Investigatory Powers (Amendment) Bill set to become law following Royal Assent

Update to the ‘Snooper’s Charter’ will expand the digital surveillance powers of the UK’s police, government and intelligence services

The Investigatory Powers (Amendment) Bill 2024 is set to become law after receiving Royal Assent. It will expand the extensive surveillance powers already granted to police, government and intelligence services in the UK under the Investigatory Powers Act 2016, and potentially empower the government to block the implementation of new security technologies.

The original IPA 2016 caused a furore among privacy campaigners when first proposed. It formally empowered state agencies to gather a wide range of information, particularly bulk data such as metadata related to phone calls and text messages, from telecoms operators. The Act also formally enshrined the power of the security services to hack selected targets.

The Bill follows on from an obligatory review of the IPA, carried out by the Home Office in 2022. This review concluded that the Act had "largely achieved its aims", but argued that reform was needed to address rising criminal, terrorist and global security threats, and noted that the technology landscape had changed significantly since 2016.

The Amendment Bill will therefore extend the information gathering powers of the IPA by enabling the collection and processing of internet connection records, which record the websites people have visited and the apps they have been using, for generalised, mass surveillance.

It will also enable bulk datasets of personal information to be collected, potentially including CCTV, facial images and social media data.

But perhaps most bizarre of all is the measure to force technology companies, including ones based overseas, to notify the UK government of plans to change security or privacy measures on their platforms, with government reserving the right to block such measures.

Technology companies have warned that this may force them to abandon the UK as a result. Apple, for example, branded the proposal "an unprecedented overreach by the government", and warned that it could be used to "secretly veto new user protections".

Even if they don't, it may entail delays in rolling out important security updates to software and online services. Either way, the measure risks eroding internet security for UK businesses and consumers.

Indeed, the Online Safety Act 2023 includes provisions empowering the government, via Ofcom, to break any software or service's end-to-end encryption. While the government claims that these measures will not be used, Ofcom can nevertheless issue notices requiring the breaking of end-to-end encryption at any time.

However, the Investigatory Powers (Amendment) Bill did not overlook privacy completely, with additional safeguards added regarding surveillance that may affect Members of Parliament.