Local Authorities

Guardian article

The Guardian‘s Comment is Free site published a short version of my critiques of RIPA today… you can read it here.

Or the full version prior to editing is here:

A little-known tribunal is meeting this week to consider a case a case of wrongful surveillance. The case brought by Jenny Paton and Tim Joyce against Poole District Council in the Regulation of Investigatory Powers Tribunal concerns the local authority’s targeted surveillance measures against the couple and their children in an investigation of their application for school places. Among other activities, council employees trailed the family and interrogated neighbours.

The case comes in the same week that the government issued its response to a consultation process on the reform of the law which the tribunal oversees: the Regulation of Investigatory Powers Act (RIPA) (2000). RIPA has proved controversial as it seems to give many different public bodies new powers of surveillance, but that isn’t entirely true: as many local council officials admit, much of this was going on before 2000, but RIPA regulates and restricts it – in fact, it restricts it too much to some of the published responses to the consultation process. It is, however, almost impossible to determine whether RIPA has increased or decreased surveillance of this kind as no consistent records were kept prior to RIPA’s introduction. What is certainly the case is that the public is now more aware of the use of surveillance powers by agencies they had never realized were allowed to do such things.

Surveys have found that only 9% of RIPA authorizations resulted in either prosecution of enforcement action. In Australia, earlier this year, when only 28% of the use of targeted surveillance (in that case by police) resulted in prosecutions, their law was denounced as an excuse for ‘fishing expeditions.’ So what does a 9% rate indicate for Britain? Desperation perhaps? Or at least that RIPA was being massively overused for trivial issues. The House of Lords Constitution Committee report, Surveillance: Citizens and the State, certainly thought so, arguing not only that the inadequate administrative procedures should be reviewed but also that the government should think again about the whole business of allowing Local Authorities police powers, and that in any case, these powers “should only be available for the investigation of serious criminal offences which would attract a custodial sentence of at least two years.”

The government has failed to take heed of these recommendations. Ok, so they have agreed to restrict the authorization of covert surveillance under RIPA to ‘Director, Head of Service, Service Manager or equivalent’, and that Local Authorities should designate compliance officers so there will be no more junior officers deciding to play James Bond, as in the Poole case. However, by going to a ‘consultation’ whose respondents were dominated by Local Authorities and other RIPA-enabled agencies, they have managed to avoid doing anything particularly radical. This started from limiting the scope of the review through the questions they asked in the consultation.

For example, by asking which covert investigatory techniques specifically should be removed (and discounting any views that said ‘all of them’) they managed to get a mixed set of answers that failed to produced a clear vote against any one technique. Result: no techniques get removed and in fact some of the existing allowed techniques get extended to yet more agencies, for example the new Child Maintenance and Enforcement Commission (the replacement for the Child Support Agency). In particular, this extension of powers covers telecommunications data, whose keeping by the state has of course increased since RIPA was proposed. Now RIPA will be used to allow new bodies access to this data.

A curious note throughout the response by the government is the insistence on using an idea of non-interference with law-enforcement as a reason for not allowing elected officials any more than strategic scrutiny over the actions their own officials take under RIPA. This matters because RIPA is just one of many ways in which law-enforcement is not spreading as a function to increasing numbers of agencies beyond the police and judiciary. This seems to be general position that New Labour has taken – although it hasn’t always got its way – does anyone remember the dropped proposals to allow any ‘responsible people’ to levy on the spot fines?

And the government response seems to take a bullish delight in attacking those who have criticized the surveillance society. They insist, for example – and despite all the evidence to suggest that such interventions have limited effectiveness – that Local Authorities should make more use of overt, mass surveillance, like CCTV, instead of using RIPA. They are creating a binary choice, which seems to say assume that some kind of surveillance should be used: which do you choose, overt or covert? But, of course, that shouldn’t be the choice at all. They are also trying to have their cake and eat it on CCTV: the response to the consultation dismisses those consultees who brought up the subject of CCTV – which is not covered by RIPA – but feel quite able themselves to recommend its extended use in their own response. This of course also ignores the perfectly legitimate feeling amongst many that it is about CCTV was brought under proper control and a reformed RIPA might well be the place to do it.

Then there are things missing: notably, the concentration on Local Authorities, which for the most part has completely obscured the use of covert surveillance by central government departments and arms-length agencies including the Department for Environment, Food and Rural Affairs (Defra), the NHS and the Environment Agency, all of which have been criticized in the past by the Surveillance Commissioner. Nothing seems to be proposed to increase the visibility of the RIPA Tribunal which is, just for now, in the news. The Lords described it as all but invisible and weak. Nor do the government propose to do anything to strengthen training or the Code of Practice, and in any case, there has been a huge over reliance on such self-regulation for matters which should have more formal control; this is also how CCTV and the security industry is largely – and incredibly ineffectively – regulated in the UK.

