The Home Office has launched an under-the-radar consultation on a critical step in the implementation of the Investigatory Powers Act (IP Act): the regulations on technical capability notices. The Open Rights Group has recently revealed details of the proposed regulations.

Under the IP Act, a technical capability notice can be issued to a telecommunications operator by the secretary of state with the approval of a judicial commissioner. A notice would require the operator to install specified technical facilities. The objective is to ensure that if the operator subsequently receives, say, an interception warrant it has the technical ability to comply with it. A technical capability notice does not itself require an operator to conduct an interception. It prepares the ground in advance by ensuring the operator has equipment in place.

The proposed regulations will spell out what kind of facilities a technical capability notice can require a telecommunications operator to install. For example, the consultation touches on one of the many controversial topics in the IP Act: the possible use of technical capability notices in effect to prevent telecommunications operators from providing users with end-to-end encryption facilities.

Telecommunications operators are widely defined in the IP Act to include not only telcos, ISPs, and the like but also Web e-mail, social media platforms, cloud hosts, and over the top communications providers.

Technical capability notices already exist, but in a much more limited form, under the Regulation of Investigatory Powers Act 2000 (RIPA). S.12 of RIPA enacted a three layer scheme similar to that under the new IP Act:

first the statute, laying out in broad terms the Home Office’s powers to require an operator to install an interception capability;

second, regulations made under the Act. These put more flesh on the obligations and potentially narrow the categories of provider who could be made subject to a notice;

third, technical capability notices themselves, issued by the Secretary of State to individual service providers (but not necessarily to all of those within scope of the Act or the regulations).

These pave the way for actual interception warrants, requiring operators to carry out particular interceptions.

The main change with the IP Act is that technical capability notices are no longer limited to interception. They apply to three of the powers under the Act: interception (targeted, thematic, and bulk), communications data acquisition (ordinary and bulk), and equipment interference (targeted, thematic, and bulk).

Another high level change is that the IP Act allows technical capability notices to be given to private as well as to public telecommunications providers. The draft regulations reflect this expansion.

Also, unlike under RIPA, IP Act technical capability notices have to be approved by a judicial commissioner.

The proposed IP Act regulations are in many respects similar to the existing 2002 regulations made under RIPA. However there are some significant differences.

Communications data acquisition capability not subject to 10,000 person threshold

The existing RIPA interception capability regulations set a 10,000 person threshold below which an interception capability cannot be required. (It has never been very clear whether this referred to customers or end-users.) The proposed new regulations repeat this threshold for interception and equipment interference, albeit removing the existing limitation that the 10,000 persons be within the UK.

For communications data acquisition, however, the new draft IP Act regulations set no minimum threshold. Combine this with the IP Act’s enlarged scope, covering private and public telecommunications operators, and we have the startling prospect that any kind of organisation, business (other than excluded financial services businesses), institution, university, school, hospital, library, political party, and so on could potentially be required to install a communications data acquisition capability. In theory this could even apply to private households, although it is difficult to imagine this ever being thought appropriate.

Communications data acquisition "black box"

The communications data acquisition aspects of the draft regulations differ from interception and equipment interference in another significant respect. The existing RIPA interception regulations are framed as obligations on operators to provide the capability themselves. The same is true of the new IP Act interception and equipment interference obligations. This approach allows operators to design or procure their own interception equipment, so long as it complies with the technical capability notice.

The new IP Act communications data requirements, however, include a paragraph under which a technical capability notice could require a provider to install a government-provided "black box":

10. To install and maintain any apparatus provided to the operator by or on behalf of the Secretary of State for the purpose of enabling the operator to obtain or disclose communications data, including by providing and maintaining any apparatus, systems or other facilities or services necessary to install and maintain any apparatus so provided.

This paragraph, unheralded during the Bill’s passage though Parliament, applies to both ordinary and bulk communications data acquisition capabilities. It is a substantial departure in kind from previous RIPA obligations.

New services

Unsurprisingly, since this was heavily trailed during the passage of the Bill, all three sets of provisions allow the imposition of obligations to notify the Home Office in advance of new and changed services. A technical capability notice would also be able to require the operator to "consider" the obligations and requirements imposed by any technical capability notice when designing or developing new telecommunications services or telecommunications systems.

The 2002 regulations contained no obligations of this kind.