draft Regulation of Investigatory Powers (Interception of Communications: code of practice) order 2015
Draft Equipment Interference (Code of Practice) Order 2015
(Limited Text - Ministerial Extracts only)
Read Full debate
The Minister for Security (Mr John Hayes)
I beg to move,
That the Committee has considered the draft Regulation of Investigatory Powers (Interception of Communications: Code of Practice) Order 2015.
The Chair
With this it will be convenient to consider the draft Equipment Interference (Code of Practice) Order 2015.
Mr Hayes
Keeping people safe is a primary responsibility of Government and one on which everything else the Government do depends. It transcends partisan politics. Indeed, many of the debates we have in Committees such as this and on the Floor of the House reflect that understanding, which crosses parties.
This is about the national interest and the common good. Before I come to the detail of the orders, it is worth emphasising the very challenging circumstances in which we debate them. The context is a terrorist threat to the United Kingdom from international terrorism that remains at severe level, meaning that an attack is highly likely. We all heard the director general of MI5, Andrew Parker, describe a few weeks ago the character of that threat and the fact that it had been thwarted more than half a dozen times in the past year. He said that circumstances were severe and that the threat level is the highest he has seen in his 31-year career.
Technological change is affecting our ability to deal with those threats. The internet has changed so many aspects of our lives—some for good, and many for ill. Revolutionary communications are taken advantage of by people for good purposes and by those who seek to do us harm, the latter of which takes two forms, in essence: not merely the willingness but the daily examples of those who seek to radicalise individuals to murder and maim their neighbours, and the ability of those malevolent individuals to communicate with one another to plan, organise and plot.
Changes to the technology that people use to communicate are making it harder for our security agencies to maintain the capability to intercept the communications of terrorists. Whenever we lose visibility of what terrorists are saying and doing, our ability to understand and mitigate the threat they pose is obviously reduced. Almost all of MI5’s top priority UK counter-terrorism investigations have used intercept capabilities in some form to identify, understand and disrupt the plots of those who seek to do us harm.
To have the best chance of preventing such harm, we need the capability to shine a light on the activity of the worst individuals who pose the greatest threats. The dark places from where those who wish to harm us plot and plan are increasing. We need to be able to access communications to obtain relevant data on those people when we have a good reason to do so.
Members will know that the House is currently considering a draft Bill introduced on 4 November last year. Indeed, a Joint Committee of Parliament will report reasonably shortly, having taken evidence from all kinds of important people in respect of that draft Bill. Some will say, “You’ve got a draft Bill before Parliament. You’re going to have new legislation. Why do you need these orders?” The reason is that this is a Government who go the extra mile, who do the right thing and who live up to their responsibilities and honour their commitments.
We committed in earlier legislation to consult on new codes of practice in these two areas, and that is precisely what we did. We consulted between February and March 2015, and the revised codes of practice reflect that original commitment and the consultation that followed it. It is right that before the draft Investigatory Powers Bill becomes law, as I hope it does, and certainly before its passage through the House, we have an adequate code of practice. It would be wrong to create a gap between the end of the consultation and the progress of that draft and, ultimately, post-draft legislation.
The safeguards provided in the codes are not new. In respect of the interception code, the law enforcement and intelligence agencies have always had robust internal arrangements overseen by the interception of communications commissioner. The draft code provides more detail about those arrangements. First, it provides additional information on the safeguards that exist for the interception and handling of external communications under section 8(4) of the Regulation of Investigatory Powers Act 2000—the ability to undertake bulk interception.
Secondly, the draft code sets out further information on the protections afforded to legally privileged material and other confidential material. As an example, the code requires the Secretary of State personally to consider the likelihood that the privileged material will be intercepted when determining whether it is necessary and proportionate to grant a warrant. It also requires additional internal safeguards to be applied in cases where legally privileged material is intercepted, including that, where such material is retained, it must be reported to the independent interception of communications commissioner.