Pretty much anyone could have predicted this limp response from the Home Office to some rather serious problems. They don’t read their own research, they don’t do consultation in a meaningful manner, and then, surprise, surprise, they conclude that there really isn’t very much wrong after all. Jenny Paton and Tim Joyce may well disagree, and let us hope that the RIPA Tribunal do too.

RIPA to be limited

The UK Home Office is finally publishing plans to reform the Regulation of Investigatory Powers Act (RIPA) which defined in law the surveillance powers open to hundreds of government bodies. You can see what I have previously said about the consultation here. The consultation on RIPA actually had 7 major questions. The Home Office has now responded to all the opinions offered during the consultation. In more detail, this is what was said:

1. Taking into account the reasons for requiring the use of covert investigatory techniques under RIPA set out for each public authority, should any of them nevertheless be removed from the RIPA framework?

Response: basically, none should be removed. Although the Home Office noted that many respondents had objections, they didn’t feel they added up. Indeed this section also seems to include extensions of the powers (or clarifications that act effectively as extensions) for example the ability of the Child Maintenance and Enforcement Commission (the replacement for the Child Support Agency), to have access to telecommunications data to investigate fathers required to pay child support. These extensions may be warranted or not, but they show the tendency for what Gary Marx long ago called ‘surveillance creep’ to occur – the saving of telecommunications data has increased since RIPA was proposed and now RIPA will be used to allow new agencies access to this data.

They also note that they will not be returning any of these investigatory functions to the police. This is interesting because later they use the reason of non-interference in law-enforcement for denying elected councillors detailed oversight. So this confirms a trend to less and less accountable law enforcement.

2. If any public authorities should be removed from the RIPA framework, what, if any, alternative tools should they be given to enable them to do their jobs?

Response: given the previous response, it is not surprising that no real change is proposed here. The Home Office in fact insists that more emphasis should be placed on overt surveillance by local authorities (like CCTV) in order to reduce the need to resort to RIPA’s covert surveillance!

3. What more should we do to reduce bureaucracy for the police so they can use RIPA more easily to protect the public against criminals?

This wasn’t a question that I ever noticed critics of RIPA asking. Some agencies seem to have objected to the amount of paperwork around RIPA and The Home Office “agrees that it is in no-one’s interests for documentation to be unnecessarily time-consuming” and they, for once, insist on a proper auditable trail that can help protect privacy. They say in any case, applications are already down massively.

There is an interesting note that suggests the increasing use of RIPA for counter-terrorism activities which is left rather open – “the Government is facilitating the work of police collaborative units, such as the regional counter-terrorist units… This means officers seeking to use techniques under RIPA will be able to apply to authorising officers in different forces, where the Chief Officers have made a collaboration agreement that permits this”, in other words that RIPA might be used for massive, blanket undercover surveillance operations. Now that certain wasn’t what the government has recently claimed it was intended for – although of course, as anyone with any kind of memory will recall, it was exactly the justification used for passing it.

4. Should the rank at which local authorities authorise the use of covert investigatory techniques be raised to senior executive?

Response: The media reports thus far have focused on the plan to limit the authorisation of such practices to council chief executives and directors – a recommendation made by the House of Lords Constitution Committee – what the Home Office actually recommends is to restrict the decision to a rather wider set: ‘Director, Head of Service, Service Manager or equivalent’. So, no junior officers any more, which is good, but not necessarily senior managers only. They also recommend having a compliance officer designated, which is good if they genuinely work on active and ethical compliance rather than thinking of excuses in retrospect.

5. Should elected councillors be given a role in overseeing the way local authorities use covert investigatory techniques?

Response: yes they should, but it should be ‘strategic’ and limited to once a year setting of policy and strategy with quarterly oversight meetings. They argue, as I mentioned earlier, that non-interference in law-enforcement is a good reason for keeping elected officials away from the details… Councillors in the UK have been increasingly hamstrung in the way that they can oversee their supposed bureaucracy, even to the point where they have been fined and suspended for criticising their own officers. Some real control would be welcome (after all, that is what the purpose of local democracy should be).

6. Are the Government’s other proposed changes in the Consolidating Orders appropriate?

Response: the Home Office basically rejected all the respondents’ comments on the proposals.

7. Do the revised Codes of Practice provide sufficient clarity on when it is necessary and proportionate to use techniques regulated in RIPA?

Response: the codes of practice will be made clearer. No more guidance will be given. The Guardian says that the proposals will ‘ban’ the use of RIPA for ‘minor matters’ but I can’t really see that they do this, and the points of such codes is usually to avoid recourse to the law by encouraging a voluntary self-regulation; it is how CCTV is largely – and incredibly ineffectively – regulated in the UK too.

