Investigatory Powers Bill

Baroness Hayter of Kentish Town Excerpts

Report: 3rd sitting (Hansard): House of Lords
Wednesday 19th October 2016 Lords Chamber

[The Advocate-General for Scotland (Lord Keen of Elie) (Con)]

My Lords, Amendments 180, 181, 197, 198, 205, 206, 231 and 232 relate to judicial commissioner approval of major modifications to warrants issued under Parts 6 and 7 of the Bill. They seek to provide additional clarity regarding the matters the commissioner must review when deciding whether to approve such a modification.

The Bill already provides for major modifications to such warrants. In the context of bulk interception, bulk acquisition and bulk personal dataset warrants, a major modification may be used to add or vary one of the operational purposes for which data may be examined under the warrant. As regards bulk equipment interference warrants, a major modification can additionally add to or vary any description of conduct in the warrant.

The Bill requires full double-lock authorisation from a Secretary of State and a judicial commissioner for any major modification to a bulk warrant. These amendments will not change that. Instead, they provide greater clarity about the matters that a commissioner must consider when determining whether to approve a modification to a bulk warrant.

The amendments specify that, for major modifications to add or vary an “operational purpose”, a judicial commissioner must review the Secretary of State’s conclusions as to whether the modification is necessary, applying the same principles as would be applied by a court on an application for judicial review and ensuring that the commissioner complies with the duties in relation to privacy set out in Clause 2, the so-called privacy clause.

In the context of bulk equipment interference, if a major modification proposes to add or vary a description of conduct, the judicial commissioner must also review the Secretary of State’s conclusions as to whether the conduct authorised by the modification is proportionate to what is sought to be achieved by it. The amendments are intended to ensure clarity and consistency across the Bill, and as such are to be welcomed.

The sharing of data and intelligence with our overseas partners is critical to the work of our security and intelligence agencies. Without working together with our allies, those agencies could not do their vital work of keeping us safe. Amendments 184, 185, 201, 202, 209 and 210 simply clarify the consideration that must be given by the Secretary of State before authorising the disclosure to overseas authorities of data acquired under the bulk powers in the Bill.

The Bill already places a duty on the Secretary of State to consider whether corresponding safeguards will be applied to the data that are to be shared with the overseas authority in relation to their retention and disclosure. These amendments make explicit that the Secretary of State must be satisfied that the overseas authority has in place safeguards, to the extent appropriate, that correspond to those in the Bill not only in respect of the retention and disclosure of the data shared in bulk but in relation to their selection for examination. This group of amendments therefore makes absolutely clear that proper consideration will be given to the examination safeguards that are applied whenever bulk data are shared with another country. I beg to move.

[Baroness Hayter of Kentish Town (Lab)]

My Lords, I thank the Minister for moving these amendments, all of which we are happy to support and some of which respond to concerns we raised in Committee.

It may assist the House if I outline at this stage the purpose of Amendment 185A, in the names of my noble friend Lord Rosser and myself, which is about safeguards for disclosing overseas-related material for our foreign allies and agencies. That is material, possibly including information sent overseas by UK residents, obtained by our security and intelligence services under bulk interception warrants. It is an amendment which we hope the Government will feel able to accept.

In Clause 142, before any information obtained under a bulk interception warrant is disclosed overseas, the Secretary of State must ensure that arrangements and safeguards are in place regarding the retention and disclosure of such material, as the Minister has outlined. These requirements correspond to Clause 141 safeguards for domestic arrangements: that is, requiring that the number of people to whom the bulk-intercepted material is disclosed, the extent of disclosure and the number of copies made is limited to the minimum necessary. These safeguards also require the destruction of such material where there are no longer grounds for retaining it.

However, unlike Clause 141 for domestic arrangements, Clause 142 for overseas disclosure provides a wide discretion for the Secretary of State, whereby she or he must ensure equivalent safeguards only,

“to such extent (if any) as the Secretary of State considers appropriate”.

It could, therefore, be possible for the Secretary of State to decide that no safeguards are required in a particular case.

We recognise absolutely that the UK will need to share intelligence with overseas agencies and our amendment does not undermine the ability of UK agencies to do that. We also accept that overseas disclosure may be of a different nature, with particular political, diplomatic or security implications, all of which the Secretary of State must consider. However, the present wording is surely too wide and, if I have understood it correctly, would not be subject to subsequent review. Amendment 185A removes this very broad discretion and requires that it must appear to the Secretary of State that safeguards corresponding to the requirements under Clause 141(2) and (5) will apply in relation to disclosure overseas.

The Minister will not be surprised if I make reference to the Szabó v Hungary finding that minimum standards should be set out in law to avoid abuses of power and that,

“it would be contrary to the rule of law … for a discretion granted to the executive in the sphere of national security to be expressed in terms of unfettered power”.

The judgment notes that,

“the law must indicate the scope of any such discretion … with sufficient clarity … to give … adequate protection against arbitrary interference”.

I hope that the Government will feel able to accept the amendment as, if anything, extra safeguards may, indeed, be required where sensitive information is being disclosed abroad. We look forward to the Minister’s response on this.

[Baroness Hamwee (LD)]

My Lords, we, too, are happy with the government amendments in this group and we support Amendment 185A. The issue is about the discretion in the application of Clauses 141(2) and 141(5)—and, shortly, Clause 143—not their relevance. The term “appropriate” suggests to me a degree of discretion which may not be related to relevance. The term “mutatis mutandis” is not one commonly used in legislation, I think, but it is that provision that one wants to see—only changing what is necessary to be changed. I do not know the proper way of dealing with that, but “appropriate” seems to be inappropriate in the context.

--- Later in debate ---

[Lord Evans of Weardale (CB)]

My Lords, there have not been very many points in the course of this legislation on which I have agreed with the noble Lord, Lord Strasburger, but on this point I do. Amendment 252A raises a very interesting and important point.

Although I am absolutely in favour, as you would imagine, of the Government having the opportunity to access the communications of anybody who is a threat to us—due to terrorism, criminal activities or anything of that sort—there is a competing national security issue here of this country having effective cybersecurity. We have seen the way in which hostile Governments have been seeking to intervene in the American elections, and we have seen all sorts of attempts by hostile states, criminal groups and others to use cyber weaknesses to take forward hostile agendas. Therefore, there is a genuine national security interest in ensuring that, as far as we can, our citizens can communicate securely and privately when they are not going about mischievous business.

The idea that we should take into consideration the requirement not to place non-targeted customers or others at additional security risk is an entirely legitimate one, and I am very interested to hear how the Minister would want to interpret this. We have competing national security issues here and it is a point well made.

[Baroness Hayter of Kentish Town]

My Lords, we have had some rather good discussions with the tech companies. In Committee, we put in some of the amendments that they suggested to us, and some of the government amendments we have been dealing with over the past few days reflect that. I thank the tech companies for their very responsible attitude in continuing discussions with the Government over this period. Certainly with us they have been open, flexible and fairly straight as to what is possible and what the dangers are for them—for example, and as we have discussed, whether a weakness in end-to-end encryption could actually undermine the security that banks and others rely on in their systems—and for their clients, public confidence and national security. The companies recognise that they have a duty of care and loyalty to their customers, while fully respecting the law of the land in which they operate and the legal demands on their staff, wherever they are located.

In their discussions with us, companies have sought clarity that they will not be asked, effectively, to create a new system that would breach end-to-end encryption. They need this clarity for their shareholders and customers’ peace of mind because the reality is that they could never be forced to create a new computer program to hack their own security. I for one cannot imagine the noble Earl, Lord Howe, or anyone else standing over a hapless computer programmer shouting, “Break into it!”, if that company did not want to do it or the computer genius was on a go-slow that day. The idea that you could force somebody to create a program that the company and the employee did not want to is probably not possible.

Given that, the reality is that the things the Government want to ask will happen only when there is a good working understanding between the security services and the company. Therefore, if the tech companies want this clarity as set out in Amendment 251—as we know they do—our interest is to hear from the Minister just what the obstacles are to giving them the clarity that they seek.

Investigatory Powers Bill

Baroness Hayter of Kentish Town Excerpts

Report: 2nd sitting (Hansard - part one): House of Lords
Monday 17th October 2016 Lords Chamber

[Earl Howe]

My Lords in moving this amendment I will speak to the other amendment in this group. They provide for the introduction of judicial approval for data retention notices given under Part 4 of the Bill. This is an important new safeguard. It means that such notices given, authorised or varied by the Secretary of State, including those requiring the retention of internet connection records, will in future also require the approval of a judicial commissioner.

