Recently the Draft Investigatory Powers Bill (Joint Committee) in UK government scrutinised the draft Investigatory Powers Bill, which aims to overhaul surveillance and interception powers. The bill could involve having the details of everyone's Internet browsing history stored so they are easily accessible to police and other security forces in the event of a national security emergency. The Committee's conclusion was that more work was required on the bill, especially in protecting the privacy of UK citizens.
The latest development in the UK brings about an important question — how willing are people to accept access to their private lives in return for enhanced security? RAND Europe attempted to answer this question using a pan-European survey undertaken as part of the European Commission's PACT project, which surveyed over 26,000 citizens across the EU member states.
The survey contained stated preference choice experiments designed to quantify the public's views on privacy and security issues in a number of real-life situations, including Internet use. The results were found to be surprisingly consistent across all 27 countries with no significant differences for respondents in the UK.
In general, respondents in the study disliked having any information about their Internet use stored. The aversion to data storage significantly increased if this information was related to communications with other people and all Internet activities, as opposed to just storing a list of websites visited and the user's locations. Even if certain data and information were stored, respondents disliked the idea that law enforcement agencies could have access to it.
There was a more mixed response towards the continuous surveillance of the Internet. Although, under most circumstances, there was strong opposition to this form of surveillance, respondents actually expressed a positive preference for it when authorised by a judicial warrant. Even under a government-declared state of emergency, most respondents disliked Internet surveillance without a judicial warrant.
The general trend of people being averse to any storage of Internet usage and Internet surveillance was seen across all age groups, but there were some interesting differences. The younger generation were less averse than the older generation to the storage of their Internet usage, but this reversed for surveillance. Indeed, over 65s were less averse to higher levels of surveillance than any other age group — even without a warrant.
The lengths that people would go to in order to protect their privacy were also highlighted through the survey. On average, respondents were willing to pay an additional 2.73 to 5.31 euros on their monthly fee for privacy-enhancing features from their Internet service provider (ISP). This would involve the ISP actively hiding a user's Internet use from others, warning users which websites do not meet the desired levels of privacy and advising on how to use the Internet anonymously without allowing websites to collect a user's personal data.
Analysis of additional data collected in the survey showed that respondents' attitudes significantly affected their preferences in relation to privacy, security and surveillance. The more distrustful (of business, voting, government and technology) a respondent was, the greater their concern for privacy.
So what do these findings mean for governments? Overall, there are significant challenges for any government looking to gain access to the private records of the public to aid security, in particular an individual's Internet use. Even in the event of a national emergency or limiting access of individuals' Internet usage to law enforcement agencies, there was still a strong aversion to information being stored or accessed.
Access and storage of personal data on the Internet present some complex issues and themes that will need to be addressed and explored in more detail. Presenting a new bill that provides easy access to these private records may cause resentment from the public, even if this is presented in the context of aiding national security.
If governments are to press ahead with further surveillance and interception powers, then there needs to be longer-term engagement with the public to increase their understanding of the balance between privacy and security.
Paul Cornish is research group director for Defence, Security & Infrastructure at RAND Europe.
