Investigatory Powers Bill (Eighth sitting)

Debate between Keir Starmer and Christian Matheson

Committee Debate: 8th sitting: House of Commons
Tuesday 19th April 2016 Public Bill Committees

[Keir Starmer]

I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 80 ordered to stand part of the Bill.

Clause 81

Data integrity and security

Question proposed, That the clause stand part of the Bill.

[Christian Matheson]

I seek the Minister’s guidance. Throughout our considerations, I have spoken of my fears whether data held under this Act are held securely. I hope that clause 81 will address many of my fears; I seek the Minister’s advice on whether it lays responsibility on communications providers to maintain those data securely. I simply reiterate my concern that when theft does take place, there has to be a consideration of an offence of unlawful possession of stolen data, on the basis that the communications provider that has suffered the theft would also be legally responsible for that theft when the provider is in fact a victim of the theft itself. Bodies that seek to obtain illicitly a person’s private communications data may try to make financial gain as a result. Is the Minister confident that clause 81 gives me the kind of assurances that I have been looking for on internet security? Is there sufficient deterrent, in terms of possession of unlawfully obtained data, that might be included later in the Bill?

[The Solicitor General]

The hon. Gentleman has been consistent in stating his concerns. I assure him that clause 81 contains the sort of requirements that he would reasonably expect. It sets out the matter clearly. It should be read in conjunction not only with other legislation that I have mentioned, such as the Data Protection Act 1998 and the Privacy in Electronic Communications Regulations 2003, but with clause 210, which provides for the Information Commissioner to audit the security, integrity and destruction of retained data, and the codes of practice to which I referred earlier. The provisions in the communications data draft code of practice go into more detail about the security arrangements.

We had a discussion some days ago about the existence of adequate criminal legislation. The Bill has a number of provisions that relate to those who hold data, and we discussed whether existing legislation could cover those who come into possession of the data unlawfully. I say to the hon. Gentleman that I will take the matter away and consider it, and come up with a proper considered response to his query.

Question put and agreed to.

Clause 81 accordingly ordered to stand part of the Bill.

Clauses 82 and 83 ordered to stand part of the Bill.

Clause 84

Enforcement of notices and certain other requirements and restrictions

Investigatory Powers Bill (Third sitting)

Debate between Keir Starmer and Christian Matheson

Committee Debate: 3rd sitting: House of Commons
Tuesday 12th April 2016 Public Bill Committees

[Christian Matheson (City of Chester) (Lab)]

It is, as always, a pleasure to see you in the Chair, Ms Dorries. The Solicitor General has given examples of wide-ranging powers that are available to protect the public. I was grateful to listen to his contribution. However, during Second Reading I queried the Home Secretary’s position on the new offences that are being created. Many of the offences the Bill refers to, particularly in clause 9, relate to the regulation of investigatory powers. My concern is that later the Bill requires internet service providers, for example, to amass a large amount of personal data, and there is a danger that those data may be stolen rather than intercepted. I gave the example of a newspaper perhaps finding a low-grade technical operator in a telecommunications company, passing a brown envelope to them and stealing a celebrity’s internet connection records. I am concerned that the offence in clause 9 of unlawfully obtaining communications data does not go far enough.

I bear in mind the Solicitor General’s comments on other protections that are available, but would he or the Government consider an offence of not just obtaining but being in possession of unlawfully obtained communications data, which would strengthen the protections given to members of the public? We all know that the kind of scenario that I am expressing concern about has not been unknown in the last few years, as various court cases have demonstrated—though I should not discuss their details. Is the Minister satisfied that the protections he has outlined and those raised by the hon. Member for South East Cambridgeshire are sufficient, or should we take this clause a bit further, to give the public broader and wider protection of their privacy and the security of their internet and telecommunications transmissions?

[Keir Starmer]

It is a pleasure to follow my hon. Friend because I want to develop the point. This is a welcome clause, it is right that it is here, and we support it. However, we question whether it goes far enough. It only covers obtaining communications data. We think that serious consideration should be given to an overarching offence of misuse of the powers in the Bill. At the moment, there are specific provisions in relation to intercept which are replicated frim RIPA and we now have this welcome provision, but there is no overarching offence of misuse of the powers in the Bill.

It is all very well to say that there is the tort of misfeasance in public office. That is not the equivalent of a criminal offence. It has all sorts of tricky complications when one tries to apply it in practice. It is fair to say that there are other bits of legislation that might be made to fit in a given case, but it would be preferable and in the spirit of David Anderson’s approach for a comprehensive piece of legislation for an overarching criminal offence to be drafted, either out of clause 9 or in some other way, relating to misuse of powers in the Bill. It has been a source of considerable concern in the past and I ask the Government to think about a wider offence that would cover all the powers, because comms data are only one small subset of the issues and material information we are concerned with.

I have two short supplementary points. In subsection (3) there is a reasonable belief defence. It would be helpful if the Minister said a bit more about that. May I also foreshadow the inconsistency that we will need to pick up as we go along in the way reasonable excuse and reasonable belief are dealt with in the Bill? It is set out in subsection (3), but there is an inconsistency in other provisions that I will point to when we get there.