The Secretary of State must already consider whether it is necessary and proportionate to issue a data retention notice to a telecommunications operator. This amendment would mean in future that the decision to give a notice would be reviewed by a Judicial Commissioner, in line with the authorisation procedures for other powers in the Bill. I hope that the House will welcome this additional safeguard and, accordingly, I beg to move.

[Baroness Hayter of Kentish Town]

My Lords, we take this opportunity to thank the Government for listening to us, to the service providers and, in this case, also to the human rights monitors—everyone is in agreement. We are happy to support the amendments.

Amendment 115 agreed.

Investigatory Powers Bill

Baroness Hayter of Kentish Town Excerpts

Report: 2nd sitting (Hansard - part two): House of Lords
Monday 17th October 2016 Lords Chamber

[Lord Paddick (LD)]

My Lords, this amendment stands in my name and that of my noble friend Lady Hamwee. It introduces to the Bill a body corporate known as the investigatory powers commission that comprises the Investigatory Powers Commissioner, judicial commissioners and staff to support the commissioners. I am relying heavily on, and am very grateful to, the Interception of Communications Commissioner’s Office in this matter.

At present the Bill creates only a chief judicial commissioner and a small number of judicial commissioners. The commissioners will be responsible for approving approximately only 2% of the applications falling within the remit of the oversight body. Most of the applications made under the Bill are likely to be for communications data, for example, individual applications for which are not subject to prior approval by a judicial commissioner. The remaining 98% will be subject only to post-facto oversight.

The post-facto oversight will be carried out predominantly by specialist inspectors, investigators, analysts and technical staff working to the Investigatory Powers Commissioner, and it is important for those individuals to have a delegated power to require information or access to technical systems. According to the Interception of Communications Commissioner’s Office:

“The creation of a Commission is crucial to achieve a modern, inquisitive oversight body that has the expertise to carry out investigations and inquiries to the breadth and depth required and the intellectual curiosity to probe and challenge the conduct of the public authorities”.

I shall expand on what IOCCO means by that.

First, it means that the specialists do not have to wait to be tasked by the commissioner but can use their initiative and expertise to follow the evidence and conduct post-facto scrutiny where they believe it is most needed. Secondly, other commissions, such as the Independent Police Complaints Commission, are bodies corporate whose investigators have all the powers of their commission. This prevents police officers saying, “I’m not talking to you, Mr Investigator. I am only going to talk to a commissioner”. The Government may say that there is no direct parallel here but they would be wrong.

The Intelligence Services Commissioner was asked by the then Home Secretary, Theresa May, to carry out an investigation into what the security services knew about those involved in the murder of Fusilier Lee Rigby. In his supplemental report to his 2015 annual report, Sir Mark Waller, at paragraph 5.3(4), talks about his attempts to have counsel, Mr Sanders, who was carrying out the investigation on the commissioner’s behalf, present during the interviews of some of those involved:

“Prior to these interviews taking place, SIS told me that Desk Officer 1 and Intelligence Officers 1 and 3 objected to Mr Sanders being present and so he did not attend. I have since been told by SIS that this objection in fact came from its senior management. I very much regret that this was not made clear to me at the time as I would have challenged it” "

The fact is that, unless those carrying out post-facto scrutiny are part of a body corporate, as in the case of the IPCC, those whom they are supposed to be scrutinising can refuse to co-operate with them and demand that they deal with the Investigatory Powers Commissioner alone.

The IOCCO says:

“Putting the oversight Commission on a statutory footing will be a huge step towards guaranteeing independence, capability and diversity within the organisation which will inspire public trust and confidence”.

It goes on to say:

“Creating an oversight Commission would also help make a distinction between the approval and post-facto audit elements of the oversight body, addressing a concern raised by a number of witnesses to the Joint Committee that the Judicial Commissioners should not be perceived to be ‘marking their own homework’”.

This of course refers to the fact that in the 2% of cases where a warrant was approved by a judicial commissioner, without the establishment of a commission it could understandably be perceived by the public that the judicial commissioners were post-facto auditing the decisions of other judicial commissioners. Although this may be an accepted practice in the legal profession—in the courts and so forth—it is likely to be lost on the general public. The Interception of Communications Commissioner’s Office concludes:

“We urge the Government to implement this recommendation which was also made by the RUSI Independent Surveillance Review, David Anderson QC and the IP Bill Joint Committee”.

The amendment seeks to implement that recommendation. I beg to move.

[Baroness Hayter of Kentish Town (Lab)]

My Lords, we are satisfied that the speedy and effective establishment of the office of Investigatory Powers Commissioner will provide the staff, expertise and structure to implement the Bill. As the noble Earl will know, we have queried whether the resources will be made available and we will continue to keep an eye on that. However, we see no rationale as to why a body corporate, with all the governance, other requirements and bureaucracy, would be better at achieving the balance that we seek, which is the timely, appropriate and thorough oversight of the powers in this Bill, taking full account of civil liberties and the need to prevent or apprehend crime, and dealing with threats from those who wish us harm.

It is possible that I have misunderstood what the noble Lord, Lord Paddick, said, but it seemed that he wanted the staff to have some of the commissioner’s authority. For ourselves, we have relied very much on the judicial commissioners, with the powers given to them under the Bill, and the IPC himself or herself to do this, and we would certainly not want to detract from their authority in any way.

Investigatory Powers Bill

Baroness Hayter of Kentish Town Excerpts

Report: 1st sitting (Hansard): House of Lords
Tuesday 11th October 2016 Lords Chamber

[Baroness Hayter of Kentish Town (Lab)]

Like other noble Lords, I thank the Minister and the Bill team for the detailed discussions—perhaps negotiations is a better word—that they have had not only with us but with other interested parties. We have sought to balance our strong desire to protect clients’ confidentiality—their ability to speak openly and honestly with their lawyer, safe in the knowledge that information will go no further —with the need to safeguard the security of citizens and free them from the threat of terrorism or other risks to life. It would be wonderful if there were a nice, absolute and clear division between those two objectives but, sadly, in the real world there seldom is.

The Bill as drafted had not got the balance right. It was tipping towards the state’s ability to access or use legally privileged information. Since then, as the Minister outlined, the amendments to Clause 2, an overriding clause which should circumvent all the powers in the Bill, will significantly safeguard privileged material. It is not an absolute, but we acknowledge movement here and in other amendments, such as the public interest test needed before approving a warrant. It would require both the Secretary of State and a judicial commissioner to be satisfied that the public interest in obtaining the information outweighed that long-standing public interest in maintaining the confidentiality of legally privileged communications, but also, importantly, that there were no other reasonable means of obtaining the required information.

Similarly, we welcome Amendment 25, by which, when a warrant is requested to prevent or detect serious crime, the exceptional compelling circumstances have to relate to national security or preventing death or significant injury, and do not, as with some of the other powers, include being in the interests of the UK’s economic well-being. We are also pleased that the commissioner would have to be informed when any privileged material is retained by an agency and note that, as has just been mentioned, it can be ordered to be destroyed or for conditions to be imposed on its disclosure.

We are, however, sympathetic to the desire of the noble and learned Lord, Lord Mackay of Clashfern—I cannot believe he really called himself less luminous—to allow the commissioner to differentiate between advice and, for example, the time when a phone call was made, which could be incredibly important but irrelevant to the content of the phone call. If there is a way to enable the commissioner to differentiate in that way, we hope that the Government will respond to that positively.

Finally, with regard to the so-called inequity exception, we note that any application for a warrant under this provision would have to set out the grounds for believing that communications are being made with the intention of furthering a crime, and we welcome that.

We are mindful that representatives of lawyers—speaking on behalf of their clients, because it is their interests that we are discussing—feel that the Government have not gone far enough to meet their concern. We acknowledge that, on paper, an enormous amount of progress has been made. Our concern is whether the resources, culture and mindset of the IPC will allow for the scrutiny and challenge that the words now on paper will require. I am reassured by the fact that the judicial commissioners are not just lawyers but very experienced and senior ones, so they will have a background of understanding the legal profession’s fears and long-standing views about this matter. Perhaps, when replying, the Minister, in addition to responding to the wider points made, can give an assurance that the commissioner and judicial commissioners will be appointed with a view to guaranteeing their complete independence and with sufficient resources to be able to look at these significant and demanding issues with due care and attention.

