As part of the 2016 Investigatory Powers Act (IPA), the British government gave several new powers to law enforcement and security services. Intended to help these bodies better deal with online crime, the law called for the creation of ‘internet connection records’.

During initial testing, internet connection records (ICR) have been used to capture every website visited by ‘suspects’ based in an unspecified region. The UK government has announced the trial was a success and now plans to roll out ICS record collection to the entire country.

How does the ICR work?

Under the IPA, British internet service providers (ISP) must collect connection data on all of their customers. So if your home broadband is provided by Vodafone, Vodafone is legally obliged to collect data about the sites and services you use.

The ICR does not contain a full list of every webpage you visit, but it does record every website you visit. So an ICR would show that you visited the Panda Security website, but not that you were reading this article.

According to the law, ISPs and telecoms can be issued with a warrant requiring them to keep the ICRs of a specific individual for 12 months. The records can then be used for investigating suspected crimes.

Does the ICR system work?

According to British authorities, the ICR system offers a “significant operational benefit”. It has been described as a powerful surveillance tool for detecting and prosecuting crime. However, because of the secrecy of the system, it is hard to assess its true effectiveness.

The National Crime Agency (NCA) cites one of their own trials that focused on a specific website hosting indecent images. According to reports, the NCA was able to identify 116 previously unknown child predators who visited the site. It is not clear exactly how ICRs helped in this case however.

Why are civil liberties experts worried about ICRs?

Not everyone agrees that ICRs are a good idea however. Some experts warn that too much data is being collected, while others are concerned about how well protected these records are.

However, all the experts agree that the secrecy surrounding the project is a significant concern. The British government and ISPs refuse to share information about exactly what ICRs entail, how the technology works or which agencies are using the data.

As a result, UK civil liberties group Privacy International is challenging the IPA in court. They are particularly concerned about the data being collected and handled, especially as the British government has been found to used personal data illegally in the past. The outcome of the case could have significant implications for the future of ICRs – and perhaps even the Investigatory Powers Act itself.