PARLIAMENTARY DEBATE
Investigatory Powers Bill (Tenth sitting) - 21 April 2016 (Commons/Public Bill Committees)
Debate Detail
Chair(s) † Albert Owen, Nadine Dorries
MembersAtkins, Victoria (Louth and Horncastle) (Con)
† Buckland, Robert (Solicitor General)
† Cherry, Joanna (Edinburgh South West) (SNP)
† Davies, Byron (Gower) (Con)
† Fernandes, Suella (Fareham) (Con)
† Frazer, Lucy (South East Cambridgeshire) (Con)
† Hayes, Mr John (Minister for Security)
† Hayman, Sue (Workington) (Lab)
† Hoare, Simon (North Dorset) (Con)
Kinnock, Stephen (Aberavon) (Lab)
† Kirby, Simon (Brighton, Kemptown) (Con)
† Kyle, Peter (Hove) (Lab)
† Matheson, Christian (City of Chester) (Lab)
† Newlands, Gavin (Paisley and Renfrewshire North) (SNP)
† Starmer, Keir (Holborn and St Pancras) (Lab)
† Stephenson, Andrew (Pendle) (Con)
† Stevens, Jo (Cardiff Central) (Lab)
† Warman, Matt (Boston and Skegness) (Con)
ClerksGlenn McKee, Fergus Reid, Committee Clerks
† attended the Committee
Public Bill CommitteeThursday 21 April 2016
(Afternoon)
[Albert Owen in the Chair]
Investigatory Powers Bill
Clause 109
Implementation of warrants
This amendment would remove the provision which allows a targeted equipment interference warrant to be served on a person outside the UK for the purpose of requiring that person to take action outside the UK.
Amendment 645, in clause 109, page 87, line 41, at end insert—
“(3A) Subsection (3) shall not be applicable where the person outside the United Kingdom has its principal office where it is established for the provision of services in a country or territory with which the United Kingdom has entered in to an international mutual assistance agreement or is subject to an EU mutual assistance instrument.”
This excludes the extraterritorial provision in cases where any mutual assistance arrangement exists between the UK and the provider’s jurisdiction while enabling the government to seek voluntary assistance from CSPs in non-MLA countries.
Amendment 679, in clause 110, page 88, line 9, at end insert—
“(1A) Where such a warrant is to be served upon a person outside the United Kingdom the warrant shall be served at that person’s principal office outside the United Kingdom, where it is established, for the provision of services.”
Amendment 694, in clause 110, page 88, line 10, at beginning insert—
“Where service of a warrant in the manner envisaged in subsection (1A) is considered unfeasible or inappropriate in the circumstances,”
Amendment 647, in clause 110, page 88, line 10, after “Kingdom”, insert—
“the warrant shall be served at that person’s principal office outside the United Kingdom where it is established, for the provision of services. Where it is considered unfeasible or inappropriate in the circumstances,”
The Home Secretary confirmed at second reading that a UK agency would only serve a notice on an overseas entity that is capable of providing assistance under the warrant. UK agencies today routinely use secure means of communication to transmit notices directly to the main office of overseas CSPs. This would make government’s commitment clear on the face of the Bill (as it is in the relevant code of practice) and address contradictory provisions that remain in the Bill.
Amendment 648, in clause 111, page 89, line 19, after “take”, insert—
“which for a relevant operator outside the United Kingdom shall include—
(a) any steps which would cause the operator to act contrary to any laws or restrictions under the law of the country or territory where it is established, for the provision of services, or
(b) where a warrant could be served pursuant to an international mutual assistance agreement or subject to an EU mutual assistance instrument.”
This amendment clarifies the reasonableness test for overseas CSPs.
Clauses 109 and 110 deal with issues about compelling a third party to provide assistance in the execution of a warrant and extraterritoriality, which is the subject of amendment 293. In speaking to the amendment, and to the clause more generally, I will unavoidably stray into matters relating to clause 110, as the two are inextricably linked.
Clause 109 provides the UK Government with the power to issue warrants that in turn force third-party organisations or individuals outside the UK to assist in acquiring information for the means of equipment interference. The clause states that
“any person whom the implementing authority considers may be able to provide such assistance”
can be served with a warrant to assist in carrying out a targeted hacking warrant. Under clause 110(2), this warrant may be served at a person’s principal office or specified address in the UK, or by making it available for inspection in the UK after appropriate steps have been taken to bring the contents of the warrant, and its very existence, to the attention of the person.
First, the problem here is the lack of judicial authorisation in this part of the process. Privacy International rightly points out that this compelled assistance will not be subject to judicial authorisation. Although law enforcement and security and intelligence agencies will have to seek a warrant to gain access to people’s devices and computers, it is correct that those authorities are not required to seek judicial approval to compel technology companies to assist in their investigations.
Secondly, we should be mindful of the difficulty that this places on any individuals or organisations who are forced to comply with the Government’s demands. These issues were heard by the Science and Technology Committee, where serious concerns were raised about the security implications of forcing companies to, for example, upload and install malware, as well as the fear that equipment interference could jeopardise their business model. The Science and Technology Committee took note of these issues and concluded that
“the industry case regarding public fear about ‘equipment interference’ is well founded.”
Amnesty International UK is deeply concerned about the dangerous precedent that this broad, aggressive power will set in forcing third-party companies to engage in hacking without any independent provision or scrutiny, and to do so in secret.
Thirdly, the extraterritorial measures in clauses 109 and 110 may cause more problems than they solve. That is why amendment 293, which stands in my name and that of my hon. and learned Friend the Member for Edinburgh South West, seeks to delete subsection (3) entirely, thereby removing the extraterritorial aspect. If we serve hacking warrants on those outside the UK, what sort of message does that send to other countries? We need to be mindful that introducing this type of clause could open the floodgates for other countries to follow suit, which will ultimately have an impact on companies based in the UK. That point was articulated by Yahoo!, which said:
“Extraterritoriality encroaches on the sovereign rights of other governments and risks retaliatory action, including against UK CSPs operating overseas.”
On that point, the Government’s independent reviewer’s report suggests that, when countries seek to extend their legislation extraterritorially, those powers may come into conflict with legal requirements in the country in which companies being asked to comply with a legal request are based. Companies explained to the reviewer that they did not consider it was their role to arbitrate between conflicting legal systems. The protection of vital human rights should not be left to the goodwill and judgment of a company. The concerns of the industry were articulated in this perfect quote. The industry
“expressed concerns that unqualified cooperation with the British government would lead to expectations of similar cooperation with authoritarian governments, which would not be in their customers’, their own corporate or democratic governments’ interests.”
I shall finish with this comment from Yahoo! It states:
“The current legal framework comprises the law in the requesting country, law in the receiving country and the international agreements that connect the two.”
It is additionally possible that the requesting and receiving countries’ laws may be in conflict. For example, the receiving country’s law may outlaw the provision of content data outside their own legal process. It continues:
“Taken as a whole, this framework is fragmented, with gaps and conflicts which have gone unaddressed for many years. In this more global communications environment, this fragmentation has become more and more obvious and creates a patchwork of overlapping and conflicting laws which overseas and domestic UK CSPs must navigate in order to discharge their legal obligations to safeguard users’ privacy and to respond appropriately to valid requests for access to data… It also creates a complex environment for users to navigate and establish their privacy rights.”
This issue is global, and national laws cannot resolve global issues.
“A warrant may be implemented only to the extent required for the purpose for which the warrant was issued.”
I think that may be implicit. If the Minister could indicate that that is his understanding, that might allay concerns and the amendment would not need to be pressed.
Amendment 293 to clause 109 seeks to remove the ability to serve a warrant on an overseas provider and amendment 645 seeks to remove the ability to serve a warrant on an overseas provider when a mutual legal assistance agreement is in place. I draw the Committee’s attention once again to David Anderson’s comments in his report, in paragraph 11.26:
“There is little dispute that the MLAT route is currently ineffective.”
I will not quote it at length but he goes on to say that it is because it is too slow and so on. I do not think that those amendments are in line with either his view or mine.
The effect of accepting the first amendment is evident. It would mean we could serve an equipment interference warrant only on a provider based in the UK. The second amendment seeks to assert mutual legal assistance arrangements as the only route. For the reasons I have already given, that is not appropriate.
The hon. and learned Gentleman asked, in the context of his amendment, whether that matter was implicit. Yes, it is implicit and I can confirm what he thought might be the case.
The arguments have already been made and, on careful reconsideration, the hon. Member for Paisley and Renfrewshire North will realise that his amendment and argument are pseudodox and will withdraw on that basis.
