The Government's powers make orders relating to information about communications have now moved from the Regulation of Investigatory Powers Act 2000 to the Investigatory Powers Act 2016. The associated Code of Practice provides useful information on the process for issuing three types of notice in particular: Communications Data Requests, Technical Capabilities Orders and Data Retention Notices.
[UPDATE: I've added links to the draft Codes of Practice that authorities are proposing to use when preparing each of the orders]
The Government has today published its draft Investigatory Powers Bill. There are 299 pages in the legislation alone, so for now I've been looking at the parts most likely to affect Janet and its customers. So far I’ve looked at a bit less than half of the Bill: further implications, if any, will be the subject of future posts.
[Corrected 28/11: "relevant internet data" is limited to that "generated or processed" (not merely "held") by the telecommunications operator]
Earlier this week Parliament passed the Data Retention and Investigatory Powers Act 2014 (DRIP), in response to the European Court of Justice's April 2014 declaration of the invalidity of the 2006 European Data Retention Directive on which the UK data retention law depended.
The amount of information stored in encrypted form is steadily increasing, supported by recommendations from the Information Commissioner and others. When deciding to adopt encryption, it’s worth planning for what might happen if the police or other authorities need to access it in the course of their duties.
If you look up "interception" in most dictionaries you’ll find that it happens before an action has completed: in sport a pass can no longer be “intercepted” once it reaches a teammate. In a legal dictionary, however, that turns out not to be true. According to section 2(2) of the Regulation of Investigatory Powers Act 2000 (RIPA) interception can take place at any time when a message is "in transmission", which is explained by section 2(7):
The Home Office has published a draft Statutory Instrument that will add a new section 1A to the Regulation of Investigatory Powers Act 2000 to establish monetary penalties for "unintentional interception" without lawful authority. This follows a brief consultation last autumn.
The Regulation of Investigatory Powers (Monetary Penalties and Consents for Interceptions) Regulations 2011 are now in force. These make two changes to the Regulation of Investigatory Powers Act 2000:
The EU has finally adopted a new Directive on attacks against information systems, first proposed in 2010. The Directive will require Member States, within two years, to ensure they meet its requirements on
