WIRED first reported the existence of the ICR trial in March 2021, when there were even fewer details about the test. It is still unclear which telecom companies were involved. The Home Office’s February report is the first official indication that the trial was useful to law enforcement, and could help lay the groundwork for expanding the system across the UK. The Home Office review also states its trial found that “ICRs appear to be currently out of reach for some potentially key investigations,” raising the possibility that the law may be changed in the future.

In May 2022, the Home Office issued a procurement notice revealing that future trials “work is now underway” to create a “national ICR service.” The existence of the notice was initially reported by the public sector technology publication PublicTechnology. The notice says the government had a budget of up to £2 million to create a technical system that allowed law enforcement officials to access ICR data for investigations.

The contract for the technical system was awarded to defense firm Bae Systems in July 2022. In response to a Freedom of Information Act request from WIRED, the Home Office provided some pages of the contract with Bae but refused to give any technical details due to commercial interests. (A spokesperson for Bae said it could not discuss specific contracts for confidentiality and security reasons.)

The Home Office FOIA response also refused to provide details of an internal review into ICRs, citing national security and law enforcement grounds. A Home Office spokesperson said the UK has “one of the most robust and transparent oversight regimes for the protection of personal data and privacy anywhere in the world” and confirmed that trials of ICRs are ongoing.

When asked whether ICRs will be rolled out across the entire UK, the Home Office spokesperson pointed to the FOIA response, which says that providing additional information may jeopardize law enforcement activities. “Information on law enforcement capabilities and targeting is very sensitive, particularly in the field of digital communications, where it is often the case that criminal groups or individuals themselves display a high degree of technical sophistication and awareness,” the FOIA response says. Because of this, it continues, “it is vital that sensitive information on how they might conduct their investigations, or the nature of their technical abilities, are not publicly known.”

The Investigatory Powers Commissioner's Office (IPCO), which oversees intelligence agencies, police, and local authorities, says the collection of ICRs to date has been to support “small-scale trials” and that it is “unable” to provide any figures on the number of data retention notices issued. A separate independent review of the Investigatory Powers Act is due to be published this summer. The National Crime Agency says it is still participating in the ICR trials to evaluate the use of ICRs, and that “data exploitation is essential” to its work.

Despite the potentially limited use of ICRs so far, there has already been one documented failure. In its annual 2020 report, published in January 2022, IPCO highlighted that an unnamed telecoms company that was asked to provide internet connection requests “provided data in excess of that which had been authorized.” The reason? There was a technical error. No extra detail was provided.