Amendment, by leave, withdrawn.
Question put, That clause 109 stand part of the Bill.
Question put, That the clause stand part of the Bill.
Clause 110 ordered to stand part of the Bill.
Question proposed, That the clause stand part of the Bill.
The Bill defines a telecoms operator as
“a person who…offers or provides a telecommunications service to persons in the United Kingdom, or…controls or provides a telecommunication system which is (wholly or partly)…in the United Kingdom, or…controlled from the United Kingdom.”
That flexible and all-encompassing definition means that not only online companies such as Google, Facebook, Twitter, Dropbox and Yahoo!, but private offices, businesses, law firms, the networks of Departments such as the NHS and institutional networks such as those of universities would be forced to comply with the Government’s instructions to interfere with or hack the communications of an individual or group. That was confirmed by the Home Secretary in her evidence to the Joint Committee that scrutinised the draft Bill. That power will place those companies, whose services most, if not all, of our constituents use, in a deeply unsettling and invidious position.
I am not convinced that any of our constituents would be pleased to hear that we were passing legislation that would allow their email accounts or Facebook pages to engage in illegal hacking on behalf of the state. The extraordinarily expansive power that the clause gives the Government will force companies to engage in highly controversial work on their behalf, which will no doubt be in conflict with the interests of cybersecurity and product security that the companies work hard to innovate in, protect and extend. Forcing these companies to engage in legal hacking could seriously harm their business and operations. It will also lead to some of their customers and users losing trust in their businesses. I am not surprised that companies have long expressed deep concern about the powers laid out in the clause, as it is in direct conflict with their business interests. For those reasons, the SNP would like to see the clause deleted from the Bill.
Question put, That the clause stand part of the Bill.
Clause 112 ordered to stand part of the Bill.
I beg to move amendment 296, in clause 113, page 91, line 22, at end insert—
“(A1) Material obtained via a warrant under this Part may only be shared with overseas authorities in accordance with the terms of an international information sharing treaty.”
This amendment would require that information obtained via an equipment interference warrant is only shared with overseas authorities where a mutual legal assistance treaty has been put in place for the purpose of doing so.
Clause 113 deals in part with the overriding issue of information obtained through equipment interference being shared with overseas authorities. We should take note of the oral and written evidence submitted by Amnesty International on this point about the lack of any proper controls over intelligence sharing with foreign authorities. The human rights implications may be very serious indeed. For example, there is nothing in the Bill to prevent data being shared with an overseas authority when that might lead to the abuse, or possibly torture, of an individual or group. Surely we should set an example by ensuring that data gathering does not lead to torture; that should be the minimum standard expected of a civilised country such as ours.
However, if the SNP and Amnesty International are a little left-wing for hon. Members’ tastes, I give them the Intelligence and Security Committee, which also criticised the lack of clarity on this point when it noted that the Bill
“does not…meet the recommendations made in the Committee’s Privacy and Security Report that future legislation must set out these arrangements more explicitly, defining the powers and constraints governing such exchanges.”
The written evidence submitted by Yahoo! and others expressed concern that the Government’s apparently unilateral assertions of extraterritorial jurisdiction
“will create conflicting legal obligations for overseas providers who are subject to legal obligations elsewhere.”
David Anderson has also noted the lack of detail in this section of the Bill. He called for information sharing with foreign countries to be subject to strict, clearly defined and published safeguards. His report states:
“The new law should make it clear that neither receipt nor transfer as referred to in Recommendations 76-77…should ever be permitted or practised for the purpose of circumventing safeguards on the use of such material in the UK.”
However, such safeguards and guarantees are notably absent from the Bill. Furthermore, the independent reviewer’s report described the international trade in intelligence between the “Five Eyes” partners—the UK, the USA, Canada, Australia and New Zealand. In so far as material gathered by the British services is shared with other countries, the report explained that the security services take the view that, under their founding statutes, information should be shared only if it
“is necessary for the purpose of the proper discharge of the security and intelligence agencies’ functions.”
When it is considered that the test is met, certain safeguards apply under the Regulation of Investigatory Powers Act 2000. However, the report concluded that
“in practical terms, the safeguards applying to the use of such data are entirely subject to the discretion of the Secretary of State.”
The 2000 Act and the codes of practice are silent on British services receiving or accessing information from foreign services, with security services limited only by the general constraints placed on their actions by various statutes. It was only during Liberty’s legal action against the security services in the Investigatory Powers Tribunal that limited information was revealed about the way in which the security services approach such situations. In its first finding against the agencies, the IPT held that, prior to these disclosures, the framework for information sharing was not sufficiently foreseeable and was not therefore in accordance with law. The tribunal held that, because the litigation had resulted in disclosures of information, the security services were no longer acting unlawfully when accessing information from the US. Based on the concerns that Amnesty International, Liberty and others have raised, the SNP has tabled amendment 296, which would insert a new subsection into clause 113. The language of the amendment is plain.
Clause 113 already provides that the Secretary of State must ensure that satisfactory and equivalent handling arrangements are in place before sharing UK equipment interference material with an overseas authority. The Secretary of State must determine that they provide corresponding satisfactory protections. Furthermore, those obligations sit alongside those in, for example, the consolidated guidance to intelligence officers and service personnel on the detention and interviewing of detainees overseas, and on the passing and receipt of intelligence relating to detainees, as well as the gateway provisions that allow for intelligence sharing in the Intelligence Services Act 1994 and the Security Service Act 1989.
In addition, the overseas security and justice assistance guidance provides an overarching mechanism that sets out which human rights and international humanitarian law risks should be considered prior to providing justice or security sector assistance. This is supplemented by the draft code of practice on equipment interference, which is clear about the safeguards on the handling of information. It seems to me that the protections, absolutely necessary though they are, are comprehensively dealt with by that variety of means, rendering the amendment unnecessary. I invite the hon. Gentleman to withdraw it.
Amendment, by leave, withdrawn.
Clause 113 ordered to stand part of the Bill.
Clause 114
Duty not to make unauthorised disclosures
‘(1A) For the purposes of subsection (1), it is in particular a reasonable excuse if the disclosure is made with the permission of the person issuing the warrant or the person to whom it is issued.”.
This amendment adds a “reasonable excuse” defence to the unauthorised disclosure offence in relation to equipment interference warrants.
My two points remain. The first is the consistency of the reasonable excuse defence. In some clauses it is there and in others it is not, and I cannot see the logic of when it is in and when it is out. Secondly, the Minister has already agreed that there must be a route for those who want to expose wrongdoing, so that disclosures can be made in the public interest where necessary. I have been pursuing those two points, and they are the same for this provision. I do not need to elaborate further.
We contend that amendment 650 is unnecessary. Clause 115(2)(b) provides that a disclosure is permitted if it is
“authorised by the person to whom the warrant is…addressed”.
Disclosure can also be authorised by virtue of this clause within the terms of the warrant, which will have been agreed by the person issuing the warrant and by a judicial commissioner. It is much better for an impartial senior judge to take a view on what is reasonable than it is for, say, a junior official or an employee of a telecommunications operator, no matter how diligent they might be; none the less, it is important that such people can raise concerns without fear of prosecution. That is why clause 203, in part 8, provides for an information gateway so that whistleblowers can take their concerns directly to the commissioner without fear of sanction under the Bill.
It is right that the Bill’s provisions reflect the sensitive techniques of the equipment interference agencies and maintain that it will be an offence to disclose the existence of a warrant. It is a well known and well rehearsed argument that the techniques and details of EI capabilities must be protected. The amendments in the round seek to achieve something that I submit is already well catered for in the Bill, and on that basis I ask the hon. and learned Gentleman to withdraw the amendment.
Amendment, by leave, withdrawn.
Clause 114 ordered to stand part of the Bill.
Clause 115 ordered to stand part of the Bill.
Clause 116
Offence of making unauthorised disclosure
“(3) In proceedings against any person for an offence under this section in respect of any disclosure, it is a defence for the person to show that the disclosure was in the public interest.”
“(3A) In proceedings against any person for an offence under this section in respect of any disclosure, it is a defence for the person to show that the disclosure was in the public interest.”
This amendment would provide a defence to the criminal offence of unauthorised disclosure in relation to a warrant issued under this Part. The offence includes disclosure of the existence and content of a warrant and disclosure of the steps taken to implement a warrant.
Amendment, by leave, withdrawn.
Clause 116 ordered to stand part of the Bill.
Clauses 117 and 118 ordered to stand part of the Bill.
