Earl Howe
Main Page: Earl Howe (Conservative - Excepted Hereditary)Department Debates - View all Earl Howe's debates with the Ministry of Defence
Wednesday 19th October 2016
(8 years ago)
Lords ChamberRead Full debate Read Hansard Text Read Debate Ministerial Extracts Amendment Paper: HL Bill 62-III Third marshalled list for Report (PDF, 153KB) - (17 Oct 2016)
“Approval of major modifications by Judicial Commissioners
(1) In deciding whether to approve a decision to make a major modification of a bulk interception warrant, a Judicial Commissioner must review the Secretary of State’s conclusions as to whether the modification is necessary on any of the grounds on which the Secretary of State considers the warrant to be necessary.(2) In doing so, the Judicial Commissioner must—(a) apply the same principles as would be applied by a court on an application for judicial review, and(b) consider the matter referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).(3) Where a Judicial Commissioner refuses to approve a decision to make a major modification under section 137, the Judicial Commissioner must give the Secretary of State written reasons for the refusal.(4) Where a Judicial Commissioner, other than the Investigatory Powers Commissioner, refuses to approve a decision to make a major modification under section 137, the Secretary of State may ask the Investigatory Powers Commissioner to decide whether to approve the decision to make the modification.”
“( ) In deciding whether to give an approval under subsection (2) in a case where subsection (1)(b)(i) applies, a senior official must have regard to the public interest in the confidentiality of items subject to legal privilege.”
“( ) For the purposes of subsection (3)(b), there cannot be exceptional and compelling circumstances that make it necessary to authorise the use of the relevant criteria unless—(a) the public interest in obtaining the information that would be obtained by the selection of the intercepted content for examination outweighs the public interest in the confidentiality of items subject to legal privilege,(b) there are no other means by which the information may reasonably be obtained, and(c) obtaining the information is necessary in the interests of national security or for the purpose of preventing death or significant injury.”
“(3A) Subsection (3B) applies if, in a case where intercepted content obtained under a bulk interception warrant is to be selected for examination—(a) the selection of the intercepted content for examination meets any of the selection conditions in section 143(3)(a) to (c),(b) the purpose, or one of the purposes, of using the criteria to be used for the selection of the intercepted content for examination (“the relevant criteria”) is to identify communications that, if they were not made with the intention of furthering a criminal purpose, would be items subject to legal privilege, and(c) the person to whom the warrant is addressed considers that the communications (“the targeted communications”) are likely to be communications made with the intention of furthering a criminal purpose.(3B) The intercepted content may be selected for examination using the relevant criteria only if a senior official acting on behalf of the Secretary of State has approved the use of those criteria.(3C) A senior official may give an approval under subsection (3B) only if the official considers that the targeted communications are likely to be communications made with the intention of furthering a criminal purpose.”
“(4A) The Investigatory Powers Commissioner may—(a) direct that the item is destroyed, or(b) impose conditions as to the disclosure or otherwise making available of that item.(4B) The Investigatory Powers Commissioner—(a) may require an affected party to make representations about how the Commissioner should exercise any function under subsection (4A), and(b) must have regard to any such representations made by an affected party (whether or not as a result of a requirement imposed under paragraph (a)).(4C) Each of the following is an “affected party” for the purposes of subsection (4B)—(a) the Secretary of State;(b) the person to whom the warrant is or was addressed.”
“Additional safeguard for confidential journalistic material
Where—(a) a communication which has been intercepted in accordance with a bulk interception warrant is retained, following its examination, for purposes other than the destruction of the communication, and(b) it is a communication containing confidential journalistic material,the person to whom the warrant is addressed must inform the Investigatory Powers Commissioner as soon as is reasonably practicable.(For provision about the grounds for retaining material obtained under a warrant, see section 141.)”
“section (General definitions: “journalistic material” etc.) (general definitions: “journalistic material” etc.),”
Lord Paddick
My Lords, the amendment is in my name and that of my noble friend Lady Hamwee. I shall speak also to all the other amendments in this group, Amendments 203B to 203D, 204A to 204F, 205A, 208A to 208C, 209A, 210A and 210B, 215A, 217A and 218A. The sole effect of all the amendments would be to remove from the Bill the power to engage in bulk equipment interference.
This is a new power for the security and intelligence agencies to carry out equipment interference in bulk overseas. It is not a power they currently have and, according to David Anderson QC, it is not something that they currently do. As a result, David Anderson said in his review of bulk powers that the operational case for bulk equipment interference was “not yet proven”. The noble Lord, Lord Murphy, has said:
“The case for bulk equipment interference was less strong, but nevertheless still there”.—[Official Report, 7/9/2016; col. 1049.]
As the noble Lord, Lord Rosser, said in Committee, there is a difference between an operational case, let alone an unproven one, and proportionality or desirability. Quoting Mr Anderson, he pointed out that Mr Anderson assessed only the operational cases in his review, saying that the issues of proportionality and necessity were a matter for Parliament—which is why we are debating these amendments today.
We heard in earlier debates about the potentially broad scope of targeted equipment interference warrants. They can specify all equipment used by anyone in a particular organisation or more than one organisation involved in a single investigation or operation; all equipment used by members of a group with a common purpose or engaged in a particular activity; equipment in a particular location or more than one location for the purpose of a single investigation or operation; and equipment being used or that may be used for a particular activity or activities. That is all contained in Clause 108.
Although I realise that the primary focus of this House should be to protect the citizens of this country, I ask noble Lords to consider how they would feel if overseas Governments took our lead and enacted similar legislation that could be deployed against the UK and its citizens. UK citizens’ communications could be acquired through the use of bulk equipment interference warrants if they communicated with others based overseas.
