How the Investigatory Powers Act Impacts Citizen Privacy

In 2016, the United Kingdom passed the Investigatory Powers Act or IP Act, into law. This act empowered the government and related agencies to access and collect citizen data, without consent. Critics immediately slammed the new law. The media dubbed it the “Snoopers’ Charter.” Meanwhile, Edward Snowden described the act as “the most extreme surveillance in the history of western democracy.” In addition to having verbal protesters, legal challenges have also arisen against the act. In the four years since it was signed into law, the IP Act has also evolved. So, what does the bill allow, and how does it impact citizen privacy? More importantly, how do citizens protect themselves?

A History of the Investigatory Powers Act

The Data Retention and Investigatory Powers Act

In 2014, the government of the United Kingdom enacted the Data Retention and Investigatory Powers Act, or DRIPA. This act allowed government and and security agencies to collect online user data with little restriction. According to the government, the purpose of the new law was to combat “serious crimes.” However, advocacy groups took DRIPA to court where it was deemed illegal in 2016. Unfortunately, by the time it was banned, the Investigatory Powers Act already replaced DRIPA. The court’s decision held no impact over the new act.

The Investigatory Powers Act

The Investigatory Powers Act allegedly came into law to strengthen oversight protocols to data access. However, civil rights activists ultimately decried the new act as even more invasive. The new act implemented three major laws:

• Telecom companies (internet service providers and phone companies) were required to store user data for up to one year. Data included browser history, app information, messages, and location services. However, the act only required telecoms to store domain name information, rather than page specific data.
• State agencies could lawfully hack citizen devices. The Investigatory Powers Act allowed for bulk data collection and citizen surveillance, and the use of communication interference equipment.
• The IP Act gave the government the power to order device manufacturers to build encryption back doors into their technology.

The advocacy group Liberty launched another legal challenge against the Investigatory Powers Act in 2017.

The Data Retention and Acquisition Regulations 2018

As a result of the legal challenges against the IP Act, the UK high court ruled it as a violation of European Union laws. In 2018, the Data Retention and Acquisition Regulations 2018 amended the Investigatory Powers Act. These amendments still stand today and include provisions such as:

• Government agencies can only access communications data if it relates to serious crime, defined as an offense that could result in a prison sentence of 12 months or more.
• Authorities must consult an independent Investigatory Powers Commissioner before requesting data.

Despite the increased restrictions imposed by the new regulations, some parties still have concerns about the act. Although agencies must seek approval before requesting data, this provision also has a loophole. The loophole allows an agency to grant internal, rapid approval for the period of three days. After the three days, they will be subject to review. However, critics argue that a review after data is accessed is too late. In addition, many people argue that the “serious crime” threshold should be increased to crimes punishable by three or more years in prison.

Who Does the Snoopers’ Charter Affect?

In general, the Investigatory Powers Act enables agencies to collect data from all United Kingdom citizens. However, many groups fear the act can impact certain groups more than others. Those groups include:

• Journalists: Journalists require free, open access to the web to accurately investigate their articles. If they fear governmental data collection, they may hesitate to access necessary resources for fair, balanced reporting.
• Medical and Legal Professionals: Medical and legal professionals have the obligation to keep client data confidential. How does that data remain safe from a government who can collect it at will? Many civil rights advocates have brought up exactly this question. Allegedly, the IP Act exempts collection of this data. However, it doesn’t explain how their internet traffic will be distinguished.
• Associates of Criminals: The United Kingdom government justifies using the IP Act by claiming that it helps prevent serious crimes. However, surveillance agencies may also justify monitoring non-criminals. This is simply because of a previous association with someone who committed a crime.

What are the Main Implications for Your Privacy?

If you live outside of the United Kingdom, the Investigatory Powers Act doesn’t affect you. Yet. However, other world governments may still introduce strict surveillance legislation, and justify it with the example of the UK. China already has.

For those who do live in or frequently visit the UK, there are a few major implications to be aware of. They include:

• Less Privacy: As can be expected, the Investigatory Powers Act reduces overall citizen privacy in the UK. Police, transportation, and justice agencies are just a few of the groups able to request citizen data. A total of 48 agencies have this power. The IP Act severely impacts the confidentiality of your private information.
• Poor Device Security: Through the Investigatory Powers Act, the UK government has the right to demand all domestic manufacturers to create encryption back doors into their technology. In essence, this allows them to access your data at will, while leaving you open to hacks. After all, if your government can access a technological back door, why can’t a hacker? This provision in the act risks reducing overall device security in the future. As for devices manufactured outside of the UK that do not comply with the back door requirement, they have the potential to be made illegal.
• You Control Your Privacy: Before the Investigatory Powers Act came into play, users expected the technology they used to protect their privacy. Now that tech companies are subject to the laws of the IP Act, however, you must rely only on yourself to maintain your privacy.

How Do I Protect My Privacy?

Thanks to the IP Act, privacy is now in your hands. There are a few ways to protect it from government surveillance.

• Use a VPN: A virtual private network, like HotBot VPN, routes all yopu internet activity through a private secure tunnel. This prevents your internet service provider from seeing any of your data and subsequently handing it over to the government. Choose a VPN service that offers a no-logs policy. That means they don’t collect your data either and can’t be compelled to give it to a governing body.
• Support Digital Advocacy Groups: When the digital advocacy group, Liberty, challenged the Investigatory Powers Act, they did so by crowdraising funds for their legal fees. Supporting this group and similar ones can help keep up the fight against unlawful surveillance.
• Reduce What You Share Digitally: Protect your privacy further by reducing the amount of information that can be collected about you. You can reduce your digital footprint with these tips.

Just because the Investigatory Powers Act wants your data doesn’t mean you have to give it. By being aware of and proactive towards the risks, you can keep your privacy strong.