Clause 119
Bulk interception warrants
“Saving this section, Part 6 shall not come into force until—
(a) the Secretary of State has established an independent review of the operational case for bulk powers contained in sections 119 to 173; and
(b) the review has been published and a copy laid before each House of Parliament.”
I remind members of the Committee that, as is set out in the code of practice, in contrast to targeted interception warrants issued under part 2, a bulk interception warrant instrument
“need not name or describe the interception subject or a set of premises in relation to which the interception is to take place”.
Chapter 1 also does not impose a limit on the number of communications that may be intercepted. For example, if the requirements of the chapter are met
“then the interception of all communications transmitted on a particular route or cable, or carried by a particular CSP, could, in principle, be lawfully authorised.”
That is directly from paragraph 6.2 of the code of practice. It gives a sense of how wide these bulk powers in the Bill are. When one has powers of such breathtaking width, there is a requirement for a high level of justification for their use, and I will come back after making some further preliminary points.
First, despite suggestions over the years that no enormous database would come into existence through the use of what, in truth, were bulk intercept warrants, it is now pretty clear that there is an enormous database, which is growing daily. Secondly, although it is right to say that bulk interception warrants are only authorised for overseas-related communications, the comfort we get from that is much more limited than might first appear. That is because, as the Joint Committee observed,
“given the global nature of the internet, the limitation of the bulk powers to “overseas-related” communications may make little difference in practice to the data that could be gathered under these powers.”
The ISC has confirmed that the Government considers that an “external communication” occurs
“every time a UK based person accesses a website located overseas, posts on a social media site overseas such as Facebook, uses overseas cloud storage or uses an overseas email provider such as Hotmail or Gmail—”
or searches on Google. Any communication that involves those external communications comes within the provisions of a bulk interception warrant. I accept that it cannot be targeted at somebody in this jurisdiction, but as I have said, the comfort that that gives is much more limited than might at first appear when one reads the legislation.
Thirdly, the sheer breadth of these warrants, if they are not carefully constrained, is capable of frustrating any meaningful review of necessity and proportionality. Those tests need to bite on something meaningful when one has a warrant as wide as these bulk warrants are potentially and in practice.
It is right to acknowledge that David Anderson, the ISC and the Royal United Services Institute panel all recommended that bulk powers should be set out in legislation, and they now are. They are avowed. The Bill sets them out and puts a framework of safeguards around them. That is welcome; it is as it should be and in accordance with those recommendations. If the Bill passes, it will increase accountability in relation to the exercise of these warrants, which until now have been exercised under implied powers without the safeguards in the Bill. But—and it is a big “but”—this is the first time that Parliament has had the chance to scrutinise those bulk powers. The argument that they already exist and are already in use is no answer to the need for close scrutiny, because until now the House has not had the chance to scrutinise them.
The first step in scrutiny is to consider the operational case, which sets out the overall need for bulk powers. An operational case was published by the Government alongside the Bill, which is welcome, but it is inadequate. It is a 47-page document and much of it is purely introductory. On average, only five pages are allocated to addressing the capabilities for each bulk power. There are four pages for bulk interception, seven pages for bulk equipment interference, six pages for bulk communications data acquisition, and five pages for bulk personal datasets. Each power is supported by a handful of one-paragraph case studies. We understand that further material has been provided to the ISC, but no formal assessment of that material and no report of the ISC has been made available to the Committee, although of course we heard the comments of the Chair of the ISC on Second Reading. Incidentally, we will be writing to him to ask him to outline the general nature of that material and what formal assessment the ISC made.
The operational case that has been published is inadequate, for the reasons that I have set out, and lacking any independent evaluation, which was a recommendation of the Joint Committee. The Labour party has been pushing for that evaluation from the start of the scrutiny of the Bill; it is why we tabled new clause 16. We say to the Government that it is not too late to carry out the evaluation that has been called for for some time. New clause 16 is not intended to delete clause 119 or to suggest that there could be no justification for bulk intercept warrants, particularly since they have been used. The intention is to put down a marker in saying that part 6 will not come into force until the Secretary of State has established an independent review of the operational case for the powers in clauses119 to 173—that is all the bulk powers, which is why it is a new clause rather than an amendment to clause 119—and the review has been published and before each House.
I want to pick up on some of the specifics of the clause. In clause 119(4)(c) and (d) it is clear that a bulk intercept warrant authorises not just interception but examination within the interception. That is extremely important, because one of the arguments that I have sought to make consistently is that the wider the power to gather, harvest or hoover up communications or data, the greater the need for thresholds and careful safeguards when that material is accessed. Under subsection (4)(c) and (d) the bulk intercept warrant provides not only for the interception of communications but for selection for examination—in other words, it deals with part 2 at the same stage as part 1, so it is important to pay careful regard to the safeguards in place. I will make the argument about safeguards when I get to clause 121, which sets out the necessity of the proportionality test; at this stage I am merely flagging up that we are talking about both the wider power and the access power and reminding the Committee that although there are some protections for the communications of those in the British islands, the protection does not extend to secondary data.
The only other point that I wanted to make at this stage relates to the code of practice, paragraph 6.12:
“Where a bulk interception warrant results in the acquisition of large volumes of communications, the intercepting agency will usually apply a filtering process to discard automatically communications that are unlikely to be of intelligence value.”
We saw last week express provisions for filtering arrangements in other parts of the Bill. As far as I can ascertain, there are no express filtering provisions in relation to bulk intercept warrants. For the record, what does the Minister say the power is for that middle exercise of filtering between the acquisition of the information and accessing it?
To be clear about how I think it is intended that that should work, the code of practice suggests later that what will happen in general, accepting that a huge volume of communications is likely to be affected by a bulk warrant, is that automated systems will be in place. On the scope of what we are talking about, paragraph 6.57 of the code of practice makes it clear:
“More than one operational purpose may be specified on a single bulk warrant; this may, where the necessity and proportionality test is satisfied, include all operational purposes currently in use. In the case of bulk interception, overseas-related communications relevant to multiple operational purposes will necessarily be transmitted and intercepted together under the authority of a bulk interception warrant. In the majority of cases, it will therefore be necessary for bulk interception warrants to specify the full range of operational purposes.”
That makes it clear that under one warrant, there are likely to be numerous operational purposes and a huge amount of data gathered. The idea that there will be one warrant for each operational purpose would be a misunderstanding of how the powers have been and undoubtedly will be used if the Bill is passed. It appears, from paragraph 6.59, that what will then happen is that
“automated systems must, where technically possible, be used to effect the selection in accordance with section 134 of the Act.”
There will be an automated filtering process.
These are very wide powers requiring close scrutiny and high levels of justification. Until there is independent evaluation of an operational case, the clauses should not come into force.
The Government have produced an operational case in response to remarks made by a number of witnesses before the Joint Committee on the Draft Investigatory Powers Bill, who were concerned about the lack of such a case, and to the Joint Committee’s recommendation 23. The Home Office published a 47-page operational case for bulk powers alongside the Bill. That document was produced within three weeks, and the first half of it is introductory, covering topics such as how the internet works and what the dark net is. Only the second half of the document, characterised as an operational case, addresses the capabilities with which we are concerned.
Going goes through the operational case, we can see that each power—bulk interception, bulk equipment interference, bulk communications data acquisition and bulk personal datasets—has an average of about five pages devoted to it. Bulk interception has only about four. Most of the material dealt with is already public in other explanatory documents. It seems that, despite the opportunity to provide concrete, solid examples of how bulk powers bring unique value, most of the material in each section is kept at a high and general level.
For example, the first three pages of the four-page case justifying bulk interception cover an introduction to the power, the current legal position and new safeguards in the Bill. The fourth and final page provides three one-paragraph case studies, which members of the Committee will all have had the opportunity to read. One in particular deals with counter-terrorism, giving an example of where the security and intelligence agencies’ analysis of bulk data uncovered a previously unknown individual in 2014 who was in contact with a Daesh-affiliated extremist in Syria suspected of involvement in attack planning against the west.
The case study says:
“As this individual was based overseas, it is very unlikely that any other intelligence capabilities would have discovered him. Despite his attempts to conceal his activities, the agencies were able to use bulk data to identify that he had recently travelled to a European country. Meanwhile, separate intelligence”—
that is, separated from the bulk-generated intelligence—
“suggested he was progressing with attack planning. The information was then passed by the agencies to the relevant national authorities. They disrupted the terrorists’ plans and several improvised explosive devices were seized.”
