Lord Keen of Elie
“(za) section (Restrictions in relation to internet connection records) (restrictions in relation to internet connection records),”
The Advocate-General for Scotland (Lord Keen of Elie) (Con)
My Lords, we recognised during the passage of the Bill thus far that care must be applied to the acquisition of internet connection records—in particular, that they should not be acquired for trivial purposes. Their value to law enforcement has been widely recognised, and the Bill, as introduced, already restricts access to four specific purposes. In addition, local authorities cannot acquire them for any purposes.
However, in response to a suggestion from the shadow Home Secretary in the House of Commons, the Government committed to consider further restrictions which would provide greater reassurance that the powers to acquire internet connection records would only ever be used proportionately. These amendments therefore apply a threshold to the acquisition of internet connection records when the statutory purpose is for the prevention and detection of crime. This means that they will be able to be acquired only for offences that are sufficiently serious that an offender can be sentenced to at least six months’ imprisonment.
In implementing this threshold, however, it is important that internet connection records can continue to be used for certain offences which, for whatever reasons, carry a lower sentencing limit. I am sure that noble Lords will agree that internet connection records should be available for these offences. These are: the investigation of any offence where the sending of a communication is an integral part of the offence: for example, offences related to stalking, cyberbullying and harassment which can, if not investigated, quickly escalate to more serious offences; offences relating to breach of a person’s privacy, such as stealing personal data, which recognises the importance of protecting privacy in the digital age and the need to fully investigate any suspected breaches; offences committed by corporate bodies—for example, corporate manslaughter, where a penalty of imprisonment cannot apply; and any offence meeting the serious crime threshold in the Bill for the most intrusive powers, ensuring that these powers can be used to investigate offences involving the use of violence, conduct that results in substantial financial gain and conduct by a large number of people in pursuit of a common purpose.
A number of consequential amendments are made as a result of this amendment. The Government and law enforcement are clear about the value and importance of accessing internet connection records to prevent and detect crime, and to keep the public safe. That has been recognised during the passage of this Bill thus far, including by noble Lords at Second Reading. The amendments build significantly on the safeguards that the Bill already applies to the acquisition of communications data. They are based on the amendments proposed by the Opposition in the House of Commons and they will ensure public trust in the use of these vital powers. I beg to move.
Lord Paddick (LD)
My Lords, the restrictions on using internet connection records set out in these amendments are welcome. However, we intend to propose the removal of internet connection records from the definition of communications data that the Secretary of State can require a telecommunications operator to retain when we come to debate Clause 83. The intended effect of that amendment would be to make it impossible to obtain internet connection records unless they were retained by the telecommunications provider for its own business purposes. I will leave any further comment on internet connection records until we reach Amendment 156A to Clause 83.
Lord Rosser (Lab)
We welcome the spirit of the Government’s amendments, which, as the noble and learned Lord said, seek to fulfil the commitment the Government made during the passage of the Bill in the Commons to introduce a clear and appropriate threshold for accessing internet connection records. The concern was that access should not be available in connection with non-serious crime. The threshold for serious crime appears workable and appropriate.
We welcome, too, the fact that specific offences such as stalking and harassment have been addressed and can lead to access to ICRs. However, we have continuing concerns around the definition of “relevant crime”, which we feel is too broad and could still lead to the use of ICRs in connection with crimes that would not be regarded as serious. Last April, the then Home Secretary told the shadow Home Secretary that restricting ICRs to serious crime would: hamper the ability of the police to investigate online stalking and harassment; disrupt police investigations of online grooming or the sending of sexual communications to a child; reduce the ability to investigate online fraud; hinder the ability to identify and disrupt the sale and distribution of illegal material online, including illegal weapons, counterfeit medicines or illegal drugs; and prevent the police from progressing investigations where there may be a threat to life, but where it is unclear whether a crime is involved—for example, locating a missing or suicidal child—because many of these activities would not meet the serious crime threshold.
We do not disagree with the intention set out in that communication from the Home Secretary to the shadow Home Secretary, but if the Government have a list of specific offences or types of offences which they feel fall below the serious crime threshold but should not be subject to a restriction on access to ICRs, perhaps that is a matter that needs further discussion about what should be included on the list or what should be covered. We wish to see the wording in the government amendment tightened further. We would want to work with the Government on this while the Bill is progressing through its stages in this House. I hope that the Minister, on behalf of the Government, will feel able to indicate that he is willing to have further discussions on this and the wording of the amendment in the light of our concerns about the apparent broad nature of the definition of “relevant crime”.
Lord Keen of Elie
My Lords, I am obliged to the noble Lord. I welcome the suggestion that we are at least heading in the right direction with regard to these amendments. We would of course be open to further discussions on this topic so we can address more fully what is a relevant crime in this context. I will add that one has to bear in mind that these potentially intrusive orders will be made only where it is necessary and proportionate. That is the test that exists, but I welcome the opportunity for further discussion with noble Lords.
Baroness Hayter of Kentish Town (Lab)
My Lords, I have added my name to Amendment 154 and will not repeat what has been said about it. It simply asks the Government to make explicit what they have said—namely, that the retention of third-party data will not be required. It would be helpful to make that clear in the Bill.
The Minister of State, Ministry of Defence (Earl Howe) (Con)
My Lords, as the noble Lord, Lord Paddick, has explained, these three amendments all deal with the issue of third-party data. Amendment 116 seeks to prevent public authorities from acquiring third-party data, Amendment 154 seeks to put the Government’s commitment not to require retention of third-party data on to the face of the Bill and Amendment 235 seeks to amend the definition of communications data to exclude from it third-party data.
On the acquisition of third-party data, the Bill maintains the existing position under RIPA that public authorities can acquire third-party data where necessary and proportionate to do so. But I want to be clear here—a provider is required to comply with a request for communications data, including a request for third-party data, only where it is reasonably practicable for them to do so. It is absolutely right that, where a communications service provider holds, or is able to obtain, communications data, whether in relation to its own services or those provided by a third party, then the data should be available to public authorities for the statutory purposes in the Bill. Put simply, data that already exist, are already held and which could save a life, convict a criminal, prevent a terrorist attack or provide an alibi, should not be put out of reach of law enforcement based solely on which company it is that holds the information.
Amendment 154 deals with the retention of third-party data. As I am sure the noble Lord knows, this matter was considered in the Commons, where the Government gave a commitment to consider it further. I am grateful to the noble Lord and the noble Baroness for tabling this amendment and giving me an opportunity to update the Committee on those considerations. My right honourable friend the Home Secretary has given a clear commitment that we will not require a telecommunications operator to retain third-party data, and that commitment is given effect to in the Communications Data Draft Code of Practice. However, distilling that commitment into primary legislative drafting is complex. We do not want to include provisions in the Bill that are not entirely clear in scope or which put in place restrictions that are broader, or indeed narrower, than intended. But we have been making good progress and are close to a provision that we think achieves the desired outcome. Of course, we need to test that drafting with operational stakeholders and with those telecommunications operators likely to be affected by the legislation, but we hope to be able to return to this issue on Report.
Finally, on Amendment 235, the principle of what are communications data is clear. Changing that position so that the classification of data changes depending on which provider holds them would no doubt cause confusion among providers as to how the data should be handled. While I understand the concerns around third-party data, and hope that what I have said today lays some of those to rest, amending the definition of communications data is not the right way forward. I invite the noble Lord to withdraw Amendment 116.
Lord Paddick
I am grateful to the Minister for his explanation and am encouraged by the promise of government amendments on Report. I have to say that I am still a little confused. The former Home Secretary, in her commitment, said that third-party data of telecommunications operators from abroad would not be required to be retained by UK telecoms operators. If the third-party data are of a different UK telecoms operator, surely the Secretary of State can make an order to get the data from that operator. But I will read carefully in Hansard what the Minister has said. As he has made a commitment, we will come back to this on Report. For the moment I beg leave to withdraw the amendment.