[Lord Keen of Elie]

My Lords, I am obliged to noble Lords. I begin by looking at Amendments 27 and 88, which seek to insert the word “clearly” in the public interest test. On this point I concur with the observations of the noble Lord, Lord Carlile of Berriew, that there is a danger that this would simply muddy the waters and not clarify.

The test as set out in the government amendment is straightforward. The public interest in obtaining the information sought either outweighs the public interest in maintaining the confidentiality of privilege or it does not. If the word “clearly” were inserted, that certainty would be lost. We would have to try to define what we mean by “clearly”. Logic suggests that it means that one public interest test should outweigh the other by a certain amount, as indicated by the noble Baroness, Lady Hamwee, but it is not apparent what that amount would be. This would undoubtedly lead to confusion and uncertainty. Given that such a warrant can be sought only in exceptional and compelling circumstances, where national security or life and limb are at risk, confusion and uncertainty are one thing that we cannot afford.

The government amendments set out in detail what is intended by “exceptional and compelling”. The test is explicit on the face of the Bill and it is one that works. We are also introducing a requirement for the codes to include additional information about when circumstances are to be considered exceptional and compelling, and requiring the Investigatory Powers Commissioner to keep that language under review. It is in these circumstances that I invite the noble Baroness not to press her amendments.

The second set of amendments in this group—Amendments 56, 57, 192 and 193—seek to change the power of the Investigatory Powers Commissioner to determine what happens to legally privileged material when it has been obtained by an agency and the agency wishes to retain it. First, they would provide that the commissioner has the power to impose conditions on the use of the item as well as its disclosure. Secondly, they would also require the commissioner to direct that any privileged material that has been obtained must be destroyed unless there are exceptional and compelling circumstances that justify its retention. These amendments raise important issues in respect of legally privileged material that is inadvertently obtained and where the agency wishes to retain it. I would like to reflect further on our consideration of these points today and to return to this issue at Third Reading.

Amendment 107 deals with communications data and seeks to provide for judicial approval of authorisations for the communications data of a person who is or is likely to be a practising legal professional. It seeks to reflect the protections provided in Part 3 of the Bill for the identity of a journalistic source, but in practice this amendment goes much further by attaching the protections to the profession rather than to the sensitive information they manage. The debates in the House of Commons and at previous stages in this House have been clear that Parliament’s view is that protection should attach to the sensitive communication or to the function being carried out and should not simply apply to the person because they are a member of some profession. For example, there was consensus that protection should apply to the journalist’s communications with a source or the client’s communications with a lawyer. This amendment would go against that consensus by providing protection to a lawyer simply because he is a lawyer.

The Bill takes a reasoned and balanced approach. It applies additional protections where appropriate; provides for judicial authorisation of the most intrusive powers and for the use of less intrusive powers in the most sensitive circumstances; and provides a powerful and robust oversight regime to ensure that powers cannot be misused. The protections provided are specific to each power under the Bill, applying protection which is appropriate to the level of intrusion represented by each power. The draft Communications Data Code of Practice sets out the additional considerations that must be taken into account when any data relate to a member of a profession which routinely holds items subject to legal provision. Indeed, Schedule 7 to the Bill requires that the code shall include such detail. In addition, the current amendment to Clause 2 puts beyond doubt the importance of taking particular care in relation to sensitive information, such as items subject to legal privilege.

Our debate has already shown the importance that the Government place on the protection of legally privileged material, but I would suggest that it is not appropriate to introduce these additional protections within the context of authorisations for communications data. I invite the noble Baroness not to press Amendment 107.

Amendment 55A, tabled by the noble and learned Lord, Lord Mackay of Clashfern, seeks to amend government Amendment 55. This amendment would require the Investigatory Powers Commissioner to direct that any material obtained that is subject to legal privilege must be destroyed and allow the agency to retain only material that is incidental to that which is privileged.

I have already indicated in response to Amendment 57, proposed by the noble Baroness, Lady Hamwee, that I am minded to look again at whether there is more we might provide on the face of the Bill regarding the test that the commissioner should apply when making a decision about whether material can be retained. However, I would respectfully suggest that what the noble and learned Lord proposes with this amendment is not appropriate in the circumstances. It is the case that the vital intelligence that an agency may require could intrude not only on incidental material in a legally privileged communication but on the legally privileged communication in general.

I take up the example which the noble and learned Lord gave of the individual communicating with a lawyer and asking, “Can I be extradited from Greece?”. One might say, in a very straightforward fashion, that the relevant intelligence there is Greece, not that he may or may not be extradited. But what if the communication goes like this: “Can I be extradited from Greece or Albania?”, and the answer is, “You can be extradited from Greece but you cannot be extradited from Albania”. Just giving them Greece and Albania will not assist the intelligence services very much. On the other hand, the legally privileged information that he can be extradited from Greece but cannot be extradited from Albania might lead the reasonable intelligence officer to infer that the individual was more likely to be found in Albania than in Greece. It is in those circumstances that I suggest that one cannot easily divide between the two. As I have indicated, we are conscious that in these areas we can look again to see whether we can strengthen these matters. At this stage I would invite the noble and learned Lord not to press his amendment.

--- Later in debate ---

[Lord Paddick]

I also thank the Minister for this impressive package of amendments. It clearly has to be necessary and proportionate in some circumstances to investigate a journalist. However, I am a little concerned about a law enforcement chief being able to authorise such acquisition through equipment interference, although there is now the reassurance of a judicial commissioner, which did not exist before. I accept what the noble Viscount, Lord Colville of Culross, and the noble Lord, Lord Black of Brentwood, said about the concern of the National Union of Journalists that there should be prior notification and the ability to make representations. However, I think it is reasonably clear how difficult it would be to differentiate between the cases to which the measure would and would not apply. In all the circumstances, I think that this is more than the best that we could have hoped for. We are very grateful.

[Baroness Hayter of Kentish Town]

My Lords, I hope that my noble friend Lord Rooker has not ended the Minister’s political career. However, I think we all can say that when we come here our political careers are behind us. I join the noble Viscount, Lord Colville, the noble Lord, Lord Black, and others in thanking the Ministers and their team for the significant changes that have been made. I will not go through all of them, but the Government’s adding in Amendment 11 a reference to,

“information identifying or confirming a source of journalistic information”,

needing extra protection is very welcome, in addition to the other overriding requirement of there being no other way of getting the information.

As has been mentioned, government Amendments 30 and 31 insert special procedures for journalistic material and, perhaps of even more concern to journalists, journalists’ sources. As has just been said, the NUJ in particular wants other changes to be introduced but the idea of prior notice for covert investigation is in itself a contradiction too far. We are, however, sympathetic to the essence of the journalists’ approach—that is, their desire to protect not simply their members but whistleblowing members of the public through whom misdeeds often come to light. However, there will be occasions when terrorists or others who wish us harm will have been in touch with a journalist and the sole indication of that person’s whereabouts might exist on a journalist’s phone. Unless we are absolutely sure that we would never in any circumstances want those who protect us to be able to access that information, we need the warrants and the powers in the Bill. We hope very much that the safeguards provided will keep those exceptions to a minimum—I think that the word used was “rare”—and we hope that the IPC, in reviewing what happens, will always bear in mind the cost to all of us if fears of retribution deter good whistleblowers from getting misdeeds into the public domain. However, those are in a way fairly small instances. I commend to the House the changes that have been made.

[Earl Howe]

My Lords, I very much appreciate the noble Lord, Lord West, alerting the House to the achievement of my distinguished ancestor, Admiral Earl Howe, in relieving the siege of Gibraltar, to which he referred for the rest of his life as one of his greatest accomplishments. Glad as I am that this package of amendments has received the approval of so many of your Lordships, I cannot claim that it falls into quite the same bracket as the relief of Gibraltar. I am obviously gratified that it has met with the House’s approval.

For the sake of completeness, I should add that we have also undertaken an extensive update of the section relating to journalists and their sources in the existing draft communications data code of practice, providing additional statutory guidance to police forces about handling requests for communications data relating to journalists. This revised version of the code has been published in time for Report, so I refer noble Lords to it.

