New equipment needed to capture internet connection records, say communication providers

Under the Investigatory Powers Bill, proposed by the UK government in November, communication service providers would be required to retain communications data for up to a year and make that data available to the police, intelligence and security services in certain circumstances, including to help with investigations into acts of terrorism or serious crime.

The Bill, for the first time, extends the communication data retention regime to ICRs, which is broadly data that reveals which websites internet users have visited without detailing the precise webpages of those sites that have been viewed.

The Bill is being scrutinised by a special parliamentary committee set up for that purpose. In an evidence session hosted by the committee earlier this week, representatives from BT, Sky and Virgin confirmed they would need to deploy new equipment to collect ICRs.

Mark Hughes, president of BT Security, said deploying new equipment will "come at a cost" and said BT has concerns that the Bill is not clear that communication service providers will be able to recover the costs they incur in complying with the legislation from the government.

Hughes said communication providers should be reimbursed for their costs in complying but said that, under current proposals, BT alone would be likely to incur costs totalling "the lion's share" of the £170.4 million the government has estimated will cost communication providers in upgrading their systems to comply with the requirements to retain ICRs.

Hughes said that placing a cap on the costs companies will be able to recover for deploying new systems would act as a safeguard against the deployment of a "disproportionate technical solution that is over-intrusive".

Hugh Woolford, director of operations at Virgin Media, said his company has estimated that it would incur costs of "tens of millions" of pounds to meet the requirements of the Bill.

Adam Kinsley, director of policy and public affairs at Sky, said "there will need to be investment in new types of technology" if Sky is to have the capability to capture ICRs that reveal up to "the first slash" of a web address visited and not more specific details of the precise content someone has viewed.

A separate legal framework regarding access to the content of communications is envisaged under the Investigatory Powers Bill than the one which would apply to communications data.

The government has outlined its plans for the new communications surveillance powers conveyed in the Bill to come into force at the end of 2016. However, Woolford said that it is likely to be 2018 before Virgin is ready to deploy new systems capable of capturing ICRs. He said the company currently has no need to collect such information.

Kinsley said that capturing ICRs will require communication providers to process "massively more" data than they currently have to and to retain up to 100 times more information than they do at the moment.

Woolford said the need to capture more data to comply with the Bill would have cost implications in relation to data processing power needed and in hosting of that information. He said the Bill could potentially require communication providers to "almost mirror" their entire network's traffic in order for that data to be filtered and for the necessary data to be retained in line with the Bill's requirements. Woolford described this as a "huge, huge undertaking".