Earl Howe
My Lords, Clause 58 is the first clause of Part 3 of the Bill and deals with the targeted obtaining of communications data. It provides the power for only those public authorities listed in Schedule 4 to the Bill to authorise conduct to obtain communications data. Obtaining communications data may be authorised only when necessary for one of the statutory purposes listed in Clause 58(7) and where the conduct authorised is proportionate to what is sought to be achieved. Similarly, Clause 146(2) provides the statutory purposes for which a bulk communications data acquisition warrant will be considered necessary. Those purposes mirror the statutory functions of the security and intelligence agencies, since bulk warrants are of course available only to those agencies. They are where it is,
“in the interests of national security”,
for the prevention or detection of serious crime, or,
“in the interests of the economic well-being of”,
the UK where relevant to national security.
Throughout the passage of the Bill, we have heard repeatedly of the vital importance of communications data for the full range of law enforcement activity and national security investigations. This Government are committed to ensuring that law enforcement and the intelligence agencies have the tools they need to carry out the critical responsibilities that Parliament has placed upon them. Indeed, one of the key aims of this legislation is to ensure that investigatory powers are fit for a digital age and that crime can be investigated wherever it takes place, regardless of the method of communication. However, the Government consider these amendments unnecessary for targeted communications data and an inappropriate extension of responsibilities for our intelligence agencies for bulk communications data.
The Bill already provides that communications data may be acquired for the purpose of preventing or detecting crime, wherever that crime takes place and whatever scale it is on, where an application for communications data meets the requirements for necessity and proportionality. So it would already be available for the purpose of suppressing less serious crimes perpetrated on a large scale. I commend the aim of my noble friend Lord Lucas’s amendment but I believe that the Bill already provides the powers that he seeks.
As I said earlier, the bulk acquisition of communications data is available only to the intelligence agencies, whose statutory functions relate to serious crime and national security. The inclusion of a statutory purpose to obtain communications data in bulk so that our intelligence agencies could suppress less serious crime would therefore, in my submission, be inappropriate.
I hope that my noble friend finds those comments helpful and will feel able to withdraw his amendment.
Lord Lucas
My Lords, I thank my noble friend for his reply. I am not surprised but disappointed, but I shall certainly seek leave to withdraw my amendment.
“( ) The fact that the communications data which would be obtained in pursuance of an authorisation relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that it is necessary to obtain the data for a purpose falling within subsection (7).”
“Restrictions in relation to internet connection records
(1) A designated senior officer of a local authority may not grant an authorisation for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record.(2) A designated senior officer of a relevant public authority which is not a local authority may not grant an authorisation for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record unless condition A, B or C is met.(3) Condition A is that the designated senior officer considers that it is necessary, for a purpose falling within section 58(7), to obtain the data to identify which person or apparatus is using an internet service where—(a) the service and time of use are already known, but(b) the identity of the person or apparatus using the service is not known.(4) Condition B is that—(a) the purpose for which the data is to be obtained falls within section 58(7) but is not the purpose falling within section 58(7)(b) of preventing or detecting crime, and(b) the designated senior officer considers that it is necessary to obtain the data to identify—(i) which internet communications service is being used, and when and how it is being used, by a person or apparatus whose identity is already known,(ii) where or when a person or apparatus whose identity is already known is obtaining access to, or running, a computer file or computer program which wholly or mainly involves making available, or acquiring, material whose possession is a crime, or(iii) which internet service is being used, and when and how it is being used, by a person or apparatus whose identity is already known.(5) Condition C is that—(a) the purpose for which the data is to be obtained is the purpose falling within section 58(7)(b) of preventing or detecting crime,(b) the crime to be prevented or detected is serious crime or other relevant crime, and(c) the designated senior officer considers that it is necessary to obtain the data to identify—(i) which internet communications service is being used, and when and how it is being used, by a person or apparatus whose identity is already known,(ii) where or when a person or apparatus whose identity is already known is obtaining access to, or running, a computer file or computer program which wholly or mainly involves making available, or acquiring, material whose possession is a crime, or (iii) which internet service is being used, and when and how it is being used, by a person or apparatus whose identity is already known.(6) In subsection (5) “other relevant crime” means crime which is not serious crime but where the offence, or one of the offences, which is or would be constituted by the conduct concerned is—(a) an offence for which an individual who has reached the age of 18 (or, in relation to Scotland or Northern Ireland, 21) is capable of being sentenced to imprisonment for a term of 6 months or more (disregarding any enactment prohibiting or restricting the imprisonment of individuals who have no previous convictions), or(b) an offence—(i) by a person who is not an individual, or(ii) which involves, as an integral part of it, the sending of a communication or a breach of a person’s privacy.(7) In this Act “internet connection record” means communications data which—(a) may be used to identify, or assist in identifying, a telecommunications service to which a communication is transmitted by means of a telecommunication system for the purpose of obtaining access to, or running, a computer file or computer program, and(b) comprises data generated or processed by a telecommunications operator in the process of supplying the telecommunications service to the sender of the communication (whether or not a person).”
(ba) there is an opportunity to obtain information where—(i) the opportunity is rare,(ii) the time to act is short, and(iii) the need to obtain the information is significant and in”
Earl Howe
My Lords, in moving Amendment 124 I shall speak also to Amendment 127. We consider the requirement for an authorising officer to be independent of the operation or investigation being worked on an important safeguard and intend the exceptions to be drawn as narrowly as possible. That is why we welcomed the Intelligence and Security Committee amendments on this in the House of Commons and why we have tabled these amendments, which fully reflect the substance of the ISC’s intention and more narrowly define the national security exceptions. I beg to move.
Lord Paddick
My Lords, my noble friend Lady Hamwee and I have Amendment 126 in this group. It attempts to challenge the fact that the size of the relevant public authority, which may make it difficult to find a senior officer independent of the investigation to which the authorisation relates, makes it an exceptional circumstance, which it would be if the Bill is accepted as drafted.
Earl Howe
My Lords, Amendment 126, as the noble Lord, Lord Paddick, has just explained, concerns the independence of the authorising officer. As I mentioned a moment ago, the Bill provides for a very limited set of circumstances in which the designated senior officer need not be independent of the investigation or operation; for example, where delays in locating an independent officer may pose a threat to life, or in specific cases where the interests of national security prevent it. As we have heard, the intention behind the amendment is to ensure that an authorising officer is always, without any exceptions, independent of the investigation. I beg the noble Lord’s pardon.
Lord Paddick
I am grateful to the noble Earl for giving way. We entirely accept that some public authorities will be so small, or some investigations so important, that there cannot be someone independent of the investigation who can give the authority. As the Bill is drafted, however, simply the size of the public authority is seen as an exceptional circumstance. It is not an exceptional circumstance and the amendment attempts to allow the size of the authority to be a reason why an independent senior officer cannot give the authority without making it an exceptional circumstance.
Earl Howe
I am very grateful to the noble Lord. He is right: in some small public authorities there will be only a small number of staff sufficiently senior to take on this important responsibility. Where he and I part company is over the question of whether the rank of the designated senior officer should be lowered to ensure that there are sufficient numbers of them to always be independent of the investigation. I do not feel able to agree to that, because to do so would lower the safeguards that form an integral part of the communications data regime. Equally, I am afraid the Government are not prepared to remove these powers from some of the smaller authorities. They may be small, but they often do vital work in keeping the public safe and investigating crime.
I would be happy to discuss this further outside the forum of Committee, if that would help the noble Lord. I understand where he is coming from, but we have a fundamental disagreement of view on this.
Lord Paddick
I would just add that we do not disagree that a public authority may be so small that there is no independent senior officer who can grant the authority; the problem is whether that situation would amount to an exceptional circumstance. However, I would be very happy to discuss that situation with the noble Earl between now and Report.
