Equipment Interference (Code of Practice) Order 2015
(Limited Text - Ministerial Extracts only)
Read Full debate
Lord Bates
That the Grand Committee do consider the Equipment Interference (Code of Practice) Order 2015.
Relevant documents: 14th Report from the Secondary Legislation Scrutiny Committee, 11th Report from the Joint Committee on Statutory Instruments (Special attention drawn to the instrument)
The Minister of State, Home Office (Lord Bates) (Con)
My Lords, with the leave of the Committee I will also speak to the Regulation of Investigatory Powers (Interception of Communications: Code of Practice) Order 2015.
Members will know that on 4 November 2015 the Government published draft legislation relating to the security, intelligence and law enforcement agencies’ use of investigatory powers for pre-legislative scrutiny by a Joint Committee of Parliament. The intention is for the Bill to be introduced early in 2016 and enacted before the sunset provision in the Data Retention and Investigatory Powers Act 2014 takes effect on 31 December 2016. In the mean time, the Regulation of Investigatory Powers Act 2000 and the codes of practice made under it provide the legal basis for the essential investigatory techniques necessary to acquire the communications of those who mean us harm. Today we debate two codes of practice made under the existing legislation: an update of the existing code of practice on the interception of communications and a new code on equipment interference.
Interception is a vital tool that helps law enforcement and intelligence agencies to prevent and detect serious or organised crime and protect national security. It is also among the most intrusive powers available to law enforcement and the security agencies. For that reason, it is subject to strict safeguards in the Regulation of Investigatory Powers Act 2000 and the code made under it. Interception warrants are issued and renewed by the Secretary of State for a small number of agencies and for a strictly limited range of purposes. RIPA also provides for independent oversight by the Interception of Communications Commissioner and an impartial route of redress through the Investigatory Powers Tribunal.
The interception of communications code of practice first came into force in 2002 and needs updating. There is now far more that can be said about the safeguards that apply to security and law enforcement agencies’ exercise of interception powers and the revised version of the code includes that extra detail. On what is new in the code of practice, the safeguards described in these codes are not new in themselves. In respect of the interception code, the law enforcement and intelligence agencies have always had robust internal arrangements, overseen by the Interception of Communications Commissioner. The draft code provides more detail about those arrangements.
First, it provides additional information on the safeguards that exist for the interception and handling of external communications under Section 8(4) of RIPA—that is, the ability to undertake bulk interception. Secondly, it sets out further information on the protections afforded to legally privileged material and other confidential material. To give an example, the code requires the Secretary of State personally to consider the likelihood that privileged material will be intercepted when determining whether it is necessary and proportionate to grant a warrant. It also requires additional internal safeguards to be applied in cases where legally privileged material is intercepted, including that where such material is retained it must be reported to the independent Interception of Communications Commissioner. Thirdly, it includes minor changes to reflect developments in law and practice since the code first came into force in 2002. For example, it reflects regulations introduced in 2011 which amended RIPA to create the power for the interception commissioner to impose a fine for certain kinds of unlawful interception. Much of the new material on the safeguards that apply to the exercise of interception powers reflects information disclosed during legal proceedings in the Investigatory Powers Tribunal, and it is right that this information is included in codes of practice so that it easy for members of the public to access it.
The equipment interference code of practice is new. Equipment interference is a set of techniques used to obtain a variety of data from equipment. This includes traditional computers or computer-like devices such as tablets, smartphones, cables, wires and static storage devices. Equipment interference can be carried out either remotely or by physically interacting with equipment. It allows the security and intelligence agencies in particular to keep pace with terrorists and serious criminals, who increasingly use sophisticated techniques to communicate covertly and evade detection. Equipment interference has been instrumental in disrupting credible threats to life, including those against UK citizens. MI5 has relied on this capability in the overwhelming majority of high-priority investigations it has undertaken over the past 12 months.
The Security Service Act 1989 and the Intelligence Services Act 1994 provide the legislative basis for the security and intelligence agencies to interfere with computers and communications devices. Warrants may be issued by the Secretary of State only when he or she considers the activities to be authorised are necessary and proportionate. The use of the powers is subject to independent oversight by the Intelligence Services Commissioner. Prior to the draft code, which we are debating today, equipment interference powers have not had their own bespoke code of practice.
