they hold will leak out and be abused. The only way to prevent this is not to create the databases in the first place.
9. The case for this huge and unprecedented extension of surveillance to levels way beyond what is available even to oppressive regimes around the world has not been made. Instead, there is a vague, hand-waving argument that it is a simply upgrade of current powers for modern times. As I’ve noted above, this is simply not true. The onus, therefore, must be on the police and security services to come up with truly compelling reasons for this unprecedented surveillance of a nation’s most intimate details – mere convenience is not good enough.
10. It is worth bearing in mind that determined criminals and terrorists will in any case be able to circumvent the proposals, using strong local encryption and non-Internet based communications. So the only people adversely affected by the proposals are law-abiding citizens. Why, then, bring in an extremely costly system (cost overruns are inevitable, as history shows) that will add major new vulnerabilities to the UK’s computing infrastructure, for what seems very little benefit? Until that is fully answered, there should be no question about bringing in the proposed system.