Internet providers tracking sites we visit in secretive trial
Campaigners complain of ‘staggering lack of transparency’ in Home Office mass data collection experiment
Two internet providers are tracking and collecting the websites visited by their customers as part of a secretive Home Office trial, designed to work out if a national bulk surveillance system would be useful for national security and law enforcement.
Details about the data collection experiment are limited, emerging via an obscure regulatory disclosure and a report in Wired, prompting campaigners to warn of a lack of transparency over data being “hoovered up into a surveillance net”.
Under the two trials, the Home Office is working with the National Crime Agency to harvest “internet connection records (ICRs)” – information about which websites a customer visited, when they did so and how much data they downloaded.
The metadata, as it is known, does not detail the specific pages visited on a given website, such as theguardian.com. But it can nevertheless point to a lot of personal information about an individual. That could include health or financial information, revealed because a browser visits a certain site or category of site frequently.
The Open Rights Group, a digital campaign group, complained that details about the Home Office trial were insufficient.
“This is a fairly staggering lack of transparency around mass data collection and retention,” said policy manager Heather Burns.
“We should have the right to not have every single click of what we do online hoovered up into a surveillance net on the assumption that there might be criminal activity taking place,” she added.
Home Office sources indicated that it was taking advantage of abilities in the Investigatory Powers Act 2016, to test what data can be acquired, how useful it is in practice, and how it might be used in investigations.
The act was described as giving the UK government “the most extreme surveillance in the history of western democracy” by whistleblower Edward Snowden when it passed into law nearly five years ago.
It aimed to legalise a range of tools for snooping and hacking by the security services unmatched at the time by any other country in western Europe or even the US, following Snowden’s revelations which showed the amount of mass surveillance that UK and US intelligence agencies already undertook.
The first trial began in July 2019 after the Home Office “retention notice” request was approved by the Investigatory Powers Commissioner’s Office (Ipco) and related to an unnamed internet provider. A second trial relating to another phone company began in October of the same year, according to the regulator’s annual report.
A spokeswoman for Ipco said the trial was continuing, and part of its purpose was to ensure that the collection of metadata was “necessary and proportionate”.
She added: “Once a full assessment of the trial has been carried out, a decision will be made on whether there is a case for national rollout.”
The National Crime Agency confirmed it was working with the government on the trial.
“We are supporting the Home Office-sponsored trial of internet connection record capability to determine the technical, operational, legal and policy considerations associated with delivery of this capability,” the police agency said.
Details about the data collection experiment are limited, emerging via an obscure regulatory disclosure and a report in Wired, prompting campaigners to warn of a lack of transparency over data being “hoovered up into a surveillance net”.
Under the two trials, the Home Office is working with the National Crime Agency to harvest “internet connection records (ICRs)” – information about which websites a customer visited, when they did so and how much data they downloaded.
The metadata, as it is known, does not detail the specific pages visited on a given website, such as theguardian.com. But it can nevertheless point to a lot of personal information about an individual. That could include health or financial information, revealed because a browser visits a certain site or category of site frequently.
The Open Rights Group, a digital campaign group, complained that details about the Home Office trial were insufficient.
“This is a fairly staggering lack of transparency around mass data collection and retention,” said policy manager Heather Burns.
“We should have the right to not have every single click of what we do online hoovered up into a surveillance net on the assumption that there might be criminal activity taking place,” she added.
Home Office sources indicated that it was taking advantage of abilities in the Investigatory Powers Act 2016, to test what data can be acquired, how useful it is in practice, and how it might be used in investigations.
The act was described as giving the UK government “the most extreme surveillance in the history of western democracy” by whistleblower Edward Snowden when it passed into law nearly five years ago.
It aimed to legalise a range of tools for snooping and hacking by the security services unmatched at the time by any other country in western Europe or even the US, following Snowden’s revelations which showed the amount of mass surveillance that UK and US intelligence agencies already undertook.
The first trial began in July 2019 after the Home Office “retention notice” request was approved by the Investigatory Powers Commissioner’s Office (Ipco) and related to an unnamed internet provider. A second trial relating to another phone company began in October of the same year, according to the regulator’s annual report.
A spokeswoman for Ipco said the trial was continuing, and part of its purpose was to ensure that the collection of metadata was “necessary and proportionate”.
She added: “Once a full assessment of the trial has been carried out, a decision will be made on whether there is a case for national rollout.”
The National Crime Agency confirmed it was working with the government on the trial.
“We are supporting the Home Office-sponsored trial of internet connection record capability to determine the technical, operational, legal and policy considerations associated with delivery of this capability,” the police agency said.