The code does not confer new powers, but simply makes public the robust internal safeguards that the intelligence agencies already apply. It brings greater transparency to the robust processes that the agencies adhere to when interfering with computer equipment to prevent terrorism, disrupt serious crime and identify and stop others who seek to harm us and our country. For the first time, this code of practice publicly sets out the stringent safeguards that the intelligence agencies apply to their use of equipment interference. This includes strict rules on how data acquired through equipment interference must be handled, how they must be securely and safely stored, and how they must be destroyed when it is no longer necessary or proportionate to hold them. The code also explains the consideration of necessity and proportionality that the Secretary of State must take before authorising any use of equipment interference. That ensures that this vital capability may be used only when the scope of the interference has been carefully considered and compared to the potential benefits of the operation. Furthermore, the code explains that equipment interference should not be considered a proportionate power if other less intrusive methods of acquiring the same data are possible.
Akin to the interception code of practice, this document also provides reassurance that the acquisition of legally privileged and confidential information is subject to even greater oversight and safeguards. The code sets out a series of tests that must be applied before any authorisation is granted and then the subsequent handling arrangements, should confidential material be acquired.
Finally, the code also provides information regarding the use of equipment interference targeted at equipment outside the British Isles. This section ensures that the public have a comprehensive guide to the use of equipment interference powers by the intelligence agencies and the range of safeguards and oversight that applies to such important activity.
The codes of practice contain no new powers; instead, they reflect the current safeguards applied by the relevant agencies. The purpose of the codes is to make more information publicly available about the stringent safeguards that the agencies apply in their use of investigatory powers. They ensure that the powers can be used only when it is necessary and proportionate and when it will help keep us safe from harm. I commend the orders to the House.
Lord Paddick (LD)
My Lords, I must first say that I am not an expert in this area. Our expert on this matter is on the Joint scrutiny Committee, which is about to sit. That is why he is not here. For this to come up when the people considering the draft investigatory powers Bill are elsewhere and engaged in that business is rather an unfortunate clash of tabling.
We are very concerned about interception, but that is and has been a widely known and accepted practice over the years, although the nature of that interception has obviously changed as means of communication have changed. It tends to be specific and targeted at particular individuals who, as the Minister said, intend to cause us harm or who are involved in serious crime. The code of practice on interception, which, as the Minister said, is an updated code of practice rather than a completely new one, is not the major area of concern for us.
We are very concerned about the use of equipment interference and the fact that very little—if any—debate has taken place, in Parliament or outside, about the use of these powers. While the Minister points to legislation that the security services rely on to carry out equipment interference, explicitly setting out what that means was not part of the discussion when those pieces of legislation were presented to Parliament. While what interception of communications involves is reasonably straightforward, equipment interference potentially means gaining complete access to a computer, for example. Speaking for myself, my life is on my computer. Therefore, if there were intrusion through equipment interference on to my computer, practically everything about me would be learnt by the security services, including websites I had visited and passwords that would give access to, for example, online banking. It is a much more intrusive power for the police and the security services than interception.
Hacking into computers and mobile phones was made an offence in the Computer Misuse Act 1990. My understanding is that a clause introduced in the then Serious Crime Bill 2015 exempted the police and the security services from that provision. Does the Minister accept that engagement in equipment interference by the police and the security services between 1990 and 2015 must therefore have been illegal because it was an offence under the Computer Misuse Act 1990, the exemption not coming in until 2015?
As far as I can see, the equipment interference code of practice relates only to the security services. There is no mention of equipment interference being used by the police. Again, I am not an expert on this, but it would appear that the police have to rely on legislation that allows them to interfere with property. That was intended for planting bugs in homes or offices—that sort of thing—rather than interfering with computers. Will the Minister say what the code of practice is for police use of equipment interference, as opposed to that of the security services?
There is also serious concern about general warrants being issued for equipment interference, rather than for named individuals. Indeed, the Intelligence Services Commissioner’s latest report expressed concern that GCHQ was using thematic warrants for equipment interference. How many thematic warrants have been issued?
I have another question for the Minister: why are the Government bringing forward these orders now, when the primary legislation on which they are based is currently being completely reviewed? As he said, the Joint Committee on the Draft Investigatory Powers Bill is currently looking at the primary legislation, so why now?
Among other things, the Government have produced HM Government Transparency Report 2015: Disruptive and Investigatory Powers. I cannot find any reference in it to equipment interference. As the Government are being transparent about these things, can the Minister assist me with where we can learn how much equipment interference has been going on?