--- Later in debate ---

[Lord Paddick]

My Lords, I support the amendments for the very reasons that the noble Lord, Lord Butler of Brockwell, has just set out. Bulk powers are exceptional powers and they raise concerns among the public. There are specific offences in other parts of the Bill and in other legislation, and now we are focusing on deliberate abuse. I echo what the noble Lord, Lord Butler, said about the integrity of the security services, but we believe that these specific offences are necessary for public reassurance, if nothing else.

[Baroness Hayter of Kentish Town]

My Lords, I was about to congratulate the noble Lord, Lord Butler, on his excellent drafting of the amendments but he has slightly given away that it was not all done by his own fair hand. However, if the look on the Minister’s face is indicating that the Government might accept the amendments, we are delighted that the noble Lord’s influence from this House seems to be keeping pace with the influence that he had in his previous occupation. We are very content to support the amendments.

[Lord Keen of Elie]

My Lords, we welcome the chance to revisit this important issue, which was debated in Committee.

In putting beyond doubt that deliberate wrongdoing in relation to the bulk powers will be subject to clear, criminal sanction, we accept that these amendments will provide clarity on a crucial issue. We also believe that they have been drafted in such a way that, rightly, they would not criminalise honest, well-intentioned mistakes by the staff of our security and intelligence agencies, who do so much to keep us all safe. As such, we believe they strike the right balance and are to be welcomed. Therefore, we are happy to accept the amendments.

Investigatory Powers Bill

Baroness Hayter of Kentish Town Excerpts

Monday 12th September 2016 Lords Chamber

[Lord Murphy of Torfaen (Lab)]

The purpose of the Liberal Democrats’ amendment seems to be that there is a speedier review of the legislation than was agreed in the passage of the Bill in the other place and was actually in the Bill. During the proceedings of the Joint Committee, a number of witnesses, including the Information Commissioner, argued for a sunset clause to be put into the Bill. The committee considered that; it did not agree, but at the end of the day believed that there should be,

“some form of review after five years”,

and that it should be “detailed post-legislative scrutiny”. The proposal that the Joint Committee came up with, to which I believe the Government have agreed, is that a Joint Committee of both Houses should be established within six months of the end of the fifth year after the Bill is enacted.

The difficulty with the amendment is that it refers specifically to the Secretary of State reviewing the Bill, whereas the Joint Committee was arguing that both Houses of Parliament should review it. The argument that technological change can be swifter than was thought by those of us who believe that five years was the answer is what lies behind the amendment. However, this is not simply about technology; it is also about the impact of the Act, as it will then be, upon the liberties of the people and about the nature of the various powers that we are enacting in the course of our proceedings. We therefore need some clarification: is it about the Government reviewing, or is it about Parliament reviewing? What precisely are we reviewing? I think everyone agrees with the principle, but we have to look carefully at the way in which Parliament reviews. If the amendment is eventually accepted then, frankly, it has to be secondary to parliamentary scrutiny.

[Baroness Hayter of Kentish Town (Lab)]

My Lords, the questions that have been asked are interesting. Times are changing, as is the nature of the threats. Who would have thought 30 years ago that we would be sitting here worrying about online grooming, ISIS terrorism and kidnapping or sophisticated cybercrime and money laundering? Who would have known that they were the challenges that would face us? Who would have talked 30 years ago about apps, internal emails—which we can get on our phones, according to some of my friends—and similar matters?

We will come back to issues of encryption. Technology is changing all the time, as is the modus operandi of those who wish us harm. Added to that, as I think my noble friend was alluding to, are the new powers in the Bill and the very welcome safeguards—the privacy measures and the double lock. These are new measures and we will want to see whether they achieve what the Government hope for them.

There are therefore two issues: first, how are the Government themselves going to monitor whether the Bill is achieving what they want; and, secondly, as alluded to by my noble friend, how will we then have formal post-legislative scrutiny to see whether they are what Parliament wants, and what is the correct time for that? The issues raised about reviewing these important powers and about the rapid change both in the technology and in the threats are ones that we want to be assured will be monitored and reported back on.

[Lord Brown of Eaton-under-Heywood (CB)]

My Lords, I am not sure how useful this intervention will be, but it occurs to me that when the Government consider the amendment and the proposed reduction of the period allowed for a review, they should also bear in mind the sole recommendation made by David Anderson in his review published in August, which we were all discussing last week, the Report of the Bulk Powers Review. I know that his amendment was not accepted then, but consideration will be given to it and I would expect amendment to the Bill along the lines that David Anderson recommended:

“The Bill should be amended to provide for a Technology Advisory Panel, appointed by and reporting to the IPC”—

that is, the commissioner,

“to advise the IPC and the Secretary of State on the impact of changing technology on the exercise of investigatory powers and on the availability and development of techniques to use those powers while minimising interference with privacy”.

Assuming that some effect is given to that and some such advisory panel—an altogether more elaborate advisory panel was canvassed during the debate last week by the noble Lord, Lord Carlile—that will surely bear on the appropriate period within which an overall review should take place.

--- Later in debate ---

[Baroness Butler-Sloss (CB)]

My Lords, I have not spoken often on this Bill but felt impelled to say that what the noble Lord, Lord Lester, and the noble and learned Lord, Lord Brown, have said is extremely good sense and the Government should follow it.

[Baroness Hayter of Kentish Town (Lab)]

My Lords, given what has been said, I have little to add. I was born in Germany after the war, when it was so easy to define national security. It was about people coming over our border. Today, it is about our streets and about keeping people safe at home and abroad. I look forward to the noble Earl’s response. I do not think it is wise to try to define national security in the Bill, not simply because of the complications but because the definition changes. I know that it is a long time since I was born, but even over the next five years the definition will change again. We look forward to hearing the Government’s comments.

Investigatory Powers Bill

Baroness Hayter of Kentish Town Excerpts

Tuesday 19th July 2016 Lords Chamber

[Lord Paddick]

My Lords, I shall speak to Amendment 116 in my name and that of my noble friend Lady Hamwee. We also have our names to Amendments 154 and 235 in this group.

These amendments relate to a government commitment not to require telecommunications operators to retain third-party data. On 4 November 2015 in a Statement in the other place, the then Home Secretary said that the Bill,

“will not include powers to force UK companies to capture and retain third party internet traffic from companies based overseas”.—[Official Report, Commons, 4/11/15; col. 969.]

However, Clause 58(5)(c) states:

“An authorisation … may, in particular, require a telecommunications operator who controls or provides a telecommunication system to obtain or disclose data relating to the use of a telecommunications service provided by another telecommunications operator in relation to that system”.

Surely this means third-party data.

Amendment 116 would alter Clause 58(5)(c) to read, “may not require”. The key point here is that telecommunications companies should not be forced to obtain third-party data. The draft code of practice on communications data states at paragraph 2.61:

“A data retention notice can never require a CSP to retain the content of communications or third party data”.

Paragraph 2.66 states:

“A CSP cannot be required to retain third party data as part of an ICR”.

Amendment 154 would add a new subsection to Clause 83(2)—the clause headed “Powers to require retention of certain data”—to make explicit that a retention notice may,

“not require a telecommunications operator to retain any third party data, unless that data is retained by the telecommunications operator for its own business purposes”.

This is to distinguish between communications data that the telecommunications operator may have and being forced to acquire third-party data that it does not have.

Amendment 235 would restrict the definition of communications data in Clause 233(5) so that it relates to the provision of the service by that operator and not a third party. I beg to move Amendment 116.

[Baroness Hayter of Kentish Town (Lab)]

My Lords, I have added my name to Amendment 154 and will not repeat what has been said about it. It simply asks the Government to make explicit what they have said—namely, that the retention of third-party data will not be required. It would be helpful to make that clear in the Bill.

[The Minister of State, Ministry of Defence (Earl Howe) (Con)]

My Lords, as the noble Lord, Lord Paddick, has explained, these three amendments all deal with the issue of third-party data. Amendment 116 seeks to prevent public authorities from acquiring third-party data, Amendment 154 seeks to put the Government’s commitment not to require retention of third-party data on to the face of the Bill and Amendment 235 seeks to amend the definition of communications data to exclude from it third-party data.

On the acquisition of third-party data, the Bill maintains the existing position under RIPA that public authorities can acquire third-party data where necessary and proportionate to do so. But I want to be clear here—a provider is required to comply with a request for communications data, including a request for third-party data, only where it is reasonably practicable for them to do so. It is absolutely right that, where a communications service provider holds, or is able to obtain, communications data, whether in relation to its own services or those provided by a third party, then the data should be available to public authorities for the statutory purposes in the Bill. Put simply, data that already exist, are already held and which could save a life, convict a criminal, prevent a terrorist attack or provide an alibi, should not be put out of reach of law enforcement based solely on which company it is that holds the information.