( ) may cancel it at any time, and( ) ”
Lord Butler of Brockwell (CB)
My Lords, I find the amendment moved by the noble Lord, Lord Paddick, difficult to understand. He made the point that the filter arrangement makes the operations of the police easier, but it makes them easier by ensuring that they do not inspect communications data which are not relevant to their purpose. It therefore protects privacy rather than threatens it. The filter is governed by the requirements of the rest of the Bill. It will apply the tests of necessity, proportionality and the protection of privacy. It is a protection of privacy rather than a threat to it.
Lord Keen of Elie
My Lords, Clauses 63 to 65 provide that the Secretary of State may establish, maintain and operate filtering arrangements for communications data—the request filter—and detail the appropriate safeguards and restrictions around its use.
Public authorities currently need to receive all the communications data disclosed by communications service providers in response to specific requests so they can determine which specific pieces of communications data are relevant to their investigation. Public authorities will sometimes need to make complex queries. For example, they may need to ask multiple communications service providers for data to identify an unknown person who is suspected of having committed a crime at three different places at different times. Currently, public authorities might approach communications service providers for location data to identify the mobile phones used in those three locations at the relevant times in order to determine whether a particular phone and a particular individual are linked to the three offences. This means the public authority may acquire a significant amount of data relating to people who are not of interest.
The request filter will mean that when a police force makes such a request, it will see only the data it needs. Any irrelevant data will be deleted and not made available to the public authority. The filter acts as a safeguard, as the noble Lord observed a moment ago, protecting privacy by ensuring that public authorities see only the data they need.
The joint scrutiny committee on the draft Bill stated:
“We welcome the Government’s proposal to build and operate a Request Filter to reduce the amount of potentially intrusive data that is made available to applicants”.
It believed that the requirement upon law enforcement to state the operational purpose for accessing data through the filter and the oversight of the Investigatory Powers Commissioner will ensure appropriate use of the filter.
Clause 64 makes it clear that the request filter may be used to obtain, disclose or process communications data only if the relevant authorisation specifically authorises that use. The designated senior officer must consider that, in addition to the necessity and proportionality concerns provided for in Clause 58, what is being authorised in relation to the filtering arrangements is proportionate to what is sought to be achieved. It also provides that the relevant authorisation must record the designated senior officer’s decisions on the use of the request filter. I therefore take issue with the suggestion from the noble Lord, Lord Strasburger, that the request filter could somehow be used to permit fishing trips, as he termed them. The request filter cannot permit such expeditions. The filtering arrangements can operate only in response to a specific, necessary and proportionate authorisation for the acquisition of communications data. In other words, that request must already have gone through all the existing communications data safeguards, such as authorisation by a designated senior officer. Indeed, the operation of the filtering arrangements will be overseen by the Investigatory Powers Commissioner. Clause 64 makes it clear that the request filter may be used to obtain, disclose or process communications data only if the appropriate authorisations have been made.
Clause 65 provides that the Secretary of State must ensure the application of the appropriate restrictions on the request filter, maintain adequate security measures with regard to the request filter, put in place procedures to ensure its effective functioning and report to the Investigatory Powers Commissioner regarding its functioning on an annual basis, including immediately reporting any significant processing errors. This again underlines the point that the commissioner will be overseeing the operation of the filter.
Lord Paddick
My Lords, Amendments 146 and 147 in this group are also in my name and the name of my noble friend Lady Hamwee. Much concern has been expressed about the number of public authorities that can intrude into people’s privacy, and as a result, restrictions have been put in the Bill. If the Bill is enacted there will be fewer public bodies with that ability, and that is to be welcomed. We therefore do not think it is right that under Clause 67 the Secretary of State should be allowed by regulation to add a public authority. Amendment 145 would delete this power from Clause 67(2)(a) and Amendment 146 would make a similar change to subsection (3).
Amendment 147 would impose a duty on the Secretary of State to consult representatives of local authorities—for example, the Local Government Association—if she intends to make regulations to change a local authority-designated senior officer to someone of lower office, rank or position, in addition to consulting each of the local authorities concerned, as set out in Clause 69(5). I beg to move.
Earl Howe
My Lords, these amendments all concern the public authorities that are able to acquire communications data. I should take this opportunity to mention a document which we published last week and which is available in the Printed Paper Office: Operational Case for the Use of Communications Data by Public Authorities. It sets out why it is essential that the authorities listed in Schedule 4 to the Bill are able to acquire communications data. It is important to recognise that the crimes they investigate are not trivial. They include offences such as bribery and corruption, defrauding vulnerable people of their life savings, stealing sensitive personal information and supplying dangerous counterfeit medicines. That document is pertinent to this group of amendments, because Amendments 145 and 146 would remove the ability of the Secretary of State to add public authorities to Schedule 4 by regulations.
I recognise the well-intentioned purpose of the amendments. However, it is not something that the Government can support because it goes against our stated aim of ensuring that the Bill is future-proofed. Although we have no plans to use the regulation-making power, and, indeed, we think it unlikely that any additional authorities will be identified, it would not be good policy to specifically rule it out. That is because communications data are an essential investigative tool for numerous investigations and they are used by a number of different authorities. As I said, we have published the operational case demonstrating why it is so essential that the authorities listed in Schedule 4 continue to be able to use these powers.
As that operational case demonstrates, the authorities that acquire communications data, including the so-called “minor users”, often do so to investigate serious crime and, in some cases, save lives. Should a new investigative body be established—for example, with a remit to investigate a specific type of serious crime—we would want the flexibility to give it the powers that it needed. Similarly, we need to be able to adapt the list if changes in the roles and responsibilities of public bodies mean that it falls out of date.
Of course, there should be full and proper scrutiny of any decisions to provide powers to an additional body. The Government will consider giving powers only where a public authority can make a robust case and, perhaps more importantly, the Bill allows a public authority to be added to Schedule 4 only under the enhanced affirmative procedure. This procedure requires additional consultation above and beyond the affirmative procedure and ensures that a parliamentary committee is provided with an opportunity to consider the draft regulations.
This power has been considered by the Delegated Powers and Regulatory Reform Committee. In her letter to the Joint Committee that scrutinised the draft Bill, my noble friend Lady Fookes reported that the committee accepted the need for the delegated power and welcomed the strengthening of scrutiny procedures under the Bill. She said that,
“the enhanced affirmative procedure ... provides an appropriate level of Parliamentary scrutiny”.
I hope that that reassures the Committee that sufficient scrutiny is already built into the process to ensure that an additional public authority would be added to Schedule 4 only where it had a robust and compelling need for the powers.
Lord King of Bridgwater (Con)
Obviously, this is a very important area, which has given rise to a lot of public concern about how widely this would go in terms of all the authorities that might have access to information in this way. But it must be right that, if there is to be a list and it is to bear the power to remove names—which the noble Lord, Lord Paddick, is not suggesting should be deleted—there must be a power to add to the list as well where appropriate. Knowing the way that Governments, bodies and names change, I can see without altering the impact at all that it would be necessary to exercise this power. Could the Minister say a little more about the committee that he was talking about? Is it a standing committee, special committee or advisory committee? When he mentioned the proposal to add somebody to the list, he said that that would be scrutinised by a committee. What sort of committee would that be?
Earl Howe
My Lords, I was referring to the procedure relating to the enhanced affirmative process. That procedure is set out in Clause 239 of the Bill. Importantly, it provides for a relevant parliamentary committee to report on the regulations. I do not think that I can be more specific at this stage. The enhanced affirmative procedure has been used in the past, albeit not very frequently, and is there as an additional safeguard. I endorse everything that my noble friend said in support of my remarks. He is absolutely right that we cannot foresee at this stage the need to add to the list, but we must and should provide for the circumstances where that becomes necessary.