Thirdly, the draft code includes minor changes to reflect developments in law and practice since the code first came into force in 2002. For example, it reflects regulations introduced in 2011, which amended RIPA to create the power for the interception commissioner to impose a fine for certain kinds of unlawful interception. Much of the new material on safeguards that apply to the exercise of interception powers reflects the information disclosed during the legal proceedings in the Investigatory Powers Tribunal. It is right that that information is included in the codes of practice so that it is easy for members of the public to access it. At this point, Ms Buck, would you like me to deal with the second code of practice?
Mr Hayes
I think that will be more convenient for the Committee. It will mean that our affairs do not continue interminably, which will please all members of the Committee.
The draft equipment interference code of practice order is new. Equipment interference is a set of techniques used to obtain a variety of data from equipment, including traditional computers and computer-like devices such as tablets, handheld devices and so on. Equipment interference can be carried out remotely or by physically interacting with the equipment. It allows the security and intelligence agencies to keep pace with terrorists and serious criminals, who increasingly use sophisticated techniques to communicate, to evade detection in dark places, and to plan and plot what they do.
Equipment interference has been instrumental in disrupting credible threats to life, including those against UK citizens. MI5 has relied on that capability in the overall majority of high-priority investigations over the past year. The Security Service Act 1989 and the Intelligence Services Act 1994 provide the legislative basis for the security and intelligence agencies to interfere with computers and communication devices. Warrants may be issued by the Secretary of State only when they consider that the activities to be authorised are necessary and proportionate. To assure the Committee that the Government are acting properly, I emphasise that necessity and proportionality are at the heart of the codes and of all we do in this area. They must always be so.
The use of the powers is subject to independent oversight by the intelligence services commissioner. Prior to the draft code that we are debating, the equipment interference powers had not had their own bespoke code of practice. This was part of the debate we had on primary legislation, part of the commitment the Government made and part of the consultation that recently came to a close.
What is new? The code does not confer new powers but simply makes public robust safeguards that the intelligence agencies already apply, but that are now in a code—clear, transparent and comprehensible. It brings greater transparency to the robust processes that the agencies adhere to when interfering with computer equipment to disrupt serious crime, and identify and stop others who seek to harm us. For the first time, the code of practice publicly sets out stringent safeguards that the intelligence agencies apply to their use of equipment interference; strict rules on how data acquired through equipment interference must be handled, and how they must be secured and safely stored; and how the data must be destroyed when it is no longer necessary or proportionate to hold them.
The code explains the consideration of necessity and proportionality that I have described, ensuring that this vital capability can be used only when the scope of the interference has been carefully considered and compared with the potential benefits of the operation. Furthermore, the code explains that equipment interference should not be considered a proportionate power if other less intrusive methods of acquiring the same data are possible. As I said earlier, it should be used only when necessary, when other things are inadequate to achieve the end.
Akin to the interception code of practice, this document also provides reassurance that the acquisition of legally privileged and confidential information is subject to even greater oversight and safeguards. The code sets out a series of tests that must be applied before any authorisation is granted and the subsequent handling arrangements should confidential material be acquired. Finally, the code also provides information regarding the use of equipment interference targeted at equipment outside this country. This section ensures that the public have a comprehensive guide to the use of equipment interference powers by the intelligence agencies and the range of safeguards that apply.
The codes of practice contain no new powers; I repeat that for absolute certainty and clarity. Instead, they reflect the current safeguards applied by the relevant agencies. The purpose of the codes is to make more information publicly available about those stringent safeguards. They ensure that the powers can be used—I emphasise again—only when necessary and proportionate. I hope that in introducing them I have been just that: necessary and proportionate.
Keir Starmer (Holborn and St Pancras) (Lab)
The Opposition welcome the codes and the tone and manner in which the debate has been opened by the Minister. I will start with some general propositions, the most obvious of which is this: the ability to intercept the communication of those who mean us harm is a vital tool in the fight against terrorism and serious crime that is available to the police and security services. I saw that for myself when I was Director of Public Prosecutions for five years. I worked closely with the police and security services, relying on the sort of intercept and data that the codes refer to on a daily basis in the fight against both terrorism and serious crime.
