Equipment Interference (Code of Practice) Order 2015

Lord Paddick Excerpts

Monday 7th December 2015 Grand Committee

[The Minister of State, Home Office (Lord Bates) (Con)]

My Lords, with the leave of the Committee I will also speak to the Regulation of Investigatory Powers (Interception of Communications: Code of Practice) Order 2015.

Members will know that on 4 November 2015 the Government published draft legislation relating to the security, intelligence and law enforcement agencies’ use of investigatory powers for pre-legislative scrutiny by a Joint Committee of Parliament. The intention is for the Bill to be introduced early in 2016 and enacted before the sunset provision in the Data Retention and Investigatory Powers Act 2014 takes effect on 31 December 2016. In the mean time, the Regulation of Investigatory Powers Act 2000 and the codes of practice made under it provide the legal basis for the essential investigatory techniques necessary to acquire the communications of those who mean us harm. Today we debate two codes of practice made under the existing legislation: an update of the existing code of practice on the interception of communications and a new code on equipment interference.

Interception is a vital tool that helps law enforcement and intelligence agencies to prevent and detect serious or organised crime and protect national security. It is also among the most intrusive powers available to law enforcement and the security agencies. For that reason, it is subject to strict safeguards in the Regulation of Investigatory Powers Act 2000 and the code made under it. Interception warrants are issued and renewed by the Secretary of State for a small number of agencies and for a strictly limited range of purposes. RIPA also provides for independent oversight by the Interception of Communications Commissioner and an impartial route of redress through the Investigatory Powers Tribunal.

The interception of communications code of practice first came into force in 2002 and needs updating. There is now far more that can be said about the safeguards that apply to security and law enforcement agencies’ exercise of interception powers and the revised version of the code includes that extra detail. On what is new in the code of practice, the safeguards described in these codes are not new in themselves. In respect of the interception code, the law enforcement and intelligence agencies have always had robust internal arrangements, overseen by the Interception of Communications Commissioner. The draft code provides more detail about those arrangements.

First, it provides additional information on the safeguards that exist for the interception and handling of external communications under Section 8(4) of RIPA—that is, the ability to undertake bulk interception. Secondly, it sets out further information on the protections afforded to legally privileged material and other confidential material. To give an example, the code requires the Secretary of State personally to consider the likelihood that privileged material will be intercepted when determining whether it is necessary and proportionate to grant a warrant. It also requires additional internal safeguards to be applied in cases where legally privileged material is intercepted, including that where such material is retained it must be reported to the independent Interception of Communications Commissioner. Thirdly, it includes minor changes to reflect developments in law and practice since the code first came into force in 2002. For example, it reflects regulations introduced in 2011 which amended RIPA to create the power for the interception commissioner to impose a fine for certain kinds of unlawful interception. Much of the new material on the safeguards that apply to the exercise of interception powers reflects information disclosed during legal proceedings in the Investigatory Powers Tribunal, and it is right that this information is included in codes of practice so that it easy for members of the public to access it.

The equipment interference code of practice is new. Equipment interference is a set of techniques used to obtain a variety of data from equipment. This includes traditional computers or computer-like devices such as tablets, smartphones, cables, wires and static storage devices. Equipment interference can be carried out either remotely or by physically interacting with equipment. It allows the security and intelligence agencies in particular to keep pace with terrorists and serious criminals, who increasingly use sophisticated techniques to communicate covertly and evade detection. Equipment interference has been instrumental in disrupting credible threats to life, including those against UK citizens. MI5 has relied on this capability in the overwhelming majority of high-priority investigations it has undertaken over the past 12 months.

The Security Service Act 1989 and the Intelligence Services Act 1994 provide the legislative basis for the security and intelligence agencies to interfere with computers and communications devices. Warrants may be issued by the Secretary of State only when he or she considers the activities to be authorised are necessary and proportionate. The use of the powers is subject to independent oversight by the Intelligence Services Commissioner. Prior to the draft code, which we are debating today, equipment interference powers have not had their own bespoke code of practice.

