Even the Food Standards Agency Could Access UK Surveillance Data Under New Bill
All kinds of government agencies beyond law enforcement could request data under the draft Investigatory Powers Bill.
The UK's proposed mass surveillance powers, if made law, will force internet service providers to store every citizen's web browsing history for up to a year. From there, police forces and security agencies will be able apply for a warrant to access the data.
But there are plenty of other agencies that could also request access.
On page 210 of the draft Investigatory Powers Bill, a planned piece of UK surveillance legislation that was announced earlier this month, is a table of "relevant public authorities." These authorities would "have the power to obtain communications data," according to a briefing paper on the Bill.
As you might expect, the list includes various police forces, the Secret Intelligence Service (MI6), the UK's signals intelligence agency GCHQ, and the Ministry of Defence. However, it also includes agencies such as the Department of Health, the Department for Work and Pensions, and the Department for Transport, whose need for such surveillance data is less obviously clear.
"We don't comment on specific organisations or departments that have been granted access to Comms Data," Home Office spokesperson George Kotschy told Motherboard in an email. Instead, Kotschy pointed to a section of the draft Bill that reads, "The Government keeps the number of public bodies which can acquire communications data under constant review; only organisations which can demonstrate a compelling need are provided with the power."
One department listed in the draft Bill is the Food Standards Agency, an independent watchdog that aims to protect the public's health in relation to food. Under a column titled the "Type of communications data that my be obtained" by the FSA, the table reads "All."
"In some targeted investigations it will be necessary for [the FSA] to have access to communications data to identify offenders and their criminal activity."
"Under the draft Investigatory Powers Bill—as is the case now—the Food Standards Agency (FSA) could only make requests for communications data for the prevention and detection of crime," a Food Standards Agency spokesperson told Motherboard in an emailed statement.
"These powers were requested following the establishment of the National Food Crime Unit (NFCU) in response to the horsemeat incident in 2013." This refers to a recent case where organised criminals snuck horse meat into products sold in the UK.
The spokesperson wrote that, "In some targeted investigations it will be necessary for the NFCU to have access to communications data to identify offenders and their criminal activity."
The table details the minimum rank of officers who can request communications data, some of which offer clues on why the agencies might want access. For example, within the entry for the Department of Transport, a "Principal Inspector" for marine, air and rail accident investigations can obtain data. For the Department of Work and Pensions, a "Senior Executive Officer in Fraud and Error Services," can apply.
"The public should be greatly concerned that so many organisations ... can access our personal communications data."
Jim Killock, executive director of the Open Rights Group, warned of potential overreach.
"The public should be greatly concerned that so many organisations that have nothing to do with law enforcement can access our personal communications data," he told Motherboard in an email.
"This is already happening under RIPA—there were around half a million data requests made last year. Many of these were by the police but also by organisations such as Royal Mail, the Department of Work and Pensions, and local authorities." RIPA, or the Regulation of Investigatory Powers Act 2000, is another controversial piece of UK surveillance legislation.
"If our communications data is accessed, it should [be] by law enforcement agencies who have a court warrant," Killock continued.