Reforming Surveillance Policy after Snowden The UK Investigatory

Reforming Surveillance Policy after Snowden: The UK Investigatory Powers Act as a Site of Struggle over Data Power Arne Hintz Data Justice Lab Cardiff University Hintz. A@Cardiff. ac. uk @arne_hz

Surveillance Policy in the UK Jigsaw puzzle of laws • Telecommunications Act (1984); Intelligence Services Act (1994); Data Protection Act (1998); Regulation of Investigatory Powers Act (2000); etc. Effects of Snowden revelations • Institutional reviews: Anderson Report, ISC, RUSI • Judicial challenges • Civil society and industry pressure Response • Investigatory Powers Bill (2015/16) • adopted November 2016

Conditions for Policy Change Policy window (Kingdon 1984) Change in policy monopolies (Meyer 2005) Shift in ideas and ideologies (Freedman 2008) Policy as “a complex ecology of interdependent structures” with “a vast array of formal and informal mechanisms working across a multiplicity of sites” (Raboy 2002) • Multi-stakeholder processes (Hemmati 2002) • Interventions by social movements (Keck/Sikkink 1998, Tilly/Tarrow 2006) • •

Digital Citizenship and Surveillance Society: UK State. Media-Citizen Relations after the Snowden Leaks • Collaborative research project (2014 -16) • Impact of Snowden leaks on: news media, public knowledge & activism, law/regulation, technological infrastructure • Investigators: Arne Hintz, Karin Wahl-Jorgensen, Lina Dencik (Cardiff Uni), Ian Brown (Oxford Uni), Michael Rogers (Briar) • DCSSproject. net

What we did Review of policy documents, statements, decisions • database of institutions, decisions, powers • www. dcssproject. net/policy Interviews: • Lawmakers / parliamentarians: House of Commons, House of Lords • Security / law enforcement officers: Military, GCHQ, NCA • Industry representatives: Tech. UK, Google, Sophos • Civil society representatives: Don’t Spry On Us, Liberty, Big Brother Watch • Officer from oversight body: Interception of Communications Commissioner

Controversies over Policy Reform Definition of surveillance • Civil society, industry: “refers to people being watched, monitored, data collected in almost any sense”, “begins at the point of collection” • Security agencies / law enforcement: data collection “becomes surveillance when it is actually looked at or analysed” by a human • Little reference to automated / algorithmic profiling Bulk collection • Law enforcement: necessary • Civil society / industry: “absolutely opposed to any bulk powers” and “any pre-emptive collection and retention just in case someone commits a crime” • Targeted collection less intrusive?

Controversies II Encryption • All: Strong encryption necessary and inevitable • Law enforcement / agencies don’t want public debate Computer network exploitation / ‘hacking’ • • “the future” But serious consequences in context of “Internet of Things” Civil society: Bulk hacking “absurd and dangerous” Security agencies: “We’re getting quite excited about the Internet of Things”

Roles and Powers in Policy Reform Snowden • • • Policy reform “would not have happened without Snowden” “We have the Snowden documents as a compass” Content of leaks “made industry furious”, “try and regain customer trust” Parliamentarians / ‘law-makers’ • • Little understanding, different priorities, security discourse No opposition Civil society • “Previously NGOs would have fought just to kill a new law and probably been unsuccessful in doing so; now they can say: here’s how we can genuinely improve it and have a proper conversation with the Home Office” Industry • • Criticism of surveillance Interventions: statements, responses to reviews, reaction to drafts Security / intelligence agencies, law enforcement • • Involved in policy development, shaped legislation Institutional set-up: Home Office responsible for IP Bill -> access

A Democratic License? Public debate • Most interviewees: Not yet taken place • Security agencies: Public should trust us • Dominant security discourse Democratic license • Law “legitimises existing behaviour rather than to enter into a debate about what should be done” • “This bill is covering their backs. It’s saying that all these things they’ve been doing for years will now be legal. It’s a bit like pulling a skirt down after you’ve exposed your ankles. ” Alternative approach? • “flip the switch from state- to citizen-centric thinking” • “if this passes, Britain will be a global leader in surveillance. (…) Is this something that we want to export? Is this the kind of standard setting that we want to be making for the world? ”

Struggle over Data Governance • Opposing views on surveillance policy • Policy window but no wider public debate • Institutional framework, access to decision-makers and security discourse favoured security agencies • … who won the struggle despite strong opposition by tech experts, industry, and civil society

Reforming Surveillance Policy after Snowden: The UK Investigatory Powers Act as a Site of Struggle over Data Power Arne Hintz Data Justice Lab Cardiff University Hintz. A@Cardiff. ac. uk @arne_hz