A top secret report to the British prime minister has recommended that a new international treaty be negotiated to force the cooperation of the big US internet companies in sharing customers’ personal data, the Guardian has learned.
Privacy campaigners said the decision to classify the report, written by the former diplomat Sir Nigel Sheinwald, as top secret was designed to bury it and its key recommendation for an international treaty could provide a legal, front-door alternative to the government’s renewed “snooper’s charter” surveillance proposals.
It is believed the former British ambassador to Washington concluded that such a treaty could overcome US laws that prevent web giants based there, including Facebook, Google, Twitter, Microsoft and Yahoo, from sharing their customers’ private data with British police and security services. It would also mean not having to revive the powers, which require British phone companies to share data from the US giants passing over their networks, from the 2012 communications data bill that would enforce their compliance.
Jim Killock of the Open Rights Group said: “The Sheinwald report should be published. Any attempt to hide it can only be interpreted as an attempt to close down debate about whether the snooper’s charter is really needed.
“A new international treaty is the right approach to cross-border requests for data by law enforcement agencies. This approach undermines Theresa May’s claim that there is a need for a new snooper’s charter when there is a simple, transparent and workable solution.”
But the Cabinet Office defended its decision to keep the report secret. It said Shinewald “reports on progress to the prime minister but … is not undertaking a public review”.
The Guardian understands the report has been classified as top secret by the Cabinet Office because it goes into the detail of each company’s operations. Shinewald was appointed by Cameron in September 2014 as his special envoy on intelligence and law enforcement data sharing.
Campaigners said the Sheinwald report could be published by redacting or stripping out the confidential detail of each company’s operations and having the report declassified.
May, the home secretary, is due to publish within the next few months an “investigatory powers bill” that is expected to extend the powers of the security services to access personal communications data, which tracks everyone’s email, web and social media use, and enhance their powers for the warranted intercept of their content.
The bill has been described as a “turbo-charged snooper’s charter” and is expected to revive the original 2012 communications data bill that was blocked by the Liberal Democrats in the coalition government.
That bill had included highly controversial powers requiring British phone and web companies to collect the personal third-party data passing over their networks from US web companies that refused to cooperate on a voluntary basis with British requests. The concerns of the US major web companies over this point was a key factor behind Nick Clegg’s decision to veto the bill.
There is currently a system of general mutual legal assistance treaties, known as Mlats, but they are regarded as cumbersome and slow. The Home Office has said they are completely unsuitable to facilitate the real-time exchange of data for day to day crime and counterterrorism investigations. The Home Office confirmed that in extreme cases it was considering inserting “black box” probes into the transatlantic networks to collect the data it says it needs.
Cameron acknowledged the problem facing internet firms when he appointed Sheinwald as a special envoy. The prime minister said a number of overseas companies had said their ability to work with the British government was severely constrained by international conflicts of jurisdiction, “for example, where they think they have a British law saying they should share data, and an American law saying they shouldn’t”.
This week’s vote in the US Congress allowing some domestic data surveillance powers to lapse underlined the growing difference in US and British policies.
Eric King, deputy director of Privacy International, accused the government of avoiding an honest debate about surveillance: “The role of US companies is critical to surveillance reform, but now the report commissioned to assess the situation, and report back to parliament and public, is being classified top secret. Why?” he asked.
“Perhaps the report hints that last summer’s Data Retention and Investigatory Powers Act [Dripa] didn’t solve the problem it claimed to, or acknowledges that greater international reform is a better option than rushing through broad powers at home to try and strong-arm companies abroad. Unless it’s published, we’ll never know.
“This is not how complex reforms should be conducted. Must the same mistakes continue to be made, time and time again? Or will this government allow public and parliament the space for an honest debate about surveillance that it so sorely needs?”
In response, a Cabinet Office spokesman said: “Sir Nigel Sheinwald has been leading the discussions on intelligence and law enforcement data-sharing with overseas governments, communications service providers, and other key international partners on ways to improve access to data when it is stored in other jurisdictions.
“This includes consideration of new international frameworks to facilitate data sharing. He reports on progress to the prime minister but unlike David Anderson QC, is not undertaking a public review.”
The Sheinwald report was commissioned by Cameron when the emergency Dripa legislation was introduced last year. At the same time he asked Sir David Anderson, the official reviewer of counterterrorism laws, to undertake a review of the current surveillance and intercept laws. The emergency data retention legislation is due to expire in December 2016 and the government is currently discussing its options to replace it.
The Cabinet Office said the Anderson review would be published soon and his “thorough and comprehensive report will be important as we draw up new legislation”. But privacy campaigners fear the Anderson review will focus on the legalities of the surveillance laws rather than the bigger picture.
The home secretary had tried to fix the problem of requiring the cooperation of the US internet giants in last summer’s Dripa legislation which asserted the “extra-territoriality” of UK intercept warrants and requests for communications data.
But US law has various blocks on sending data overseas which has limited the impact of the move. An international treaty would allow these blocks to be dismantled to facilitate data exchange between trusted countries.