Undoubtedly, every hon. Member on the Committee and in the House would wish such activities to be intercepted and prevented by the security services. I applaud the security services for the work that they do, but what concerns me is that analysing this case study in any meaningful way is challenging, because there is inadequate information to begin to test the accuracy of the case study or to challenge its conclusions. Nevertheless, I have had some initial analysis of it carried out, which suggests that perhaps the ends could just as easily have been achieved by the use of targeted interception. I will give a couple of examples to show why.
The case study refers to a previously unknown individual who was in contact with a Daesh-affiliated individual, who presumably was known. It is possible, therefore, that targeted interception may have uncovered this previously unknown individual. Although the Daesh-affiliated individual was already being monitored, there is no clear explanation in the case study of why bulk interception was necessary. It seems likely that intercepting the Daesh-affiliated individual’s contacts in a targeted manner might have identified the previously unknown individual.
That is just one of a number of issues raised about this case study by the analysis that I have had carried out. I will not take up the Committee’s time with them all, but that is one example.
The value that this case study has is that in this case a previously unknown individual was identified. Questions as to why targeted interception would not have worked are not addressed, nor are questions as to why other targeted capabilities were not used. The case study suggests that the initial identification is the only aspect in which bulk interception played a role, with the rest of the case study a result of other capabilities and separate intelligence. No information is provided about the scale of collateral intrusion undertaken when intercepting in bulk and there is no assessment of the proportionality of bulk interception. Also, given that the attack was not in the UK, there is no explanation of the necessity of UK agencies playing a role, although that is perhaps a slightly lesser consideration.
There is no information outside this case study as to the frequency of events of this kind or whether in similar cases different methods produced different results. As such, it is impossible to analyse it and make any kind of independent assessment of the necessity or proportionality of bulk power.
This is not nit-picking. These are very wide-ranging powers. The hon. and learned Member for Holborn and St Pancras, who speaks for the Opposition, described them as breathtakingly wide powers. They have never before been debated or voted on in this Parliament, and it is crucial that we get them right. We are debating and voting on them, at a time and in a climate whereby there is quite a lot of independent evidence available from the United States of America that suggests that bulk powers are not as efficacious as is suggested in the operational case produced by the Government.
I will say a little about what happened in the States, because it is important to loop to that to understand what the Scottish National party says would be the appropriate way to approach the production of an operational case to justify bulk powers.
In the USA, the Snowden revelations revealed that the National Security Agency was running a bulk domestic telephone records programme. The US intelligence community put forward strong arguments for keeping that programme going, and to bolster its position it compiled a list of 54 counter-terrorism events in which it said that section 215 of the USA Patriot Act, which underlined that bulk collection, contributed to a success story.
In America, two independent bodies undertook reviews related to those powers to determine whether the case studies put forward by the intelligence agencies were credible and accurate. They determined that only 12 of the 54 counter-terrorism events cited by the security services had any relevance to the exercise of bulk powers under section 215 of the USA Patriot Act. With access to classified material, one of the independent groups— the President’s Review Group on Intelligence and Communications Technologies, which is a very high-powered body set up under the auspices of President Obama—concluded:
“Our review suggests that the information contributed to terrorist investigations by the use of section 215 telephony metadata was not essential to preventing attacks and could readily have been obtained in a timely manner using conventional section 215 orders”.
The other body, the Privacy and Civil Liberties Oversight Board, concluded very similarly that the programme of bulk collection under section 215 had
“shown minimal value in safeguarding the nation from terrorism. Based on the information provided to the Board, including classified briefings and documentation, we have not identified a single instance involving a threat to the United States in which the program made a concrete difference in the outcome of a counterterrorism investigation. Moreover, we are aware of no instance in which the program directly contributed to the discovery of a previously unknown terrorist plot or the disruption of a terrorist attack.”
I quote those two bodies because they are independent.
I am aware that Mr William Binney, who previously worked for the National Security Agency, gave evidence to the Joint Committee. His evidence could be summarised as “bulk powers cost lives”. He is concerned about the “needle in a haystack” argument. I am aware from previous discussions that certain members of the Committee have concerns about the evidence of Mr Binney. Even if we set his evidence to one side, we cannot set to one side the evidence of those two very high-level, independent American committees that looked at bulk collection in the USA. Their conclusions seriously question the information they were given by the security services that the bulk powers were necessary to prevent terrorist outrages. They also made suggestions on existing targeted capabilities.
“GCHQ explained that its bulk access capabilities are the critical enabler for the cyber defence of the UK, providing the vast majority of all reporting on cyber threats and the basis for counter-activity.”
“The six outline examples at Annex 9 to this Report go a little way towards remedying that defect. They illustrate the utility of bulk data capabilities more generally”.
He recognises the limitations, but still acknowledges the efficacy of the powers.
We know, because the Home Secretary has told us—there was an interesting article about this in The Guardian today—that the bulk powers have been running for a long time. The headline of the article is, “UK spy agencies have collected bulk personal data since 1990s, files show”.
I will come back to that article in a moment, but we know that the bulk powers are operational. Given that they have been running for a while, a full list of cases where they have been required should be easy to provide. That should not be to this Committee, but to an independent review staffed by high-level individuals with the highest security clearance—the sort that David Anderson has. I have in mind such people as retired judges and retired professionals with an interest in the area.
I am suggesting that there should be independent, security cleared assessors to consider whether such powers pass the legal tests of necessity and proportionality. They would need to conclude that the powers were strictly necessary and that the same results could not be achieved using more proportionate and less intrusive means. The two American committees I mentioned concluded that the same information could be achieved using more proportionate and less intrusive means, so we in the United Kingdom should not legislate gung-ho for the continuation of such breathtakingly intrusive surveillance powers without being certain that they are necessary and proportionate. We do not have sufficient evidence to reach that conclusion.
I will not be side tracked by a suggestion that I am criticising David Anderson, because I am not—I make that absolutely clear. His review, “A Question of Trust”, was published prior to the Joint Committee of these Houses saying that a sufficient case has not been produced for bulk powers. David Anderson’s report was taken into account by the Joint Committee. I know that some members of this Committee, including the hon. Member for Fareham, sat on the Joint Committee, and one of its conclusions, recommendation 23, was:
“We recommend that the Government should publish a fuller justification for each of the bulk powers alongside the Bill. We further recommend that the examples of the value of the bulk powers provided should be assessed by an independent body, such as the Intelligence and Security Committee or the Interception of Communications Commissioner.”
The Joint Committee said that in the full knowledge of David Anderson’s report, having read and considered it. My point is that such operational case as has been produced by the Government does not live up to the Joint Committee’s recommendation 23, and does not adequately provide an operational case for the powers.
“Though I seek to place the debate in a legal context, it is not part of my role to offer a legal opinion (for example, as to whether the bulk collection of data as practised by GCHQ is proportionate). A number of such questions are currently before the courts, which have the benefit of structured and opposing legal submissions and (in the case of the IPT) the facility to examine highly secret evidence, and which are the only bodies that can authoritatively determine them.”
There we have the words of the man himself. Although David Anderson seeks to place the debate in a legal context, he does not see it as part of his role to offer a legal opinion on the proportionality of GCHQ’s bulk collection of data. At least two cases now before the courts will result in judgments on whether the powers are proportionate.
“not persuaded of the case for”
an additional independent review of bulk powers, as
“it would be very difficult to say that the ISC had not had an independent look at these issues.”––[Official Report, Investigatory Powers Public Bill Committee, 24 March 2016; c. 6, Q2.]
The quote from David Anderson that she is using comes from the very beginning of his report, in which he sets out his general approach to his work. In an effort to make her an even more accomplished advocate than she already is, my advice would be to drop Anderson from her argument.
Those of us who sat through David Anderson’s evidence in Committee on 24 March might also remember that he discussed the different views held about the legality of bulk powers. He said that, ultimately, that will be determined by the courts. The thrust of my argument is that given the serious concerns expressed by two independent United States committees, and the serious concerns about the legality of the powers, we should not be gung-ho about putting them in legislation until we have a proper operational case and have seen the outcome of the litigation. That is a thoroughly respectable approach to part 6, and one that is in accordance with the rule of law.
I can reassure the hon. Member for North Dorset that I have no intention of following the United States of America’s security policy. We should devise our own policy in the United Kingdom, so long as it remains the United Kingdom. I am saying that we should set up an independent review body, made up of people from the United Kingdom—not the Americans or French; let us not panic about the French or the Americans telling us what to do. I am suggesting that our own people, if I may use that phrase, should be on the body. I mentioned the American experience to show that our key ally in such matters has, as a result of two very high-level congressional committees, reached the view that bulk powers are not justified. That is my point; it is not that we should do what the Americans tell us to do. I can assure the Committee that that is far from being the position of the Scottish National party. My point is that we should look to the experience in other countries to inform our decision making.