Lord Kennedy of Southwark (Lab)
My Lords, the orders before us today are important. They are tools to obtain evidence of suspected wrongdoing. I can tell the noble Lord that the Opposition support both orders, although we have some concerns. There has to be a balance between the scope of the powers exercised by the state and the rights of individuals who are subject to the exercise of those powers.
The noble Lord will, I am sure, be aware of the concerns raised by the Bar Council in relation to legal privilege. It would be helpful if he could say something about the safeguards against interference with privileged communications and, in particular, how the equipment interference order could result in the acquisition of matters subject to legal privilege, as well as what steps are being taken to mitigate such a risk. What I am looking for today from the noble Lord, Lord Bates, is more reassurance that the balance has been properly fixed. Clearly, technology is moving very fast and I am supportive of the Government ensuring, on the one hand, that the powers are appropriate and up to date and, on the other, that the procedures are properly codified and people’s rights are respected. I also understand that the orders are likely to be in force for only a short time, as of course we will be having the new Bill, which has to be on the statute book by the end of next year.
It would be helpful if the noble Lord could explain to the Committee a bit more about the safeguards that are in place, particularly in relation to the interception of communications code. Can he also say a bit more about the equipment interference code? As he said, it confers no new powers but simply sets out those powers and the safeguards that are in place. The noble Lord, Lord Paddick, suggests that new powers are being conferred, so the comments of the two noble Lords contrast somewhat. Therefore, we need to be clear about whether there are new powers in this code. If the noble Lord says that there are not, can he set out for the Committee why he believes that he is correct and the noble Lord, Lord Paddick, is wrong in that respect? Having said that, the Opposition support the orders.
Lord Bates
First, scheduling business is a matter entirely in the inscrutable hands of the Whips’ Office and usual channels. The Home Office has no influence on that. I take it that the noble Lord, Lord Paddick, was referring to the noble Lord, Lord Strasburger, who plays a very important role in the pre-legislative scrutiny of the investigatory powers Bill at present. Of course, we appreciate his expertise in this area. I am sure he will bring that fully to bear when the Bill comes before your Lordships’ House later. Let me try to deal with some of the points that the noble Lord, Lord Paddick, raised.
One was: why choose to do this now when we have legislation going through? I alluded to part of the reason in my opening speech, relating to current or recent cases that have gone through the Investigatory Powers Tribunal service. There is always a balance to be struck there. The legislation proposed is just that: it is proposed—it is not on the statute book. We need to make sure that the powers are in place appropriately and that the code is kept up to date for the purposes of activities that happen in the interim.
That is an important element as well, which I would convey through the noble Lord, Lord Paddick, back to the noble Lord, Lord Strasburger. Given the noble Lord’s strong interest in these areas, I assume he would welcome these codes of practice being kept up to date in the light of case law going through the tribunal and, in particular, in relation to equipment interference. Effectively, there are now 18 pages of guidance that were previously not in the public domain. Those can now be scrutinised and reviewed. They are there to be reviewed by the committee currently sitting, should it so wish. All the way through this process with investigatory powers legislation, we are trying to make sure, at the same time, that the security services have the tools they need to do their job and that we keep the public on our side in feeling that the powers exercised—which are intrusive in certain cases—are necessary and proportionate.
I pay tribute to the work of the noble Lord, Lord Jones, on the Intelligence and Security Committee in the other place. He knows all too well about the work going on. In that context, he will be aware that the powers we are talking about are not notional or academic. Elements of investigatory powers are deployed in response to the majority of serious and organised crime, such as the seven terrorist acts over the past year prevented by the security services. I certainly join the noble Lord in paying tribute to the work those services do to keep us safe.
I shall deal with some of the other issues raised. I will come back to the point raised by the noble Lord, Lord Kennedy, that in a sense our argument is that there is nothing new here and, at the same time, we are introducing some new measures. I will be able to tell him what is new in this.
The noble Lord, Lord Paddick, asked if, before now, it was an offence under the Computer Misuse Act to interfere with equipment. The answer is no. The powers to undertake equipment interference are contained in the Intelligence Services Act 1994 and the Police Act 1997, so we do not believe that at any point the police or security services have operated outside their powers. The noble Lord asked about the number of thematic equipment interference warrants that have been requested. That information is not collected centrally at present. Of course, we also have as part of the investigatory powers a quite sophisticated system of commissioners who oversee these processes, to whom those who feel that their rights have been trespassed on wrongly can go to seek redress—either directly through the commissioner or through the tribunal. Of course, that happens.