Lord Paddick
I am grateful for the noble Earl’s explanation. The noble Lord, Lord King of Bridgwater, raised this important concern that people have about the range of public authorities that will be able to access this data. There is a real concern that the Secretary of State by regulation can simply add to the list included in the Bill. As a general principle, to have provisions in a Bill in order—to quote the noble Earl —to future-proof it, even if those are unlikely to be used, is not the ideal way forward. However, the enhanced affirmative procedure does give some reassurance on that issue.
On the other matters, I will read carefully what the noble Earl has said, but at this point I beg leave to withdraw the amendment.
Lord Rosser
My Lords, I shall be very brief. As has been said, the provisions of this Bill have been subject to considerable scrutiny. The heart of Amendment 156A is about the balance between privacy, security and safety. Inevitably there will be disagreements, which have been highlighted in this debate, about where an appropriate and proper balance lies.
On Amendment 147A, I have virtually no knowledge about the Advocate-General’s opinion, to which reference has been made. However, if we have that opinion, we would like to hear at some stage whether the Government think that it would have implications for any of the provisions and procedures in the Bill, were that opinion subsequently adopted.
Lord Keen of Elie
My Lords, Amendment 156A seeks to prevent the retention of internet connection records. The Committee will not be surprised that the Government cannot support such an amendment. We have been absolutely clear about the need for internet connection records. We addressed that when publishing the operational case for these powers.
The right reverend Prelate the Bishop of Chester referred to a model of pre-legislative scrutiny. The noble Lord, Lord Carlile, referred to the most scrutinised Bill ever seen. My noble friend Lord King alluded to the three reports we have had, and the noble Lord, Lord Murphy, spoke about the Joint Committee that he had chaired which scrutinised these matters. Over and above that, we had the evidence given to the Public Bill Committee by, for example, the noble Lord, Lord Reid, and Charles Clarke. They were asked whether they thought that ICR were a key part of updating legislation for the current world, and both agreed definitively. I commend the contents of those three reports to the noble Lord, Lord Oates, and also commend to him the findings of the Joint Committee. He asked whether the UK was unique within the “Five Eyes” or indeed the world in seeking to develop these powers. It may well be that we are the forefront of developing them, and a good thing it be. I quote from the report by David Anderson QC:
“Comparing the UK’s legal regime with those of other countries is fraught with danger”.
I commend to the noble Lord, Lord Oates, what follows in that report because David Anderson develops those points and explains them. It is on the record, we have had it for a long time, we have considered it in the development of the Bill and the Joint Committee considered these matters. That is why the Bill is in its present condition.
The noble Lord, Lord Evans, observed that we have the ability to secure effective police investigations in areas where other countries have failed. I mentioned on a previous occasion the comparison between the results in the UK and Germany regarding the investigation and prosecution of cases involving paedophilia. I do not accept that, because we are ahead of others, somehow we are wrong.
Lord Oates
Does the Minister accept that the point is not just that we are in front of other common-law jurisdictions such as the US, New Zealand and Australia but that, in the case of Australia, as alluded to by my noble friend Lord Strasburger, this issue was specifically considered by the Australian Government and Parliament, and the Australian data retention law specifically excludes the collection of such information precisely because it was felt to be a disproportionate invasion of privacy?
Lord Keen of Elie
I invite the noble Lord to have a little more confidence in the parliamentary procedures in the UK, in the scrutiny that is being given by our institutions to the provisions of the Bill, and even in the Committee procedures of this House. We have looked with care at these matters repeatedly and have come to a view regarding ICRs.
Lord Keen of Elie
Not just yet. The fact that other jurisdictions may have taken a different view is to be noticed but is not necessarily of any great moment in this context.
I want to deal with the suggestion by the noble Lord, Lord Paddick, that somehow GCHQ could provide the alternative route into all this material, and that somehow the security services would be there at the beck and call of the police authorities in order to in-gather and provide the appropriate information by different means. He asserted that the security services said, “We do not need”. That is far too hard-edged. They have other means but they did not say, “We do not need” in that context.
The noble Lord suggested that I had made an assertion on a previous occasion about the admissibility of certain intelligence acquired by the security services. I did not make an assertion; I made a statement of fact. Intelligence acquired through interception cannot be used as evidence in court. That is the factual position.
Lord Paddick
This Committee is part of the process of the scrutiny of legislation, and therefore this House should have respect for noble Lords who wish to use it to challenge what the Government are proposing. With regard to the greater success that the UK has had compared with, say, Germany in the prosecution of paedophiles, will the Minister confirm that that is using existing legislation without the use of internet connection records?
On the question of an evidential basis, why, in the operational case for internet connection records, is the need for evidential material not included in any of the examples provided by the National Crime Agency? Why, when I visited the NCA on a couple of occasions, was none of the examples that it gave of a need for evidence that could be presented in court? Indeed, the case studies presented to me at GCHQ confirmed that the work done by GCHQ in conjunction with the NCA was sufficient for the NCA to bring successful prosecutions, notwithstanding that the interception of content is not acceptable in giving evidence in court.
Lord Keen of Elie
I am most obliged to the noble Lord for his intervention. Of course, I did not accompany him to the NCA, so I do not know what examples he was or was not given, and nor did I prepare or draft the operational examples that he referred to earlier. Of course, there are other means by which evidence may be gathered for the purpose of prosecution, but we are looking to the most effective means of doing this going forward, remembering that people are moving away from telephonic communication—using mobiles and telephone systems—and into the use of internet connection by way of such examples as WhatsApp. Our police forces will be blinded if we allow that development and do not attempt to keep up with such developing technology.
On the question of whether there is an evidential requirement, I note that the noble Lord now acknowledges that there is an evidential requirement in the sense that intelligence gathered by way of interception is not admissible as evidence in court.
The question of the cost of carrying out this exercise was raised. The figure of £1 billion has been put about repeatedly, and the experience in Denmark has been referred to on many occasions. However, one has to look at this from the perspective of the United Kingdom and its approach to this matter. We do not accept the estimate of £1 billion that has been given, and indeed—in response to the inquiry from the right reverend Prelate the Bishop of Chester—the current estimate of costs is about £175 million. Our figures factor in the existing infrastructure and the requirements already placed on individual communications service providers, as well as the technical complexity of their networks in this context.
One has to bear in mind that, for example, the Data Retention and Investigatory Powers Act 2014 and the Counter-Terrorism and Security Act 2015 already provide for the retention of source IP addresses and port numbers, which make up part of an internet connection record. So I cannot accept the assertion from the noble Lord, Lord Strasburger, that none of these records are provided for under existing legislation. Furthermore, the Bill allows the Government to require the retention of communications data, including internet connection records, only when necessary and proportionate. One must not lose sight of that test in this context.
So we consider that a case was made in the reports regarding internet connection records. We entirely agree with the view arrived at by the Joint Committee. The noble Lord, Lord King, has already quoted from its report that,
“on balance, there is a case for Internet Connection Records as an important tool for law enforcement”.
That has been clearly established by the work that has been done. I acknowledge that of course the Committee of this House wishes to scrutinise this legislation, and it is right that it does so, but it is helpful if it does so against the background and with an understanding of the pre-legislative scrutiny that has already taken place, with regard to the three reports and indeed the recommendations of the Joint Committee. So we submit that the ability to require the retention of internet connection records is a fundamental power that will provide substantial benefits to law enforcement and indeed to the security and intelligence agencies. It is in these circumstances that I say that we cannot support Amendment 156A.
I turn for a moment to Amendment 147A, which seeks to require judicial commissioner approval for applications to acquire internet connection records. I hope that I can persuade noble Lords that the amendment is not needed because we already have a stringent authorisation regime in place that protects against the abuse of applications for communications data. Indeed, the noble Lord, Lord Carlile, alluded to the suggestion that somehow our security agencies and police would have such time on their hands that they would simply roam around such communications data for their own amusement. One is entitled, surely, to discount such a proposition.
The Bill contains robust safeguards for every stage of the acquisition of any form of communications data. This includes requiring the use of an expert single point of contact; authorisation by a designated senior officer who is independent of the investigation and who must be of a rank approved by Parliament; comprehensive oversight by the new Investigatory Powers Commissioner; and the new offence of unlawfully acquiring communications data from a telecommunications operator.
