The Regulation of Investigatory Powers (RIP) Act sets out the government's plans for how the security services can monitor and access communication over the internet. It passed into law hours before the Commons rose for its summer break and has now come into force.
Why is it so controversial?
Critics say the act is a gross invasion of privacy which will scupper e-commerce in Britain; the government argues it is necessary to crack down on internet crime and paedophilia.
What are the key areas of controversy? The first is "black box" interception. Security services, such as MI5, will be able to monitor people's internet habits through the collection of "communications data". This data is not website or email content, but users' "clickstream" - the websites and chatrooms they visit and the addresses of emails they send and receive. If security services suspect criminal activity, they request a government warrant to intercept and decode internet content.
The Home Office says the interception procedures are in line with the right to privacy enshrined in article eight of the European Convention on Human Rights (ECHR - now part of UK law) and simply brings the monitoring of the internet in line with that of telephone calls. All telephone numbers are logged (call content is not) and some telephone companies are required to enable security services to intercept calls. But web addresses also show exactly what people have been looking at and build up detailed profiles of where people go online and who they communicate with.
Under RIP, some UK internet service providers (ISPs) will be asked "to maintain a reasonable intercept capability". This will come in the form of the much hyped "black boxes", a piece of computer technology enabling the security services to monitor the flow of data. Critics say that the black boxes will be hugely expensive and will have difficulty keeping pace with fast-changing internet technology as well as the ever-growing volume of internet traffic.
The Home Office claims the power of interception is rarely used. All security service warrants for the interception of data will require the personal approval of the home secretary and must meet stringent criteria - national security must be threatened or serious crime must be suspected. Critics prefer an independent judicial panel, which would provide external checks on the system and ensure spies and governments maintain the rule of law.
The second key controversy is the legislation's reverse burden of proof. If intercepted communications are encrypted (encoded and made secret), the act will force the individual to surrender the keys (pin numbers which allow users to decipher encoded data), on pain of jail sentences of up to two years. The government says keys will only be required in special circumstances and promises that the security services will destroy the keys as soon as they are finished with.
Human rights campaigners argue the act reverses the burden of proof in UK law. There is also the threat of stiff prison sentences if an individual who has been required to hand over keys tells a third party. However, the Home Office says the burden remains on the prosecution to prove "beyond reasonable doubt that an accused person is, or has been, in possession of a key to unlock particular protected data." The act also contains a defence for individuals who have lost or forgotten a key, and a person is no longer liable if they are judged to have done all they can to help the authorities to recover a key.
Critics argue that innocent people could still be jailed for innocently forgetting keys, while drug smugglers and paedophiles would happily settle for a two-year prison sentence rather than face far harsher penalties for being found guilty of the crime they are suspected of.
What about employers?
The act also allows employers to intercept emails and internet use by their staff, on grounds such as monitoring for computer viruses.
Will the act compromise e-commerce?
Many in business fear the act will scare off e-commerce entrepreneurs. A fiercely critical British Chambers of Commerce (BCC) report estimates the RIP Act could cost business £46bn in the first five years of operation, as ISPs are compelled to install costly black boxes, e-commerce firms are forced out of the country and new firms are dissuaded from basing their operations in the UK.
The act's potential to enable unlimited "fishing expeditions" in companies' databases compromises corporate privacy, they argue, while security service knowledge of clickstreams and encryption keys could fall into criminal hands, compromising the security of e-commerce. Forcing employees to secretly hand over encryption keys could also breach trust and rules within a company.
In turn, the home secretary, Jack Straw, says the BCC's figures are "incredible" given that the value of UK e-commerce is currently estimated at around £5bn. He prefers to highlight what he says is the overall cost of crime - £50bn a year.
What do other countries do?
There is no comparable legislation in the US. Tim Berners-Lee, the British inventor of the world wide web, has said that RIP would have been thrown out of the US "in a second". Ireland recently sought to encourage e-commerce by passing a law making it illegal for government to access commercial encryption keys. France has relaxed controls on domestic encryption, while Germany is opposed to restrictions on citizens' use of encryption. Russia, Singapore and Malaysia have passed laws similar to RIP.
RIP centre - Foundation for Information Policy Research
The RIP bill
The Home Office RIP site
The British Chambers of Commerce information and communication technology page
House of Commons library research report (pdf)
The Human Rights Act 1998 (enshrines the ECHR into British law)