RIPA Reform

I’ve been looking over the government’s proposals for consultation on the reform on the Regulation of Investigatory Powers Act 2000 (RIPA), officially published on Friday. There’s actually very little that they suggest, apart from some minor and largely voluntary controls on the use of RIPA for trivial purposes by Local Authorities. The Times rang me up and asked me to knock off 500 words (in about an hour!) for a comment on the proposals… which I did… and here it is, unedited*:

Reforming RIPA

Back in the year 2000, opposition was developing to a new piece of legislation, the Regulation of Investigatory Powers Bill. But the controversy over the Bill which became the Regulation of Investigatory Powers Act 2000 (RIPA) was all about provisions to bring electronic communications (e-mail) under the same regulatory regime as telephone and telex, and to demand encryption keys.

What was relatively uncontroversial then were the provision for the regulation of covert surveillance by Local Authorities. Now, councils are accused of abusing the RIPA for trivial purposes, such as dog fouling or littering, or using oppressive or intrusive methods that are not proportional or appropriate to the alleged offences, such as covert monitoring of children to establish where parents involved in an application for school places lived. And much seems to have been inefficient too: a survey of Britain’s 182 Local Authorities found that they have used RIPA surveillance on over 10,000 occasions, yet only 9% resulted in prosecution or enforcement action. But it is not just local government. The Surveillance Commissioner has criticized national ministries like DEFRA and agencies including Ofcom and the Charities Commission over their misuse of RIPA**.

Officials respond that RIPA merely restricts and records what organisations were already doing. Most of the surveillance, they argue, is of the level of two men in a car watching a known fly-tipping site, and that even this requires onerous form-filling – four pages for each request. And even the statistics mislead, because there simply were no statistics on surveillance by these organisations before RIPA.

If RIPA has enabled us to see both the levels and abuse of surveillance powers, it has done us this favour at least. But the Surveillance Commissioner found generalized lax practice, a lack of proper justifications and proportionality, and little training or accountability: RIPA is being used because the powers exist, not because there is any pressing justification to use surveillance in this manner.

RIPA was always expansionary in that it allowed more than was intended. It was also a rag-bag; even the original e-mail surveillance provisions were cut and pasted from another bill. Like so much of the legislation from this government, it was poorly drafted and justified in parliament at the time by reference to issues (like national security) which little relevance to what most of the Act was about. And its appeals body, the Investigatory Powers Tribunal, is practically invisible, as the House of Lords Constitution Committee report on surveillance argued recently.

The Constitution Committee went a lot further than the government in this consultation document, arguing that surveillance powers should be reserved for the investigation of serious criminal offences and that should judicial oversight for all surveillance carried out by public authorities. Instead here, the government merely suggests moving sign-off powers higher up within the organizations. The Lords also suggested that there should have been proper provision for public accountability and post-legislative scrutiny in RIPA. Instead, this review is taking place due largely to government embarrassment over the constant stream of revelations.

Yet the government seems intent on extending surveillance and other powers still further; there has been a proliferation of databases, agencies, laws, and quasi-police. The new Communications Bill will extend surveillance powers over the Internet still further. The consultation document also reminds us in one section that there is still no meaningful regulation of the now ubiquitous CCTV cameras: they are outside of RIPA and, it seems, out of control. RIPA is merely one aspect of a very British tendency to manage things through surveillance before other means – which is a good working definition of a ‘surveillance society’. This has to be controlled, and in a rather more thoughtful and systematic way than these knee-jerk reviews in response to media concern.

*The edited version has now been published by The Times as ‘A very British tendency…’ They have just trimmed the attempt to broaden the argument at the end!

**This is what you get for writing something very quickly – in the editing, I compressed stuff that had originally said that Ofcom and the Charities Commission were using RIPA and that various organisations had been criticised into one sentence that implied that they were the organisations being criticised. Neither have been so criticised by the Surveillance Commissioner and I apologise to both for suggesting that they were.

Massive British Local Government Spying

Details obtained under the Freedom of Information Act have revealed the extent of the use of the Regulation of Investigatory Powers Act (RIPA) 2000 by Britain’s 182 Local Authorities. The Act has apparently been used to authorise surveillance on over 10,000 occasions for monitoring acts that are mostly trivial. Only 9% of these resulted in any kind of prosecution or enforcement action. This, to me, indicates massive abuse of surveillance by local governments, and they must be controlled. Almost everyone thinks this now, and the government is currently conducting a review of RIPA (due the embarrassment caused by the constant stream of revelations).

This doesn’t go far enough. RIPA is simply bad legislation that was justified in parliament by reference to crime and terrorism. It is poorly overseen and its Tribunal for complaints – yes, there is one, not that anyone knows – is practically invisible. It should be repealed and a more carefully thought out law on the use of surveillance by public bodies with proper provision for judicial oversight, public accountability and post-legislative scrutiny should be introduced.