On top of those general requirements, there are extra, specific safeguards for the acquisition of internet connection records. So internet connection records will be able to be acquired only if they are needed for one of the four specified investigative purposes—and local authorities, for example, will be barred from acquiring internet connection records in any form. As well as these protections, we have also tabled an amendment that provides for a crime threshold that must be met before internet connection records can be acquired. We addressed this issue earlier. This will prevent their use for low-level crimes.
So while we recognise that there are sensitivities concerning internet connection records, they will, among other things, be fundamental in resolving IP addresses in certain cases. For example, where the telecommunications operator uses technology that allocates the same IP address to a number of different customers, the internet connection record will help to determine the specific individual in whom law enforcement is interested. There has been cross-party agreement that we need to solve the problem of IP address resolution and I cannot see how it would make sense to require judicial authorisation for some types of IP address resolution but not for others, simply because of the technology that a telecommunications operator uses.
If a public authority were considering acquiring internet connection records in a way that was novel or contentious, it would certainly be right for additional safeguards to apply. That is why the draft communications data code of practice requires any novel or contentious application for communications data to be referred to the judicial commissioner. The Government believe that it is absolutely right that novel or contentious cases are referred to the commissioner, but we do not believe that the tried and trusted authorisation system for communications data should be fundamentally changed when there is no evidence that it is not working. Furthermore, none of the three independent reports that we have referred to and which informed the drafting of this Bill—from David Anderson, the ISC and RUSI—suggested or recommended any changes to the authorisation regime for communications data.
Finally, the noble Lord, Lord Strasburger, referred to the recent opinion of the Advocate-General in the case of Watson in the CJEU, which came out this morning. We note what was said in a fairly lengthy opinion. Your Lordships will be aware that that is the opinion of the Advocate-General, not the judgment of the court; a final judgment is anticipated in the autumn of this year. The Government maintain that the existing regime for the acquisition of communications data and the proposals in the Investigatory Powers Bill are compatible with EU law, and clearly it would not be appropriate to comment further while legal proceedings are ongoing. In these circumstances, I invite the noble Lord to withdraw his amendment.
Lord Oates
The Minister may have given an impression, which I am sure he did not intend, that by scrutinising the Bill and seeking to do so, noble Lords were somehow not cognisant of the history of the development of these proposals and of the various bits of scrutiny. He should correct that. I myself spent five years in the coalition Government very much involved in these discussions, and one reason I am sceptical about many of the things I hear about why we must do things is because I have heard them before. For example, on the third-party data issue, the Independent Reviewer of Terrorism Legislation David Anderson said in his report that it was unnecessary and no operational case had been made for it. So I want the Minister to be clear on that. Noble Lords are concerned not because they have not studied or are not aware of these things but because they are very much aware of them.
Lord Keen of Elie
No doubt noble Lords are cognisant of the three reports and the Joint Committee’s recommendations on the Bill. But I sought and seek to remind noble Lords of what those recommendations contained and of the terms of the Joint Committee’s report—particularly as the noble Lord, Lord Strasburger, who was a member of that committee, seemed to think it appropriate to depart from the recommendations which appear to have been made in its report.
Lord Paddick
My Lords, perhaps this is a bit of light relief. Clause 77(1) defines what conduct is lawful when it comes to obtaining communications data, and Clause 77(2)(a) goes on to say that someone cannot be sued if what they do,
“is incidental to, or is reasonably undertaken in connection with”,
the lawful conduct defined in subsection (1). So far, so good. Clause 77(2)(b) goes on to say that someone cannot be subject to any civil liability in respect of conduct that,
“is not itself conduct for which an authorisation or warrant … is capable of being granted”,
under various acts set out in subsection (3) and,
“might reasonably have been expected to have been sought in the case in question”.
If I understand this correctly—and I am sure I have not—if that conduct could and should have been authorised but was not, they can be sued, but if it was not something that could or should have been authorised, no civil liability arises. Either that cannot be right, or it is capable of misunderstanding and should be changed. Can the Minister put the provision in plain English? Our amendment is probing to ensure that we know what we are dealing with. I beg to move.
Lord Keen of Elie
My Lords, the provisions on the lawfulness of conduct authorised by Part 3 replicate those that apply currently in the Regulation of Investigatory Powers Act 2000. As we made clear in response to an identical amendment in the other place, the Bill goes no further as regards providing indemnity from civil liability for conduct that is incidental to, or reasonably undertaken in connection with, a communications data authorisation.
The provision as drafted ensures that a person who engages in conduct only in connection with an authorisation cannot be subject to civil liability unless that activity could itself have been authorised separately under a relevant power. That, we submit, must be right. The amendment would remove that provision entirely, which, in effect, would mean that a person acting lawfully under an authorisation that had properly been granted under the Bill would be at risk of civil liability if some incidental or reasonably connected conduct were not expressly covered by the authorisation.
I notice that it is a probing amendment. In those circumstances, I invite the noble Lord to withdraw it.
Lord Paddick
I thank the noble and learned Lord for what he has said. However, we tabled this probing amendment in order to understand what the provision means. Unfortunately, simply saying that it replicates legislation that is already on the statute book does not really help our understanding. Perhaps the noble and learned Lord can say whether the provision has been applied in the past under the Regulation of Investigatory Powers Act.
Lord Keen of Elie
I am not in a position to give a specific answer to that question, but I am content to write to the noble Lord on the point.
Lord Paddick
I am very grateful to the noble and learned Lord for his promise to write on this issue. My question is genuine. Perhaps it is because I am not a lawyer and my brain is not very big, but I contend that the provision is impenetrable. At this stage, I beg leave to withdraw the amendment.
“( ) The fact that the data which would be retained under a retention notice relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that the requirement to retain the data is necessary for one or more of the purposes falling within paragraphs (a) to (j) of section 58(7).”
Lord Rosser
The intention behind this amendment to Clause 83 is to replicate the Data Retention and Investigatory Powers Act in its original form. In so doing, it would restrict the scope of Clause 83 and equate it to existing data retention provisions in DRIPA, with the only addition being the inclusion of internet connection records.
Under the Data Retention and Investigatory Powers Act, the term “relevant communications data”, as I understand it, covers internet access services, internet email and internet telephony. Those categories replicate the 2009 data retention regulations, which implemented the then EU data retention directive. The Counter-Terrorism and Security Act 2015 extended DRIPA to include what was called IP address resolution data.
Clause 83 currently empowers the Home Secretary to issue retention notices covering some six categories of data under the definition of “relevant communications data”. One of these categories is internet connection records. That therefore leaves five other categories, which on the face of it would appear to go wider than the existing data retention categories under the Data Retention and Investigatory Powers Act 2014 as amended by the Counter-Terrorism and Security Act 2015.
As the Bill is currently drafted, the term “relevant communications data” could be interpreted as some sort of catch-all definition of relevant communications data that would cover the collection of virtually any type of communication on a network, including communications where the sender or recipient was not a human being. If that is an accurate assessment, the definition of “relevant communications data” in Clause 83 would cover not only background interactions that smartphone apps make automatically with their supplier servers but presumably also the entire internet of things.
I therefore seek an explanation from the Government as to why the scope of “relevant communications data” in the Bill is not consistent with that in current recent legislation, the reasons and justification for the apparent broadening of the scope, and the difficulties that presumably the Government believe would be caused if the scope of Clause 83 were restricted in line with the amendment and instead equated to existing data retention provisions in DRIPA, apart from the addition of the inclusion of internet connection records. I beg to move.
Earl Howe
My Lords, the amendment seeks to amend the definition of “relevant communications data”—that is, the communications data that the Secretary of State will be able to require communications service providers to retain.