On the framework, the powers set out in the draft codes—the interception of communications and equipment interference, which is being put into a code for the first time—are among the most intrusive and therefore the most sensitive available. The need for strict adherence to the safeguards in the Regulation of Investigatory Powers Act is vital; it is those safeguards that allow the powers to be used. Whether the safeguards in the existing legislative framework are robust enough is a debate for yesterday, because the draft Investigatory Powers Bill is going through its various processes currently with the Joint Committee, and no doubt many of the issues discussed today will be equally if not more relevant in those debates. Given the legislation that we have and that we are existing under at the moment, it is welcome to have codes that give guidance to those who need to exercise such powers, and to ensure that, as far as possible, the safeguards are properly applied.
The Minister mentioned necessity and proportionality, which are key to the exercise of any of the powers referred to in the codes; they are, as the Minister says, at the heart. In that respect, I welcome the guidance in paragraph 3.6 of the interception of communications draft code and in paragraphs 2.6 and 2.7 of the equipment interference draft code, which spell out in practical terms how proportionality is to be applied. Having worked, before I was Director of Public Prosecutions, with the Police Service of Northern Ireland, I know that practical guidance to those on the ground as to how they assess necessity and proportionality is critical. It is well set out in those parts of the code, and that is welcome guidance not only for all of us and for the public to see, but for those charged with implementing the codes. In those paragraphs are the key principles that privacy must be balanced against the need for activity in operational terms, and the reminder, if it is needed for those exercising the powers, that actions should not be deemed proportionate simply because there is a potential threat to security. If that were the case, the proportionality test would be redundant.
Paragraphs 3.22 and 3.23 of the interception of communications draft code are welcome, because they make clear for the first time in a code that a
“communication remains in the course of its transmission regardless of whether the communication has previously been read, viewed or listened to.”
That central issue emerged in the investigations and prosecutions relating to allegations of hacking across various news bodies. At one stage, there was a lack of clarity about whether a communication that had already been listened to remained in the course of its transmission. That gave rise to a huge debate before and after the Leveson inquiry. It is welcome that the new code aligns the position in guidance with the approach suggested by Lord Justice Leveson, which in my opinion is the right approach.
Keir Starmer
I am grateful for that.
Regarding the remaining tricky or more complicated areas, I shall focus on legal professional privilege and the protection of communications involving confidential journalistic material and other confidential information. Before I do so, though, I highlight the point made by a number of respondents to the consultation on the equipment interference code. The Government’s response to the consultation summarises their point as saying that
“a code of practice was not a suitable vehicle for setting out the power to conduct equipment interference and that it should be provided for in primary legislation. This would offer an opportunity to have an open and transparent debate about the use of equipment interference by the Security and Intelligence agencies.”
That is a point well made in the consultation, although the Government’s response is inevitably constrained by the legislation that is currently in place. Nevertheless, it emphasises the need for a real debate on this issue as the draft Investigatory Powers Bill goes through its various stages.
I will not take up time by reminding the Committee of the importance of legal professional privilege, but the need for reform and further guidance under the code is absolutely clear. In that respect, probably the only quarrel I have with the Minister is that I am not sure that the new codes are simply about the Government doing their job properly. They were necessary as a result of the ruling in the Investigatory Powers Tribunal, which declared in February last year that the previous approach was not in accordance with article 8 of the European convention on human rights. That position was rightly conceded by the Government, because in that case the IPT ruled that
“the regime for the interception/obtaining, analysis, use, disclosure and destruction of legally privileged material has contravened Article 8 ECHR and was accordingly unlawful.”
It was therefore necessary, for the period that the current regime remains intact, to have further guidance to bring the approach into accordance with the IPT.
I remind the Committee that the previous code simply said that caseworkers
“should be alert to any intercept material which may be subject to legal privilege.”
It did not go on to state what steps should be taken if legally privileged material was identified. There was a deficiency there that the new code is intended to deal with.
Although they do not ring-fence legally privileged material, the new codes do provide much more detailed guidance, which, again, is welcome, particularly in paragraphs 4.5 to 4.25 of the interception of communications draft code and chapter 3 of the equipment interference draft code. I highlight the fact that the latter provides that, prior to any warrant being granted where interception of privileged information is likely, there must be an assessment of how likely it is that such information will be intercepted. So, first, there must be an assessment before the event. Secondly, when the interception of legally privileged information is intended, the threshold, as the Minister said, is that there must be
“exceptional and compelling circumstances that make the authorisation necessary.”
