Draft Investigatory Powers Bill

Lord Rosser Excerpts

Wednesday 4th November 2015 Lords Chamber

[Lord Rosser (Lab)]

I thank the Minister for repeating the Statement made in the Commons earlier today on the draft investigatory powers Bill, which the Government intend should receive Royal Assent before the sunset clause in the Data Retention and Investigatory Powers Act 2014 comes into effect at the end of next year. An important stage in the consideration of this Bill will be undertaken by the pre-legislative scrutiny committee and its findings will, I am sure, be awaited with considerable interest.

We have also had a number of different reports on this issue in the last few months including from, but by no means only from, the Independent Reviewer of Terrorism Legislation, David Anderson QC, the Intelligence and Security Committee, and the review convened by the Royal United Services Institute. All three of those reports supported an overall review of the current legislative framework for the use of investigatory powers and the replacement of legislation such as the Regulation of Investigatory Powers Act 2000.

The Anderson report was commissioned on the basis of an opposition amendment when Parliament was asked to legislate very quickly to introduce the Data Retention and Investigatory Powers Act 2014. We argued then that it was the right time for a thorough review of the existing legal framework to be conducted as we, and others, no longer felt that the current arrangements were fit for purpose. Fast-developing technology and the growing threats we face internationally and domestically have left our fragmented laws behind and made the job of our police and security services, to whom we all owe a considerable debt of gratitude, harder.

We support the Government in their attempt to update the law in this important and sensitive area, particularly since the Statement appears to indicate that the Government have listened to at least some of the concerns that were expressed about the original proposed legislation put forward during the last Parliament. However, we hope that this Statement and the draft legislation does not prove to be a bit like some Budget speeches where it is only afterwards that some of the detail proves to put a rather less acceptable gloss on aspects of some of the changes and measures proposed.

Although it is becoming something of a cliché, the need is to secure the appropriate balance between the requirement to safeguard national security and the safety of our citizens, and the requirement to protect civil liberties and personal privacy, which is surely one of the hallmarks of a democracy compared to a dictatorship. The extent to which the proposals set out in the Statement, and in the draft legislation, achieve that difficult balance is clearly going to be the subject of much discussion during the consideration of the Bill. However, the Statement indicates stronger safeguards than were previously being proposed, including in the important area of judicial authorisation, and it appears as though in broad terms that difficult balance may be about right. We will examine carefully the detail of the Bill and where necessary seek to improve the safeguards to increase the all-important factor of public trust.

The proposals set out today do not of course relate just to national security. They also have relevance to preventing serious and abhorrent crimes and apprehending those who commit them, including murder, major fraud and child sexual exploitation. In that regard, can the Minister confirm that the far-reaching powers of content interception will be used only for the most serious crimes, as applies under RIPA? The Statement indicated that the detailed web browsing of individuals will not be accessible, which we support, but will the Minister set out precisely what internet activity of an individual will be accessible without a warrant?

Clearly, vulnerability of information has gone up the agenda of public concern in light of the attack on TalkTalk. Since data retention and bulk storage were referred to in the Statement, what steps do the Government intend to take to ensure the security of bulk storage of data by public and private bodies?

The Statement referred to the change of approach on encryption from the possible ban previously mentioned by the Prime Minister, and reference was also made to communication providers and legal duties. Are the Government satisfied that they can make any such legal requirements stick against some of the largest and most popular online names, many of whom have headquarters overseas?

The Statement also referred to the protection of communications for parliamentarians. Will that protection also apply to people communicating with parliamentarians, whether on personal matters or on providing information? What protection arrangements will there be for sources of information used by journalists? The Statement said that, if it were proposed to intercept the communications of a parliamentarian, the Prime Minister would also be consulted. What in this context does “consult” mean? Does it mean that the Prime Minister would have to give his or her agreement?

