Tech Firms Are Unclear on New UK Surveillance Laws, Warns Government Committee

The wording of the United Kingdom's proposed surveillance law is so vague that tech companies have little idea what data it would require them to store, a new government report has said. Companies are also concerned about the cost and feasibility of collecting such data, and are unclear on the law's position regarding encryption. “The Government must urgently review the legislation so that the obligations on the industry are clear and proportionate,” wrote Nicola Blackwood MP, chair of the Science and Technology Committee.

The committee has been taking evidence from activists, academics, and tech companies around the draft Investigatory Powers Bill, a proposed piece of legislation that will force Internet service providers (ISPs) to store all customers' browsing history for 12 months, among other things. This data collection includes the creation of so-called Internet connection records, or ICRs. An ICR is, according to Home Secretary Theresa May, “a record of the communications service that a person has used, not a record of every web page they have accessed.” That could include information such as a record of when you visit a specific website or when you use WhatsApp on your phone. But members of the tech industry are not clear on what an ICR actually is, according to the Science and Technology Committee's report. “The Bill was intended to provide clarity to the industry, but the current draft contains very broad and ambiguous definitions of ICRs, which are confusing communications providers,” Blackwood's statement continues. There is also confusion around the tech industry's obligations around end-to-end encryption.