The code does not confer new powers, but simply makes public the robust internal safeguards that the intelligence agencies already apply. It brings greater transparency to the robust processes that the agencies adhere to when interfering with computer equipment to prevent terrorism, disrupt serious crime and identify and stop others who seek to harm us and our country. For the first time, this code of practice publicly sets out the stringent safeguards that the intelligence agencies apply to their use of equipment interference. This includes strict rules on how data acquired through equipment interference must be handled, how they must be securely and safely stored, and how they must be destroyed when it is no longer necessary or proportionate to hold them. The code also explains the consideration of necessity and proportionality that the Secretary of State must take before authorising any use of equipment interference. That ensures that this vital capability may be used only when the scope of the interference has been carefully considered and compared to the potential benefits of the operation. Furthermore, the code explains that equipment interference should not be considered a proportionate power if other less intrusive methods of acquiring the same data are possible.

Akin to the interception code of practice, this document also provides reassurance that the acquisition of legally privileged and confidential information is subject to even greater oversight and safeguards. The code sets out a series of tests that must be applied before any authorisation is granted and then the subsequent handling arrangements, should confidential material be acquired.

Finally, the code also provides information regarding the use of equipment interference targeted at equipment outside the British Isles. This section ensures that the public have a comprehensive guide to the use of equipment interference powers by the intelligence agencies and the range of safeguards and oversight that applies to such important activity.

The codes of practice contain no new powers; instead, they reflect the current safeguards applied by the relevant agencies. The purpose of the codes is to make more information publicly available about the stringent safeguards that the agencies apply in their use of investigatory powers. They ensure that the powers can be used only when it is necessary and proportionate and when it will help keep us safe from harm. I commend the orders to the House.

[Lord Paddick (LD)]

My Lords, I must first say that I am not an expert in this area. Our expert on this matter is on the Joint scrutiny Committee, which is about to sit. That is why he is not here. For this to come up when the people considering the draft investigatory powers Bill are elsewhere and engaged in that business is rather an unfortunate clash of tabling.

We are very concerned about interception, but that is and has been a widely known and accepted practice over the years, although the nature of that interception has obviously changed as means of communication have changed. It tends to be specific and targeted at particular individuals who, as the Minister said, intend to cause us harm or who are involved in serious crime. The code of practice on interception, which, as the Minister said, is an updated code of practice rather than a completely new one, is not the major area of concern for us.

We are very concerned about the use of equipment interference and the fact that very little—if any—debate has taken place, in Parliament or outside, about the use of these powers. While the Minister points to legislation that the security services rely on to carry out equipment interference, explicitly setting out what that means was not part of the discussion when those pieces of legislation were presented to Parliament. While what interception of communications involves is reasonably straightforward, equipment interference potentially means gaining complete access to a computer, for example. Speaking for myself, my life is on my computer. Therefore, if there were intrusion through equipment interference on to my computer, practically everything about me would be learnt by the security services, including websites I had visited and passwords that would give access to, for example, online banking. It is a much more intrusive power for the police and the security services than interception.

Hacking into computers and mobile phones was made an offence in the Computer Misuse Act 1990. My understanding is that a clause introduced in the then Serious Crime Bill 2015 exempted the police and the security services from that provision. Does the Minister accept that engagement in equipment interference by the police and the security services between 1990 and 2015 must therefore have been illegal because it was an offence under the Computer Misuse Act 1990, the exemption not coming in until 2015?

As far as I can see, the equipment interference code of practice relates only to the security services. There is no mention of equipment interference being used by the police. Again, I am not an expert on this, but it would appear that the police have to rely on legislation that allows them to interfere with property. That was intended for planting bugs in homes or offices—that sort of thing—rather than interfering with computers. Will the Minister say what the code of practice is for police use of equipment interference, as opposed to that of the security services?

There is also serious concern about general warrants being issued for equipment interference, rather than for named individuals. Indeed, the Intelligence Services Commissioner’s latest report expressed concern that GCHQ was using thematic warrants for equipment interference. How many thematic warrants have been issued?

I have another question for the Minister: why are the Government bringing forward these orders now, when the primary legislation on which they are based is currently being completely reviewed? As he said, the Joint Committee on the Draft Investigatory Powers Bill is currently looking at the primary legislation, so why now?

Among other things, the Government have produced HM Government Transparency Report 2015: Disruptive and Investigatory Powers. I cannot find any reference in it to equipment interference. As the Government are being transparent about these things, can the Minister assist me with where we can learn how much equipment interference has been going on?