So Theresa May’s investigatory powers bill has completed its passage through the House of Commons. It passed its third reading by 444 votes to 69 and now goes to the Lords for further consideration. Their lordships will do their best – and they are good at scrutinising complex legislation – but sometime in the next parliamentary session the bill, substantially unchanged, will receive the royal assent and become law. As a result, the powers of the national security state will have been significantly expanded.

If you and I were to try this kind of 'interference', we would be liable to be detained at her majesty’s pleasure

As an example of legislative cunning, the bill is a machiavellian masterpiece. Starting from the premise – obvious to the meanest intelligence – that the rat’s nest of existing laws governing surveillance, interception of communications etc was intolerable, it purported to create a clean sheet in which all the powers of the secret state would be brought under one statute. And it appeared to take on board many of the criticisms levelled at the aforementioned rat’s nest by three major independent reviews. It brought some of the activities of the security services that had hitherto been conducted under the dubious auspices of the 1984 Telecommunications Act under explicit statutory control. It threw in artfully obscurantist provisions (eg something called internet connection records) that were designed to get privacy activists stirred up, much as one might throw bits of offal to distract a pack of menacing dogs. And then, under cover of the resulting fuss, it slipped in authorisation of a massive extension of intrusive state power under the banal heading of “equipment interference”.

In plain English, “equipment interference” is authorised hacking. It’s what the security services have been doing covertly for ages without, as far as I can see, explicit legal authorisation. It is defined (in the code of practice accompanying the bill) as “a range of techniques used by the equipment interference agencies that may be used to obtain communications, equipment data or other information from the equipment. The material so obtained may be used evidentially or as intelligence, or in some cases, may be used to test, maintain or develop equipment interference capabilities.”

Illustration by James Melaugh.

What it means is anything from penetrating computer systems by covertly installing malware (viruses, trojans etc) on to them, using keyloggers to monitor every keystroke, tapping into cables, installing malware on smartphones and so on. If you and I were to try our hand at this kind of “interference”, we would be contravening the Computer Misuse Act and be liable to be detained at her majesty’s pleasure. When our spooks do it, therefore, they have to be protected from such unpleasant consequences, which is what part five of the investigatory powers bill is intended to provide.

Two kinds of hacking are authorised by the bill – “targeted” and “bulk”. Both require warrants and a fairly robust authorisation process. Targeted interference seems relatively unproblematic: if the spooks or cops have good reason to suspect an individual, then it’s appropriate to allow them to bug said individual using whatever ingenious means are appropriate.

Bulk interference, however, is a very different matter. The grounds for doing it are threefold: national security; preventing or detecting serious crime; and threats to “the economic well-being of the UK”. So it’s externally focused. But essentially it gives GCHQ & co a licence to hack into any device or network anywhere on the planet if they can persuade the home secretary to sign a warrant to authorise it.

The most worrying aspect of this, however, is that any company served with an equipment interference warrant not only has to assist the authorities in implementing it, but is also legally bound not to disclose that fact – to anyone.

So imagine, for a moment, that you run a plucky British startup offering cybersecurity products and services. Given how insecure the online world is (see, for example, the recent catastrophic attack on the Swift banking system), many of your most lucrative customers will be overseas banks, some of whose customers may well be of interest to GCHQ or HMRC. But if you are served with an equipment interference warrant, you will have to comply and keep your mouth shut.

When you tender for foreign business, therefore, guess what happens? Your foreign competitors will claim that your stuff probably has a backdoor in it installed by UK authorities. And your indignant denials will be greeted with cynical amusement, because foreigners aren’t daft – and they can read the investigatory powers bill, too.

So here we have a government, whose chancellor recently declared his firm determination to “support the best cyber startups”, who is nevertheless pushing through legislation that seems designed to undermine the international credibility of said startups. Strange way to run a country, eh? But that’s the national security state for you.