Investigatory Powers Bill

Debate between Kevin Hollinrake and Stella Creasy

Tuesday 15th March 2016 Commons Chamber

[Stella Creasy (Walthamstow) (Lab/Co-op)]

A comment often made to explain why political events go on for so long is that, although everything that needs to be said has been said, not everybody has yet said it. In the spirit of trying to offer something different to this debate, I want to speak as a member of the Science and Technology Committee, which we might call Parliament’s geek squad, and raise a third set of concerns about the Bill as it currently stands.

Members have already talked about proportionality and people’s concerns about the balance between security and liberty, about the challenges of extra-jurisdictional legislation and whether, in a global world, we can pass national laws that make sense. I want to add concerns about the technical aspects of the Bill and, frankly, about whether it will work. Is this legislation designed for digital natives who are comfortable with the modern world, or has it in fact been designed by what we might call digital refugees—people who run away from the reality of the modern technical advances with which we are trying to deal?

All of us have had the experience of trying to explain to a person aged under 20 that, no, we could not google our homework when we were at school. Many of us may have jumpers that are older than the internet, which has fundamentally changed our lives. In this country, a third of all divorces contain a reference to Facebook, a technology that came into our lives only in 2007, but has fundamentally transformed that most personal of relationships. When we come to thinking about legislation that takes account of modern technologies and the ways in which they change, such legislation must be based on an understanding of those technologies and of the consequences of such changes to the law.

With that in mind, it was when the Committee looked at the question of surveillance, especially internet connection records, that concerns arose. Concerns arose in particular about the idea that, as the right hon. Member for Sheffield, Hallam (Mr Clegg) said, a dragnet could be used to bring together internet connection records for every single member of the British population for 12 months, and about what that might entail.

There is a fundamental challenge at the heart of the Bill about the idea that it is possible to separate somebody’s contact data from their content data. Many internet companies have made that point and said that they are concerned about such a definition. As yet, the legislation has not completely grappled with that definition. The Bill makes a distinction between identifying IP addresses and being able to know whom people have contacted, and what it calls anything else that

“might reasonably be considered to be the meaning…of the communication”.

That definition makes sense when we are talking about phone records, but the legislation has to cope with the world to come, not the world that has gone. If I send a message through Outlook, others do not need to know the content of the message to know that it is a request for a meeting. When we talk about knowing which websites people have visited, that of course brings with it content analogies: if I visit the Refuge website or the Alcohol Concern website, that is contact data, but because it is online contact, by its very nature it carries content information.

I very much welcome the shadow Home Secretary’s comments about our needing to challenge such definitions. We need a much tighter definition of what it means to have an internet connection record and of what information is held as part of that record. All three of the Committees that have looked at the legislation have called for that. However, to date, we have not heard from the Government an understanding that in the modern world the distinction between content and contact is not viable. The distinction between entity and events, and everything else, must be much tighter in the Bill. If it is not, the question of who can access that information bleeds into the question of who can access the meaning of those content combinations.

Such questions will become starker as the internet develops, and particularly with the internet of things—I see that a few digital refugees on the Government Benches, and perhaps even some Labour Members, are querying what the internet of things is. It is the growing number of physical objects that are connected online. This Christmas I was given a coffeemaker that I can set off using my mobile phone, and it is wonderful to sit in bed and order several cups of coffee. So far, we have online airbags in cars, online burglar alarms, and some Members might even set their home electricity online. All those forms of contact are created through online mediums. We will soon have pacemakers that are electronically set up. People will be able to access their bank accounts in the same way. All such contact is potentially information that could be created in an internet communication record. It could also be useful in an investigation.

[Kevin Hollinrake (Thirsk and Malton) (Con)]

With the internet connection record, we are looking for a past history for a future crime. If someone is investigating a child abuser or a terrorist, is it not relevant to see their past records and whether they have accessed sites with relevant material? We would be able to see that from contact information.

[Stella Creasy]

I am not quite sure about the hon. Gentleman’s point because no one is suggesting that we would not want to access such information. My point is that, from a technical perspective, separating contact data from content data is much more difficult than the Home Secretary suggests. That means that we need more honesty about the powers we are proposing that our police and investigatory authorities should have.

For example, if someone can get information about my use of an electricity meter, they might want to look at the contact between me and that meter. If I were accessing it a lot, they might wonder what I was doing in my home that required so much heat. Drug enforcement agencies might look at such contact patterns, and inevitably that brings with it content about what someone is doing. That does not mean that we do not need methods to access that information; it means that one thing missing from this debate to date is an honesty about the technological complications that will come with this Bill, and we must address those concerns.