In paragraph 7.37 of his report into bulk powers, David Anderson QC warns that considerable caution is required for a series of reasons. He concludes in paragraph 7.38:
“All this means that bulk EI will require, to an even greater extent than the other powers subject to review, the most rigorous scrutiny not only by the Secretary of State but by the Judicial Commissioners who must approve its use and by the IPC which will have oversight of its consequences”.
It is the nearest David Anderson comes to expressing an opinion on necessity and proportionality and, reading between the lines, it is clear that he is not keen.
For those reasons—and as the Intelligence and Security Committee initially recommended, although it was subsequently persuaded—we believe that bulk equipment interference warrants should be removed from the Bill. I beg to move.
The Minister of State, Ministry of Defence (Earl Howe) (Con)
My Lords, these amendments would remove the bulk equipment interference provisions from the Bill. Before I address the amendments specifically, it is worth pausing to reflect briefly on the importance of bulk powers in the round and the very significant steps that the Government have taken to ensure both that a robust operational case has been made for their necessity and that the most rigorous safeguards will apply to their use.
Extremely detailed and extensive scrutiny has been applied to bulk powers during the passage of the Bill, both in Parliament and, of course, by David Anderson QC as part of his bulk powers review. The conclusion of that review was that bulk powers,
“have a clear operational purpose”;
that they,
“play an important part in identifying, understanding and averting threats in Great Britain, Northern Ireland and further afield”;
and that where alternatives exist to their use,
“they were likely to produce less comprehensive intelligence and were often more dangerous (for example to agents and their handlers), more resource-intensive, more intrusive or—crucially—slower”.
The Government have now tabled amendments giving full effect to the sole recommendation of that review, establishing in statute a Technology Advisory Panel to the Investigatory Powers Commissioner. We have also accepted an amendment tabled by the Intelligence and Security Committee which introduces a specific offence in the Bill to address deliberate misuse of the bulk powers. We have addressed wider concerns of that committee by adding very significant detail to the Bill on the safeguards that will regulate the use of these powers. I am grateful for the intensive scrutiny that has been applied to the bulk provisions in the Bill and believe that those provisions are all the stronger for it. There should now be no question that these powers are necessary and they are subject to world-leading safeguards.
(a) ceases to have effect (unless already cancelled), and(b) may not be renewed;and section 166(4) does not apply in relation to the refusal to approve the decision.”
“Approval of major modifications by Judicial Commissioners
(1) In deciding whether to approve a decision to make a major modification of a bulk equipment interference warrant, a Judicial Commissioner must review the Secretary of State’s conclusions as to the following matters— (a) whether the modification is necessary on any of the grounds on which the Secretary of State considers the warrant to be necessary, and(b) in the case of a major modification adding or varying any description of conduct authorised by the warrant, whether the conduct authorised by the modification is proportionate to what is sought to be achieved by that conduct.(2) In doing so, the Judicial Commissioner must—(a) apply the same principles as would be applied by a court on an application for judicial review, and(b) consider the matters referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).(3) Where a Judicial Commissioner refuses to approve a decision to make a major modification under section 173, the Judicial Commissioner must give the Secretary of State written reasons for the refusal.(4) Where a Judicial Commissioner, other than the Investigatory Powers Commissioner, refuses to approve a decision to make a major modification under section 173, the Secretary of State may ask the Investigatory Powers Commissioner to decide whether to approve the decision to make the modification.”
“( ) In deciding whether to give an approval under subsection (2) in a case where subsection (1)(b)(i) applies, a senior official must have regard to the public interest in the confidentiality of items subject to legal privilege.”
“Additional safeguard for confidential journalistic material
Where—(a) material obtained under a bulk equipment interference warrant is retained, following its examination, for purposes other than the destruction of the material, and(b) it is material containing confidential journalistic material,the person to whom the warrant is addressed must inform the Investigatory Powers Commissioner as soon as is reasonably practicable.(For provision about the grounds for retaining material obtained under a bulk equipment interference warrant, see section 177.)”
“section (General definitions: “journalistic material” etc.) (general definitions: “journalistic material” etc.),”
“and section 190(4) does not apply in relation to the refusal to approve the decision.”
(d) where the Secretary of State has imposed conditions under section (Protected data: power to impose conditions), specify those conditions.”
“( ) Section (Protected data: power to impose conditions) applies in relation to the renewal of a specific BPD warrant as it applies in relation to the issue of such a warrant (whether or not any conditions have previously been imposed in relation to the warrant under that section).”
“Approval of major modifications by Judicial Commissioners
(1) In deciding whether to approve a decision to make a major modification of a class BPD warrant or a specific BPD warrant, a Judicial Commissioner must review the Secretary of State’s conclusions as to whether the modification is necessary on any of the grounds on which the Secretary of State considers the warrant to be necessary.(2) In doing so, the Judicial Commissioner must—(a) apply the same principles as would be applied by a court on an application for judicial review, and(b) consider the matter referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy). (3) Where a Judicial Commissioner refuses to approve a decision to make a major modification under section 197, the Judicial Commissioner must give the Secretary of State written reasons for the refusal.(4) Where a Judicial Commissioner, other than the Investigatory Powers Commissioner, refuses to approve a decision to make a major modification under section 197, the Secretary of State may ask the Investigatory Powers Commissioner to decide whether to approve the decision to make the modification.”
“( ) In deciding whether to give approval for the purposes of subsection (3)(b), the Judicial Commissioner must—(a) apply the same principles as would be applied by a court on an application for judicial review, and(b) consider the matter with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).”