Thirdly, the code makes it clear that the threshold will be met when there is an
“imminent threat of death or serious injury or serious threat to national security”
but it is anticipated that such situations will be rare. In addition, the code states that any communication between lawyer and client or any third party for the purpose of actual or contemplated litigation
“must be presumed to be privileged unless the contrary is established”.
Those are three or four aspects in which the guidance is much sharper and clearer. Time will tell—in the limited life of such codes—whether the regime is robust enough. Over the coming weeks and months, we will obviously keep a beady eye on how matters progress. To some extent, however, such matters will be considered in greater detail as the Bill proceeds.
My only point at this stage is that there is a question mark over whether the protection in relation to dissemination is strong enough under the code. The code simply states that privileged information cannot be disseminated unless a legal adviser has been consulted on the lawfulness of such action and that “all reasonable steps” must be taken to ensure that “as far as practicable” authorities involved in legal proceedings are prevented from seeing privileged information relating to those proceedings. Why does the code not expressly prevent dissemination where legal advice has been received as to its unlawfulness? I accept, however, that that question is probably equally well suited to the forthcoming debate on the Bill.
Moving on, it is noticeable that the protection for journalistic material and other confidential information is a lot weaker than the protection for legally privileged material. In his report, “A Question of Trust”, David Anderson, the Government’s reviewer, points out:
“The Draft Interception Code sets out similar provisions in respect of journalistic or other confidential material but the threshold for access is not as high as that in respect of legal privilege.”
It is obviously a matter of some concern that there are two different regimes for protected information. This matter was raised in the consultation, and I remind the Committee that the News Media Association took the view that the current regulatory framework
“poses a threat to journalism, journalists and their sources”.
The new provisions in the code of course have a chequered history. The National Union of Journalists, in a joint statement with the Bar Council, said that
“access to professional data should be protected in law and should be subject to independent, judicial oversight. Using codes of practice—such as the draft code under RIPA—undermines the rule of law.”
To some extent, their plea is for a change in the law, which is hopefully now forthcoming. The general secretary of the NUJ said:
“The proposals contained in the existing RIPA code of practice simply do not offer the protection to journalists and to sources, and are in fact dangerously inadequate. New legislation is urgently needed—it is vital that judicial oversight is introduced to force police officers and other snoopers to apply to judges in a transparent process before surveillance powers against media and legal professionals can be considered.”
Finally, the Press Gazette and the Society of Editors said that the draft code provides
“wholly inadequate protection for journalists’ sources”
and demanded that communication between journalists and public officials be treated the same as privileged information.
I recognise that the target of some of those comments was new legislation rather than a different code and that the code can only go so far, but not to have aligned in the interim the protection for journalistic material and other confidential material with the protection now given in the code to legally privileged material is a missed opportunity.
Mr Hayes
The hon. and learned Member for Holborn and St Pancras, whom I should have welcomed to his place at the outset—I do so now with your indulgence, Ms Buck—affirmed what I said about portability and necessity. As I said when I intervened on him, this is in the code for the first time. I draw attention to paragraph 3.6 of the interception of communications draft code of practice.
The hon. and learned Gentleman asked specific questions about the consultation. He is right: there were over 150 responses, one of which did talk about whether the safeguards should be put in primary legislation or in a code. The legislation underpinning much of the good practice that he absolutely properly called for is already in place. The assertion made in the consultation was misjudged, because in the Security Service Act 1989 and the Intelligence Services Act 1994 there is a legislative basis for the security services to interfere with computers and communications devices. It is set out in that legislation.
It is true that the safeguards and protections that have been commonly used, as I said at the outset, have not previously been as accessible publicly, so the code sets them out very clearly. However, those safeguards and that diligence had applied to both those legislative vehicles up to now. We are not putting in place new safeguards but simply codifying them. That was perhaps not quite appreciated in some of the consultation.
