British politicians will dramatically expand the UK's powers of mass surveillance under a draft bill demanding that ISPs store records of every website visited by internet users for up to a year. This level of online monitoring has been banned in the US, Canada, and every other European nation, and has even previously been rejected in the UK. Supporters of the legislation (known as the Investigatory Powers Bill) are presenting it and other security measures as a compromise, but privacy campaigners say it is in fact more intrusive.
Records of citizens' internet activity would only include the basic URL of websites they visit (e.g. www.google.com or www.theverge.com) and not any specific pages (e.g. http://www.theverge.com/tag/surveillance). Searches made on sites would not be recorded, but the time of visits, as well as the IP addresses of other computers which the individual contacted, would.
A record of websites citizens visit will be kept, but not of specific pages
Police would need authorization from a panel of judges before accessing an individual's web history, which would also include browsing data from smartphones and other mobile devices. This is the first time such "bulk collection" has been made explicit in UK law since the whistleblower Edward Snowden revealed the scale of digital surveillance by Britain's GCHQ and the NSA.
The home secretary, Theresa May, described the bill as a "significant departure" from previous plans known as the Snooper's Charter, and said that it provided "world-leading oversight to govern an investigatory powers regime which is more open and transparent than anywhere else in the world." Privacy groups, however, said this was simply spin, with Jim Killock of the Open Rights Group commenting: "This bill is an attempt to grab even more intrusive surveillance powers and does not do enough to restrain the bulk collection of our personal data by the secret services."
Surveillance powers of this sort are illegal in the US and the rest of Europe
Similar legislation has already been rejected in Europe and in Britain itself. An EU bill asking ISPs to keep internet users' browsing data was blocked by the European Court of Justice (CJEU), which ruled that this sort of blanket retention of data interfered with fundamental human rights. When the UK government rushed through similar powers in the Data Retention and Investigatory Powers Act (DRIPA) that same year, a High Court said the legislation was again unlawful, although this time became because of insufficient safeguards
As well as bulk data collection, the draft bill also formalizes when and how British spies can hack and bug computers and phones. The interception of an individual's communications (i.e. the audio from a phone call or content of an email or text message) will have to be approved by the home secretary and by a judge, although in situations where someone's life is in danger or there is a perceived critical need to gather intelligence, the warrant can be approved without judicial oversight.