“Additional safeguards for items subject to legal privilege: examination
(1) Subsections (2) and (3) apply if, in a case where protected data retained in reliance on a specific BPD warrant is to be selected for examination—(a) the purpose, or one of the purposes, of using the criteria to be used for the selection of the data for examination (“the relevant criteria”) is to identify any items subject to legal privilege, or(b) the use of the relevant criteria is likely to identify such items.(2) If the relevant criteria are referable to an individual known to be in the British Islands at the time of the selection, the data may be selected for examination using the relevant criteria only if the Secretary of State has approved the use of those criteria.(3) In any other case, the data may be selected for examination using the relevant criteria only if a senior official acting on behalf of the Secretary of State has approved the use of those criteria.(4) The Secretary of State may give approval for the purposes of subsection (2) only with the approval of a Judicial Commissioner.(5) Approval may be given under subsection (2) or (3) only if—(a) the Secretary of State or (as the case may be) the senior official considers that the arrangements mentioned in section 188(6)(d) include specific arrangements in respect of items subject to legal privilege, and(b) where subsection (1)(a) applies, the Secretary of State or (as the case may be) the senior official considers that there are exceptional and compelling circumstances that make it necessary to authorise the use of the relevant criteria.(6) In deciding whether to give an approval under subsection (2) or (3) in a case where subsection (1)(a) applies, the Secretary of State or (as the case may be) the senior official must have regard to the public interest in the confidentiality of items subject to legal privilege.(7) For the purposes of subsection (5)(b), there cannot be exceptional and compelling circumstances that make it necessary to authorise the use of the relevant criteria unless—(a) the public interest in obtaining the information that would be obtained by the selection of the data for examination outweighs the public interest in the confidentiality of items subject to legal privilege,(b) there are no other means by which the information may reasonably be obtained, and(c) obtaining the information is necessary in the interests of national security or for the purpose of preventing death or significant injury.(8) In deciding whether to give approval for the purposes of subsection (4), the Judicial Commissioner must—(a) apply the same principles as would be applied by a court on an application for judicial review, and(b) consider the matter with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).(9) Subsections (10) and (11) apply if, in a case where protected data retained in reliance on a specific BPD warrant is to be selected for examination— (a) the purpose, or one of the purposes, of using the criteria to be used for the selection of the data for examination (“the relevant criteria”) is to identify data that, if the data or any underlying material were not created or held with the intention of furthering a criminal purpose, would be an item subject to legal privilege, and(b) the person to whom the warrant is addressed considers that the data (“the targeted data”) or any underlying material is likely to be data or underlying material created or held with the intention of furthering a criminal purpose.(10) If the relevant criteria are referable to an individual known to be in the British Islands at the time of the selection, the data may be selected for examination using the relevant criteria only if the Secretary of State has approved the use of those criteria.(11) In any other case, the data may be selected for examination using the relevant criteria only if a senior official acting on behalf of the Secretary of State has approved the use of those criteria.(12) Approval may be given under subsection (10) or (11) only if the Secretary of State or (as the case may be) the senior official considers that the targeted data or the underlying material is likely to be data or underlying material created or held with the intention of furthering a criminal purpose.(13) In this section, “underlying material”, in relation to data retained in reliance on a specific BPD warrant, means any communications or other items of information from which the data was produced.”
“( ) In deciding whether to give approval for the purposes of subsection (7), the Judicial Commissioner must apply the same principles as would be applied by a court on an application for judicial review.”
Baroness Hamwee
My Lords, I shall also speak to Amendments 245 and 246. These amendments take us back to the question of the reimbursement of the operators’ costs. We have heard frequent assurances about the operators’ compliance costs and that they are to be met, but the words of the Bill do not quite live up to some of the narrative.
Our three amendments cover two alternatives; they would not all be possible. Amendments 244 and 245 would provide that arrangements were in force to secure for the operators the full amount of all relevant costs—“relevant costs” are defined later in the clause—not an appropriate contribution. As Clause 225(1) is framed, the Secretary of State must ensure,
“an appropriate contribution in respect of such of their relevant costs as the Secretary of State considers appropriate”.
With these two amendments, we seek to take out that element of discretion.
Amendment 246 would provide that if the contribution was not an equal amount, there should be regulations regarding the basis of how the contribution is calculated. Our amendments provide that the Secretary of State should lay regulations to that effect. It will be obvious to noble Lords that our reasons are transparency, equality between operators and the opportunity to consider the criteria—the factors, if you like—applied in calculating the contribution. In other words, our intention is scrutiny, using the opportunity that regulations give for debate of their content.
We have debated this matter on a number of occasions, and the Minister will be well aware of our concern. This is an attempt, at this almost last stage, to pin down just how the contribution will be made. I beg to move.
Earl Howe
My Lords, Amendments 244 and 245 are intended to ensure that communications service providers are fully reimbursed for their costs in connection with complying with obligations under the Bill. As the noble Baroness knows, this matter has been considered at length both in this House and in the Commons. It is important to recognise that service providers must not be unduly disadvantaged financially for complying with obligations placed on them aimed at protecting national security or combating crime. Indeed, the Government have a long history of working with service providers on these matters and we have been absolutely clear that we are committed to cost recovery.
I once again take the opportunity to reaffirm to the House a point that both my right honourable friend the former Security Minister and my right honourable friend the Prime Minister made very clear in the other place and that I made in Committee: this Government will reimburse 100% of reasonable costs incurred by communications service providers in relation to the acquisition and retention of communications data. This includes both capital and operational costs, including the costs associated with the retention of internet connection records.
The question that the House needs to consider, I submit, is whether it is appropriate for the Parliament of today to tie the hands of future Governments on this issue. That does not mean that we take our commitment lightly, or that future Governments will necessarily or lightly change course. Indeed, it is unlikely that any change in policy will ever take place. For example, the current policy has not changed since the passage of the Regulation of Investigatory Powers Act 2000, and so has survived Governments of three different colours, or combinations of colours.
The Bill adds further safeguards, requiring a data retention notice to set out the level of contribution that applies. This ensures that the provider must be consulted on any changes to the cost model and means that the provider could seek a review of any variation to the notice which affected the level of contribution.