“has been going on for longer than previously disclosed while public knowledge of the process was suppressed for more than 15 years.”
According to the article, The Guardian has surveyed the paperwork, which shows that the
“frequency of warnings to intelligence agency staff about the dangers of trespassing on private records is at odds with ministers’ repeated public reassurances that only terrorists and serious criminals are having their personal details compromised…For example, a newsletter circulated in September 2011 by the Secret Intelligence Agency (SIS), better known as MI6, cautioned against staff misuse.”
That internal newsletter said:
“We’ve seen a few instances recently of individuals crossing the line with their database use…looking up addresses in order to send birthday cards, checking passport details to organise personal travel, checking details of family members for personal convenience”.
The internal memo goes on to say:
“Another area of concern is the use of the database as a ‘convenient way’ to check the personal details of colleagues when filling out service forms on their behalf. Please remember that every search has the potential to invade the privacy of individuals, including individuals who are not the main subject of your search, so please make sure you always have a business need to conduct that search and that the search is proportionate to the level of intrusion involved.”
It adds that, where possible, it is better to use “less intrusive” means.
The papers also reveal that there has been disciplinary action. The article states:
“Between 2014 and 2016, two MI5 and three MI6 officers were disciplined for mishandling bulk personal data. Last year, it was reported that a member of GCHQ’s staff had been sacked for making unauthorised searches…The papers show that data handling errors remain a problem. Government lawyers have admitted in responses to Privacy International that between 1 June 2014 and 9 February this year, ‘47 instances of non-compliance either with the MI5 closed section 94 handling arrangements or internal guidance or the communications data code of practice were detected.’ Four errors involved ‘necessity and proportionality’ issues; 43 related to mistransposed digits and material that did not relate to the subject of investigation, or duplicated requests…Another MI5 file notes that datasets ‘contain personal data about individuals, the majority of whom are unlikely to be of intelligence or security interest’.”
I am conscious that I have taken up quite a bit of time with that submission. I will not take it any further. I have alluded to the fact that there are outstanding legal challenges, and I will make one or two more comments on clause 119. I have already made the point that the clause seeks to put bulk interception programmes that are already in operation on a statutory footing. They were disclosed for the first time by Edward Snowden in June 2013, and their existence has now been avowed by the Government. They have never before been debated or voted on by this Parliament. That is why I am taking my time with this point.
The approach that has been held to date is maintained in the clause. The bulk interception proposed by the clause will result in billions of communications being intercepted each day, without any requirement of suspicion, or even a discernible link to a particular operation or threat. I have information from Liberty that the agencies currently handle 50 billion communications per day. To put that in context, there are only 7 billion people in the world, and only 3 billion of them have access to the internet.
The Intelligence and Security Committee reported at the end of 2014 that there were just 20 warrants in place under section 8(4) of RIPA authorising this vast volume of interception. It is clear from the wording of the clause that although it purports to collect overseas-related communications, it will, for the reasons the hon. and learned Member for Holborn and St Pancras gave, collect the communications of persons who are resident in the United Kingdom. Internet-based communications have eradicated the distinction between external and internal communications. He told us that posts on social media sites overseas, such as Facebook, use overseas cloud storage, so the material there would be covered by clause 119.
Searches on Google are counted as an external communication. I do not know about other hon. Members, but I must do at least a dozen searches on Google per day. Those are external communications, even though I am a citizen of the United Kingdom. Be in no doubt: the handful of warrants that will be issued under this clause will be scooping up billions of communications by the United Kingdom’s citizens. Those communications will then sit somewhere and certain people in the security service will have unwarranted access to them. There are some people who do not respect the rules, as we know from the disclosures in The Guardian today, so there is that concern, as well as the concern about the security of the data. The vast majority of those communications that will be scooped up will be the communications of innocent people.
We are not saying that the security services should not have any powers. We have a nuanced approach to the Bill. Members of the Scottish National party did not sit on their hands and do nothing on Second Reading; we made a constructive contribution to the debate. However, I will not be dissuaded from holding these very serious concerns. They are not just my concerns; they are widely held, and there is strong evidence from one of our closest allies that they are well founded.
Let me be clear: a Google search by a person in the UK is not overseas-related. Clause 119 deals with overseas-related communications. Warrants must be targeted at overseas communications. That will provide strong protections for people on these islands.
The ISC privacy and security report concluded that it is unlawful for GCHQ to conduct indiscriminate interception. It is also impractical for it to do so. The hon. and leaned Lady must understand, as most members of this Committee do, that it would be impossible, undesirable and unnecessary for GCHQ to deal with all but a fraction of internet communications. The peculiar view that somehow those missioned to keep us safe are interested in a whole range of communications that bear no relation whatever to their task is—again, I am trying to measure my words carefully—unusual. I say that because it is certainly not the view of the vast majority of people in this country, who want those so missioned to have the powers necessary to guard us against very real threats.
The hon. and leaned Lady spoke, quoting the hon. and learned Member for Holborn and St Pancras, of breathtaking powers. I shall come to that in a moment. She needs to understand that the threats we face are equally—actually, I would say far more—breathtaking. Unless we equip those in the security and intelligence services and the law enforcement agencies with what they need to do their job, we will pay a very dear price indeed. That is what bulk powers are about.
The collection of large volumes of information through bulk powers and the use of those data are essential. Of course they have to be filtered, and search criteria must be applied, so that fragments of intelligence can be gathered and pieced together during the course of an investigation. This is, in essence, about establishing patterns of behaviour and confirming networks. That is what GCHQ is about. Unless we collect those large volumes of information, we cannot move to the targeted regime that the hon. and leaned Lady seeks. Through a mix of misunderstanding and misjudgment, she is making an unhelpful case to those of us who want the safeguards to be as sure and certain as they need to be; I entirely take the point about “need”.
The ISC plays an important role in these matters, and the hon. and learned Gentleman acknowledged that the Chairman of the ISC made it clear on Second Reading that he was convinced by the information that was made available to him in his special role that these powers were necessary and exercised proportionately. The Joint Committee on the draft Bill looked at these matters and, as my hon. Friend the Member for Fareham pointed out, also made it clear that it understood that bulk powers were important for the work of our security services, as I have said. But there is a case for looking at these matters carefully and, despite listening to the speech of the hon. and learned Lady, I am not by any means dissuaded from that case. She was taking me to that place, but fortunately from the perspective of those who want to get this right, I did not quite get there.
I remain open to argument about this issue. I will say no more than that at this juncture. It is important that we make a robust case for bulk powers, and the best way of doing that is to be certain about the operational case, as the hon. and learned Gentleman suggested. There is also a debate to be had about safeguards, but, as he said, they are dealt with later in the Bill. No doubt we will have a short debate about them as well. It is important that we recognise that those safeguards are fit for purpose. They are clear that information that is not pertinent to the needs of the security services must be discarded, they are clear about the limits of the criteria under which searches take place, and they are clear about the content and secondary data that are obtained accordingly and what can and cannot be used. Nevertheless, we should explore and examine those matters.
The hon. and learned Gentleman also drew attention to filtering. It is important that data are filtered before they are obtained by a public authority. No provision expressly requires the filtering of data once they are obtained, but the code of practice sets out specific provisions in respect of filtering. We can have a further discussion about that if the Committee wishes.
I was thinking of Ruskin when the hon. and learned Lady was speaking. I often think of Ruskin, as you know, Mr Owen. Ruskin said that
On that basis, she tested my nobility to its very limit.
There is a clear difference on this subject in the Committee, and I suspect—I do not want to assume too much—that it is the difference between those parties that are in government, have been in government or aspire to be in government in this House, and those that are not, have not been or do not aspire to be. If that is a little unkind, I hope you will forgive the unkindness, Mr Owen—
This Committee is now considering the Bill following publication in its final form on Second Reading. In the Second Reading debate the Chairman of the Intelligence and Security Committee, a senior Member of this House who chairs a very important Committee, said that he was convinced that these powers were necessary. The hon. and learned Member for Holborn and St Pancras has argued for perhaps going further on the operational case.
“The present Committee and its predecessor are satisfied that the Government are justified in coming to Parliament to seek in broad terms the powers that the Bill contains. None of the categories of powers in the Bill—including the principle of having powers of bulk collection of data, which has given rise to controversy in recent years—is unnecessary or disproportionate to what we need to protect ourselves.”—[Official Report, 15 March 2016; Vol. 607, c. 836.]
