Home Office uses internet providers to harvest data in secretive trials

Digital campaign groups have voiced alarm after it emerged the Home Office is using internet providers to harvest users’ browsing histories as part of two secretive trials.

The data is being collected to see whether such surveillance should be rolled out in the interests of national security.

The trials, first reported in Wired, started in July and October 2019 and are being run by two separate internet firms.

Although shrouded in secrecy, the tests are understood to be gathering internet connection records (ICRs), with metadata showing which websites people have visited.

Campaigners warn ICRs can reveal private information including political beliefs, health conditions, and personal interests.

Heather Burns, police manager of Open Rights Group, told Wired: “This is a fairly staggering lack of transparency around mass data collection and retention.

“We should have the right to not have every single click of what we do online hoovered up into a surveillance net on the assumption that there might be criminal activity taking place,” she added.

The law allowing the tests to proceed is the controversial Investigatory Powers Act — branded a “snooper’s charter” by critics — which was introduced in 2016. The whistleblower Edward Snowden said at the time it enabled “the most extreme surveillance in the history of western democracy”.

Under this act, the Home Office can serve “retention notices” to internet providers so that they keep any relevant data.

Two such notices were approved by the Investigatory Powers Commissioner’s Office (Ipco) in 2019, according to a report published in December.

An Ipco spokesperson said: “Once a full assessment of the trial has been carried out, a decision will be made on whether there is a case for national rollout.”

The National Crime Agency (NCA), which is working with the Home Office on the tests, said it uses “data exploitation” in its work.

“We are supporting the Home-Office-sponsored trial of internet connection record capability to determine the technical, operational, legal and policy considerations associated with delivery of this capability,” the NCA said in a statement.