Another question that I hope the House will consider is whether a communications service provider should be able to derive commercial benefit as a result of the obligations imposed on them in relation to the other powers under the Bill. Sometimes, it may be necessary for a communications service provider to upgrade part of its infrastructure to comply with an obligation imposed on it under a technical capability notice. As the communications service providers may be able to derive some business benefit from that upgrade, it is right that the legislation allows for the contribution to the costs to be appropriate to the circumstances.
Some noble Lords have expressed concern about the term “reasonable costs” and asked what it means. I hope I can provide some reassurance on that point. Significant public funding is made available to companies to ensure that they can provide assistance to public authorities in tackling terrorism, crime and other threats. As costs are reimbursed from public funds, the codes of practice make very clear that companies should take value for money into account when procuring, operating and maintaining the infrastructure required to comply with a notice. Were a company to select a solution that did not deliver best value for public funds, I am sure noble Lords would agree that it is absolutely right that the Government would need to consider carefully whether those costs were reasonable and therefore whether it was appropriate to reimburse the company in full.
The noble Baroness’s Amendment 246 acknowledges that there may be circumstances where it is appropriate for a communications service provider to be reimbursed less than its full costs. However, we do not think her proposed regulations provide the required flexibility. As I just explained, communications service providers may receive some business benefit from the changes made to their systems and it is appropriate that the Government are able to discuss these matters with them on a case-by-case basis, rather than be bound by general regulations. Indeed, while communications service providers would welcome an amendment to require 100% cost recovery in all cases, I suggest that they are unlikely to welcome regulations which enshrine in law circumstances where they would not receive full reimbursement.
I hope I have allayed any concerns about the Government’s position on costs and accordingly invite the noble Baroness to withdraw her amendment.
Baroness Hamwee
My Lords, until the last two or three sentences, I thought the noble Earl had made a much better case for regulations than I did. I am a little worried about his argument that regulations cannot provide for flexibility. Flexibility is not necessarily bad, but how it is exercised should be transparent, and that is what my amendment is driving at.
The noble Earl started his remarks by saying that the operators should not be “unduly disadvantaged”, and it is those words which caveat the commitment that has troubled us throughout our debates. We have tried, particularly with the third amendment, to meet the points made by the Government. I will obviously not pursue this any further; we have reached the end of the road. I have no doubt that someone will draw to our attention any problem in practice in future. I beg leave to withdraw the amendment.
“( ) In a case where—(a) a national security notice would require the taking of any steps, and(b) in the absence of such a notice requiring the taking of those steps, the taking of those steps would be lawful only if a warrant or authorisation under a relevant enactment had been obtained,the notice may require the taking of those steps only if such a warrant or authorisation has been obtained.”
Earl Howe
My Lords, I shall speak also to the other government amendments. Government Amendments 247 to 250 clarify the activity that can be authorised by a national security notice to provide greater reassurance to telecommunications operators to whom such a notice may be given. These amendments also respond to concerns raised in the Commons that the detail set out in the draft code of practice was clearer than the provisions in the Bill.
Clause 228 states that the Secretary of State may give such a notice to a telecommunications operator in the UK, requiring the taking of such specified steps as are considered necessary in the interests of national security. The type of support that may be required includes the provision of services or facilities which would help the intelligence agencies to safeguard the security of their personnel and operations, or provide assistance with an emergency as defined in Section 1 of the Civil Contingencies Act 2004.
Amendment 248 makes it clear that a national security notice cannot be used for the primary purpose of acquiring communications or data. The proposed amendments further clarify that, in any circumstance where the taking of a step set out in the notice would involve the acquisition of private data, any interference with privacy must be authorised by an appropriate warrant or other authorisation under the Bill, or another relevant statute, where it is available. Therefore, a notice, of itself, cannot authorise as its primary purpose an intrusion into an individual’s privacy.
I should like to emphasise here that this power can be exercised only if the Secretary of State and a judicial commissioner are satisfied that the conduct required by a notice is necessary and proportionate to what is sought to be achieved.
In addition, Amendment 250 makes it clear that any conduct required under a notice is lawful for all purposes, providing reassurance for telecommunications operators that, when conduct is carried out in accordance with the requirements of a notice, the operator will not risk being found to be in breach of any other legal requirement.
I hope that these amendments reassure noble Lords that a national security notice cannot be used to circumvent the need to obtain a warrant or authorisation, but neither could it prohibit the acquisition of private data when such conduct has been appropriately authorised.
Lord Paddick
I can certainly tell the noble Lord that Yahoo! was one of the operators, but I do not have a list to hand.
Earl Howe
My Lords, Amendment 250A would define a technical capability notice as,
“specifying the distinct service or product to which the notice applies”.
I do not believe this amendment is necessary. The safeguards that apply to the giving of a notice under the Bill already ensure that a technical capability notice cannot be of a generic nature. I will not go into detail here about the lengthy process that must be undertaken before a notice can be given; we have discussed them at length previously and we will undoubtedly review them again shortly during our discussions on encryption. But it might be helpful for me to summarise.
Before giving a notice, the Secretary of State must consult the company concerned. This process will ensure that the company is fully aware of which services the notice applies to. The decision to issue a notice must be approved by the Secretary of State and a judicial commissioner. The obligations set out in the notice must be clear so that the Secretary of State and judicial commissioner can take a view as to the necessity and proportionality of the conduct required. As I have already mentioned, we propose a similar role for the judicial commissioner when a notice is varied. The operator may raise any concerns about the requirements to be set out in the notice, including any lack of clarity regarding their scope, during the consultation process. The operator may also seek a formal review of their obligations, as provided for in Clause 233. The safeguards which apply to the giving of a notice have been strengthened during the Bill’s passage through Parliament, and will ensure that the regime provided for under the Bill will be more targeted than that under existing legislation. It is for these reasons that I consider the amendment unnecessary.
