Internet Connection Records (ICRs)
Internet Connection Records are data collected and retained by TOs about the sites and services to which their customers connect on the internet. Certain Public Authorities are permitted to seek disclosure of that data within limited Access Conditions and upon independent authorisation by the Investigatory Powers Commissioner’s Office (IPCO) (or internal authorisation for National Security purposes by the intelligence services). The Public Authorities are laid out in Schedule 4 of the Act and include police forces, the NCA and the UK intelligence services.
	The capability allows those specified Public Authorities to ask two primary questions of the data. Firstly, in instances where the subject of interest or device is known, the question of which internet sites or services have been connected to over a specified period (subject development) and secondly, for instances where a site or service is known, which customers have accessed that service at a specified time or times (subject identification).
	The change in the Act concerns this second ‘subject identification’ aspect of the legislation. The IPA 2016 as drafted cover this within Condition A.
Condition A is that the person with power to grant the authorisation considers that it is necessary, for a purpose falling within section 60A(7), 61(7) or 61A(7) (as applicable), to obtain the data to identify which person or apparatus is using an internet service where-
(a) the service and time of use are already known, but
(b) the identity of the person or apparatus using the service is not known.
	Condition A is designed to assist in investigations where a specified internet site or service is known to have been accessed at a specified time or times and the public authority is seeking to determine the identity of the party or parties involved in that connection. To that end this Condition is event (s) specific.
	Examples of this may be where officers receive intelligence, perhaps from forensic examination of a seized device, about the use of a specified video conferencing facility, to livestream the abuse of a child or where a public figure has been subject to sustained online threats and abuse via a number of internet facilities, such as an overseas hosted email facility, social media platform or constituency website. In such circumstances investigators would wish to identify subjects accessing those internet resources at relevant specified times coincidental to the abuse occurring and threats having been made.
	There were concerns that this requirement to know the specific service and time of access limited utility of the ICR capability and prevented this TO stored and managed data from being used to assist in the detection of some of the most serious offenders and National Security threats.
	Whilst investigators may identify websites of interest in the course of their investigations, they may lack knowledge around whether a specified site has been accessed or a specific time or times of access. Where the site is itself criminal in nature then investigators are interested in access at any time.
	The addition by this Act of new Condition D to the legislation allows investigators to state a service or services and a time period i.e. ‘between this date/time and this date/time’ within an application. These stated service or services in a particular time period will be based upon subject matter expertise, analysis and existing intelligence and be indicative of behaviours that indicate serious criminality or a national security threat. All such applications must be both necessary and proportionate before they can be authorised.
	An example of where a Condition D ICR may be appropriate would be where the intelligence services identify a previously unknown site promoting terrorism, or child sexual abuse and exploitation, or the command and control infrastructure for malware, and wish to identify parties who are accessing those resources – where they may have a clear suspicion that they are being accessed but lack the requisite knowledge that they are and exactly when.
	In circumstances where serious criminality may be denoted by a very specific pattern of connections, this new provision aims to allow that pattern to be translated into the form of a question of ICR data to assist in discovering subjects of interest displaying those linked behaviours and in respect of whom it would not otherwise have been possible to detect.
	An example of this would be in high-harm fraud which often involves online behaviour that could be identified by ICRs. ICRs can now be used, for example, to search for devices which are simultaneously connecting to legitimate banking applications and to malicious control points. Such behaviour could indicate that a financial fraud is in progress. Improved access to ICRs will enable the intelligence services to detect such activity more effectively and to inform law enforcement partners of the identity of the potential fraudsters and of any associated organised crime groups.
	Whilst clearly having the potential to provide significant operational utility it is recognised that such queries are highly susceptible to imprecise construction. As a result, additional safeguards are introduced in this Act with the intention of managing access to this new Condition and mitigating public concerns.
	These safeguards include that the capability is to be limited solely to the intelligence service and the NCA who are assessed to possess the requisite subject matter expertise to formulate appropriate queries to derive the correct subset results. This has a significant reliance on understanding the construct of the ICR data queried, which may differ between TOs, understanding of human verses machine generated connections, and understanding of computer logic and the importance of accurate syntax.
	The lawful purposes for which this new Access Condition may be utilised are also limited, relating solely to National Security, the Economic Wellbeing of the UK so far as those interests are also relevant to the interests of national security, and for Serious Crime purposes.
	Under this new condition, all applications would undergo review, where an appropriately trained authorising officer would consider the application. Applicants would have to address in detail within their application exactly how collateral intrusion would be managed to ensure only those persons who should be the subject of an investigation are so. Persons so identified would then be subject to individual development utilising established investigative capabilities to support the intelligence, all of which would need to be further and separately authorised. Data returned as a result of a Condition D application will be subject to the safeguards as set out in the Codes of Practice, including that data may only be held for as long as the relevant public authority is satisfied that it is still necessary for a statutory purpose.
	The need for this change was considered in depth, and supported, by Lord Anderson KC in his review of proposed IPA 2016 reforms.