In looking at how the amendment is couched, I would like to bring the Committee’s attention to a statement made by David Anderson QC in his report on investigatory powers. He said that,
“any new law … must be couched in technology-neutral language”.
The Government agree. However, the amendment would go against that advice. It would seek to revert to the technical language from the data retention regulations 2009. This, in turn, as the noble Lord mentioned, was drawn from the EU data retention directive 2006, which was struck down in 2014.
I suggest to the noble Lord that it would be inappropriate to base today’s law on specific tele- communications definitions from a decade ago. For example, the amendment would ensure that we retained a reference to dial-up internet access in our legislation. That surely cannot be appropriate where broadband and mobile internet access are now the norm. The approach we have taken is to keep our definitions technologically neutral, as David Anderson recommended and as, indeed, is sensible in the drafting of any law that needs to apply across a range of technologies over time.
I hope that the noble Lord will recognise that it is not appropriate to tie our data retention regime to specific, and outdated, technological language. Those are the reasons why the Government cannot support the amendment.
Lord Rosser
Perhaps I may ask a question on that point. Not unfairly, the noble Earl made reference to regulations of some years ago, but presumably it is also accurate to say, and perhaps he could comment on this, that very recent legislation—namely, DRIPA 2014, as amended by the Counter-Terrorism and Security Act 2015—has also used the wording referred to in the amendment. Therefore, it also relates to legislation that is not particularly old and indeed is pretty recent. As I see it, we are making a change in wording from legislation that was passed only a year or two ago.
Earl Howe
The noble Lord makes what is, on the face of it, a fair point. We have language, as I have explained, that is out of date. But even where the language is not out of date in the kinds of instances that he refers to—for example, legislation refers to the “international mobile equipment identity” of devices—the rate at which telecommunications change means that that kind of language could become out of date very quickly. We try to read across the data descriptions that originated in the 2006 directive to the communications technologies of today, and do so in technology-neutral language. That is why we have departed from the approach that the noble Lord is advocating.
As the noble Lord will remember, DRIPA was emergency legislation. We simply replicated the existing language in that Bill. We now have an opportunity in the Bill before us to do rather better and try to future-proof the terms that the Bill contains.
Lord Rosser
I thank the Minister for that explanation. In the light of what he has said on behalf of the Government, I beg leave to withdraw the amendment.
“( ) The fact that additional relevant communications data which would be retained under a retention notice as varied relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that the requirement to retain the data is necessary for one or more of the purposes falling within paragraphs (a) to (j) of section 58(7).”
Lord Harris of Haringey (Lab)
My Lords, I listened very carefully to the noble Lord, Lord Paddick, and his explanation of his amendments, but I was not at all convinced. If we believe that there is a need for the Bill, which I do, but have reservations about some of the issues around encryption, we have to ensure that the relevant agencies have some tools in their kit box. One of those tools has to be the ability to interfere with or look at the specific equipment. What the noble Lord is trying to do is to restrict the availability of that power to such an extent that it would effectively become almost useless. It would simply be available if you have one named individual. Therefore surely it is right that a significantly broader power should be available to engage here.
The question that the Minister who is going to respond needs to answer is this: how will the test of proportionality be applied in such cases? Presumably it is not proportionate to have such a broad sweep contained within the authorisation that it is inappropriate and overly onerous. The mechanism is therefore this: how is it determined that this is a proportionate and proper use of the power, and can we and the public be reassured that the mechanisms exist to ensure that that proportionality is adhered to?
Lord Keen of Elie
I am obliged to noble Lords. I know that these are probing amendments and I shall address them in that light. Of course some of these amendments were discussed in the other place and, as noted, were considered again by this Committee in the context of interception.
Amendments 158D to 158M and 169B to 169T would remove the ability of the warrant-requesting agencies to apply for a warrant against an organisation, a group of persons with a common purpose, or a group of persons carrying out the same activity. They would require a warrant to name or identify each person or piece of equipment to which the warrant relates and they would remove the ability to obtain warrants for testing and training activity. As I have already set out when we considered similar amendments in the context of interception, it is important that those responsible for keeping us safe have the powers they need. These amendments would undermine their ability to employ those powers.
Let me start with the amendments regarding unique identifiers. As I explained in the context of interception warrants, it is not always possible at the outset of an investigation to know or have identified all of the individuals who may be subject to a warrant over the course of that investigation. The example of a kidnap gang applies to equipment interference just as it applies to interception. When a warrant is granted against a gang, the person applying for the warrant may not know that there are four members of the gang rather than three. The ability to grant a warrant against the gang in order to establish its size and to identify co-conspirators is precisely why the Bill provides for thematic warrants. Thematic warrants are already available to the equipment interference agencies under the Intelligence Services Act 1994 and the Police Act 1997 and they are invaluable when investigating complex or fast-moving threats. It is right that the Bill should not undermine their ability to do this.
I would seek to reassure your Lordships that the Bill already provides in Clause 107 that the warrant has to describe the relevant persons, locations, activity or groups and the type of equipment to which the warrant relates in so far as it is reasonably practicable to do so. This is an important safeguard which will assist the oversight of thematic targeted warrants. The Investigatory Powers Tribunal recently considered the use of equipment interference in this way. It determined that,
“a warrant is lawful if it is as specific as possible in relation to the property to be covered by the warrant”,
and that,
“it need not be defined by reference to named or identified individuals”.
Let me turn to the amendments that seek to remove the ability to grant a warrant relating to particular subject matters. This was also discussed at some length in the other place and very recently in this Committee, again in the context of interception. Such a change would be operationally damaging and is moreover unnecessary. The Bill and the statutory code of practice impose strict limits on the issue of warrants, including in relation to organisations or groups of persons. I should emphasise that such warrants are not open-ended. Their scope must be sufficiently limited that the issuing authority can properly assess the necessity and proportionality of the interference. Further, under the Bill a judicial commissioner will need to approve the issuing authority’s decision. So the clause does not allow for overly broad warrants to be issued. Moreover, removing the ability to seek warrants against persons carrying out the same activity could prohibit the agencies from, for example, seeking a warrant against individuals accessing a particular website in order to access child abuse images. In such cases it is vital that law enforcement should be able to identify suspects and bring them to justice.
Lord Paddick
I am very grateful for the lengthy explanation that the noble and learned Lord has provided. However, I still have questions. One of the examples he gave was to be able to interfere with equipment of a group of people who are accessing a particular website. I guess that you would need to know the IP addresses of the devices that were accessing that website to interfere with them, and that would be within the terms of our amendment. I may have lost concentration, and apologise to the Minister if so, but I cannot remember him addressing targeted examination warrants, where presumably the security services—the only ones who would apply for such a warrant—would know the identity of the people. I am still not clear about the need for thematic targeted examination warrants.
The big question that I have around testing and training is: who are the poor innocent people targeted by the warrants used for testing and training purposes? How is it decided who should be targeted? Will the Minister say what that other information is that needs to be specified in the warrant?
I accept that the withdrawal of these powers would be a mistake but, as the Minister acknowledged to begin with, these are probing amendments. I am grateful for the explanations he has given so far. Perhaps he might write to me to deal with my further and more difficult questions, but at this stage I beg leave to withdraw the amendment.
Lord Keen of Elie
I shall be happy to write to the noble Lord on the three particular points. I do not think that they were the more difficult questions but they may be the ones that I did not fully answer, and I am content to write to him.
Baroness Hayter of Kentish Town (Lab)
My Lords, I added my name to Amendments 159 and 160. Amendment 164 is in my name and that of my noble friend Lord Rosser. Our points are much the same as those made by my noble friend Lord Harris. I do not think there will be planting of evidence, for example. Our concern is much more about the risk to any public cybersecurity system, and we would want that to be taken into account. These amendments follow the recommendations of the Joint Committee. The idea is to minimise any potential risks. If, for example, the Secretary of State has to take into account any risk to the security and integrity of the networks, that by itself will ensure that any applicant sets that out in the form they submit. We hope the Government will respond, as my noble friend Lord Harris said, not necessarily by using these exact words but in the spirit of these amendments in order to retain overall security.
