Draft Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018
Draft Investigatory Powers (Technical Capability) Regulations 2018
Draft Investigatory Powers (Review of Notices and Technical Advisory Board) Regulations 2018
Draft Investigatory Powers (Codes of Practice) Regulations 2018
(6 years, 9 months ago)
General CommitteesRead Hansard Text Read Debate Ministerial Extracts
The Committee divided: - Ayes: 13 / Noes: 1 - Question accordingly agreed to.
The Committee divided: - Ayes: 13 / Noes: 1 - Question accordingly agreed to.
The Committee divided: - Ayes: 13 / Noes: 1 - Question accordingly agreed to.
The Minister for Security and Economic Crime (Mr Ben Wallace)
I beg to move,
That the Committee has considered the draft Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018.
The Chair
With this it will be convenient to consider the draft Investigatory Powers (Technical Capability) Regulations 2018, the draft Investigatory Powers (Review of Notices and Technical Advisory Board) Regulations 2018 and the draft Investigatory Powers (Codes of Practice) Regulations 2018.
Mr Wallace
It is a pleasure to serve under your chairmanship, Mr Rosindell. I am pleased to be given the opportunity to debate these important regulations, which are being made under the Investigatory Powers Act 2016. The Act passed with strong support from Members on both sides of the House of Commons and received Royal Assent in November 2016, following unprecedented parliamentary scrutiny.
That legislation brings together the powers available to our law enforcement and security and intelligence agencies to obtain communications and data about communications. It ensures that those powers and the safeguards that apply to them are clear and understandable, and it radically overhauls how the powers are authorised and overseen. It introduces a double lock for the most intrusive powers so that they cannot be used until the decision to do so has been approved by a judge. It has also created a powerful new Investigatory Powers Commissioner—a post held by Lord Justice Fulford—to oversee how the powers are used.
Let me be clear: the powers in the Act are absolutely crucial to our national security and the safety of our citizens. They make sure that our law enforcement and security and intelligence agencies are equipped to carry out their critical work of protecting the public and ensuring that terrorists, paedophiles and other perpetrators of serious crimes can be brought to justice. In the light of the horrifying attacks in this country in the past year, making sure that our agencies maintain the powers that they need is more important than ever.
The regulations are all intrinsically linked to the implementation of the Act. They do not create any new powers; rather, they enable a number of the Act’s provisions to be exercised and set out further details of how certain powers will be used. Collectively, they also create additional safeguards about the use of the powers, building on those set out in the primary legislation.
We will debate four sets of regulations. First, the draft Investigatory Powers (Codes of Practice) Regulations 2018 bring into force five codes of practice covering a number of vital provisions under the Act. The codes relate to the interception of communications, equipment interference, the bulk acquisition of communications data, national security notices and the intelligence services’ retention and use of bulk personal datasets. Each of the five codes sets out processes and safeguards governing the use of the investigatory powers to which they relate. They give detail on how the relevant powers should be used, including examples of best practice. They provide additional clarity and ensure that the highest standards of professionalism and compliance with this vital legislation are adhered to.
The codes are primarily intended to guide the public authorities that can exercise powers under the Act, as well as communications service providers that might be required to provide assistance in giving effect to its provisions. The codes provide information on the process associated with applying to use each of the powers, as well as the safeguards and oversight arrangements that will ensure that the powers are used in the intended manner. The codes are detailed and comprehensive, together with more than 400 pages of guidance and best practice, ensuring that the use of these important powers is subject to the most stringent safeguards.
Secondly, the draft Investigatory Powers (Technical Capability) Regulations 2018 set out the obligation that may be imposed on a telecommunications or postal operator in a technical capability notice. The purpose of such a notice is to ensure that when a warrant or authorisation is served on or given to an operator, that company has the capability to provide assistance, giving effect to it securely and quickly.
As part of maintaining a technical capability, the Act specifies that a telecommunications operator may be required to maintain the capability to remove encryption from communications that it has applied or that has been applied on its behalf. The regulations do not change that position and simply make it clear that such an obligation could be included in a technical capability notice when necessary and proportionate.
The Act sets out robust safeguards on the use of technical capability notices. Such a notice may be given by the Secretary of State only where necessary and proportionate, having taken into account a number of factors such as technical feasibility and cost, and having consulted with the operator to which a notice is to be given. The decision of the Secretary of State to give a notice must be approved by a judicial commissioner.
Thirdly, the draft Investigatory Powers (Review of Notices and Technical Advisory Board) Regulations 2018 are fundamentally linked to the technical capability regulations. The Act provides for the important safeguard that a telecommunications operator in receipt of a technical capability notice, a national security notice or a data retention notice may seek a review of that notice by the Secretary of State. In conducting such a review, the Secretary of State must consult the Technical Advisory Board—a non-departmental public body—as to the technical feasibility and cost of the notice. These regulations set out the circumstances in which a review may take place and how the board must be constituted.