Amendment 251A seeks to narrow the category of operators to whom a technical capability notice could be given. This change would exclude operators that provide services that have a communications element but are not primarily a communication service. This amendment, which has already been discussed in the Commons, is also unnecessary and, in my view, risks dangerously limiting the capabilities of law enforcement and the security and intelligence agencies. We are aware that the manner in which criminals and terrorists communicate is diversifying, as they attempt to find new ways to evade detection. We cannot be in a situation where terrorists, paedophiles and other criminals can use technology to escape justice. As David Anderson said,
“no-go areas for law enforcement should be minimised as far as possible, whether in the physical or the digital world”.
It is important that the Government can continue to impose obligations relating to technical capabilities on a range of operators to ensure that law enforcement and the security and intelligence agencies can access, in a timely manner, communications of criminals and terrorists using less conventional services, such as those offered by gaming service providers and online marketplaces. It may be appropriate to exclude certain categories of operators from obligations under this clause, such as small businesses, but it is our intention to use secondary legislation to do so. It would not be appropriate to impose blanket exemptions on services that have a communications element but are primarily not a communication service, since to do so would make it clear to terrorists and criminals that communications over such systems could not be monitored.
For all the reasons I have set out, I hope that the noble Lord, Lord Paddick, will feel able to withdraw his amendment.
Lord Beith (LD)
Before the noble Earl sits down, I refer to a point which at least needs to be borne in mind in drafting regulations. In most circumstances, if the Government impose upon a business an obligation of some kind, and behave totally unreasonably in doing so—or the business thinks that the Government are behaving unreasonably—the matter will end up in public discussion and the company has the weapon of saying to the public at large, “The Government are asking us to do something unreasonable”. That must not happen in these circumstances because clearly secrecy must be maintained. Therefore, the company is in a weaker position than it would be in the normal exchange between government and business. I hope that Ministers will recognise that fact.
Earl Howe
With the leave of the House, I am grateful to the noble Lord for raising that point, which I think will come up in the next group of amendments when we discuss encryption because it is centre stage in that issue. He is absolutely right and I hope that I can assuage his concerns in the next debate.
Lord Paddick
I am very grateful to the Minister, particularly for his explanation around Amendment 251A. I completely accept that the whole range of ways in which people can communicate potentially needs to be covered. I am encouraged by the fact that there may be some exceptions in secondary legislation. It is unfortunate that we do not have sight of that before I withdraw this amendment but life is like that.
Bearing in mind the fact that the Minister did not articulate any downside to Amendment 250A, I wonder why the Government will not accept it, given that it appears not to limit the Government’s action in any way. However, at this stage, I beg leave to withdraw the amendment.
Earl Howe
My Lords, I hope that the House will allow me to speak at somewhat greater length than usual in responding to these amendments. I recognise the concern that lies behind them and I also recognise that, although we debated the Bill’s provisions on encryption in Committee, there is a need to correct a number of misconceptions that have been expressed and to set out the reality of the Government’s position on encryption. I would also like to make clear what the provisions in the Bill do and, crucially, what they do not do, and to explain why these provisions are so important to our law enforcement and intelligence agencies. I hope that by, setting this out, I can reassure noble Lords that the amendments are not necessary.
As we have made clear before, the Government recognise the importance of encryption. It keeps people’s personal data and intellectual property secure and ensures safe online commerce. The Government work closely with industry and businesses to improve their cybersecurity. For example, GCHQ plays a vital information assurance role, providing advice and guidance to enable government, industry and the public to protect their IT systems and use the internet safely. Indeed, the director of GCHQ said in March that he is accountable to the Prime Minister just as much, if not more, for the state of cybersecurity in the UK as he is for intelligence collection.
In the past two years, the security and intelligence agencies have disclosed vulnerabilities in every major mobile and desktop platform, including the big names that underpin British business. You do not have to take the Government’s word for that. In September 2015, Apple publicly credited the information assurance arm of GCHQ with the detection of a vulnerability in its operating system for iPhones and iPads, which could otherwise have been exploited by criminals to disrupt devices and extract information from them. As a result, this vulnerability could be fixed.
The assertion that the Government are opposed to encryption or would legislate to undermine it is fanciful. However, the Government and Parliament also have a responsibility to ensure that our security and intelligence services and law enforcement agencies have the capabilities necessary to keep our citizens safe. Encryption is now almost ubiquitous and is the default setting for most IT products and online services. While this technology is primarily used by law-abiding citizens, it can also be used—easily and cheaply—by terrorists and other criminals. Therefore, it can only be right that we retain the ability, as currently exists in legislation, to require a telecommunications operator to remove encryption in limited circumstances, subject to strong controls and safeguards. If we do not provide for this ability, then we must simply accept that there can be areas online beyond the reach of the law where criminals can go about their business unimpeded and without the risk of detection. That would be both irresponsible and wrong.
That is our starting principle, and it is one that we share with David Anderson QC. I have quoted this before, but he stated in his investigatory powers review, A Question of Trust:
“My first principle is that no-go areas for law enforcement should be minimised as far as possible, whether in the physical or digital world”.
This principle was also shared by the Joint Committee on the draft Bill and the Science and Technology Committee, both of which recognised that, in tightly prescribed circumstances, it should remain possible for our law enforcement agencies and security and intelligence services to be able to access unencrypted communications or data. That is exactly what Clauses 229 to 234 of the Bill provide for: strong safeguards to ensure that obligations to remove encryption can be imposed only in limited circumstances and subject to rigorous controls.
Clause 229 enables the Secretary of State to give a technical capability notice to a telecommunications operator in relation to interception, communications data or equipment interference. As part of maintaining a technical capability, the Bill makes clear at Clause 229(5)(c) that the obligations that may be imposed on an operator by the Secretary of State can include the removal of encryption. Before a technical capability notice is given, the Secretary of State must specifically consider the technical feasibility and likely cost of complying with it. Clause 231(4) provides that this consideration must explicitly take account of any obligations to remove encryption.