Amendment 154 deals with the retention of third-party data. As I am sure the noble Lord knows, this matter was considered in the Commons, where the Government gave a commitment to consider it further. I am grateful to the noble Lord and the noble Baroness for tabling this amendment and giving me an opportunity to update the Committee on those considerations. My right honourable friend the Home Secretary has given a clear commitment that we will not require a telecommunications operator to retain third-party data, and that commitment is given effect to in the Communications Data Draft Code of Practice. However, distilling that commitment into primary legislative drafting is complex. We do not want to include provisions in the Bill that are not entirely clear in scope or which put in place restrictions that are broader, or indeed narrower, than intended. But we have been making good progress and are close to a provision that we think achieves the desired outcome. Of course, we need to test that drafting with operational stakeholders and with those telecommunications operators likely to be affected by the legislation, but we hope to be able to return to this issue on Report.

Finally, on Amendment 235, the principle of what are communications data is clear. Changing that position so that the classification of data changes depending on which provider holds them would no doubt cause confusion among providers as to how the data should be handled. While I understand the concerns around third-party data, and hope that what I have said today lays some of those to rest, amending the definition of communications data is not the right way forward. I invite the noble Lord to withdraw Amendment 116.

--- Later in debate ---

[Lord Strasburger (LD)]

My Lords, I shall speak briefly on the amendments on the request filter. Along with internet connection records, the request filter is another power that first appeared in the draft Communications Data Bill and which died along with that ill-fated Bill. The view of the pre-legislative Joint Committee on that Bill, on which I sat, was that,

“the Request Filter introduces new risks, most obviously the temptation to go on ‘fishing expeditions’. New safeguards should be introduced to minimise these risks”.

The request filter was described as,

“essentially a federated database of all UK citizens’ communications data”.

I dare say that the committee would be even more worried when it said that in 2012 if it had seen how this Bill expanded the range of data to which the request filter can be applied. That expansion comes from the proposed introduction of internet connection records, which would reveal every detail of a person’s digital life and a very large part of their life in the real world. The effect of the request filter will be to multiply up the effect of intrusion into those data by allowing public authorities to make complex automated searches across the retained data from all telecoms operators. This has the potential for population profiling and composite fishing trips. It is bulk surveillance without the bulk label.

Use of the request filter would be self-authorised by the public authority without any judicial authorisation at all. The concept that the Government promote for bulk data is that they are passive retained records, which they say sit there unexamined until someone comes to the attention of the authorities. That concept is negated by the request filter. The data become an actively checked resource and are no longer passive. Will the Minister confirm that the request filter is not yet in existence and is not yet being used?

The request filter is a bulk power masquerading as an innocuous safeguard to reduce collateral intrusion. Unless and until the Government come forward with proposals to strictly limit use of the request filter through tighter rules and judicial approval for warrants, as is the case with other bulk powers, Clauses 63, 64 and 65 should not stand part of the Bill.

[Baroness Hayter of Kentish Town]

My Lords, I shall use the opportunity that arises from Amendments 140 and 146A to ask the Minister to clarify whether it really is the case that Clause 2 does not automatically affect every power in the Bill. If this was the case, we would be sympathetic to these amendments, as the privacy objective should be considered before any of the powers are used. My understanding was that Clause 2 was a general provision, which affected everything. Indeed, the letter of the noble Earl, Lord Howe, of 14 July to my noble friend Lord Rosser says, “The new overarching privacy clause sets out the privacy obligations which constrain the use of the powers in the Bill”. Our understanding had been that it covered the whole Bill, so I was slightly bemused by Amendments 140 and 146A—not helped by a briefing received, again very late last night, from the Equality and Human Rights Commission, which only ever sends out its briefings on the very eve of debate. That briefing says that Clause 2 does not cover it all, whereas my understanding was that it did. Perhaps this is the opportunity for one of the Ministers to make clear the situation.

[Lord Butler of Brockwell (CB)]

My Lords, I find the amendment moved by the noble Lord, Lord Paddick, difficult to understand. He made the point that the filter arrangement makes the operations of the police easier, but it makes them easier by ensuring that they do not inspect communications data which are not relevant to their purpose. It therefore protects privacy rather than threatens it. The filter is governed by the requirements of the rest of the Bill. It will apply the tests of necessity, proportionality and the protection of privacy. It is a protection of privacy rather than a threat to it.

--- Later in debate ---

[Lord Harris of Haringey]

My Lords, as I said earlier in Committee, it is important that, in assessing any proposal made in the Bill, we strike the balance between the need for it and any possible negative consequences, and whether that may weaken the security of a device, enabling the malign elements, as opposed to benign, to penetrate systems. As I understand it, the purpose of the amendment is to try to ensure that that balance is clear in the Bill. It would place an obligation on those seeking warrants and those considering them to look at whether that balance has been struck and ensure that it has.

It is reasonable for those seeking warrants to demonstrate that they have considered whether there are any negative consequences of the action they are prepared to take, particularly if it leads to a weakening of the general security of a wider system that may mean it is prone to attack from cybercriminals or others accordingly, or that there is likely to be a large amount of collateral damage in other people’s information being made available to the authorities.

I make it clear that I do not think the fact that the information of other people who are not the purpose of a warrant may be compromised is necessarily a reason why we should not proceed with this. It should be balanced with the consequences. For example, I can conceive of circumstances where a warrant might be sought for a machine in an internet café. Clearly, that is because certain individuals are thought to be using it. In any application I would want consideration to be given to what would be done about those other, presumably entirely innocent individuals who might use the same machine.

I am concerned that, as part of the process, there should be consideration of the downsides of a particular application: whether it is weakening the system or interfering with the privacy of other people who are not specifically targeted. If either is the case, there should be clear consideration of what can be done to minimise those risks. The fact that another person is not the subject does not necessarily mean that it should not be proceeded with. It is a matter of proportionality—the benefits that will be gained from the action being taken and whether those are properly considered by those making the application and those considering whether to approve it. For those reasons, the amendment is broadly helpful. I hope that Ministers may be prepared to accept this or something like it to provide that assurance.

[Baroness Hayter of Kentish Town (Lab)]

My Lords, I added my name to Amendments 159 and 160. Amendment 164 is in my name and that of my noble friend Lord Rosser. Our points are much the same as those made by my noble friend Lord Harris. I do not think there will be planting of evidence, for example. Our concern is much more about the risk to any public cybersecurity system, and we would want that to be taken into account. These amendments follow the recommendations of the Joint Committee. The idea is to minimise any potential risks. If, for example, the Secretary of State has to take into account any risk to the security and integrity of the networks, that by itself will ensure that any applicant sets that out in the form they submit. We hope the Government will respond, as my noble friend Lord Harris said, not necessarily by using these exact words but in the spirit of these amendments in order to retain overall security.

[Earl Howe]

My Lords, Amendments 159 and 160 would introduce new clauses requiring the person making an application for a warrant to make a detailed assessment of the risks of the proposed equipment interference activity to any critical national infrastructure, to the security and integrity of systems and networks, and to the privacy of those not targeted. Amendment 164 is linked to the requirement to produce risk assessments and would require the Secretary of State, when issuing warrants to the Chief of Defence Intelligence, to consider the content of these assessments when deciding whether the activity under the warrant would be proportionate. Amendment 169A would require a judicial commissioner to take into account a technical cyber risk assessment, conducted by the Investigatory Powers Commissioner, of the specific equipment interference proposed when deciding whether to approve a decision to issue a warrant.

I start by making an important general point. It seems these amendments are based on a fundamental misinterpretation of what GCHQ and others are here to do. Their role is to protect the public. That includes protecting cybersecurity. Indeed, the Government have invested very considerable resources into improving our cybersecurity efforts. Last November, the Chancellor announced the creation of a new national cyber centre led by GCHQ, with an additional £190 million of funding.

GCHQ has an excellent track record in identifying cyber vulnerabilities and making leading computer companies aware so they can improve their security. For example, in September 2015, Apple publicly credited CESG, the information assurance arm of GCHQ, with the detection of a vulnerability in its iOS operating system for iPhones and iPads, which could have been exploited to allow the unauthorised modification of software and to extract information from the devices. That vulnerability has now been patched.