The Statement also addressed the issue of authorisation, and set out a two-stage process which is clearly intended to address the twin points of accountability to Parliament on the one hand and sufficient independence from the political process on the other in order to build trust—an issue referred to by David Anderson QC in his report. What will be the powers of the judges involved in the authorisation of warrants process in view of the reference in the Statement to a warrant being “formally” approved by a judge, and will judges have to sign off warrants in all cases? Will the information made available to the judge in order to make his or her decision be the same as the information made available to the Home Secretary? Will the criteria against which the judge will make a decision be the same as the criteria against which the Home Secretary makes her decision, or will the judge have a different remit? Who, or what body, will appoint the judges who will be involved in the authorisation of warrants process? How long is it expected to take to go through the double-lock authorisation process outlined in the Statement, and what will happen if there is an emergency requiring immediate authorisation of a warrant?

One of the key themes of the report by David Anderson was that a core objective for the renewal of legislation concerning investigatory powers ought to be public trust from all sections of our community in the use of those powers by government agencies, since public consent to intrusive laws depends on people trusting the authorities to keep them safe and not to spy needlessly on them. That in turn, as David Anderson said in his report, requires knowledge, at least in outline, of what powers are liable to be used, and visible authorisation and oversight mechanisms in which the wider public can have confidence.

The Bill will go through its stages in the Commons before coming to this House. It is, of course, a matter for the other place to determine, but one can only express the hope that a Bill of this importance will have received full and proper consideration before it gets to this House, although I am sure there will be no lack of willingness in this place to make up for any deficiencies in that regard and to ensure that the powers being sought are necessary and proportionate in relation to the issues and potential dangers they are intended to combat and address.

[Lord Paddick (LD)]

My Lords, I, too, thank the Minister for repeating the Statement made by the Home Secretary in the other place. Clearly, we would like to be reassured by the Home Secretary’s claim that the draft Bill is not a return to the draft Communications Data Bill 2012, which the Liberal Democrats in the coalition Government quite rightly blocked, and from which this Government now appear to want to distance themselves.

There are some clear and very welcome changes proposed, including judicial authorisation of interception warrants and a promise not to interfere with encryption, but we must look very carefully at the detail of what is being proposed, particularly in relation to what the Home Secretary calls, “internet connection records”. Clearly, there has been a great deal of concern about communications service providers storing everyone’s web browsing history and handing over this information to the police and the security services. While the Home Secretary says that the proposed Bill would not allow that, I will probe very gently whether that is the case, so as to dispel concerns that this is just smoke and mirrors.

Intuitively, the Home Secretary must be right that if the police can use mobile phone data to find an abducted child, they should be able to do so if criminals are now using social media or communication apps instead of cellular data. Our concerns are: first, whether this is technically feasible; secondly, whether it is technically feasible without prohibitive costs to communications service providers; and, thirdly, whether it is possible without the risk of disproportionate intrusion into innocent people’s privacy, whether by the forces of good or by hackers such as those who breached TalkTalk’s security, as the noble Lord, Lord Rosser, mentioned.

Talking to experts, I was told that communications service providers would be unable to tell the police or the security services whether someone had used the internet to communicate, as opposed to just browsing, without storing content. This requires billions of pounds of hardware investment, and even then it may not be possible to tell the difference between browsing and communication. Determined suppliers of applications that enable people to communicate covertly could disguise internet communication as passive browsing, for example. Will the Minister say whether the Government know that it is technically possible for internet service providers to provide a record of the communications services a person has used without a record of every page they have accessed? What would be the cost to communications providers? Has a risk assessment been undertaken of the possibility that, having stored sensitive personal information, that information might be accessed unlawfully?

Finally, in 2005 the police, backed by the then Labour Government, asked for a power to detain terror suspects without charge for up to 90 days—a power that the security services did not ask for and that Parliament, quite rightly, rejected. Will the Minister also confirm whether the requirement to store internet communication records has come from the police alone or from the police and the security services?