He said that on the basis of the information provided to him, but in the knowledge that robust safeguards will govern the examination of data that have been collected in bulk and that it will be possible to select such data for examination only when it is necessary and proportionate for a specific operational purpose. What is happening in other places is, of course, of interest to us and of course we consider other jurisdictions, but my job is to listen to those who have examined the Bill with considerable diligence and in considerable detail, and to be guided by their conclusions.
In that spirit and with that purpose, I hope that we can move on to the next clause, having been persuaded, I hope, that what the Government are doing is perfectly reasonable.
“UK intelligence service GCHQ can legally snoop on British use of Google, Facebook and web-based email without specific warrants because the firms are based abroad, the government has said. Classed as ‘external communications’, such activity can be covered by a broad warrant and intercepted without extra clearance, spy boss Charles Farr said.”
Forgive me, but “spy boss” is BBC language. Charles Farr’s correct title was director general of the Office for Security and Counter Terrorism. He told Privacy International that
“Facebook, Twitter, YouTube and web searches on Google—“
Question put, That the clause stand part of the Bill.
Question put, That the clause stand part of the Bill.
Clause 120 ordered to stand part of the Bill.
Amendment 652, in clause 121, page 98, line 12, leave out subsection (3).
Amendment 653, in clause 121, page 98, line 26, at end insert—
‘(7) Where an application made by, or on behalf of, the Secretary of State includes the activities set out in section 119(4)(c) or (d), a bulk interception warrant can only be issued if the Secretary of State considers that selection for examination or disclosure is necessary—
(a) for a purpose under subsection (8), and
(b) it is necessary to obtain the data—
(i) for a specific investigation or a specific operation, or
(ii) for the purposes of testing, maintaining or developing equipment, systems or other capabilities relating to the availability or obtaining of data.
(8) The paragraph 7(a) purposes are—
(a) the interests of national security,
(b) preventing or detecting serious crime or preventing serious disorder,
(c) the interests of public safety,
(d) protecting public health,
(e) preventing death or serious injury or any serious damage to one or more person’s physical or mental health,
(f) assisting investigations into alleged miscarriages of justice,
(g) where a person (“P”) has died or is unable to identify themselves because of a physical or mental condition—
(i) to assist in identifying P, or
(ii) to obtain information about P’s next of kin or other persons connected with P or about the reason for P’s death or condition, or
(h) exercising functions relating to—
(i) the regulation of financial services and markets, or
(ii) financial stability.’.
Amendment 674, in clause 138, page 110, line 1, leave out subsection (b).
Amendment 675, in clause 138, page 110, line 4, leave out subsection (3).
Amendment 676, in clause 138, page 110, line 46, at end insert—
‘(11) Where an application made by, or on behalf of, the Secretary of State includes the activities set out in section 138(7)(b) or (c), a bulk acquisition warrant can only be issued if the Secretary of State considers that selection for examination or disclosure is—
(a) necessary for a purpose within subsection (12), or
(b) that it is necessary to obtain the data—
(i) for the purposes of a specific investigation or a specific operation, or
(ii) for the purposes of testing, maintaining or developing equipment, systems or other capabilities relating to the availability or obtaining of data.
(12) A paragraph 11(a) purpose is—
(a) the interests of national security,
(b) preventing or detecting serious crime or of preventing serious disorder,
(c) the interests of public safety,
(d) protecting public health,
(e) preventing death or serious injury or any serious damage to one or more person’s physical or mental health,
(f) assisting investigations into alleged miscarriages of justice,
(g) where a person (“P”) has died or is unable to identify themselves because of a physical or mental condition—
(i) to assist in identifying P, or
(ii) to obtain information about P’s next of kin or other persons connected with P or about the reason for P’s death or condition, or
(h) exercising functions relating to—
(i) the regulation of financial services and markets, or
(ii) financial stability.’.
In essence, our position is not to seek to reduce the capabilities of the security and intelligence services, which of course currently operate the powers in question under other authorisations. We seek to ensure that there is proper justification for bulk powers—hence new clause 16, which we will vote on at the end, which would delay the provisions from coming into force until an independent evaluation has taken place. I speak only for my party in saying that there is no intention to reduce the capabilities of the security and intelligence services. I am not suggesting for a moment that there is any intention to do that on anybody else’s behalf, but I am simply making my position clear. I am not speaking for anybody else, because I should not.
The Bill brings a legal framework and definition to the powers, and a set of safeguards to go with the exercise of those powers. I think that is important. If the powers are to be exercised, I would rather they were exercised within a proper legal framework, with more effective safeguards than under the current framework. I think that is the only real difference of approach between us.
What we all have to bear in mind is not whether we personally have been persuaded by the case that the powers are justified, because we all have different experiences and backgrounds—I worked with the security and intelligence services for five years on very serious terrorist cases—but whether members of the public can have confidence that they are. That is why we have been pressing for further consideration and independent assessment of the operational case.
Clause 121 deals with the first part of the safeguards on the exercise of the bulk powers—the test of necessity and proportionality. The clause is in familiar form. Subsection (1) states that the Secretary of State has to consider
“that the main purpose of the warrant is one or more of the following…the interception of overseas-related communications, and…the obtaining of secondary data”
and then that
“the warrant is necessary…in the interests of national security,”
or on
“grounds falling within subsection (2)”
Subsection (2) adds that the warrant can be
“for the purpose of preventing or detecting serious crime, or…in the interests of the economic well-being of the United Kingdom”.
I will not test the Committee’s patience by going over the same ground about the economic wellbeing of the United Kingdom being relevant to the interests of national security. The point that I have made consistently on that applies just as much to clause 121, but I will not repeat it.
It is important to appreciate that the necessity of proportionality test set out in subsections (1)(b) and (2) has very broad criteria. When the Secretary of State is considering a warrant, clause 121(1)(d) requires him or her to consider that
“each of the specified operational purposes…is a purpose for which the examination of intercepted content or secondary data obtained under the warrant is or may be necessary”.
On the face of it, that provides some comfort. That is the examination part of the exercise, and it is important because it recognises the distinction that I have made between collating or bringing together data and accessing it. It relates to accessing, because it involves
“a purpose for which…examination…under the warrant is or may be necessary”,
which brings us into the territory of what the test is for examining the data that has been collected. As I said, the Bill states that the Secretary of State will consider
“each of the specified operational purposes”.
However, in clause 125(4), we get into a circular argument. It states:
“In specifying any operational purposes, it is not sufficient simply to use the descriptions contained in section 121(1)(b) or (2)”,
the two provisions to which I have just referred. It is not enough to say, “It is necessary for the operational purposes of national security or preventing serious crime,” or, “It is in our economic interests.” That is not enough,
“but the purposes may still be general purposes.”
That is all there is on the subject in the Bill. At the vital stage when we move from hoovering up or collecting communications to accessing them, the test of necessity and proportionality bites on something that is not quite as general as national security, which would not be much of a test at all, but could be not much more than that—“general purposes”. That is a cause for concern, which has prompted our amendments to tighten it up.
In crafting the amendments, we have had one eye on the code. I refer to paragraph 6.19, which suggests that some detail should be put in the application, stating:
“Each application, a copy of which must be retained by the applicant, should contain the following information:
Background to the operation in question:
Description of the communications to be intercepted and/or from which secondary data will be obtained, details of any CSP(s) and an assessment of the feasibility of the operation…
Description of the conduct to be authorised, which must be restricted to the interception of overseas-related communications…
The operational purposes for which the content and secondary data may be selected”.
What is envisaged in the code includes:
“An explanation of why the interception is considered to be necessary…A consideration of why the conduct to be authorised by the warrant is proportionate…An assurance that intercepted content and secondary data will be selected for examination only so far as it is necessary”
under section 134. Paragraph 6.26 of the code adds further guidance on necessity and suggests, at the bottom of page 43:
“For example, if a bulk interception warrant is issued in the interests of national security and for the purpose of preventing or detecting serious crime, every specified operational purpose on that warrant must be necessary for one…of these two broader purposes.”
So the code operates on the basis that the detail will be provided in the application, even though it is not necessary under the Bill. I would therefore have thought it would be hard for the Minister and the Government to resist the amendments, which would simply lift the requirement to include the detail in the application from the code and put it into the Bill, so that we and the public could be assured that the test would be stricter than the combined effect of clauses 121 and 125(4).
