Regulation of Investigatory Powers: Codes of Practice

The draft Regulation of Investigatory Powers (Interception of Communications: Code of Practice) Order 2015 and explanatory memorandum, and the draft Equipment Interference (Code of Practice) Order 2015 and explanatory memorandum, were laid before Parliament on 4 November 2015. The codes of practice to which they relate were published on the same day, following a public consultation on earlier drafts. This coincided with the publication of the Draft Investigatory Powers Bill, which would govern the use and oversight of investigatory powers by law enforcement and the security services and intelligence agencies, replacing existing legislation in this area.

The draft Interception of Communications Code of Practice is a revised code of practice made under section 71 of the Regulation of Investigatory Powers Act 2000 (RIPA), the purpose of which is to provide guidance on the interception of communications under Part 1 of that Act.

The orders were considered in Grand Committee in the House of Lords on 7 December 2015. Home Office Minister Lord Bates stated that the Interception of Communications Code of Practice first came into force in 2002 and is in need of updating to provide further detail of the safeguards that apply to the security and law enforcement agencies' use of interception powers:

First, it provides additional information on the safeguards that exist for the interception and handling of external communications under Section 8(4) of RIPA—that is, the ability to undertake bulk interception. Secondly, it sets out further information on the protections afforded to legally privileged material and other confidential material. To give an example, the code requires the Secretary of State personally to consider the likelihood that privileged material will be intercepted when determining whether it is necessary and proportionate to grant a warrant. It also requires additional internal safeguards to be applied in cases where legally privileged material is intercepted, including that where such material is retained it must be reported to the independent Interception of Communications Commissioner. Thirdly, it includes minor changes to reflect developments in law and practice since the code first came into force in 2002. For example, it reflects regulations introduced in 2011 which amended RIPA to create the power for the interception commissioner to impose a fine for certain kinds of unlawful interception. Much of the new material on the safeguards that apply to the exercise of interception powers reflects information disclosed during legal proceedings in the Investigatory Powers Tribunal, and it is right that this information is included in codes of practice so that it easy for members of the public to access it.

The Equipment Interference Code of Practice is new. Its purpose is to set out guidance relating to property interference carried out under sections 5 and 7 of the Intelligence Services Act 1994. Lord Bates explained that although the published code is new, it reflects existing practice:

The code does not confer new powers, but simply makes public the robust internal safeguards that the intelligence agencies already apply. It brings greater transparency to the robust processes that the agencies adhere to when interfering with computer equipment to prevent terrorism, disrupt serious crime and identify and stop others who seek to harm us and our country. For the first time, this code of practice publicly sets out the stringent safeguards that the intelligence agencies apply to their use of equipment interference. This includes strict rules on how data acquired through equipment interference must be handled, how they must be securely and safely stored, and how they must be destroyed when it is no longer necessary or proportionate to hold them. The code also explains the consideration of necessity and proportionality that the Secretary of State must take before authorising any use of equipment interference. That ensures that this vital capability may be used only when the scope of the interference has been carefully considered and compared to the potential benefits of the operation. Furthermore, the code explains that equipment interference should not be considered a proportionate power if other less intrusive methods of acquiring the same data are possible.

Both codes provide for additional safeguards in relation to the acquisition of legally privileged and confidential information.

The Opposition supported the orders, and they were thus approved. However, Lord Kennedy asked for further reassurance that there would be sufficient safeguards against interference with privileged communications.

Responding for the Liberal Democrats, Lord Paddick raised concerns that there had been very little debate on the use of equipment interference powers because there was no explicit discussion of the issue when the relevant legislation was before Parliament.

The new Codes of Practice followed a public consultation between February and March 2015.

135 responses were received to the consultation, including from Liberty, the Law Society, Open Rights and Privacy International, the Bar Council, and Tech UK.

The Government published its response to the consultation in November 2015, summarising the main responses and comments that informed revisions to the codes. Modifications were made to reflect certain concerns about intelligence sharing; security of computer networks and devices; safeguards for keeping records and the handling of information; and access to confidential and legally privileged information. The Government suggested that the Draft Investigatory Powers Bill would be the most appropriate place to address concerns raised about the operation of RIPA; the extra-territorial application of the Data Retention and Investigatory Powers Act 2014; the use of equipment interference powers; and the regime for oversight of warrants.

​​​​​