The Secretary of State must also consult the relevant operator before a notice is given. The draft codes of practice, which were published on 4 October, make clear that should the telecommunications operator have concerns about the reasonableness, cost or technical feasibility of any requirements to be set out in the notice, which of course includes any obligations relating to the removal of encryption, it should raise these concerns during the consultation process.
We have also amended the Bill to make clear that the Secretary of State may give a technical capability notice only where he or she considers that it is necessary and proportionate to do so, and, under Clause 230, that decision must also now be approved by a judicial commissioner, placing the stringent safeguard of the double lock on to any giving of a notice to require the removal of encryption. Clause 2 of the Bill, the privacy clause, also makes explicit that, before the Secretary of State may decide to give a notice, he or she must have regard to the public interest in the integrity and security of telecommunications systems.
In addition, a telecommunications operator that is given a technical capability notice may refer any aspect of the notice, including obligations relating to the removal of encryption, back to the Secretary of State for a review. In undertaking such a review, the Secretary of State must consult the Technical Advisory Board in relation to the technical and financial requirements of the notice, as well as a judicial commissioner in relation to its proportionality. We have amended the review clauses in the Bill to strengthen these provisions further. Where the Secretary of State decides that the outcome of the review should be to vary or confirm the effect of the notice, rather than to revoke it, that decision must be approved by the Investigatory Powers Commissioner.
The Bill also makes absolutely clear that, in line with current practice, obligations imposed on telecommunications operators to remove encryption may relate only to encryption applied by or on behalf of the company on whom the obligation is being placed. That ensures that such an obligation cannot require a telecommunications operator to remove encryption applied by other companies to data transiting their network. As we have already outlined, we have also now tabled a government amendment that would further strengthen the Bill’s provisions on technical capability notices. This amendment makes clear that the Secretary of State may vary a notice only where they consider that it is necessary and proportionate to do so. The amendment also makes clear that, in circumstances where a notice is being varied in such a way that would impose new obligations on the operator, the variation must be approved by a judicial commissioner.
Furthermore, obligations imposed under a technical capability notice to remove encryption require the relevant operator to maintain the capability to remove encryption when it is subsequently served with a warrant, notice or authorisation, rather than requiring it to remove encryption per se. That means that companies will not be forced to hand over encryption keys to the Government. Such a warrant, notice or authorisation will be subject to the double lock of Secretary of State and judicial commissioner approval, and the company on whom the warrant is served will not be required to take any steps, such as the removal of encryption, if they are not reasonably practicable steps for that company to take. So a technical capability notice could not, in itself, authorise an interference with privacy. It would simply require a capability to be maintained that would allow a telecommunications operator to give effect to a warrant quickly and securely including, where applicable, the ability to remove encryption.
That is an enormously long list of safeguards. Indeed, it is difficult to think what more the Government could do. These safeguards ensure that an obligation to remove encryption under Clause 229 of the Bill will be subject to very strict controls and may be imposed only where it is necessary and proportionate, technically feasible and reasonably practicable for the relevant operator to comply. Let me be clear: the Bill’s provisions on encryption simply maintain and clarify the current legal position, and apply strengthened safeguards to those provisions. They will mean that our law enforcement and security and intelligence agencies maintain the ability to require telecommunications operators to remove encryption in very tightly defined circumstances.
I would also like to make absolutely clear what the Bill does not provide for on encryption.
Lord Beith
Could the Minister help those of us who are not deeply technical in these matters? We fear that circumstances by their nature cannot be technical and defined. In at least some cases, the consequences of serving a notice would be that the operator would have to create a significant weakness, which would apply far beyond the objective for which the notice was being served, and the operator would have to say in future to its customers, “This system is not as strong as we would like it to be”.
Earl Howe
We come back to the test of reasonable practicability here. I am about to come on to what the Bill does not provide for on encryption and I hope that this will help the noble Lord.
The Bill does not ban encryption or do anything to limit its use. The Bill will not be used to force providers to undermine their business models, to create so-called back doors or to compromise encryption keys. It will not be used to prevent new encrypted products or services from being launched and it will not undermine internet security.
Lord Harris of Haringey
I am very grateful for the detailed exposition that has been given. The Minister says that the Bill will not be used to do those things. Can he confirm that it cannot be used to do those things?
Earl Howe
My Lords, some noble Lords have suggested the Bill’s provisions cause a weakening in encryption, which I think is the central point that the noble Lord is getting at. Many of the biggest companies in the world rely on strong encryption to provide safe and secure communications and e-commerce, but retain the ability to access the content of their users’ communications for their own business purposes, such as advertising, as we have heard. These companies’ reputations rest on their ability to protect their users’ data. This model of encryption can, and does, maintain users’ security. I do not think that anyone would dispute that.
Before I come on to the individual amendments, it would be helpful to address a number of specific points that were raised in relation to encryption. There was a suggestion that a company should never be asked to do something that it does not already do. Such an approach would of course, at a stroke, remove our ability to use any of the powers in the Bill, including carrying out any interception of terrorists’ and serious criminals’ communications, because companies do not do this in the normal course of their business.
There was a suggestion that equipment interference would do away with the need for these provisions. It will not. Equipment interference is no substitute for having a company’s assistance. Even if it were, there are only a very small number of very clever people who are able to carry out equipment interference. There will never be the capacity to deploy them on each and every operation.
Finally, there was a suggestion that encryption is not a problem for the security and intelligence agencies. The heads of those agencies have repeatedly made clear that ubiquitous encryption is one of the most difficult challenges they face.