Earl Howe
My Lords, Amendments 159 and 160 would introduce new clauses requiring the person making an application for a warrant to make a detailed assessment of the risks of the proposed equipment interference activity to any critical national infrastructure, to the security and integrity of systems and networks, and to the privacy of those not targeted. Amendment 164 is linked to the requirement to produce risk assessments and would require the Secretary of State, when issuing warrants to the Chief of Defence Intelligence, to consider the content of these assessments when deciding whether the activity under the warrant would be proportionate. Amendment 169A would require a judicial commissioner to take into account a technical cyber risk assessment, conducted by the Investigatory Powers Commissioner, of the specific equipment interference proposed when deciding whether to approve a decision to issue a warrant.
I start by making an important general point. It seems these amendments are based on a fundamental misinterpretation of what GCHQ and others are here to do. Their role is to protect the public. That includes protecting cybersecurity. Indeed, the Government have invested very considerable resources into improving our cybersecurity efforts. Last November, the Chancellor announced the creation of a new national cyber centre led by GCHQ, with an additional £190 million of funding.
GCHQ has an excellent track record in identifying cyber vulnerabilities and making leading computer companies aware so they can improve their security. For example, in September 2015, Apple publicly credited CESG, the information assurance arm of GCHQ, with the detection of a vulnerability in its iOS operating system for iPhones and iPads, which could have been exploited to allow the unauthorised modification of software and to extract information from the devices. That vulnerability has now been patched.
I appreciate that the noble Lords’ amendments are intended to introduce safeguards, but I contend that sufficient safeguards are already contained in the Bill. Part 5 already requires the Secretary of State or law enforcement chief to consider whether the proposed conduct is necessary and proportionate before issuing a warrant. The Government have provided even more reassurance since the discussion of these same amendments in the other place. As we have frequently reflected, Clause 2 is a new provision that sets out overarching privacy duties. It includes a requirement to have regard to the public interest in the integrity and security of telecommunication systems. This requirement applies to any decision on whether to issue an equipment interference warrant.
The draft statutory code of practice also sets out, in detail, the factors that must be considered in respect of proportionality. The code states at paragraph 3.27 that one element of proportionality that should be considered is,
“explaining how and why the methods to be adopted will minimise the risk of intrusion on the subject and others”.
It goes on to state at paragraph 3.30:
“Equipment interference activity must therefore be carried out in such a way as to appropriately minimise the risk that the activities of the equipment interference agency would result in any increase of the likelihood or severity of any unauthorised intrusion into the privacy, or risk to the security, of users of equipment or systems, whether or not that equipment is subject to the activities of the equipment interference agency”.
If noble Lords will allow me one last quote, paragraph 3.31 states:
“Any application for an equipment interference warrant should contain an assessment of any risk to the security or integrity of systems or networks that the proposed activity may involve including the steps taken to appropriately minimise such risk … The issuing authority should consider any such assessment when considering whether the proposed activity is proportionate”.
Lord Beith (LD)
An innocent citizen could be the subject of training or testing equipment interference under paragraphs (d) or (e). Are these not legitimate questions to ask on behalf of such a citizen? If it is established that there was a risk, albeit a relatively small one, who will make the judgment that it is reasonable to expose the person, his equipment and his privacy to that risk?
Earl Howe
My Lords, I hope the noble Lord will accept that, in the context of training and testing, those activities are essential if we are to have fully functioning services. It should not only be current investigations that are used for training as that could jeopardise operations. Current investigations may not give the full range of testing and training opportunities to prepare staff and equipment for all necessary eventualities. I will write to the noble Lord on the precise procedures involved in authorising testing and training as I do not have the information in front of me. However, appropriate safeguards will be built into those procedures.
I come back to the point I was making about these amendments in general. I contend that they are not necessary because the Bill and the draft statutory code of practice already require that the impact on people’s privacy, including in respect of collateral intrusion and cybersecurity, is properly considered in every single case. The draft codes will, of course, also be subject to parliamentary scrutiny and agreement before they come into force. I hope that those remarks are helpful in reassuring the noble Lord and that he will withdraw his amendment.
Lord Paddick
I thank the Minister for responding to these amendments. I have to say that I am a little sceptical. Yes, of course, as I think he just mentioned, one part of GCHQ is responsible for improving cybersecurity and identifying vulnerabilities around it. However, the role of another part of GCHQ is to breach cybersecurity in order to access information on terrorists’ and serious criminals’ devices. Indeed, when I was at GCHQ it was accepted that there was a tension between the two parts of that organisation as far as that is concerned.
I am also not convinced that it is absolutely clear and obvious in the Bill that there is a need to consider the unintended consequences of damage to networks or devices. I accept what the noble Earl says about collateral intrusion but not in terms of damage to devices or networks. However, at this stage—
Earl Howe
Before the noble Lord decides what to do with his amendment, it might be helpful if I amplify my earlier comments. It is perfectly right to say that some equipment interference operations involve taking advantage of weaknesses, generally in how users are interacting with the internet, but sometimes vulnerabilities in the software or hardware themselves. However, I also contend that the use of equipment interference does not in itself create those weaknesses. While the security and intelligence agencies might on occasion—as I say—exploit such capabilities, they are at the same time committed to making the internet as secure as possible. As I mentioned, the security and intelligence agencies regularly highlight such vulnerabilities to industry.
There is a simple point to be made here. To leave targets open to exploitation by others would increase the risk that their privacy would be unnecessarily intruded upon. It would also increase the risk of those who wish to know who our targets are identifying the security and intelligence agencies’ tools and techniques. Therefore, operations must be carried out in such a way as to minimise that risk. I come back to the point I made near the start of my remarks: the purpose of GCHQ is to protect the public in that sense.
“( ) The fact that the information which would be obtained under a warrant relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that the warrant is necessary on grounds falling within subsection (5).”
“( ) The fact that the information which would be obtained under a warrant relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that the warrant is necessary as mentioned in subsection (1)(b) or (2)(b).”
“( ) The fact that the information which would be obtained under a warrant relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that the warrant is necessary as mentioned in subsection (1)(a).”
“( ) The fact that the information which would be obtained under a warrant relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that the warrant is necessary as mentioned in subsection (1)(a).”
(a) ”
( ) consider the matters referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).”
Lord Rosser
Since the issue of the Wilson doctrine has been raised, perhaps I could refer to the recent report from the Select Committee on the Constitution. It referred to the Wilson doctrine and made particular reference to a case decided last year, where,
“the Investigatory Powers Tribunal held that the Wilson Doctrine provided fewer safeguards for parliamentarians’ communications than had commonly been supposed”.
The Select Committee ended that section of its report by saying:
“We note that the surveillance of parliamentarians is a significant constitutional issue and would welcome clarification from the Government of its current understanding of the Wilson Doctrine”.
Do the Government intend to give an indication of their current understanding of the Wilson doctrine, in line with the views expressed in that recent report from the Select Committee on the Constitution?
Earl Howe
My Lords, Amendment 169AA would remove the role of the Secretary of State and law enforcement chiefs from the warrant authorisation process, in circumstances where an equipment interference warrant is sought for the purposes of acquiring the communications or private information of a Member of a relevant legislature. This proposal reflects an earlier amendment discussed by this Committee in the context of interception. As I understood her, the noble Baroness, Lady Jones, is concerned that the safeguards contained in the Bill politicise the process of authorising a warrant. I do not share that perspective at all.
As my noble and learned friend Lord Keen said when we first discussed this matter, this amendment would in fact reduce the safeguards for parliamentarians. In line with the commitment given by the previous Prime Minister last November, the Bill provides a triple lock where warrants concern a parliamentarian’s communications or private information: they must be issued by the Secretary of State; approved by the Prime Minister; and authorised by a judicial commissioner. The Bill goes even further in the context of equipment interference warrants issued to law enforcement agencies, which are issued by a law enforcement chief and must be approved by the Secretary of State, the Prime Minister and an independent judicial commissioner.
