The Lee Rigby murder doesn’t justify an extension of internet snooping powers

http://www.theguardian.com/commentisfree/2014/nov/25/lee-rigby-murder-no-extension-internet-snooping

Version 0 of 1.

The killing of Lee Rigby in May 2013 was the result of a catalogue of missed opportunities by the intelligence services. As the just published report by the intelligence and security committee explains, one of the killers, Michael Adebolajo, had been known to MI5 since 2008. There were repeated chances to investigate him and Michael Adebowale; the very day of the murder, the home secretary was presented with – and signed – an application to tap Adebowale’s communications, a procedure given “routine” urgency, and one that had taken a month.

Yet the ISC’s report instead lays the blame on a single (unnamed) internet company for failing to tell MI5 that Adebowale had had a number of accounts automatically closed for “terrorism-related” reasons.

If that company had done so back in December 2012, the ISC suggests, then MI5 would have put the would be murderer at “Priority 1” in its investigation. “This is the single issue which – had it been known at the time – might have enabled MI5 to prevent the attack,” the ISC says.

Certainly, the ISC has a point here. As the report highlights, when internet companies discover accounts associated with child exploitation, they are quick to pass on details to the authorities. But if someone suggests “let’s kill a soldier” in a message, the account is marked for closure. Adebowale had four out of seven internet accounts at one provider automatically closed over suspected terror-related activity; yet none was reviewed by a human. That’s a clear failure to link the action – closing an account – and the reason; communications companies can’t seek public approval for trying to prevent child exploitation, yet wash their hands of terrorism discussions.

But the ISC also bemoans the fact that the UK’s laws, specifically Ripa – the Regulation of Investigatory Powers Act – do not allow the intelligence services to demand content from overseas internet companies. Though it isn’t spelt out, the clear assumption is that companies such as Google, Apple, Microsoft, Facebook, Twitter, BlackBerry, and myriad smaller ones providing interpersonal communications are meant here.

Why, complains the ISC, can’t Ripa be extended to cover those pesky overseas companies, and compel them to hand over data – even if it isn’t held in the UK – if it’s about UK residents?

On this the ISC is wandering into dangerous territory where it has failed to reflect on the inevitable result. If the UK can demand access to the contents of internet accounts – even where the data is stored overseas – of people in the UK, why shouldn’t Russia demand exactly the same of Britons who happen to be in Russia? Why shouldn’t border guards in China demand access to your hard drive as you get off the plane in Shanghai? What’s to stop Iran insisting on the decryption keys to any internet service that wants to connect its citizens? The current system is a mess – but making it easier for MI5 to get hold our emails won’t actually make us any safer. Better work by the intelligence agencies will. As the report shows, they had plenty of opportunity to focus on the murderers.

The ISC report makes depressing reading, because it shows that internet companies still haven’t decided quite what their priorities should be – and, equally, that our legislators are still apt to forget that the internet is global, and that the laws we try to make here could be used against us elsewhere. And in the end, it wasn’t emails that killed Lee Rigby. It was a pair of extremists known to the intelligence services, who had been in regular contact via monitored phones, who used kitchen knives. The clues were all there. What was needed was the intelligence to connect them.