I appreciate that the noble Lords’ amendments are intended to introduce safeguards, but I contend that sufficient safeguards are already contained in the Bill. Part 5 already requires the Secretary of State or law enforcement chief to consider whether the proposed conduct is necessary and proportionate before issuing a warrant. The Government have provided even more reassurance since the discussion of these same amendments in the other place. As we have frequently reflected, Clause 2 is a new provision that sets out overarching privacy duties. It includes a requirement to have regard to the public interest in the integrity and security of telecommunication systems. This requirement applies to any decision on whether to issue an equipment interference warrant.

The draft statutory code of practice also sets out, in detail, the factors that must be considered in respect of proportionality. The code states at paragraph 3.27 that one element of proportionality that should be considered is,

“explaining how and why the methods to be adopted will minimise the risk of intrusion on the subject and others”.

It goes on to state at paragraph 3.30:

“Equipment interference activity must therefore be carried out in such a way as to appropriately minimise the risk that the activities of the equipment interference agency would result in any increase of the likelihood or severity of any unauthorised intrusion into the privacy, or risk to the security, of users of equipment or systems, whether or not that equipment is subject to the activities of the equipment interference agency”.

If noble Lords will allow me one last quote, paragraph 3.31 states:

“Any application for an equipment interference warrant should contain an assessment of any risk to the security or integrity of systems or networks that the proposed activity may involve including the steps taken to appropriately minimise such risk … The issuing authority should consider any such assessment when considering whether the proposed activity is proportionate”.

Investigatory Powers Bill

Baroness Hayter of Kentish Town Excerpts

Wednesday 13th July 2016 Lords Chamber

[Viscount Hailsham]

My Lords, I want to address Amendment 48 in a few words. I find myself uncomfortably caught between the issues raised by the Bill as drafted and Amendment 48. I agree very much with the criticism of the Bill that has been articulated by the three noble Lords who have already spoken. The test in the Bill as drafted is subjective, very wide and likely to have some of the undesirable consequences identified by the noble Lords. I also think that the amendment is, curiously, too narrow. As I interpret it, it requires compelling evidence of a criminal purpose.

A long time ago, when I was in the Home Office, I had responsibility for one of the prevention of terrorism Bills which was going through the House of Commons. One of the issues we had to consider in Committee was very similar to the point made by the noble Lord, Lord Carlile. What happens when a lawyer receives, through the legal process of discovery, information which is capable of supporting terrorism? We decided as a matter of principle that that information would not be disclosed to the defending lawyer because of the risk of transmission to the client, who might use it for the purposes of terrorism.

I am therefore concerned that while the Bill as drafted is too broad, the amendment is too narrow. It does not capture the situation when an innocent communicator can communicate to a client, who may be a terrorist, information which that person can use for an act of terrorism. I am glad to hear that this is a probing amendment, which has been accurately advanced, and that the Government are minded to be responsive to the anxieties expressed. I hope that the Minister will keep in mind my own anxiety, that while Amendment 48 has a great deal of merit, it is too narrow, while the Bill as drafted is too broad.

[Baroness Hayter of Kentish Town (Lab)]

My Lords, I will not dare to try to better the arguments already made in this debate but will only emphasise two things with regard to the amendments to which I have added my name.

The first, which has already been mentioned by the noble Lord, Lord Pannick, is that this so-called privilege is of the utmost importance to clients—the description always sounds as if it is your privilege rather than ours. I speak as the former chair of the Legal Services Consumer Panel, where we represented the interests of those who—often in times of trouble—need the help and advice of a lawyer.

We know that very many people who could do with legal assistance do not go, partly because they do not know that they need it, partly because they do not know how to get it, partly due to cost, but also because it is all a bit too intimidating. It often falls to the lawyer to reassure them not just about the particular case, but that what passes between them will be absolutely confidential and—for example, in the case of a domestic break-up or a child’s custody—will never be revealed to their former partner or others involved, including agencies of the state.

Therefore, this confidential relationship is key to people getting good advice and advocacy and a fair hearing, as well as being key, as we have already heard, to the role of our lawyers and the rule of law. However, we also understand that there will be occasions when some details of this relationship might be caught by powers included in the Bill. We look for some assurance that the maintenance of clients’ confidence is absolutely understood, and that any such occasions will be as limited as we have heard, and only after proper due process.

We look forward to hearing in the Minister’s response the Government’s current thinking and perhaps some indication of what they will be willing to bring forward on Report.

[Lord Mackay of Clashfern (Con)]

My Lords, I put my name to these amendments. I am grateful to the noble Lord, Lord Pannick, for the clear exposition he has given of the reasons for them, and I have listened to the anecdotal evidence provided by the noble Lord, Lord Carlile.

I think we are all agreed that proper legal professional privilege is vital to the rule of law. It is not a privilege of the legal profession but of the client, as the noble Baroness said. However, the illustrations show that some other factor may be buried in proper legal confidentiality. The example of information being passed on innocently is one such. It was not part of the legal professional privilege conversation but an adjunct to it—“Please pass this on to my girlfriend”. Another possible illustration, which I have discussed with the Minister, is that the location of the client might be mentioned incidentally. Where he happens to be is not crucial to the advice he gets or the information he gives in order to get it, which is, of course, the real reason the conversation is protected.

--- Later in debate ---

[Baroness Hamwee]

My Lords, my noble friend Lord Paddick and I have Amendments 86 to 88, 244 and 245 in this group, which takes us to the provision for payment towards compliance costs. Under Clause 222(1):

“The Secretary of State must ensure that arrangements are in force for securing that telecommunications operators and postal operators receive an appropriate contribution in respect of such of their relevant costs as the Secretary of State considers appropriate”.

As I read that, I wonder why it needs to be “an appropriate contribution” and such as the Secretary of State “considers appropriate” of their relevant costs. That is belt, braces and some other form of security.

Amendments 86 to 88 taken together provide for cover for all the operators’ costs, but those costs should be assessed objectively, and I feel quite strongly that the arrangements should be in place before the operational parts of the Bill are in force. The audit provision—the subject of the amendment of the noble Lord, Lord Rosser, and the noble Baroness, Lady Hayter—would remain, as is right.

I feel strongly about this because however much good will there is on both sides, if you do not get an agreement in place before you get on with the next stage of the operation, there is always the danger that you will not satisfy the parties. It is important not to leave the matter open.

There has been a lot of discussion of the quantum. The Minister in the Public Bill Committee said that 100% of the compliance cost will be met by the Government. He clarified that the estimated costing of £174 million—which illustrates why it is important to get the Bill right—

“is not a cap, but an estimate”.—[Official Report, Commons, Investigatory Powers Bill Committee, 3/5/16; col. 632.]

The Science and Technology Committee, reporting on the Bill, recommended:

“The Government should reconsider its reluctance for including in the Bill an explicit commitment that Government will pay the full costs incurred by compliance”.

It is a short point regarding an awful lot of money and potential exposure for the operators, so we are concerned to get the matter pinned down. I beg to move.

[Baroness Hayter of Kentish Town]

My Lords, as was mentioned, Amendment 89 stands in my name and that of my noble friend Lord Rosser. Clause 222(6) contains what is to me the unusual phrase:

“Different levels of contribution may apply for different cases or descriptions of case but the appropriate contribution must never be nil”.

“Must never be nil” is a slightly strange phrase, especially given that someone who, until a few hours ago, was the Home Secretary but is now the Prime Minister said on Second Reading:

“I reiterate … that … 100% of the compliance costs will be met by the Government”.

She was asked to provide a long-term commitment for that and said,

“we are clear about that in the Bill … it is not possible for one Government to bind the hands of any future Government in such areas, but we have been clear about that issue”.—[Official Report, Commons, 15/3/16; col. 821.]

However, being clear about the contribution which must never be nil is not what I call clarity.

Amendment 89 simply takes the then Home Secretary’s words as used in Parliament that the Government would meet 100% of the compliance costs, with full cost recovery for communication service providers, which, after all, have to implement the legislation. It is important to write it into the Bill to ensure that the financial impact of the legislation is transparent, not hidden, and to give forward confidence to those companies, whose activity in this country is already a little wobbly thanks to Brexit, that they will not at some point be hit by unexpected and unavoidable costs.

