RIPA permits mass interception of communications but controls exist on viewing message contents, says UK government official

Charles Farr, director of the Office for Security and Counter-Terrorism, said that UK individuals' Google search queries, Facebook messages and Twitter postings may all be intercepted without the intelligence agencies or law enforcement bodies having to specify the target of their surveillance. He said, though, that UK-to-UK email messages would not be subject to broad interception even where the communications go through servers based overseas.

However, Farr explained that the contents of the communications that are intercepted cannot be "read, looked at or listened to" other than in "tight constrained circumstances" that are set out in UK legislation.

Farr clarified how powers to intercept communications, as laid out in the Regulation of Investigatory Powers Act (RIPA), apply to both 'internal communications' and 'external communications' in a witness statement (50-page / 1.81MB PDF) submitted as part of proceedings currently before the UK's Investigatory Powers Tribunal. The government and intelligence bodies are in the process of defending their information surveillance practices in light of challenges brought by privacy and civil liberty groups such as Liberty and Amnesty International.

RIPA provides law enforcement bodies in the UK with a right to intercept communications under certain circumstances. The Act requires the bodies to obtain the Home Secretary's authorisation to intercept the communications before they can do so, and the Home Secretary must, before authorising a warrant, assess whether the request to intercept communications is necessary and proportionate in order to protect the UK's national security interests, prevent and detect terrorism and serious crime or to safeguard the UK's economic well-being.

The Home Secretary must consider certain factors relating to the necessity and proportionality of any interception before authorising it, including "whether the information which it is thought necessary to obtain under the warrant could reasonably be obtained by other means".

However, RIPA provides for two different types of warrants to be issued, one which applies when the law enforcement agencies wish to intercept 'internal communications' and one which applies when they wish to intercept 'external communications'. An external communication is defined under the Act as "a communication sent or received outside the British Islands".

When seeking to intercept internal communications, the bodies must specify either the identity of the subject of the interception or the single set of premises where they wish to intercept communications, together with a number of other details. These warrants are known as 'section 8(1)' warrants.

However, warrants for intercepting external communications (section 8(4) warrants) do not have to specify the intended target of the interception and can be issued if the home secretary believes the surveillance to be necessary. A number of additional safeguards apply in the case of these "certified warrants".

Farr said some communications that are sent from within the British Islands and read by people within the British Islands may be classed as 'external communications' and be subject to mass surveillance. Examples he gave were Google searches, Facebook messages and 'tweets' on Twitter. Emails between UK-based individuals that are transmitted via servers based overseas would not, though, be classed as 'external communications', he said.

However, Farr said that intercepted external communications cannot be "read, looked at or listened to" without first being subject to the system of further safeguards in place under RIPA.

"Despite the fact that some UK to UK communications may be intercepted under section 8(4) warrants and that common uses of the internet by persons in the British Islands, such as a Google search, a Facebook post, or a 'tweet' on Twitter, may entail the making of 'external communications' ... the section 8(4) regime as a whole is designed so as not to authorise the selection for examination of communications of this nature, except in the tight constrained circumstances set out in section 16 of RIPA.," he said.

"It is therefore unlikely that such communications would be capable of being read, looked at or listened to, even in the unlikely even that they fell within a description of communications to which a section 8(4) warrant related," he said.

In accordance with section 16 of RIPA, the intercepted external communications may only be read, looked at or listened to if the home secretary has deemed it necessary and, generally, if the information is "referable to an individual who is known to be for the time being in the British Islands; and has as its purpose, or one of its purposes, the identification of material contained in communications sent by him, or intended for him", although other limited conditions also apply to enable the contents of communications to be read, looked at or listened to.

Farr said, though, that "in practice" the contents of a Google search that has been intercepted under a section 8(4) warrant could, other than in accordance with the section 16 circumstances, "not be selected to be read, or even looked at, on the basis of any factor referable to that individual".

Farr said that the distinction between section 8(1) and section 8(4) warrants was necessary because it may not be possible to specifically identify a target for interception when intercepting external communications.

"Within the British Islands, the government has sufficient control and considerable resources to investigate individuals and organisations, and it is feasible to adopt an interception regime that requires either a particular person, or a set of premises, to be identified before interception can take place," Farr said. "Outside the British Islands, the government does not have the same ability to identify either relevant individuals or premises."

"For examples, the government is in many cases not aware of the precise location and online identities of members of Al-Qaeda around the world, or of cyber criminals, Taleban insurgents, proliferators of weapons of mass destruction or precursor chemicals, or of other similar individuals or organisations whose activities pose a threat to national security, the prevent and detection of serious crime or the economic wellbeing of the United Kingdom. And even if the government were aware of their precise location and online identities, it would be unlikely to have the same practical ability to access communications relating to those individuals or premises," he said.

Farr said that enabling the intelligence services to intercept "a large volume of communications" was the "only practical way" to ensure that they can "obtain at least a fraction of the type of communication in which it is interested". He said that the mass of data intercepted is not all used by the intelligence services but that just a "small fraction" of that information is selected to be examined on the basis of "relevant selectors".

Far admitted, though, that 'internal communications' could be intercepted at the same time as external communications under the broader section 8(4) warrant regime. However, that interception is permitted where the interception of internal communications is "necessary" in the process of intercepting "wanted external communications".

He said that the contents of internal communications intercepted under the section 8(4) warrant regime "cannot be read, looked at or listed to by anyone except in accordance with the certificate and pursuant to section 16 of RIPA and [if to do so would breach human rights laid out in the European Convention on Human Rights]".