The final set of regulations is the draft Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018. The Act provides that it is a criminal offence to intercept communications in the absence of lawful authority. It also makes clear that lawful authority includes interception by businesses or other bodies where it is legitimate practice. The regulations set out what conduct that includes, and simply ensure that companies can undertake routine activities without falling foul of the offence of unlawful interception. Such activities might include, for example, call centres recording telephone calls for training purposes or companies scanning their computer networks to detect cyber-attacks.
In summary, the regulations give effect to provisions already set out in primary legislation that is fundamental to our national security. The regulations make clear how a number of provisions in that Act will operate, and establish additional safeguards to the already rigorous controls set out in the primary legislation.
Nick Thomas-Symonds (Torfaen) (Lab)
It a pleasure to serve under your chairmanship, Mr Rosindell.
I will make a few general remarks and then deal with the regulations in the same order as the Minister, for the convenience of the Committee. I pay tribute to the work done on the Investigatory Powers Bill during its passage through Parliament, particular that of my predecessors in the shadow Home Office team, who sought reassurances and changes, and that of my predecessor as the Member of Parliament for Torfaen, the now Lord Murphy, who chaired the cross-party Joint Committee on the Draft Investigatory Powers Bill, which considered it in detail and suggested a number of changes.
Turning to the draft Investigatory Powers (Codes of Practice) Regulations 2018, the Opposition believe that strong powers should always be accompanied by strong safeguards. The regulations bring into practice five specific codes under paragraph 1(1) of schedule 7 to the Investigatory Powers Act, dealing with the matters of bulk acquisition of communications data, equipment interference, interception of communications, national security notices, and the intelligence services’ retention and use of bulk personal datasets. The Opposition believe that in the context and framework of the Act the codes of practice are important, and we do not oppose bringing them into effect. As the Minister has already set out, clarity, best practice and compliance with them across the board is extremely important, and I hope those codes will have that effect.
Secondly, the draft Investigatory Powers (Technical Capability) Regulations 2018, set out the obligations that may be contained in a technical capability notice given by the Secretary of State under the Act. Clearly, for the Act’s provisions to work, relevant operators—defined as a postal operator or a telecommunications operator—have to have technical capability, and a technical capability notice imposes obligations to ensure that those bodies have the ability to provide assistance regarding warrants and authorisation. The regulations clearly set out the obligations that can be placed in notices, and telecommunications operators that provide only banking, insurance, investment or other financial services are excluded. There is also a requirement that certain obligations apply only to operators providing a service to more than 10,000 customers. We believe that those limitations are sensible. We also believe in the importance of necessity and proportionality, to which the Minister has already referred. Therefore, on that basis, the Opposition will not oppose the regulations.
Thirdly, the draft Investigatory Powers (Review of Notices and Technical Advisory Board) Regulations 2018 apply where a data retention notice has been issued and the body concerned wishes to review any part of it as unreasonable. In those circumstances, it can be referred to the Secretary of State for review, but he or she has to consult the Technical Advisory Board. That referral has to be within 28 days, starting from either when the notice was given, or when a particular variation was made. The Technical Advisory Board has to consider the technical requirements and financial consequences of the notice for the person making the reference.
The regulations are also clear in terms of the composition of the Technical Advisory Board. There has to be a minimum of 13 members and a maximum of 15. Six must represent the interests of the operators, on whom obligations can be imposed by a retention notice, a national security notice or a technical security notice. The board has to have at least one and a maximum of three members who are independent, not representing either those on whom the obligations can be imposed or those who can apply for warrants and authorisation. Again, the Opposition believe that the regulations seem to constitute useful safeguards in the context of the Act, and we will not oppose them.
The fourth and final set of regulations is the draft Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018. Section 3 of the Act creates an offence of intentionally intercepting a communication during transition by a telecommunication system without lawful authority. The regulations set out the conduct that can be authorised: it has to be for one of the purposes set out in the regulation, and it has to be done by or with the express consent of someone who has the right to control the operation or use of the telecommunication system in question. There are also further restrictions in the regulations. We believe that that framework, with intentional interception being illegal save in the prescribed circumstances, provides a very sensible balance. Again, the Opposition will not oppose the regulations.
Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)
It is a pleasure to serve under your chairmanship, Mr Rosindell. We all agree that we must give our intelligence, security and police services the tools needed to fight serious crime and terrorism, and I pay tribute to the amazing work they do day in, day out on our behalf. However, it is also vital that any new powers are proportionate, focused and in accordance with the law.
