A bill described as the most extreme surveillance legislation ever passed in a democracy has become law in the UK and will come into force next year, without ever facing substantial opposition.
The Investigatory Power Act brings in a new requirement for communications service providers to harvest and keep logs of the digital services accessed by all their users for a full year, which will be accessible without a warrant to a wide range of government agencies, not just law and intelligence.
The government's explanation for needing surveillance powers has always been combating terrorism, but how they need to study the online behaviour of individuals is less obvious. It also throws up security concerns to give UK authorities the power to require a company to remove encryption, or limit the rollout of end-to-end encryption on a future service, surely risking the security of user data.
The law also sanctions state hacking of networks, devices and services, including bulk hacking overseas, as well as maintaining large databases of personal information on UK citizens even if suspected of no crime.
The oversight court for UK intelligence agencies is due to rule on the proportionality of the law’s so-called bulk measures next month, when it will also be ruling on the legality of the powers with the wider European Union context, and when it is likely to be challenged by the European courts, despite Brexit.
A petition to parliament to repeal the IP Act has already passed more than 140,000 signatures, but it could be too late for those MPs who backed the bill to admit they sleepwalked into a surveillance state.