EE, Vodafone and Three handing customer call records to police “like a cash machine,” claims Guardian investigation
Mobile operators EE, Vodafone and Three hand over the “vast majority” of customer call records requested by police automatically and without involvement of any phone company staff, an investigation by the Guardian has found.
According to one unnamed employee cited in the report, the operators supply customer data “like a cash machine.”
The law requires that mobile operators store a year of call records for all customers, which can be accessed, without warrant, using the Regulation of Investigatory Powers Act (Ripa).
Similar to the US Prism programme, to gain access to records, a police officer must first get approval from a colleague on the same force who will then enter the details via an online form.
The Guardian states that in the vast majority of cases, the information is delivered without any further human role.
Eric King, deputy director of Privacy International, a transparency watchdog, said that “widespread, automatic access of this nature” meant the UK telecoms industry “essentially already provides law enforcement with joined-up databases.”
“If companies are providing communications data to law enforcement on automatic pilot, it’s as good as giving police direct access [to individual phone bills],” he added.
King said “urgent clarity” is needed on the “unquestioning” relationship between telco companies and law enforcement.
“It’s crucial that each individual warrant for communications data is independently reviewed by the companies who receive them and challenged where appropriate to ensure the privacy of their customers is not being inappropriately invaded.”
In a statement, EE – which operates Orange and T-Mobile – said that it does use an automated system but that it is subject to oversight. It claimed monthly reports are sent to the law enforcement agency requesting the data, and annual reports are sent to the interception commissioner and the Home Office.
Vodafone said that an “overwhelming” majority of Ripa requests are processed automatically.
“Even with a manual process, we cannot look behind the demand to determine whether it is properly authorised,” it said.
Similarly, Three, said it “works with the government and does no more or less than is required or allowed under the established legal framework.”
O2 was found to be the only major phone network which required staff to review all police information requests.