Government plans for internet surveillance are heavily criticised by business owners and analysts as UK tech firms head for the exit

When home secretary Theresa May announced last month that the newly elected government would revive the “snooper’s charter” as part of a new investigatory powers bill, she would not have expected UK tech firms to react so swiftly and decisively. Yet, two British tech firms, Eris Industries and Ind.ie, have announced they are leaving the UK, citing the proposed bill as the reason.

What the 'snooper's charter' means for business and the public Read more

“These proposals would introduce the security state into the core of our business’s day-to-day operations. This will make doing business in the UK nearly impossible,” says Preston Byrne, chief operating officer at Eris Industries. Byrne has been approached directly by the government to give an explanation for his actions.

“Going on the prime minister’s express prior statements and the content of the draft communications data bill back in January, we have told them that we expect the investigatory powers bill to contain both requirements for state-mandated back-doors in our cryptography and onerous data retention requirements. As the government has yet to deny that either provision is in their current, and not publicly released, draft, we have to assume that they are.”

Like Eris, Ind.ie too has expressed similar concerns.

“This government has made it crystal clear it’s declaring open season on human rights in this country and that’s why we are leaving,” says Aral Balkan, founder of Ind.ie

Shooting UK tech entrepreneurship in the foot?

But are these likely to be isolated cases or is there a real danger here that the Home Office could effectively damage the growth of UK tech entrepreneurship?

“Clearly, technology firms which develop solutions that depend upon secure communications will find it impossible to do business,” says computer security expert Graham Cluley. “But more than that I would expect companies, which rely upon solutions to ensure their own privacy and the privacy of their clients (for instance, financial institutions), would feel very disturbed.”

Cluley goes on to say the proposals are “absurd and unworkable”. It has also led the Open Rights Group to put together a petition (which currently has more than 5,000 signatures) to stop the proposals, which it says will not be effective and will not represent value for money.

Open Rights Group executive director Jim Killock says that although we do not know the full extent of the proposed legislation yet, it is likely to have an impact.

“Internet service providers (ISPs) will end up with large costs as their relationship with customers would inevitably change,” he says. “Companies will end up sinking a lot of time into something that is fundamentally unproductive, and this is not necessarily a good thing.”

Killock adds that more disturbing is the potential threats to encryption technologies, something which has irked both Eris Industries and Ind.ie. He says this will severely limit the sorts of products these businesses can develop, as it could undermine their security.

“It could be a very bad place to be a technology security company,” adds Killock, who also suggests that this could also extend to other industries, where security products and customer privacy are crucial to their existence.

Taking chances

So will more tech firms really leave the UK? Or is this all a bit premature given that the government hasn’t actually decided on the content of the bill yet? Both Eris and Ind.ie are encryption companies so it makes sense that they should be unhappy, but will the bad feeling really extend to other businesses? Can the government afford to take that chance?

“I find it hard to believe that many tech firms based overseas, including social-media services, who offer secure communications, will feel comfortable putting backdoors into their software or weakening encryption for the benefit of the UK government,” says Cluley. “If one messaging app (say WhatsApp) played along with the UK government, I would expect there to be an outrage on social media and many of its users to decide to switch to a service that wasn’t kowtowing to the Brits.”

While the prospect of the UK losing tech firms, their products, services and related jobs and investment is clearly a cause for concern, surely the crux of this for many tech firms is whether there are appropriate legal checks and balances in place?

The Home Office was non-committal, instead releasing a statement saying it: “Fully supports the financial services sector’s work to protect customers from fraud and other crimes. However, this should not stop our police and security services from obtaining communications data in certain, limited circumstances, to protect the public and ensure national security.”

Of course the police are already having requests for access granted to communications data, so this is not new. Theresa May’s proposals are not about communications data (location, type of app used, device etc), but communications content – the actual words used in emails, for example. So while metadata is apparently helping security forces to disrupt terrorist plots, how much will having access to content really help? Isn’t the real issue that the security services have a lack of resources and not necessarily a lack of knowledge on potential terrorists?

In a speech to the Bavarian Parliament in February this year, Google’s outgoing senior vice president communications and public policy Rachel Whetstone said that “encryption is also important – because it requires governments to go through the proper legal channels. There’s simply no other way for them to get encrypted data, save hacking into our systems.”

Google’s stance has been to work with governments, but it claims, it also has a duty to its users too. Whetstone said as much.

“When people sign-up for an email account, they trust Google to keep that information private. So we need to be certain the law enforcement requests we receive – and remember they come from all around the world – are legitimate, not targeted at political activists or incredibly broad in their scope. And we never let governments just help themselves to our users’ data.”

So what would Google do in the UK if a bill was passed forcing it to create a backdoor into its users’ emails and messages?

Google declined to comment on the issue beyond Whetstone’s speech.

Legal parameters

Of course, legal parameters will be required to ensure no agency abuses access to communications content without a proper warrant. Surely? It’s the trust thing again and since Edward Snowden lifted the lid on the extent of internet surveillance, trust in politicians has declined, according to an Ipsos Mori poll.

The Home Office statement concluded that it is currently “considering recommendations made by the Independent Reviewer of Counter-Terrorism legislation”, a review to be “published shortly.”

Theresa May’s department will have another report to consult as the review by the Royal United Services Institute (commissioned by former deputy prime minister Nick Clegg) into intelligence agencies’ use of internet data is also due out soon.

So while we wait for the snoopers’ charter to take shape and while companies flee these shores, should we be worried about our private emails and messages?

The UN Declaration of Universal Human Rights says ‘No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence.’ Unless the government has good reason to suspect anyone of criminal activities, it should not have access to personal data. Of course the bill could change all that. Last one out, turn off the Wi-fi.

To get weekly news analysis, job alerts and event notifications direct to your inbox, sign up free for Media Network membership.

All Guardian Media Network content is editorially independent except for pieces labelled ‘Advertisement feature’ – find out more here.