As was mentioned, Amendment 89 also allows for a proper audit to ensure that operators do not provide unduly high costings. Obviously, they can make no profit from these procedures because they are a departure from normal business, but they need those costs to be met. Cost recovery could be significant, but the Bill does not seem to put any limit on it at present. We will depend on the good will of these companies to make the Bill effective. We should not charge them for their willingness as well.

[Earl Howe]

My Lords, this amendment seeks to ensure that communications service providers are fully reimbursed for their costs in connection with complying with obligations under this Bill, and that arrangements for doing so are in place before the provisions in the Bill come into force. It is, of course, important to recognise that service providers must not be unduly disadvantaged financially for complying with obligations placed upon them. Indeed, the Government have a long history of working with service providers on these matters. We have been absolutely clear that we are committed to cost recovery. I want to reaffirm to the Committee a point that my right honourable friend the Security Minister made very clear in the other place: this Government will reimburse 100% of reasonable costs incurred by communications service providers in relation to the acquisition and retention of communications data. This includes both capital and operational costs, including the costs associated with the retention of internet connection records. I hope that that assurance is helpful.

The key question that this Committee needs to consider is whether it is appropriate for the Government of today to tie the hands of future Governments on this issue. I wonder whether, on reflection, the noble Baroness thinks it right to press for that. That does not mean that we take our commitment lightly or that future Governments will necessarily change course. Indeed, I suggest that it is unlikely ever to be the case; for example, the current policy has not changed since the passage of the Regulation of Investigatory Powers Act 2000 and so has survived Governments of three different colours or combinations of colours.

This Government have been absolutely clear that we practised cost recovery and we have been consistent in our policy for a very long time. Indeed, this Bill adds additional safeguards requiring a data retention notice to set out the level of contribution that applies. This ensures that the provider must be consulted on any changes to the cost model and also means that the provider would be able to seek a review of any variation to the notice which affected the level of contribution. The Government already have arrangements in place for ensuring that providers receive appropriate contribution for their relevant costs without delay, so the amendment that seeks to ensure that they are in place before the provisions come into force is, I suggest, unnecessary. Accordingly, I invite the noble Baroness to withdraw her amendment.

--- Later in debate ---

[Lord Strasburger]

My Lords, I am speaking to Amendments 92, 102 and 103 in my name. These amendments address aspects of two extremely strong powers granted to Ministers by the Bill which are tucked away at the back in Clauses 225 and 226. As we have heard, they are about national security notices and technical capability notices. Although they are not listed as powers under the Bill, they are, in fact, very strong, broad powers.

The national security notices permit, with some caveats, the Secretary of State to instruct the telecommunications operator to do whatever she considers necessary in the interests of national security. Technical capability notices enable, with some caveats, the Secretary of State to instruct an operator to develop or maintain a capability to assist the authorities. Both types of notice must be kept secret by the recipient, if the Secretary of State so wishes. In a recent amendment, the Government added the need for a judicial commissioner to approve both types of notice. This is a welcome step forward, as is the forthcoming repeal of Section 94 of the Telecommunications Act 1984, which has been used in the past to create new powers.

These three amendments address one particular capability specified in Clause 226(5)(c)—the removal of electronic protection. All the experts who gave evidence to the Joint Committee, and with whom I have discussed this matter since, agree that the phrase “removal of electronic protection” must include decryption of encrypted information and/or weakening of encryption in some way. They are deeply alarmed about it.

Encryption is a vital feature of all the financial, commercial and personal activity on the internet. The Government have confirmed on several occasions, including in answer to Questions in this House, that any weakening of our back-door access to encryption would threaten the entire operation of large parts of the digital economy. Once the integrity of cryptosecurity has been compromised for one set of users—in this case the Government—that weakness is available for everyone, including hackers, criminals, terrorists and hostile Governments, to exploit. Furthermore, as my noble friend Lord Paddick has said, UK plc has many successful businesses operating in the field of encryption products. They are very concerned that their clients will shun their products if they suspect that the Government have secretly weakened the security that these products offer. Unless this risk is eliminated from the Bill, they may have to take their companies abroad to avoid their products being tainted by the perceived risk of government damage to the security integrity of their products.

At the end of Second Reading in this House, the Minister, the noble and learned Lord, Lord Keen, stated:

“The provisions of the Bill do not weaken encryption or threaten it. We do not seek what have sometimes been erroneously termed “back doors” into encrypted material. I would seek to dispel any such suggestion”.—[Official Report, 27/6/16; col. 1461.]

These amendments simply seek to give force to that clear assurance by deleting the reference to “removal of electronic protection” and explicitly prohibiting the use of national security notices and technical capability notices for the purpose of “removal of electronic protection”. I commend them to the Committee.

[Baroness Hayter of Kentish Town]

My Lords, Amendment 93 stands in my name and that of my noble friend Lord Rosser and is on the same issue of encryption. Encryption is fundamental to keeping the whole of the digital economy safe and secure. It is widely used by business, government and consumers to protect sensitive and confidential information and as a building block in the advanced security technology which has been described.

The undermining of encryption would not simply mean that the communications of criminals could be read more easily; it would risk creating a major vulnerability in the security infrastructure, which could be exploited by various malicious actors, be they criminal gangs or rogue states. So it is important for this economy and for all the financial and other businesses that depend on it that the foundations of encryption technology remain absolutely firm.

There will be times when state security undoubtedly needs access to encrypted information for a specific investigation. This is not the problem. The problem is whether the Government would ever require a company to engineer such access, enforcing the company to create a model which, if then followed by other nations with perhaps less security than ours, would lead to a lowering of standards. We welcome the statement by the Government that they do not require industry to build back doors into their encrypted products. The Bill as it stands is perhaps not as clear as the commitments the Government have made.

Clause 226 risks making encryption intrinsically weaker if a company could be asked to build the ability to break the encryption. Amendment 93 seeks to address that. We hope the Government will understand that, when the request is made, they should not ask a company to develop a new way of breaking encryption that is not already within its ability. At the moment, the clause implies that, where companies that did not have the ability to remove the protection were issued with a notice, they would be required to build that capability so as to adhere to the notice. That is worrying the companies because of the general undermining of encryption. End-to-end encryption is essential to protect sensitive personal, commercial and security information. I think the Government share our concern that we should maintain that.

The thrust of Amendment 93 makes it explicit that a company would be required to remove the electronic protection only where it had the current capacity to do so and that it should not have to engineer it. We hope it will be accepted by the Government.

[Lord Harris of Haringey (Lab)]

My Lords, first, I should draw attention to my interests in the register on policing and counterterrorism matters. Secondly, I should make clear that my starting point on the Bill is that it is important that the developing gaps in access to communications data are addressed to protect the nation against all sorts of threats.

In any set of counterterrorism or counterespionage measures, or whatever else it might be, you have to look at the balance and weigh the benefit to the nation in protecting its citizens by having those powers against the potential downside or consequences of exercising them.

When we come to the question contained in this group of amendments—essentially about enabling or requiring companies to break the apparent encryption—we have to look carefully at the potential downsides presented by this. The first downside, or danger, is that by enabling this to happen—by creating the mechanism and requiring companies, as my noble friend Lady Hayter said, to make new arrangements so that encryption can be broken—you create a back-door mechanism. This would be available not just to the forces of good—those who are trying to protect all our security—but to cybercriminals and those who would do us ill. Therefore you need to weigh clearly what you are trying to do against whether you are creating something that will make it easier for criminals and those who would do us harm.

The second element is the extent to which what we do in this country sets a precedent that will be seized in other countries, whose interests may not be the same as ours or as positive as ours towards their citizenry. If we create that precedent, what is to prevent Governments in other countries saying that they want the same powers and therefore doing the same? That test has to be applied to quite a number of the measures in the Bill. As I say, my starting point is that I want the state to be able to fill the gap in its access to communications data that is emerging and opening up. However, I want to hear from the Government a clear explanation of why in this set of cases the benefits outweigh the potential disbenefits.

--- Later in debate ---

[Earl Howe]

It might be, but it might not be. Again, it depends on what is reasonably practicable in the particular circumstances. Those circumstances might vary from provider to provider and from situation to situation, so it is not possible for me to generalise about this, but I will take further advice and write to the noble Lord about it.

[Baroness Hayter of Kentish Town]

My Lords, the Minister spoke about what is possible and reasonable, but the point of our Amendment 93 is that a notice may not impose the requirement to build a facility that would break end-to-end encryption. We may need to return to this on Report, but it would perhaps be useful to have a discussion between now and then about imposing the requirement to build capacity to break end-to-end encryption.