I will not rehearse the arguments for the double lock at this point, but it is important to remember, as the noble Lord, Lord Murphy, reminded us, that it was endorsed by the Joint Committee of Parliament that scrutinised the draft Bill and, following amendments made in the other place, enjoyed cross-party support. The additional safeguards provided for parliamentarians add an extra layer of checks to the process. I do not share the perception of the noble Baroness, Lady Jones, that the process introduces the risk of political bias. In fact, I find it difficult to see what possible benefit would accrue from removing one of the checks that we now propose—that regarding the Secretary of State or law enforcement chief. In view of that, I respectfully invite the noble Baroness to withdraw her amendment.
I will move on briefly to the amendment tabled by the Government. Amendment 173 is—this answers the question from the noble Baroness, Lady Hamwee—a small, technical amendment that simply corrects the omission of a definition from Clause 114. The amendment adds the appropriate definition of a “designated senior official” to the clause, informing the reader of the persons to whom the provision applies. We do not think that there is any need to revisit the relative definitions in other parts of the Bill, and the amendment does not change how the equipment interference regime operates in any way.
The noble Lord, Lord Rosser, asked about the Government’s view of the Wilson doctrine. As he will be aware, in its judgment of 14 October the IPT comprehensively rejected the claim brought by a number of parliamentarians that their communications were improperly intercepted and found that all activity was within the law. The IPT also found that MPs’ communications with their constituents and others are protected by RIPA, the statutory legal regime, and that the regime governing the interception of MPs’ communications is compliant with the European Convention on Human Rights.
In February 2015, the Government published an updated draft code of practice on the interception of communications, which explicitly recognised the importance of communications between constituents and their elected representatives. In consequence, the Bill now provides for this in statute by setting out a role for the Prime Minister in authorising warrants which target a parliamentarian. I hope that that is helpful.
Lord Beith
I have to ask the Minister to address the Wilson doctrine just to this extent. Given the statutory provision which he and I both now support, what kind of statement does he envisage would be made by a Prime Minister to the House of Commons on the lines first envisaged by Harold Wilson so long ago? How can that possibly be a relevant proceeding now that these statutory provisions will be in place?
Earl Howe
My Lords, as I understand it, the Wilson doctrine committed the then Government to returning to Parliament if there was a change of policy. Clearly, now that we are enshrining what I think by common consent is a good formula for protecting parliamentarians, the need for a Government to come back to Parliament to announce a change in policy would have to be followed up, if it were done, by further primary legislation. I cannot envisage that and simply do not foresee that contingency. Through the Bill, we are now in a stronger and clearer position on the protection of parliamentarians and their communications with constituents than we were before.
Baroness Jones of Moulsecoomb
I thank the noble Lords who have made kind comments, even if they disagreed with me. We are not going to agree on the double or treble lock because, quite honestly, if you have two people from the same background or discipline agreeing with and corroborating each other—whether police chiefs or politicians—I think that there is the possibility of bias and that people outside this Chamber will see that as well.
I have heard several times in our debates the idea that we have to give the security or intelligence services the tools that they need to do the job. Personally, I heard that quite a lot with reference to the Met Police when I was on the Met Police Authority. In fact, while the Met and the intelligence services can be somewhat like a greedy child at Christmas, wanting more and more toys, it was the current Prime Minister who said “Enough” to the police. When the previous Mayor of London, Boris Johnson, wanted water cannon to be used on the streets of London, Theresa May MP said that, no, she would not authorise it. So sometimes you have to say no because it is not the right thing—the right powers or toys to give to a department.
This is a monstrous Bill which, in essence, means the end of privacy for us all. It is very important that we get these things right, so I welcome all the debate that we are having. I beg leave to withdraw the amendment.
““designated senior official” means a senior official who has been designated by the Secretary of State or (in the case of warrants issued by the Scottish Ministers) the Scottish Ministers for the purposes of this section.”
Lord Keen of Elie
I am obliged to the noble Lord for his suggestion that this is essentially a probing amendment, which he directs at what he perceives as anomalies in the Bill. For reasons that I shall expand on, those anomalies do not exist.
Amendment 176 seeks to introduce a clause that would enable the Secretary of State to make regulations requiring that the authorisation of property interference under the Police Act 1997, where the purpose is to enable the interception of communications, should be subject to the equivalent approval processes as set out under Part 5 of this Bill, including double-lock review by a judicial commissioner. That is how I understand the amendment and the noble Lord indicates his agreement.
It is worth being clear that interception warrants are not issued under the Police Act 1997, but are currently issued by the Secretary of State under Part 1 of the Regulation of Investigatory Powers Act. However, sometimes it may be necessary for intercepting authorities to carry out property interference to enable interception to take place. In these circumstances, the intercepting authority would need to ensure that appropriate property interference authorisation is obtained in addition to an interception warrant.
Clause 14 will restrict the ability of law enforcement agencies to authorise this type of equipment interference under the Police Act 1997. The restriction will mean that where the purpose of the interference is to enable the acquisition of communications, private information or equipment data, the activity can no longer be authorised under the Police Act 1997. As a result, the amendment in question is not required, as it will not be possible to authorise the type of activity it envisages under the Police Act 1997.
In future, if it is necessary to interfere with property to enable interception to take place, the interference with equipment will need to be authorised under Part 5 of the Bill. The Bill and its associated codes of practice make it clear that an equipment interference warrant cannot authorise activity which would constitute live interception of communication in the course of its transmission. As a result, both an equipment interference warrant and an interception warrant will be required.
In practice, this activity is likely to be authorised as a combined equipment interference and interception warrant. Paragraph 3 of Schedule 8 to the Bill enables the Secretary of State to issue such a combined warrant to the relevant intercepting authorities, such as the NCA. This reflects the fact that the Secretary of State is responsible for issuing targeted interception warrants, and the Bill ensures that combined warrants always default to the most senior level of authorisation. Any such warrant would always also go through the double lock of judicial commissioner authorisation.
I hope that reassures the noble Lord that the amendment is not necessary and I accordingly invite him to withdraw it
Lord Paddick
I thank the noble and learned Lord for what he has said, but I did ask whether he would be prepared to offer an opinion about the deployment of a covert camera into somebody’s home without the need for either Secretary of State or judicial commissioner approval and what, in the Government’s opinion, is the right level of authority. I accept what he says about an interception warrant being required if equipment interference is for the purpose of intercepting communication. However, if it is for the purpose of observing what is going on inside an office or a home, I do not believe that that amounts to interception of communication as such, even though the people who are present in the room are communicating with each other. I do not think that amounts to interception of communication as intended by the Bill.
The other issue that I was hoping the noble and learned Lord could enlighten the Committee on is that equipment interference warrants issued to the security services require the double lock of the Secretary of State and a judicial commissioner, but equipment interference warrants issued to law enforcement do not require that double lock, because a police chief can self-authorise the issuing of such a warrant to such agencies. We have to bear in mind how intrusive that can be. We have already discussed that the equipment interference may not necessarily be in order to intercept communication, and the noble and learned Lord gave the example earlier of looking for a pornographic image on a computer. Despite what he said, it still seems an anomaly that the security services require a double-lock authority and the police do not.
Lord Keen of Elie
I am not sure to what extent I can respond before the noble Lord sits down, but let me be clear that I do not accept that there is an anomaly, because we are dealing here with two entirely different circumstances that are not directed to the present amendment. As regards a camera being placed in someone’s room, I undertake to write to the noble Lord on that if that will assist him, although it does not appear to me to assist with this amendment.
Lord Paddick
I am grateful to the noble and learned Lord, who has all the time in the world to add comments until I finally withdraw the amendment. However, I beg leave to withdraw it at this stage.