Perhaps I am not making my point clearly enough. If in the end the necessity and proportionality requirements in the Bill for the bulk power and for access are no different, then no real distinction is being made between the two. I think a real distinction should be made in the Bill, to make it clear to everyone that at the point when material is to be accessed or examined, there is a higher threshold and a higher requirement to be specific. That would reflect what is in the code, and that is the spirit in which we tabled the amendments.
Of course, there is a balance to be struck. I think we have got the balance right, and I will therefore resist the amendment, not because I do not understand the thinking behind it or its purpose but because I err on David Anderson’s side of the argument and think that these matters should be in the codes of practice.
However, as I have said repeatedly—I make no apology for amplifying this—the codes are, at this juncture at least, a moveable feast. We have published draft codes with the intention that they should be refined over time on the basis of the arguments we hear here and elsewhere. It may be that we can strengthen the wording in the codes if the hon. and learned Gentleman feels that is the right thing to do. I would have no objection to doing that, but on the basis I have outlined, I will resist his amendment.
Amendment, by leave, withdrawn.
Question put, That the clause stand part of the Bill.
‘(4) Material obtained via a warrant under this Part may only be shared with overseas authorities in accordance with the terms of an information sharing treaty”.
I am sure it will be to the relief of many Committee members if I indicate that I anticipate that we will now move at greater speed, because each of the bulk powers sits within a framework of safeguards that is similar throughout the Bill. The amendment deals with warrants affecting overseas operators. We have rehearsed the arguments either way on more than one occasion, so I do not intend to repeat them.
Amendment, by leave, withdrawn.
Question put, That the clause stand part of the Bill.
“review the Secretary of State’s conclusions as to the following matters”
and insert “determine”.
Amendment 663, in clause 123, page 99, line 18, leave out subsection (2).
Amendment 531, in clause 123, page 99, line 19, at end insert
“but a Judicial Commissioner may not approve a warrant unless he is satisfied that there are reasonable grounds for believing that it is both necessary and proportionate to do so”.
This amendment would clarify the judicial review process by ensuring that both the process and underlying facts of an interception of communications warrant are considered by a Judicial Commissioner.
Amendment 677, in clause 139, page 111, line 3, leave out
“review the Secretary of State’s conclusions as to the following matters”
and insert “determine”.
Amendment 678, in clause 139, page 111, line 15, leave out subsection (2).
Amendment 532, in clause 139, page 111, line 16, at end insert
“but a Judicial Commissioner may not approve a warrant unless he is satisfied that there are reasonable grounds for believing that it is both necessary and proportionate to do so”.
This amendment would clarify the judicial review process by ensuring that both the process and underlying facts of an interception of communications warrant are considered by a Judicial Commissioner.
Amendment 533, in clause 157, page 123, line 16, at end insert
“but a Judicial Commissioner may not approve a warrant unless he is satisfied that there are reasonable grounds for believing that it is both necessary and proportionate to do so”.
This amendment would clarify the judicial review process by ensuring that both the process and underlying facts of an interception of communications warrant are considered by a Judicial Commissioner.
Nevertheless, I am not going to persuade anybody who is yet unpersuaded by repeating the arguments. They are essentially the same and they have been consistent throughout the Bill. If there is to be any change on the judicial test, it needs to be consistent throughout the Bill, one way or another.
Amendment, by leave, withdrawn.
Question put, That the clause stand part of the Bill.
Question put, That the clause stand part of the Bill.
Clause 124 ordered to stand part of the Bill.
“but the purposes may still be general purposes”
and insert
“and any specification must be described in as much detail as is reasonably practicable”.
Amendment 665 would require that bulk interception warrants “must” specify all operational purposes. In the Government’s drafting, the word is “may”. I am sympathetic to the amendment, but I do not think it is necessary. The purpose of the clause is simply to clarify that a bulk interception warrant may include multiple operational purposes. That is necessary because overseas-related communications, which are relevant to multiple operational purposes, will necessarily be transmitted and intercepted together under the authority of a bulk interception warrant. In the majority of cases, it will therefore be necessary for bulk interception warrants to specify the full range of operational purposes in use at a particular time. I submit that the Bill is sufficiently clear on that point without the amendment. On that basis, I invite the hon. and leaned Gentleman to withdraw it.
Amendment, by leave, withdrawn.
Question put, That the clause stand part of the Bill.
Duration of warrants
Amendment, by leave, withdrawn.
Clause 126 ordered to stand part of the Bill.
Question put, That the clause stand part of the Bill.
Clause 127 ordered to stand part of the Bill.
This amendment makes a minor drafting clarification (to address the case where, before its modification by virtue of clause 128(2)(b), a bulk interception warrant authorised or required only one of the activities mentioned in that provision).
This is a technical amendment; it is self-explanatory. Obviously, if any colleague wants me to explain it, I will, but I think that for the sake of brevity I will leave it at that.
Amendment 610 agreed to.
“(c) may only be made if the Secretary of State considers that it is proportionate to the operational purposes specified in the warrant.”
‘(7A) A minor modification—
(a) may be made only if the Secretary of State or a senior official acting on behalf of the Secretary of State considers that it is necessary on any of the grounds on which they consider the warrant to be necessary (see section 121(1)(b)).
(b) may only be made if the Secretary of State considers that it is proportionate to the operational purposes specified in the warrant.
(7B) Except where the Secretary of State considers that there is an urgent need to make the modification, a minor modification has effect only if the decision to make the modification is approved by a Judicial Commissioner.”
Amendment 669, in clause 128, page 102, line 5, at end insert—
‘(7C) In a case where any modification is sought under this section to which section [NC2 Items subject to legal privilege] or section [NC11 Confidential and privileged material] applies, section 97 (approval of warrants by Judicial Commissioners) applies to a decision to modify a warrant as it applies in relation to a decision to issue such a warrant (and accordingly any reference in that section to the person who decided to issue the warrant is to be read as a reference to the person who decided to modify it)”.
Amendment 670, in clause 128, page 102, line 29, at end insert—
‘(14) Any modification which constitutes the adding or varying of any matter must be approved by a Judicial Commissioner in accordance with section 123.”
Amendment 685, in clause 144, page 113, line 32, at end insert—
“(c) may only be made if the Secretary of State considers that it is proportionate to the purposes specified in the warrant.”
Amendment 686, in clause 144, page 114, line 1, at beginning insert—
‘(8A) A minor modification may only be made—
(a) if the Secretary of State or a senior official acting on behalf of the Secretary of State considers that it is necessary on any of the grounds on which they consider the warrant to be necessary (see section 121(1)(b)).
(b) if the Secretary of State considers that it is proportionate to the purposes specified in the warrant.
(8B) Except where the Secretary of State considers that there is an urgent need to make the modification, a minor modification has effect only if the decision to make the modification is approved by a Judicial Commissioner.
(8C) In a case where any modification is sought under this section to which section [NC2 Items subject to legal privilege] or section [NC11 Confidential and privileged material] applies, section 97 (approval of warrants by Judicial Commissioners) applies to a decision to modify a warrant as it applies in relation to a decision to issue such a warrant (and accordingly any reference in that section to the person who decided to issue the warrant is to be read as a reference to the person who decided to modify it).”
Amendment 525, in clause 144, page 114, line 19, at end insert—
‘(13) Any modification which constitutes the adding or varying any matter must be approved by a Judicial Commissioner in accordance with section 139.”
This amendment adds the requirement to obtain approval from a Judicial Commissioner for any modification which constitutes the adding or varying (but not removing) any matter for each type of warrant.
Amendment 526, in clause 164, page 128, line 10, at end insert—
‘(14) Any modification which constitutes the adding or varying any matter must be approved by a Judicial Commissioner in accordance with section 157.”
This amendment adds the requirement to obtain approval from a Judicial Commissioner for any modification which constitutes the adding or varying (but not removing) any matter for each type of warrant.
In light of the ongoing discussions about modifications in general, I take it that all the modification provisions come within the same further consideration that I know the Government are giving to modifications, and I will not say anything more about it. However, I cannot resist saying that subsection (6) perhaps gives an example of how one could achieve approval by judicial commissioners of all major modifications.
It is interesting that subsection (6) is markedly different to the provision in clause 30. In other words, some thought has been given by whoever drafted clause 128 to how one gets major modifications back through the judicial commissioner, but that was not a technique deployed in clause 30. I simply point that out because it perhaps gives further strength to my argument that that is the correct way of dealing with these modifications, not only in this clause but in all clauses, and to similar effect. However, as I have said, we have rehearsed these discussions and I will not add to them on modification.
Amendment, by leave, withdrawn.
This amendment is consequential on amendment 612.
“A major modification…must be made by the Secretary of State”—
he will see that the authority still rests with the Secretary of State.