The Investigatory Powers Bill—I sat on the Joint Committee to which the shadow Minister, the hon. Member for Torfaen, referred—contained some important and welcome developments, including those set out by the Minister. It consolidated and, in some places, clarified existing law and introduced new oversight procedures. Despite what the Minister says, it was also a very controversial piece of legislation, and there were many important debates on where the balance lies between empowering security and intelligence services and protecting individual liberties and privacy.
My party had huge issues with the developments regarding the bulk powers contained in the Bill and, of course, with new powers regarding internet connection records. Ultimately, we voted against the Bill. Whether one supported or opposed the Bill, we can all agree that such debates are not only difficult and important, but very complex and technical. I think that the debate should continue.
Excepting the draft Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018, we have concerns about the scope of some of the regulations, which outline practice in relation to some of the powers we objected to during debates on the Bill. For example, industry has raised concerns with us about the scope of the technical capability notices that might be issued. Arguably, they contain new and slightly broader powers than those envisaged in the Bill.
The more fundamental point is that we have a problem with process. Issues surrounding investigatory powers, including bulk acquisition, should receive the fullest scrutiny and, we believe, greater scrutiny than that which a Delegated Legislation Committee can provide. The Minister himself referred to 400 pages of codes and guidance. The ideal would be for fuller Committee scrutiny, including evidence gathering or at least a debate in the House. Although opposing the regulations will not deliver that, at the very least it will ensure that the whole House has the chance to vote. The Minister, as ever, has presented his case impeccably; we simply believe that the regulations should be tested more thoroughly. For those reasons, we will object to three of the four sets of regulations.
Mr Wallace
May I first thank the official Opposition for their position and considered view on the regulations? The passing of the Investigatory Powers Act 2016 through the House was a significant process, with many Government concessions and lots of working across party lines to ensure that we struck the balance between freedoms and security, while trying to allow our law enforcement agencies and intelligence services to stay one step ahead of paedophiles and terrorists who often exploit technology to outwit or to remain undetected.
It is not easy in my job to listen to the intercepted communication of paedophiles plotting to kidnap a child. Sometimes that is behind encrypted communication. They do that knowing that they are hard to detect because some of the data they use is hard for us to analyse or capture. That is why the 2016 Act was so important. I do not think any Government like to change a piece of legislation at any stage, but it has allowed us to detect, prosecute and convict some of the people in society who pose a real danger to us.
The codes of practice are user-friendly, believe it or not. Often the statutory instruments we debate are slightly gobbledegook and we have to refer to the explanatory notes and go back to the original debate to understand what they are about. The codes of practice are designed for the superintendent or the official sitting at their desk doing an investigation to ensure that they comply with the law. The codes are user-friendly and accessible.
In the drafting of the codes of practice, I was determined to ensure that the protections we promised to the House in primary legislation are reflected strongly. In terms of the protected professions, I ensured that journalism, about which people expressed concern during the passage of the Bill, was given the due prominence required in the codes so that when people are considering using the powers, they understand that we have to give extra consideration to a number of protected provisions. For that reason, I am content with the regulations.
I am grateful for the official Opposition’s support. The regulations contain all sorts of ways to ensure that the agencies are held to account. Lord Justice Fulford is a formidable individual and a highly respected judge. The independence of the interception commissioners will be without question. One or two are from Scotland and some are from jurisdictions across the United Kingdom to ensure that it is not just the usual suspects, but a broad base of judiciary, and our decisions and the technical notices will be subject to that scrutiny. Judges will not do it with favour; they will do it in compliance with the law. When I look across the oversight that we now have, both independent and in this House, of our intelligence agencies, I see that we have the Intelligence and Security Committee, the varying roles of the tribunals, including the Investigatory Powers Tribunal—some of those roles will be folded into the commissioners’ jobs—and Parliament and the review of terrorism. We have many more layers of oversight than some of our contemporary countries across Europe and the United States, and we should be proud of that.
When I visit our intelligence services, I am always struck by how determined they are to abide by the law. Sometimes I am tempted to say, “Why are we not doing more of this?” and more and more they reflect back to me, “Minister, we have to do what is proportionate, necessary and no more.” Those professionals in those organisations take that duty incredibly seriously. The secondary legislation will ensure that they have that capability. I genuinely believe that by having it, they will help us and our children stay safe from predatory paedophiles, terrorists and organised crime. The hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East will know that only recently one of the major serious organised crime kingpins was arrested. He had military-scale weapons on him, including military-grade communication encryption. That is the enemy we can be up against, and that is why we need the powers. I urge him to reconsider his opposition.
The legislation has had lots of airing, and I am incredibly grateful to all parties that have supported it. The people who use it do so in a measured, proportionate and necessary manner.
Question put and agreed to.
Draft Investigatory Powers (Technical Capability) Regulations 2018
Motion made, and Question put,
That the Committee has considered the draft Investigatory Powers (Technical Capability) Regulations 2018.—(Mr Ben Wallace.)