Counter-Terrorism and Security Bill

Debate between Baroness Ludford and Lord Rosser

Monday 26th January 2015 Lords Chamber

[Baroness Ludford (LD)]

My Lords, the amendment stands in my name and those of my noble friends Lady Hamwee and Lord Paddick. I shall speak also to Amendment 77. In this grouping, there is also Amendment 78 of the noble Baroness, Lady Smith of Basildon.

The Explanatory Notes refer to data that are “necessary” to attribute internet protocol addresses to a person or device. However, that word does not appear in the Bill; I believe that something similar happened in the draft Communications Data Bill in 2012, which was picked up by the committee on the draft Bill. There is a tendency to put “necessary” in Explanatory Notes but not to transfer that to the Bill. Amendment 76, therefore, at least seeks to apply the test of “necessary” to communications data that could,

“assist in identifying, which internet protocol address … belongs to the sender or recipient of a communication (whether or not a person)”.

At least it tightens up, somewhat, the scope of communications data—relevant internet data—required.

I have seen an itemisation of possible data—I confess that I do not know what the origin was, but it refers to possible data which would be required to be retained. I state just for interest that it includes,

“account-to-IP address mappings for broadband … source IP address and port for NAT on mobile and cloud networks … MAC addresses on cloud WiFi networks … source port information in server logs”,

and:

“MAC addresses from end-user equipment”.

This is above my technical pay grade and I think we need some clarity about what sort of information is being required. Therefore, in Amendment 77 we are requesting that when the term “other identifier” is used, meaning an identifier used to facilitate the transmission of a communication, what qualifies as “other identifier” should be specified in regulations made by the Secretary of State.

I have seen it cited that there has been consultation with industry on these matters. Certainly, the Internet Services Providers’ Association has complained that it was not consulted on this section on the collection of IP addresses. It posted something on its website on 24 November, so something may have happened in the intervening two months, but it certainly felt at that time that it had not been consulted. Of course the association would be qualified, as the experts, which I am not, to know what is being talked about here and what is, indeed, necessary and essential to identify an IP address.

I mentioned at Second Reading that the Bill refers to,

“the sender or recipient of a communication (whether or not a person)”.

I still believe that it is somewhat misleading to suggest that a person can be identified from an IP address. Even with a static IP address allocated to a particular device or subscriber, you would at best know who the subscriber was, but you would not necessarily know who was using the device at a particular time. It may not have been the subscriber; it may have been a friend, a relative or a business associate. If it is a dynamic IP address I understand that there can be tens of thousands of people who could have used it. Even with this other information, even if you can identify the device that was using it at 4.12 pm on a Tuesday afternoon, it is still not clear that you can, of itself, then identify the person using it. You would need other investigations—police investigations—to ascertain who precisely was using the device.

I hope that I have conveyed the meaning of Amendments 76 and 77, which seek to put greater precision into the Bill as to what further communications data are being required to be kept.

[Lord Rosser]

My Lords, our Amendment 78 in this group seeks to make it explicit that the extra data retention provided for in Clause 17 does not extend beyond that which is necessary for the purpose of identifying a user from the internet protocol address. The amendment is not meant to impact on the rest of the Data Retention and Investigatory Powers Act.

Clause 17 amends the definition of “relevant communications data” in the Data Retention and Investigatory Powers Act 2014. The clause expands the definition of “relevant communications data” to include an extra category of data—described as “relevant internet data”—in Section 2 of the DRIP Act, to allow the Secretary of State to use powers under Section 1 of that Act to bring in regulations to ensure that this “relevant internet data” is retained by communications service providers. Essentially, the Government are using this fast-track primary legislation to amend emergency primary legislation from last July to enable the Secretary of State to bring in secondary legislation relating to a clause in this Bill, which extends the current provision on data retention.