My other point is to ask the Minister to consider whether obtaining communications data unlawfully is a sufficient definition to make the offence workable in practice. I put my questions in the spirit of supporting the clause, but I also invite Ministers to go further and consider drafting a clause that covers the misuse of powers in the Bill, rather than simply saying that if we fish about in other bits of legislation or common law we might find something that fits on a good day. In my experience, that is not a particularly helpful way of proceeding.

Investigatory Powers Bill (Fourth sitting)

Debate between Keir Starmer and Christian Matheson

Committee Debate: 4th sitting: House of Commons
Tuesday 12th April 2016 Public Bill Committees

[Christian Matheson]

I am most grateful for that assurance and explanation and, indeed, for the previous explanation. The Minister has gone into considerable depth on the matter and I am most grateful for that.

[Keir Starmer]

I, too, welcome you to the Chair of this Committee, Mr Owen. It is a privilege to serve under your chairmanship.

The assurance that has just been asked for cannot be given because the whole purpose of the provision is to enable the secondary data of any of us in this room that is caught by a bulk interception warrant to be looked at without any further warrant. If my data is swept up in a bulk interception warrant, even though I am not the target it can be examined without a separate warrant. That goes for every member of the Committee, every member of the public and everybody residing in the British Isles. The neat distinction between people here and people abroad breaks down in relation to this clause. I want us to be clear about that. The Minister is making the case that that is perfectly appropriate and necessary and that there are sufficient safeguards in place, but he is not making the case that this would not happen for those in the British Isles. It can and undoubtedly does happen, and it will happen under this regime. That means that all our secondary data are caught by this provision, even where we are not the primary target.

The Minister pointed to the double lock and the roles of the Secretary of State and judicial commissioner. He took an intervention on that, but I want to be absolutely clear on what those roles are and how necessity and proportionality play out. Clause 125 sets out what requirements must be met by a bulk interception warrant. Subsection (3) says:

“A bulk interception warrant must specify the operational purposes for which any intercepted content or secondary data obtained under the warrant may be selected for examination.”

The Minister points to that and says that there has got to be an operational purpose, which is true. However, we then read just how specific that operational purpose is likely to be:

“In specifying any operational purposes, it is not sufficient simply to use the descriptions contained in section 121(1)(b) or (2)”.

Those are just the general descriptions of national security and preventing serious crime, so it is not enough to say that the operational reason is national security or to prevent serious crime. Well, good—that that is all that had to be specified, it would not be very much. However, the purposes may still be general purposes, so the operational purposes are likely to be very broad—necessarily so in practical terms, given that it is a bulk warrant.

The role of the Secretary of State and the judicial commissioner is to decide whether the warrant is necessary and proportionate according to those purposes. We keep using the words “necessary and proportionate”. We have to keep an eye on what the object of the necessity and proportionality is. The question for the Secretary of State and the judicial commissioner is whether it is necessary and proportionate for the very broad operational purposes that are permitted under clause 125. It is not a very detailed, specific examination by the Secretary of State or the judicial commissioner; nor could it be.

At some later date, there is further consideration when it comes to examination. If it was suggested that at the later stage of actual examination, rather than authority for examination, it goes back to the Secretary of State and judicial commissioner, that is just plain wrong. It does not go back at all. All that the judicial commissioner or Secretary of State do is to authorise the general purposes under the warrant. As far as selection is concerned, that is governed by clause 134(1) and (2). Subsection (2) specifies that:

“The selection of intercepted content or secondary data for examination”

—that is at the heart of what we are talking about—

“is carried out only for the specified purposes”.

That relates to back to subsection (1). It continues,

“only so far as is necessary”

—necessary to what? It then refers straight back to the “operational purposes” set out in clause 125. Even at that later stage, the question of necessity and proportionality is against the very broad operational purposes. The Minister has been very clear about this and I am not suggesting otherwise, but the idea that there is some forensic and carefully curtailed exercise that looks in detail at the individual circumstances of the case is pretty far-fetched. In the end, all anyone has to do is ask whether it is necessary or proportionate to the general operational purposes upon which the warrant was issued in the first place. That is very different from the test set out for targeted interception. It is the test that will be applied to all the secondary data of anybody in this room who ever finds themselves caught up in a bulk interception warrant. That is not far-fetched. There will be many bulk intercept warrants, which may well capture the content and secondary data of many members of the public who are not targets in any way.

As a result, although I applaud the Minister for his long and detailed answer, it was not very persuasive regarding the necessity of this scheme or the effectiveness of the safeguards. Simply saying that secondary data may be necessary to determine location is hardly enough to justify the provision. I recognise that secondary data are different to content and that bulk powers are different from targeted powers, but in the end, when this is unravelled, it shows that there is no effective safeguard. In the circumstances we will not divide the Committee on the amendment, but I reserve the right to return to the matter at a later stage. It goes to the heart of the Bill. When properly analysed and understood, the safeguard in this respect is barely a safeguard at all.