I now turn to the individual amendments, because I hope that this will clarify the picture further. Amendment 251 seeks to preclude an obligation to remove encryption from being imposed under a technical capability notice in relation to end-to-end encrypted services. I hope that the points I have already made make clear why the proposed amendment is not necessary and indeed why it is not desirable. As I have set out, the Government recognise the vital importance of encryption. Nothing in the Bill does anything to limit its use, and that of course includes the use of end-to-end encryption. But I have also set out the dangers of creating a guaranteed safe space online for those who would seek to do the public harm such as terrorists and other serious criminals, and I am afraid that that is exactly what this amendment would do. The amendment seeks to make explicit provision in law for there to be certain online services that criminals can use to go about their business unimpeded with no fear of being caught. That is not a position that any responsible Government or, I hope, Parliament could support.
What we must ensure is that the Bill enables us to work collaboratively with individual telecommunications operators to establish what steps are reasonably practicable for them to take, considering a range of factors including technical feasibility and likely cost. Any decision will have regard to the particular circumstances of the case, recognising that there are many different models of encryption, including many different models of end-to-end encryption, and that what is reasonably practicable for one telecommunications operator may not be for another.
As I have already said, this is not about asking companies to undermine their existing business models; it is about working with them to find a solution to ensure both that their customers’ data remain secure and that their services cannot be exploited by individuals who pose a threat to the UK. So in answer to the question put by the noble Lord, Lord Harris, I can confirm that these provisions cannot be used to introduce back doors or undermine internet security.
Lord Strasburger
My Lords, if the noble Earl is so confident that none of the unintended consequences listed in Amendment 252A can occur, and that the Government do not want them to occur, what is his objection to putting them into the Bill?
Earl Howe
We already have a wide range of safeguards which I have listed. I do not see that it is necessary to go down the road the noble Lord is advocating because of the dangers that I have pointed out. These amendments would create safe spaces which I am sure that neither he nor any noble Lord would desire to occur.
Lord Harris of Haringey
My Lords, I am enormously grateful to the noble Earl for his detailed response and for reiterating the welcome and voluminous safeguards that are set out in the Bill. They are important and valuable, and they give me confidence about the context of the whole Bill. However, the argument with which he concluded does not quite hold together and there is an elision between different issues. The noble Earl has given an absolute assurance, I think on the basis of a piece of paper that was handed to him, that it cannot be used to require a communications service provider to build a back door or to create one in a future area. But then he said that we must not put in the Bill something that creates a safe space. Either the Government’s position is that this cannot be used to require a company to produce a back door, in which case the safe space exists and presumably the Government are not happy with their own legislation, or it is the case that the Bill could require a communications service provider to build such a back door.
We have already heard from the noble Lord, Lord Evans of Weardale, that what we are trying to do here is balance two national security concerns: the national security concern to prevent terrorism and so on and the national security concern about making it slightly easier for cybercriminals. These are very important issues. If the Government are clear that, as a result of the Bill, a technical capability notice could not require an operator to build a back door that would otherwise not exist, it is important to set that out in the Bill. If we are in a position where techUK says—as it has in the briefing it circulated to me and, I am sure, to other noble Lords—that this is ambiguous, perhaps it is the responsibility of the Government to remove that ambiguity and make the position clear. I do not really want to have to divide the House on this matter, so between now and Third Reading, is the noble Earl prepared to turn the unequivocal assurance he has given that it cannot be used in this way into an amendment to the Bill that will remove that ambiguity?
Earl Howe
With the leave of the House, I hope I can help the noble Lord on this because I do not believe that the Bill is contradictory. First, the term “back door” has been used, but I do not think that is a helpful or accurate way of describing the Bill’s provisions. “Back door” is in everyone’s judgment a loosely defined term. It is used incorrectly to imply that the Bill would enable our law enforcement, security and intelligence agencies to gain unrestricted access to a telecommunications operator’s services or systems, thereby undermining the security of those services—to force that to happen. That is absolutely not the case. The Bill enables our agencies to require telecommunications operators to remove encryption themselves, only in tightly defined circumstances: where they have applied the encryption themselves; where it has been applied on their behalf; where it is reasonably practicable for them to remove it; and where doing so is required to comply with a relevant warrant, notice or authorisation.
I come back to the point I made earlier. This is about the Government being able to sit down with companies and reach agreement with them on the basis of what is reasonably practicable, affordable and so on. It would not be responsible for any Government to deny themselves the possibility of doing that and discussing what in all the circumstances is reasonably practicable for the company, and for the company to agree to do it.
Lord Harris of Haringey
Again I am grateful to the noble Earl. I do not think anyone here has misunderstood the point that this is not about giving the Government uninterrupted access. It is about requiring companies to create a facility so that if they are asked, after all the suitable warrants have been gone through and all the safeguards have been fulfilled, to gain information and pass it back to the Government. I accept that that is the position and that is what is intended here. However, the Minister has still not been unequivocal on whether technical capability measures could require such a facility to be created, so that, in those circumstances and with all those safeguards in place, something could be done. It is a critical issue that we need to clarify. Otherwise, we do not know where we stand as far as the amendment is concerned. The Minister needs to provide the House and the IT industry with as much clarity as he can on this point, because the danger is that it will become the subject of continual argument.
Were the Bill to be amended by any of the amendments in this group, the Government would still have the option to say that they were minded to serve a technical capability notice on a particular company. That would then trigger a series of discussions, because it is what the Bill provides for, and a communications service provider might come back at that point and say, “Look, we literally cannot do it. We do not have the facility”. However, it is not clear whether the Government could none the less say, “Well, we understand that, but we are requiring you to do it”. The question then is: what is or what is not feasible? I happen to believe that some of the biggest communications service providers in the world have more computing expertise than any nation state. If they are told, “You are legally required to do this”, they could do it; they could find a way of making it happen. We have to be explicit as to what the Government’s expectation is. Are they saying, “No, that is not what we are requiring”, or are they saying, “Well, we might”? If they are saying, “We might”, that clarifies the position, if not helpfully. If they are saying, “No, we are not”, which is what the Minister said earlier, perhaps we could put that in the Bill—if not in the form of words proposed, then in some form of words that the Government could craft between now and next week. That would be a helpful way forward and provide absolute clarity as to the extent to which technical capability notices could be served. If I am not able to get that assurance from him—I appreciate that bits of paper have been flying backwards and forwards between him and the Box—we are in a very difficult position.
