Buried inside the Investigatory Powers Act and the Online Safety Act are explicit statutory provisions that exempt MPs, Lords, ministers and civil servants from the very surveillance regimes they voted to impose on everyone else, including the client-side scanning of private messages before encryption can protect them. The legal mechanisms involved, Section 26 of the IPA, Schedule One of the Online Safety Act, the Henry VIII powers, and the now-codified Wilson Doctrine, were not written in by accident, and understanding them precisely is the starting point for any serious conversation about digital sovereignty.
One Law for Them
There is a line buried inside the Investigatory Powers Act, Section 26, that tells you everything about the relationship between the British state and the people it governs. Under that section, a standard law enforcement agency cannot touch an MP’s private communications data. To intercept a politician’s messages, a warrant is required, and that warrant can only be issued with the Prime Minister’s personal written authorisation. Not a judge. Not a court. The Prime Minister.
Meanwhile, your messages, your photos, your private conversations on WhatsApp or Signal, et al, are subject to mass, bulk warrants and algorithm-driven scanning that no individual ever approves and no single official ever has to sign. The contrast is not incidental. It is the architecture.
The Golden Shield
The Investigatory Powers Act is the same legislation that gives intelligence agencies sweeping powers to intercept, hack and harvest public data at scale. It does both things simultaneously, one for the public and one for those who voted it into existence, and it does so explicitly, in writing, with statutory force.
This is not a loophole someone discovered after the fact. The protections for politicians are not an oversight. Section 26 was written into the Act deliberately, creating what amounts to a constitutional class divide inside surveillance law itself.
The Online Safety Act, the legislation currently pushing for client-side scanning, the proposal that tech companies scan your private messages on your device before encryption can protect them, contains its own version of the same carve-out. Schedule One of the Act explicitly exempts internal communication tools and services used by public bodies. The servers and channels used by Secretaries of State, MPs, ministers and civil servants are statutorily exempt from the same scanning regime the government is trying to force onto everyone else. They know exactly how invasive this technology is. Their exemption from it is the evidence.
Henry VIII and the Art of Rewriting Rules
The Online Safety Act also grants what constitutional lawyers call Henry VIII powers, named deliberately for a monarch who governed by personal decree rather than parliamentary process. Under these provisions, the Secretary of State holds secondary legislative authority to alter, amend or create new exemptions for categories of digital service via a statutory instrument, bypassing a full House of Commons vote.
In plain terms: if a future surveillance clause ever threatened to catch a government minister, that minister, or a colleague, could rewrite the relevant section of the law without submitting it to parliamentary debate. The oversight mechanism that is supposed to check executive power can itself be overridden by the executive. It is a closed loop, and it was designed to be one.
The Wilson Doctrine: A 1966 Convention Now Hardened into Statute
The principle that the state should not monitor its own parliamentarians dates to 1966, when Prime Minister Harold Wilson established a constitutional convention that security services were barred from tapping MPs’ or peers’ communications. This began as a political understanding between gentlemen, the kind that could theoretically be broken under sufficiently extreme circumstances.
Modern surveillance legislation has since codified the Wilson Doctrine into law, transforming what was an informal restraint into a statutory guarantee. The very individuals currently voting to strip citizens of digital privacy are constitutionally and legally protected from ever experiencing the consequences of those votes. The doctrine does not distinguish between MPs who defend civil liberties and those who do not. It protects them all equally, regardless of what they vote for, on the basis that they are legislators rather than ordinary people.
The Inversion
A democratic society, as the principle was originally conceived, rests on a specific arrangement: the state is transparent to the people, and the people maintain privacy from the state. Accountability flows upward. The governed can scrutinise the governors. That is the theory.
The UK has reversed this. The state is becoming opaque to the public at precisely the rate at which the public is becoming transparent to the state. By the end of 2026, mandatory age verification is scheduled to be rolled out across social media and internet access for under-16s (well, in reality, that means everybody). The 29th of July 2026 marks a deadline by which the Secretary of State must report to Parliament on progress toward that target. The infrastructure for universal identity-linked internet access is being constructed quietly, deadline by deadline, statutory instrument by statutory instrument.
None of this happened suddenly. The Online Harms Bill, the precursor to the Online Safety Act, was resisted by civil liberties campaigners years before it reached its current form. The warnings were public and sustained. The trajectory was readable. The system was not co-opted at some recent inflexion point. It was built, piece by piece, to arrive here.
What Sovereignty Looks Like When Voting Isn’t Enough
The gap between the law as applied to citizens and the law as applied to legislators is not a glitch awaiting correction. It is a feature of how legislative power protects itself. Understanding that gap is the first act of genuine sovereignty in response to it.
Informed refusal matters. Encrypted communication, where it still functions, matters. Legal literacy matters. The anger that comes from understanding these specific provisions, not generalised fury at the system, but precise knowledge of which section of which act does exactly what, is harder to dismiss and harder to deflect than emotion alone.
The law is not neutral. Neither is knowing it.
Source: fiona_covileaks
Join the Conversation
Does the legal distinction between how the state monitors citizens and how it protects its own politicians change the way you think about compliance with surveillance legislation? What forms of resistance or sovereignty feel realistic and meaningful to you right now? Share your experiences and insights below.
