The key elements of the snooper’s charter, including the bulk collection and storage for 12 months of everyone’s personal data, tracking their use of the web, phones and social media, will remain firmly in place when the government publishes its new investigatory powers bill on Wednesday.

The legislation, to be introduced by the home secretary, Theresa May, will provide the security services with an explicit licence to “snoop on the web” for the first time.



Until the disclosures of the whistleblower Edward Snowden, these powers and mass surveillance programmes remained hidden in the complex undergrowth of the pre-digital age Regulation of Investigatory Powers Act 2000 (Ripa) and other arcane surveillance laws.

The new, comprehensive, surveillance legislation will provide the security services and police with access to personal web and phone data using bulk-collection powers and will also put on a fresh legal footing spies’ mass computer hacking, known as “computer network exploitation”.

In the runup to the bill’s publication May has made much of having removed some of the more contentious elements from her previous attempt to introduce the snooper’s charter in parliament, which was blocked by her Liberal Democrat coalition partners. So is this week’s new surveillance law a climbdown or is it still a snooper’s charter?

What personal data does Theresa May want companies to collect?

Internet and phone companies are expected to be required to keep the communications data of all their customers’ use of the web, their phones and social media for 12 months. This is not the content, which has to be authorised by a ministerial intercept warrant, but the who, what, where and when of everyone’s use of the web.



It is often the case that the “who sent what to whom from where” can be more useful to the security services and police than the actual content of messages because it can tell them a lot about an individual’s life, and represents hard evidence.

It is easy to lie in the writing of an instant message but far harder to lie over when and to whom it was sent. This is reflected in the fact that communications data can be used as evidence in court while information obtained via interception is not admissible and can only be used for intelligence.

The Home Office will pay the internet and phone companies an as-yet unspecified (but no doubt large) sum to store this data and to provide access to the security services and the police according to specified regimes.

What will GCHQ be able to do with that data?

The security and intelligence services will use the bulk collection of personal internet data by the web and phone companies as the basis of GCHQ’s powerful data-mining programs to generate intelligence data.

It is the activity of the hundreds of such programs that campaigners say amounts to the snooper’s charter invasion of privacy.

The police, who make the bulk of the 500,000 external requests for communications data each year, have a separate regime with approval at inspector or superintendent level depending on the kind of data being requested for use in crime investigations. This includes terrorism investigations but also stalking and missing persons cases.

The bill is expected to add a category of internet connection records that will allow the police to trace which websites a suspect has visited, but not the content of pages. This is expected to require judicial authorisation, which is likely to be in the form of a panel of specially trained retired judges and requests will have to be targeted and limited.

They may also be required to authorise police requests for the communications data of journalists, lawyers or other legally privileged professions.

A further 40 public bodies also get different levels of access but often will need a magistrate’s authorisation. But the vast majority of the 500,000 requests made each year will continue as now without the need for a judicial or ministerial warrant.

Will US internet companies such as Google and Facebook be affected by the new law?

The home secretary has given up trying to force overseas web companies to meet British requests to hand over their customers’ data. She has also dropped her plan to get UK-based companies to keep “third party” data that passes over their networks if the US companies refused to cooperate.

Instead, May has decided to rely on the recommendations of Sir Nigel Sheinwald, the former British ambassador to Washington, who earlier this year told the government that the only way to solve this problem was to negotiate a new treaty with the US to secure a rapid response to requests.



Does David Cameron still want to ban encryption?

When the prime minister visited Washington earlier this year he gave the impression that he wanted to ban encryption on the web, arguing that there should be no safe space for terrorists or paedophiles. Ministers have ruled out for now any such ban or restriction on encryption, which would have severely undermined Britain as a global business centre.

What will the security services get out of it?

The bill will enshrine the security services’ licence to hack, bug and burgle their way across the web. Britain’s security services only officially admitted that they had worldwide powers to attack computers this year.

As a result of a court case, an innocuous-sounding “draft equipment interference code of practice” was published by the Home Office. This put into the public domain the rules and safeguards surrounding the use of computer hacking outside the UK by the security services for the first time.

Privacy campaigners said the powers outlined in the draft guidance detailed the powers of intelligence services to sweep up content of a computer or smartphone, listen to their phone calls, track their locations or even switch on the microphones or cameras on mobile phones. The last would allow them to record conversations near the phone or laptop and snap pictures of anyone nearby.

Who will oversee this new regime?

Theresa May faces strong parliamentary opposition to continued ministerial authorisation of the 2,400-a-year intercept warrants she currently signs. She has already offered a two-stage compromise by floating the idea of a judicial veto on her authorisations. She is also expected to announce that the fragmented system of five separate oversight commissioners is replaced with a single investigatory powers commissioner, who would be a senior judge, to hold the security services and police to account.