Earl Howe
I can state categorically to the noble Lord that it is absolutely not the case that the Bill would force a company to insert a back door, thereby undermining internet security. We might ask a company in certain circumstances to decrypt particular data if it was reasonably practicable and feasible for them to do so.
Lord Harris of Haringey
My Lords, I understand that that is the case; that is, if they have the encryption key—we will not use “back door”; we will find another form of words—and the capability to do it, and it is not too complicated and all the relevant warrants are in place, yes, they will do that. As I understand it, most tech companies are perfectly understanding of that and willing to do it. The question is whether, if the Government were presented with a situation they were concerned about, they could say to one of the biggest communications service providers in the world, “We are asking you to build something which is not there at the moment, but we’ll provide that facility for those circumstances that might arise in the future when we’ve gone through all the relevant warrants and so on”. I am looking for an assurance from the Minister that that is not sought here, because of the dangers that we have already discussed. If he wishes, I can reiterate the question to give the Minister the opportunity to read the piece of paper that has just arrived.
Earl Howe
Of course, a technical capability notice can require a new capability to be built; that is what they are there for. If it was neither practicable nor feasible, they would not have to do it. The problem here is that it is very difficult to generalise, because any decision about these things would have to have regard to the particular circumstances of the case. As I said, there are many different models of encryption, including many different models of end-to-end encryption. Any decision has to recognise that what is reasonably practicable for one telecommunications operator may not be for another. That is why I have referred repeatedly to the need for the Government and industry to have that easy interchange which they do at the moment. It is important to emphasise that these powers already exist in law today. We should not do anything that undermines the basis for the constructive discussions that we are having.
Lord Harris of Haringey
The Minister reminds us that the ideal arrangement is one of easy interchange and discussion—I understand that that carries on and works very well. He is right to say—this is why the wording of the current legislation is ambiguous and therefore a problem—that building a technical capability could mean simply putting in a piece of equipment, which means that, at the point at which the Government ask, having gone through all the voluntary processes, it is quite a straightforward matter to provide the information that the Government have legitimately and lawfully requested. That is one definition of technical capability.
What I want to know is whether “technical capability” could apply to a very secure end-to-end encryption process which no communications service provider could break but where, if they devoted thousands of person hours in California or wherever they operate from, they could develop something which might do that. If that is what the Bill is saying, we need to know.
Lord Harris of Haringey
I accept that it would not be reasonably practicable; it would also be very expensive—as I understand the Bill, the Government would have to pay for it and I am sure that technical experts in California or wherever might be very expensive. If that is the case, and if it is not possible to write it into the Bill—I would have thought it could be—it would be helpful for the Minister to write and make very clear what the Government’s intentions are in that regard and confirm that such circumstances are precluded by the Bill. If the Minister is prepared to do that, I am prepared not to press the amendment to a vote.
Earl Howe
I think I have made the Government’s position as clear as I possibly can and I am not sure what I can do to amplify the remarks I have already made. While I want to be as helpful as possible to the noble Lord, I am struggling to see how a letter from me would make the position clearer.
Lord Harris of Haringey
I understand the Minister’s dilemma and I am sure that a letter from him to me would have far less force than the words appearing in Hansard. I appreciate that the courts can look at the debates in Hansard to try to interpret them. However, I ask that the Minister spends the next few days just thinking about some further modification to the Bill to make sure that this ambiguity, which I think genuinely exists—because techUK tells me so—is cleared up. On the basis that I am sure he will spend his waking hours between now and next Monday thinking about precisely these matters, I beg leave to withdraw the amendment.
(a) the Secretary of State considers that the variation is necessary in the interests of national security,(b) ”
“General definitions: “journalistic material” etc.
(1) The definitions in this section have effect for the purposes of this Act.Journalistic material(2) “Journalistic material” means material created or acquired for the purposes of journalism.(3) For the purposes of this section, where—(a) a person (“R”) receives material from another person (“S”), and(b) S intends R to use the material for the purposes of journalism,R is to be taken to have acquired it for those purposes.Accordingly, a communication sent by S to R containing such material is to be regarded as a communication containing journalistic material.(4) For the purposes of determining whether a communication contains material acquired for the purposes of journalism, it does not matter whether the material has been acquired for those purposes by the sender or recipient of the communication or by some other person.(5) For the purposes of this section—(a) material is not to be regarded as created or acquired for the purposes of journalism if it is created or acquired with the intention of furthering a criminal purpose, and(b) material which a person intends to be used to further such a purpose is not to be regarded as intended to be used for the purposes of journalism.Confidential journalistic material(6) “Confidential journalistic material” means—(a) in the case of material contained in a communication, journalistic material which the sender of the communication—(i) holds in confidence, or(ii) intends the recipient, or intended recipient, of the communication to hold in confidence;(b) in any other case, journalistic material which a person holds in confidence.(7) A person holds material in confidence for the purposes of this section if—(a) the person holds it subject to an express or implied undertaking to hold it in confidence, or (b) the person holds it subject to a restriction on disclosure or an obligation of secrecy contained in an enactment.”
“Confidential journalistic material | Section (General definitions: “journalistic material” etc.)(6) and (7)” |
“( ) section 218(2A),”
“( ) In subsection (3) “enactment” does not include any primary legislation passed or made after the end of the Session in which this Act is passed.”
“Security Service Act 1989
In section 1(5) of the Security Service Act 1989 (meaning of “prevention” and “detection”) for the words from “the provisions” to the end substitute “that Act”.”