There is also a bigger issue. As I look round and see distinguished right hon. and hon. Members of this House, I think it not unreasonable to say that there is always a debate about how much is put in a Bill and how much is dealt with in supplementary material. How often I have had that conversation! In this area in particular, which is so rapidly moving—where the threat we face is dynamic and where the technology changes very quickly—the risk of rigidity is even greater than in most legislation. Retaining a degree of responsiveness through the flexibility provided by using codes of practice seems particularly pertinent in this area, as long as they are as robust, certain and well defined as the hon. and learned Gentleman suggested. He made the very good point that the language used becomes critical if we adopt the position I just have, because the codes will be tested in law.
Perhaps I was a little coy when I spoke initially, but the hon. and learned Gentleman is right that part of the reason why we are doing this are the challenges that have taken place. He drew the Committee’s attention to them entirely properly and I would not want to disagree. That again emphasises the need for precision in language, because these things would be challenged if we were to be anything other than precise.
To that end, the hon. and learned Gentleman dwelt for a while on whether we should have used the word “prevent” in respect of the dissemination of privileged information. We considered that issue in the course of the consultation. Let me be clear: the code states that all applications to intercept communications must be authorised by the Secretary of State. Further, the draft code requires the Secretary of State to apply:
“Particular consideration…in cases where the subject of the interception might reasonably assume a high degree of privacy, or where confidential information is involved.”
There is a general assumption that the interception is of particular interest, if I can put it in those terms, where a high degree of privacy or confidential information is involved and that a bar needs to be set at a level that takes account of the importance of that privacy and confidentiality.
Keir Starmer
The point I was making was limited to dissemination where it has been established that material has been unlawfully obtained, as will happen in certain situations. My point is about the safeguard where, whatever the prior assessment, it transpires that legally privileged material has been captured and should not have been. The question was why in those circumstances there is not a prohibition on dissemination, rather than the assessment before the event.
Mr Hayes
I was going on to that point, but that would have deprived the hon. and learned Gentleman of his place in the sun, so I am glad that I did not. I was going to add that there are further safeguards on the retention and dissemination of confidential material that must apply when seeking and granting a warrant. In any case where confidential information is retained, there is a requirement for notification to the interception of communications commissioner.
The hon. and learned Gentleman is right that, although they are related, the acquisition, dissemination and retention are different issues, and each requires appropriate safeguards. He made a good, more general point, as did the former Secretary of State for Scotland, the right hon. Member for Orkney and Shetland, about the need to look at things again in light of the new legislation, and it is absolutely right that we do. I confirm, as they asked me to, that that will happen, but it would be inappropriate for the Government to say, “We will not do anything until then.” Unless the important cross-House Committee considering these things makes alarmingly radical recommendations or the Bill Committee in its proper scrutiny of these things forces the Minister to make radical changes, I do not anticipate extraordinary changes between what we see today and what we end up with. However, the hon. and learned Gentleman and the former Secretary of State for Scotland are both absolutely right that proper reconsideration is necessary in the context of that new legislation. It would be inappropriate not to do that. The hon. and learned Gentleman is right that we will look at such things in that way.
The hon. and learned Gentleman also raised the issue of journalists. There is a difference between journalists and lawyers in these terms, because commissioned lawyers retain for all kinds of purposes, many of which he was intimately familiar with in his previous life. My hon. Friend the Member for Fareham is right that these days defining a journalist is more complicated than defining a lawyer, but there is a good argument for applying the provisions I have just described around privacy and particularly sensitive or confidential information to those areas.
I met representatives of the National Union of Journalists in that context, and they put directly to me the case that the hon. and learned Gentleman described. It was right to hear that case. I am not insensitive to the argument, but equally we have probably got the balance about right in emphasising the need for confidentiality and the higher bar, without treating journalists in quite the same way as we treat lawyers.
I think I have covered most of the points that the hon. and learned Gentleman raised. I will sit down unless he wants to intervene on me to raise additional points.
Mr Hayes
Brevity, as you know, Ms Buck, is my middle name.
Question put and agreed to.
Resolved,
That the Committee has considered the draft Regulation of Investigatory Powers (Interception of Communications: Code of Practice) Order 2015.
DRAFT EQUIPMENT INTERFERENCE (CODE OF PRACTICE) ORDER 2015
Resolved,
That the Committee has considered the draft Equipment Interference (Code of Practice) Order 2015.—(Mr John Hayes.)