Amendment 611 agreed to.
Amendment made: 612, in clause 128, page 102, line 17, leave out from beginning to “the” in line 22 and insert—
“( ) If it is not reasonably practicable for an instrument making a major modification to be signed by the Secretary of State, the instrument may be signed by a senior official designated by the Secretary of State for that purpose.
( ) In such a case, the instrument making the modification must contain a statement that—
(a) it is not reasonably practicable for the instrument to be signed by the Secretary of State, and
(b) ”.—(Mr John Hayes.)
This amendment enables an instrument making a major modification of a bulk interception warrant to be signed by a senior official in any case where it is not reasonably practicable for the Secretary of State to sign it.
Question put, That the clause, as amended, stand part of the Bill.
“ending with the fifth working day after the day on which”
and insert “of 48 hours after”.
“ending with the fifth working day after the day on which”
and insert “of 24 hours after”.
Amendment, by leave, withdrawn.
Question put, That the clause stand part of the Bill.
Question put, That the clause stand part of the Bill.
Clause 130 ordered to stand part of the Bill.
“(3B) Subsection (3) shall not be applicable where the person outside the United Kingdom has its principal office in a country or territory where it is established, for the provision of services with which the United Kingdom has entered in to an international mutual assistance agreement or is subject to an EU mutual assistance instrument.”
This amendment would exclude the extraterritorial provision in cases where any mutual assistance arrangement exists between the UK and the provider’s jurisdiction. This amendment would continue to enable government to seek voluntary assistance from CSPs in non-MLA countries.
Amendment 521, in clause 147, page 115, line 39, at end insert—
“(3B) Subsection (3) shall not be applicable where the person outside the United Kingdom has its principal office in a country or territory where it is established, for the provision of services with which the United Kingdom has entered in to an international mutual assistance agreement or is subject to an EU mutual assistance instrument.”
This amendment would exclude the extraterritorial provision in cases where any mutual assistance arrangement exists between the UK and the provider’s jurisdiction. This amendment would continue to enable government to seek voluntary assistance from CSPs in non-MLA countries.
Amendment 524, in clause 167, page 129, line 39, at end insert—
“(3b) Subsection (3) shall not be applicable where the person outside the United Kingdom has its principal office in a country or territory where it is established, for the provision of services with which the United Kingdom has entered in to an international mutual assistance agreement or is subject to an EU mutual assistance instrument.”
This amendment excludes the extraterritorial provision in cases where any mutual assistance arrangement exists between the UK and the provider’s jurisdiction. This amendment would continue to enable government to seek voluntary assistance from CSPs in non-MLA countries.
Amendment, by leave, withdrawn.
“(7) A warrant may be implemented only to the extent required for the purpose for which the warrant was issued.”
This amendment would bring the implementation of warrants into line with section 16(8) of PACE 1984.
Amendment 529, in clause 147, page 116, line 6, at end insert—
“(6) A warrant may be implemented only to the extent required for the purpose for which the warrant was issued.”
This amendment would bring the implementation of warrants into line with section 16(8) of PACE 1984.
Amendment 530, in clause 167, page 130, line 12, at end insert—
“(7) A warrant may be implemented only to the extent required for the purpose for which the warrant was issued.”
This amendment would bring the implementation of warrants into line with section 16(8) of PACE 1984.
“it is necessary to undertake in order to do what is expressly authorised or required by the warrant”.
That clearly sets out the scope of the authorised conduct. Well intentioned though the amendments are, we submit that they are unnecessary.
Amendment, by leave, withdrawn.
Question put, That the clause stand part of the Bill.
Question put, That the clause stand part of the Bill.
Clause 132 ordered to stand part of the Bill.
Question put, That the clause stand part of the Bill.
Clause 133 ordered to stand part of the Bill.
This amendment makes a minor drafting correction.
This is a minor drafting correction to the clause. It is self-explanatory.
Amendment 613 agreed to.
Question put, That the clause, as amended, stand part of the Bill.
Amendment 505, in clause 135, page 108, line 14, at end insert “and
(c) where paragraph (b)(i) applies, compelling evidence indicates that the items in question consist of, or relate to, communications made for a criminal purpose such that it is necessary to authorise or require the selection for examination of those items.”
Amendment 509, in clause 135, page 108, line 22, leave out from “privilege” to end of line 25
Amendment 510, in clause 135, page 108, line 26, after “item”, insert “presumptively”.
Amendment 511, in clause 136, page 108, line 40, at end insert—
‘(3) Section 25 (items subject to legal privilege) applies in relation to an application for a bulk interception warrant as it applies in relation to an application for a targeted interception warrant.”
Amendment 512, in clause 171, page 133, line 38, after “items”, insert “presumptively”
Amendment 513, in clause 171, page 133, line 40, at end insert “and
(c) where paragraph (b)(i) applies, compelling evidence indicates that the items in question consist of, or relate to, communications made for a criminal purpose such that it is necessary to authorise or require the selection for examination of those items.”
Amendment 517, in clause 171, page 134, line 2, leave out from “privilege” to end of line 5
Amendment 518, in clause 171, page 134, line 6, after “item”, insert “presumptively”
Amendment 519, in clause 172, page 134, line 17, at end insert—
‘(2) Section 100 (items subject to legal privilege) applies in relation to an application for a bulk equipment interference warrant as it applies in relation to an application for a targeted equipment interference.”
In clause 25, the first time we looked at the matter, the distinction was important because the higher test in the Bill—exceptional and compelling circumstances—applied only to the situation in which legally privileged material was purposely targeted, and that test did not apply where it was not being targeted, but it might none the less be picked up because the items targeted would be likely to include material subject to legal privilege. I was uncomfortable with that distinction and I made my submissions at the time.
Curiously—this is understandable; it is not a criticism of different drafting hands in different parts of the Bill—when we get to clause 135, we have a version of the legal privilege provision that sets out in subsection (1)(b)(i) and (ii) both the purpose being to intercept or to obtain legally privileged material and the situation in which the use of the relevant criteria is likely to identify such items, so it sweeps up the targeted and the incidental, and then subjects both to the higher test.
For all the reasons I have set out, I do not think even that is enough, but when the Solicitor General looks again at all the provisions on legal privilege, I ask him to note that there is not even consistency through the statute, perhaps because it was differently drafted at different times. I cannot work out why under clause 25 incidental legally privileged material is not subject to the special test, but under clause 135 it is. I want to put that on the table and invite the Solicitor General to bear it in mind if he gives further consideration to how legally privileged material will be dealt with consistently through the Bill.
We have safeguards in place that we would say are strong. We are having a debate about that; I entirely concede that point. We are having a debate about items subject to legal profession privileges in circumstances where content collected under a bulk interception or equipment interference warrant is being selected for examination. That is the key stage. Before that, we are dealing with the stage of acquisition, not examination.
When content is being selected for examination for the purpose of identifying items subject to legal privilege, or selections such as under the distinction that we have discussed, clause 135, relating to the bulk interception provisions, is the relevant clause, together with clause 171, which deals with equipment interference provisions. That action requires approval from a senior official in the warrant granting department, only on the basis that they are satisfied that there are specific safeguards in place for the handling, retention, use and destruction of items that are subject to legal privilege. In addition, in circumstances when selection for examination is taking place for the purpose of identifying items subject to legal privilege, the senior official must be satisfied that the exceptional and compelling circumstances test that we have discussed is applicable. Furthermore, when an item that is subject to legal privilege is intercepted under a bulk interception warrant and is then retained following its examination, the investigatory powers commissioner must be informed of course.
My point about collection, and I think the hon. and learned Gentleman gets it, is that meaningful safeguards must be applied at that key point, because one does not know what one is getting. That is the wording, and that is why there is that difference in clause 135.
Briefly, the other amendments relate to the arguments about legal professional privilege, and the question whether there are circumstances in which material would not be covered by the iniquity exemption but would be of interest. We have discussed that point before, and I draw my remarks to a close on the same terms that we have discussed previously.
Amendment, by leave, withdrawn.
Question put, That the clause stand part of the Bill.
Question put, That the clause stand part of the Bill.
Clause 136 ordered to stand part of the Bill.
Question put, That the clause stand part of the Bill.
Clause 137 ordered to stand part of the Bill.
Ordered, That further consideration be now adjourned. —(Simon Kirby.)
Adjourned till Tuesday 26 April at twenty-five minutes past Nine o’clock.
IPB 69 Letter from the Rt Hon Owen Paterson MP
Contains Parliamentary information licensed under the Open Parliament Licence v3.0.