IANAL but I've been chewing my way through the ~300 pages of the published draft bill. What catches my attention is that the bill appears does not appear to sufficiently constrain the Secretary of State's powers to oblige a "telecommunications provider" to render technical capabilities deemed necessary to "assist in the in the implementation of warranted activity".
Here, the definition of "telecommunications provider" seems (to my understanding) so broad as to cover any provider of an online service, paraphrasing section 193:
"Communication" is "anything comprising speech, music, sounds, visual images or data of any description" and "signals serving either for the impartation of anything between persons, between a person and a thing or between things or for the actuation or control of any apparatus."
And a "telecommunication service" includes "any case where a service consists in or includes facilitating the creation, management or storage of communications transmitted".
Section 189 titled Maintenance of technical capability allows the Secretary of State to make obligations on telecommunication services including (paraphrasing again):
* relating to apparatus
* relating to the removal of electronic protection applied by a
relevant operator to any communications or data
* relating to the handling or disclosure of any material or
data
in addition to requiring them to "provide facilities or services of a specified description"; the specification apparently being deferred until notice is served on the service provider.
Conversely, the Secretary of State is required to consult before serving a "technical capability notice" and section 190 lays out a number of considerations for the Secretary of State including "technical feasibility", "likely cost", "likely benefit" etc.
But other than these apparently very weak constraints, it appears to provide carte blanche for the Secretary of State to demand new technical capabilities of any service provider for the warranted access and interception of any user data they store or transmit.
Here, the definition of "telecommunications provider" seems (to my understanding) so broad as to cover any provider of an online service, paraphrasing section 193:
"Communication" is "anything comprising speech, music, sounds, visual images or data of any description" and "signals serving either for the impartation of anything between persons, between a person and a thing or between things or for the actuation or control of any apparatus."
And a "telecommunication service" includes "any case where a service consists in or includes facilitating the creation, management or storage of communications transmitted".
Section 189 titled Maintenance of technical capability allows the Secretary of State to make obligations on telecommunication services including (paraphrasing again):
* relating to apparatus * relating to the removal of electronic protection applied by a relevant operator to any communications or data * relating to the handling or disclosure of any material or data
in addition to requiring them to "provide facilities or services of a specified description"; the specification apparently being deferred until notice is served on the service provider.
Conversely, the Secretary of State is required to consult before serving a "technical capability notice" and section 190 lays out a number of considerations for the Secretary of State including "technical feasibility", "likely cost", "likely benefit" etc.
But other than these apparently very weak constraints, it appears to provide carte blanche for the Secretary of State to demand new technical capabilities of any service provider for the warranted access and interception of any user data they store or transmit.