News of the legal dispute between Apple and the FBI has made headlines across the world. The dispute stems from the FBI’s investigation of the 2015 mass shooting in San Bernardino, California. As part of its investigation, the FBI obtained an iPhone used by one of the deceased shooters, Syed Farook. The data on the iPhone is encrypted and the FBI wants Apple to create new software that would cripple core security features of the iPhone.
Apple has refused, challenging a court order obtained by the US government. Apple’s refusal has engendered a heated public debate in the US about the balance between security in the technology products and services we increasingly rely upon, and government authority to undermine that security. The case has divided White House officials, catalysed a congressional hearing and inspired national polling on this issue.
Meanwhile in the UK, the government has unveiled an investigatory powers bill, nicknamed the snooper’s charter, to enshrine these very powers, with fewer safeguards, into primary legislation. Privacy International, with Human Rights Watch, submitted a friend-of-the-court brief in the Apple case to highlight its international implications. But even as the British media and public follow developments in the Apple case, they seem to overlook its relevance to the investigatory powers bill.
This can in part be explained by differences in British and American attitudes to surveillance. Edward Snowden’s revelations regarding the surveillance activities of the US government sparked outrage among Americans, but failed to make a similar impact in the UK. In a YouGov poll commissioned by Amnesty International last year about attitudes to surveillance across 13 countries, Americans felt most strongly that the government should leave citizens alone. David Davis MP said: “Because for the past 200 years we haven’t had a Stasi or a Gestapo, we [the British] are intellectually lazy about it.”
Should the British bill pass in its current form, the UK government will have the power to force Apple and other technology companies to undermine the security of their products and services. The bill permits the agencies to hack – the government calls this “equipment interference” – to obtain “communications” or “any other information”, including through surveillance techniques, such as remotely “monitoring, observing or listening to a person’s communications or other activities”.
The bill authorises agencies to compel “telecommunications providers” to assist them in effecting a hacking warrant, unless “not reasonably practicable”. Apple has pointed out that the term “telecommunications provider” is so broadly defined as to expand the government’s “reach beyond UK borders to … any service provider with a connection to UK customers”. Apple and other technology companies have spoken against many provisions of the investigatory powers bill. In particular, they have noted that the bill “seems to threaten to extend responsibility for hacking from government to the private sector” and rejected “any proposals that would require companies to deliberately weaken the security of their products”.
The investigatory powers bill authorises the UK government to issue “national security notices” and “technical capability notices”, both of which could compel telecommunications providers to assist the agencies in vague and sweeping terms, including by hacking.
The UK government’s exercise of these powers will not be subject to a meaningful judicial authorisation process. While the government must seek a warrant to hack, it is not required to seek any form of judicial approval to compel assistance from technology companies. Anyway, the judicial authorisation process for the underlying hacking warrant is inadequate. The investigatory powers bill provides that the home secretary issues such warrants, subject to approval by a judicial commissioner. Judicial commissioners – a new position created by the investigatory powers bill – are appointed by the prime minister and sit for three-year terms, raising questions about their independence.
Finally, the UK government’s exercise of powers to compel technology companies to hack their own products or services will be wielded in secret, protected from public scrutiny. The investigatory powers bill contains strict non-disclosure provisions, gagging telecommunications providers from revealing information about any hacking warrants or notices.
Sir David Omand, former director of GCHQ, has described the bill as “the gold standard” that other European countries would aspire to emulate. Should the bill pass, the UK will become the first liberal democratic state to place the powers to hack and to compel technology companies to hack on a statutory footing. It will also, as David Anderson QC, the independent reviewer of terrorism legislation, has noted, make the UK the only state in the Five Eyes alliance (which includes the US, Canada, Australia and New Zealand) that does not vest the power to approve surveillance activities in the judiciary.
The legal dispute between Apple and the FBI is not just a news story in the US. The issues of security and surveillance are relevant and pressing in the UK. The investigatory powers bill is proceeding quickly through parliament, with a second reading scheduled for Tuesday. The public must seize this opportunity to question the powers the UK government seeks.
