Internet Connection Records (ICRs)
An Internet Connection Record (ICR) is a record, held by a Telecommunications Operator, about the service to which a device has connected on the internet, for example that someone has accessed ‘illegalsite.com.’ The Government’s policy position is that the ability of investigators to discover and prosecute serious criminals would be revolutionised by better use of these ICRs.
	The way in which the IPA 2016 was originally drafted required certain thresholds to be met on the ‘known’ elements of the investigation, such as when a website had been accessed. Condition A for ICR access is focused on identifying subjects relevant to specific known event(s) and does not permit enquiry into wider use beyond that known event(s). A significant gap existed with ICRs where, for example, analysis of a seized device identified a site serving images of child sexual exploitation or that the device was being used for communications between threat actors. In such circumstances, ICRs could not have been used to detect other unknown subjects using those sites, beyond a specific known event.
	This limited the ability of the intelligence services and the NCA to use ICRs to detect previously ‘unknown’ criminals online. The changes will help the intelligence services and NCA to detect and locate individuals involved in serious criminal activities, such as in the grooming of children online, those engaged in widespread internet enabled fraud or those who seek to undermine the security of the UK, where previously this would not have been possible using ICRs.
	The Act adds a new condition D to the list of existing conditions for the use of ICRs at s62 of the IPA 2016. This will enable target detection, which was not possible using the existing ICR conditions A to C. This new condition D is only available to the intelligence services and the NCA, and for a more limited set of lawful purposes relating solely to national security, the economic wellbeing of the UK (so far as those interests are also relevant to the interests of national security), and serious crime.
	The policy objective of this measure therefore is to enable the intelligence services and the NCA to detect previously unknown individuals who are using the internet to commit high-harm crimes. The addition of condition D is a relatively small change to the Act as the intelligence services and the NCA are already permitted to use the existing ICR conditions for subject identification but were required to know the time of access and service in use to do so, which limited the utility of the capability to assist in detecting new subjects of interest.
	The measure allows target detection of high-impact offenders by removing the requirement to unequivocally know a specific time or times of access, and service in use and instead allows these parameters to be set out in the application, based upon detailed analysis and subject matter expertise.
	ICRs could be used to identify high-risk child sexual abuse (CSA) offenders, including those who both access multiple CSA platforms and have ready access to children. Intelligence derived from ICR applications could assist law enforcement partners in prioritising their efforts against CSA, protecting children, and bringing offenders to justice.
	High-harm fraud often involves online behaviour that could be identified by ICRs. ICRs could be used, for example, to search for devices which were simultaneously connecting to legitimate banking applications and to malicious control points. Such behaviour could indicate that a financial fraud is in progress. This improved access to ICRs could enable the intelligence services to detect such activity more effectively and to inform law enforcement colleagues of the identity of the potential fraudsters and of any associated organised crime groups. Flagging suspicious behaviour in that way can lead to action being taken to prevent criminals from defrauding their intended victims.
	The period of time to be specified, and the service(s) to be queried must still meet necessity, proportionality and collateral intrusion tests and service(s) could not be queried, or for any longer, than was absolutely necessary to meet the operational objective of the ICR application. The applicant should explain their reasoning with reference to tangible supporting information which is subject to the existing oversight and safeguards of the regime. Data returned as a result of a Condition D application will be subject to the safeguards as set out in the Codes of Practice, including that data may only be held for as long as the relevant public authority is satisfied that it is still necessary for a statutory purpose.