On Thursday, the Investigatory Powers Bill, colloquially known as the Snoopers' Charter, completed its final stage and is set to become law. The legislative process began in March of this year, and has been rather overshadowed by the Brexit referendum and its shambolic aftermath. As a result, the UK government has had a comparatively easy ride over what are some of the most extreme surveillance powers in the world.

Much was made of the fact that there was a "double lock" system, whereby a warrant authorised by the home secretary must also be approved by a judge. But what many people have not appreciated is that one of the most contentious parts of the new law—access to records of all your Internet activity—does not require a warrant at all, and therefore lacks even a single lock.

Under what we must soon call the Investigatory Powers Act, "communications service providers"—essentially ISPs and telecoms companies—can and doubtless will be required to create Internet Connection Records (ICRs) for all their users, and to store them for a year. The government factsheet on ICRs describes them as follows:

Internet connection records are records captured by the network access provider (e.g. the Internet Service Provider or Wi-Fi operator) of the Internet services with which a uniquely identifiable device (e.g. a laptop or mobile phone) interacts. It will involve retention of a destination IP address but can also include a service name (e.g. Facebook or Google) or a web address (e.g. www.facebook.com or www.google.com) along with a time/date. It could never contain a full Web address as under the law these would be defined as content.

As here, the government has emphasised repeatedly that the ICRs contain "only" metadata, not content. But computer experts have explained at length that retaining metadata is potentially far more intrusive than retaining content. Metadata is already categorised, which makes it much easier to aggregate and cross reference.

The government factsheet on the Snoopers' Charter makes clear that a warrant will not be necessary for the police to access ICRs: all that is required is sign-off by a "designated senior person." That means the police get to approve their own access.

As Ars reported back in June, the police underline the fact that considerable bureaucracy will be involved in obtaining approval, which in theory should act as a brake on abuse. But access to highly-revealing metatdata is likely to prove so useful that the temptation to dip into the ICR databases will be strong.

Eye see... arrrrrgh

The mere existence of ICRs is problematic, since it represents continuous surveillance of everything we do online. Ready access to ICRs by the police, without the need for a warrant, is clearly troubling from a privacy point of view. But even setting those issues aside, there's another major problem that has barely been discussed, probably because the politicians simply don't understand the technology that will be involved in implementing the system.

The government factsheet quoted above explains that ICRs are created and held by ISPs and telecoms. However, the government intends to create centralised software that will allow queries to be made across multiple databases using "request filters". That presumably means that a single program will have access to all ICR databases, creating a tempting target for those wishing to gain access to the information stored in the UK's ICRs.

Even without that risk that the centralised application will be compromised, the individual ICRs will also be under constant attack. Unfortunately, the track record of the companies involved here is not good, as breaches at TalkTalk, Vodafone, O2, and Three show.

The release of ICRs could be career- or even life-threatening for some people. Leaving aside obvious issues like unusual tastes in pornography, which could prove highly embarrassing to public figures, there are also important issues involving health. For example, if ICR records were obtained that show a judge, senior police officer, or CEO of a major company is visiting sites with information about a serious mental health condition, that could easily be exploited by unscrupulous individuals to suggest that person is not fit to hold a position of responsibility.

ICR records are the perfect material for blackmail, which makes them valuable in a way that traditional telephone records are not. And where potentially large sums of money are involved, corruption is sure to follow. Even if ICR databases are secured with the best available technology, they are still vulnerable to subversion by individuals whose jobs give them ready access.

This is no theoretical risk. Just one day ago, it emerged that corrupt insiders at offshore call centres used by Australian telecoms were offering to sell phone records, home addresses, and other private details of customers. Significantly, the price requested was more if the target was an Australian "VIP, politician, police [or] celebrity."

Although that happened in an offshore company, it would be naive in the extreme to think that it couldn't happen in UK-based ISPs and telecoms if the price were right—and for high-profile individuals, it will be. Similarly, if the reward is great enough, the risk of prosecution is unlikely to be much of a deterrent.

Once the databases holding ICRs are created, it is only a matter of time before some of them fall victim to one of the many threats that will see intimate details of people's online lives exposed to the world, with possibly serious consequences for the individuals concerned.

It seems inevitable that the law will be challenged in the courts, and that it will end up before the Court of Justice of the European Union (CJEU). Based on previous rulings, it's likely that the CJEU will strike down the Snoopers' Charter. Whether the UK government will pay any attention depends on what happens with Brexit.