The UK's contentious surveillance bill has become law

So much for the last-minute petition to repeal it.


The Investigatory Powers Bill, the UK's sweeping new piece of surveillance legislation, becomes an Act of Parliament today after receiving its final stamp of approval from the Queen -- a formality called royal assent. This comes just a few weeks after the House of Lords approved the bill, which consolidates various existing surveillance powers, and introduces several new and controversial ones.

The Home Office is calling it "a landmark Bill which sets out and governs the powers available to the police, security and intelligence agencies to gather and access electronic communications." It will ensure agencies "have the powers they need in a digital age to disrupt terrorist attacks, subject to strict safeguards and world-leading oversight," the Home Office says.

"This Government is clear that, at a time of heightened security threat, it is essential our law enforcement, security and intelligence services have the powers they need to keep people safe," Home Secretary Amber Rudd added. "The Investigatory Powers Act is world-leading legislation that provides unprecedented transparency and substantial privacy protection."

One of the most controversial provisions of the Act allows the government to force communication service providers like ISPs and mobile carriers to store the Internet Connection Records (ICRs) of users for 12 months. ICRs are top-level data about your internet usage -- websites you've accessed, for example, but not the individual pages you visited under that domain (so, just They also cover the metadata of online communications, like who, when and where someone used WhatsApp or another messaging service, but not the content of conversations. Just as important, numerous government departments and agencies will be able to access that data without a warrant.

Several of the more serious powers will require two independent forms of authorisation before they are deemed both necessary and proportionate to an investigation. Indiscriminate, bulk data collection including the content of communications, for instance, and state-sponsored hacking, known as equipment interference.

Not every provision in the bill will come into force immediately, though, the Home Office has said, as they "will require extensive testing and will not be in place for some time." The Home Office is still "developing plans for implementing the provisions in the Bill and will set out the timetable in due course." The systems required for the collection and storage of ICRs, for example, could take years to build, according to communications service providers consulted during the bill's debate stages.

The Investigatory Powers Bill has been debated at length since the first draft was published this time last year, and privacy advocates have taken a dim view of the powers since day one. Only recently has the bill interested much of the general public, though, with a petition to repeal the bill started just after it passed through the House of Lords. At the time of writing, the petition is approaching 135,000 signatures, but as the Investigatory Powers Bill has now received royal assent, it's too little too late.