[Lord Strasburger]

I fear that the Minister is taking himself down a long cul-de-sac here, because the implication of what he is saying is that no one may develop end-to-end encryption. One feature of end-to-end encryption is that the provider cannot break it; encryption is private between the users at both ends. He seems to be implying that providers can use only encryption which can be broken and therefore cannot be end to end, so the next version of the Apple iPhone would in theory become illegal. I think that there is quite a lot of work to be done on this.

Investigatory Powers Bill

Baroness Hayter of Kentish Town Excerpts

Monday 11th July 2016 Lords Chamber

[Viscount Hailsham]

My Lords, I would like to raise two points, if I may, about Amendment 66. I entirely agree with the suggestion that the consent should be in writing, and I would rather hope that the Minister will give us some reasons why it should not be, because on the face of it, it is an extremely sensible suggestion. As we all know, there is sometimes a certain degree of opaqueness regarding what people have or have not done. Looking at Clause 42, to which Amendment 66 applies, I have some difficulty in understanding the relationship between subsections (1) and (2). I am not sure why subsection (2) is there, given the language contained within subsection (1). Perhaps my noble friend can help us on that.

[Baroness Hayter of Kentish Town (Lab)]

My Lords, I wish to speak briefly to Amendment 68, which is in my name and that of my noble friend Lord Rosser. Clause 45(1)(a) permits interception by a Revenue & Customs officer under Section 105 of the Postal Services Act 2000. That is the provision that contains the power to open postal items, so that is clear enough. However, Clause 45(1)(b) permits interceptions by, again, a Revenue & Customs officer under the same Section 105 “and another enactment”. It is the phrase “and another enactment” that I am not quite clear about. If Section 105 is sufficient, why add the words “and another enactment”? If it calls on some other law in order to legitimise this activity, should that not be detailed in the clause? Amendment 68 therefore proposes deleting the second arm—the “and another enactment” bit—unless the Minister can make some sense of it for me.

[Earl Howe]

My Lords, let me turn first to Amendment 19. Clause 4 defines interception. It provides greater clarity in relation to the activity that constitutes interception than is currently the case under the Regulation of Investigatory Powers Act 2000—RIPA—and responds to calls from a number of quarters that such clarity is necessary. “Relevant time” is defined in Clause 4(4) to make clear that the interception offence can be committed at any time while the communication is being transmitted, or while the communication is being stored. Under RIPA, it is an offence to intercept a communication in the course of its transmission by means of a public telecommunications system. There had in the past been some uncertainty as to the scope of the offence; for example, whether a voicemail message stored by a telecommunications system was still in the course of its transmission, and therefore whether to access it without lawful authority would engage the offence of unlawful interception. The revised definition of interception in Clause 4 is intended to make clear that messages stored in or by the telecommunications system are caught within the definition of interception, and therefore cannot be accessed without lawful authority. This puts beyond doubt, for example, that so-called phone hacking constitutes unlawful interception.

If the Bill were amended in the manner suggested, it would, I believe, undermine the strong safeguards that the Bill provides for the protection of private communications. It would cast doubt over whether access to stored communications without lawful authority would engage the criminal offence, and it would be less clear when a public authority required a warrant to intercept communications.

Amendment 66 is not necessary and would be very difficult to implement in practice. Clause 42 simply makes clear that where both parties to a communication have consented to the communication being made available to a third party, this does not constitute unlawful interception. The Bill already requires that consent must be given in such instances for it to be lawful. On the example of a telephone call, plainly it would not be practical to write to an individual seeking their consent before continuing with that call. I hope that the noble Lord will not press that amendment.

I turn to Amendment 68. Clause 45 relates to the power of HM Revenue & Customs to inspect postal items to ensure that contraband or illegal items are not being imported or exported from the country. This clause is vital in countering terrorism and preventing and detecting serious and organised crime. RIPA was amended by the Policing and Crime Act 2009 to put beyond doubt that the protections from interception afforded to postal communications in RIPA did not restrict this vital Revenue & Customs power to check international postal traffic. This clause simply maintains this position. I hope that I have been able to provide some reassurance as to why this provision is necessary.

--- Later in debate ---

[Earl Howe]

The noble Lord has expressed it very well, and I defer to his excellent interpretation.

[Baroness Hayter of Kentish Town]

Could the Minister write on the amendment to Clause 45(1)? I was absolutely not suggesting by the amendment that the right would be lost for Customs & Revenue to intervene—it was about whether it needed to be under both Section 105 and, as it says,

“that section and another enactment”.

It was the clarity of the words “and another enactment” that I was asking about. I would be quite content to have a letter to clarify that point.

[Earl Howe]

I shall gladly write to the noble Baroness on that point. I can also say, for the benefit of the Committee, that I shall look into the drafting of Clause 45, including the reference to other enactments.

--- Later in debate ---

[Baroness Hayter of Kentish Town]

My Lords, I shall speak briefly about Amendment 148 in this group, which stands in my name and that of my noble friend Lord Rosser. It deals with what protections there should be for any journalist’s material collected as a result of any of these powers. In the case of material obtained that falls under normal rules of legal privilege, the Bill lays down the care with which such material should be treated under professional privilege. It is particularly important that the material is secured very safely, should anything from a journalist be held. Similarly for lawyers, material should secured very safely, and be seen by the fewest number of people possible. Anything that is not subsequently used in the investigation should be destroyed or returned and certainly not kept. That sort of safeguard should cover any journalist’s material, either under the Bill as it stands or as amended under Amendment 25.

The case has been made as to why it is so important to protect journalists’ sources. It encourages people to come forward to give what might be really important information to an independent source, who can then verify and publish it without the source’s identity being known. Sometimes, however, I have sympathy with people’s identity being known, when they are, for example, selling secrets they should not be to newspapers for large amounts of money. I am sorry that the noble Lord, Lord Black, was not here when we dealt with Amendment 18, as a number of newspapers have failed to work to implement Leveson. In discussion of what might constitute a journalist, perhaps anyone who works for a Leveson-compliant organisation, would be a good way of defining them. This might be the encouragement needed to bring that into being.

Guaranteeing anonymity has and always will be vital to the journalists’ profession, for the sake of those who go to them but also, as has just been mentioned, for the safety of journalists, literally hundreds of whom are killed around the world in the course of their duty. There can be little doubt that should some undesirable person or organisation think that a journalist who they have briefed or who has photographed or filmed them might hand that material over to the state, then that journalist becomes at risk. It is also essential that the use of powers that may affect journalists’ sources of information should be thought of being used only when there are exceptional and compelling reasons.

There will be times when journalists’ material gets scooped up, which is when it needs to be protected. More seriously, where journalists are being asked to hand over film or photographs, we share the desire that they should be fully protected, as outlined by the noble Viscount, Lord Colville. We hope that the Government have continued their discussion with the parties involved and we look forward to hearing an update.

[Earl Howe]

My Lords, this Government have been clear on their continuing commitment to protecting the free press and freedom of expression in this country. In the Commons and at Second Reading, we committed to looking at this issue further and ensuring that the balance of such protections was exactly right. I thank noble Lords for tabling this amendment and giving us the opportunity to continue this important debate. The Government have listened carefully to the debate on these issues so far, and have continued to discuss them with media organisations. I have met journalists and their representatives for a very informative discussion. This engagement has proved extremely useful all round, not least in resolving misunderstandings about the relevant safeguards provided in existing legislation.

In response, the Government tabled amendments in the House of Commons strengthening the protections in the Bill for journalists’ sources. The amendment passed on Report places an extremely strong test in the Bill where a public authority seeks to use communications data to identify or confirm a journalist’s source. This means that a judicial commissioner—that is, a serving or former high court judge—must first consider the public interest in protecting a source of journalistic information and then be satisfied that there is another, overriding public interest before approving an application.

In addition, the Government introduced a new overarching privacy clause which makes it explicit that public authorities exercising functions under the Bill must have regard, for instance, to whether what is sought to be achieved by any authorisation may reasonably be achieved by other less intrusive means. It also requires persons exercising functions under the Bill, including authorising police officers and judicial commissioners, to have regard to the public interest in the protection of privacy as well as numerous other principles that underpin the legislation. These amendments clearly spell out in the Bill some of the protections that journalists seek.

Of course, the Bill proceeds from the widely accepted position, endorsed by the Joint Committee on Human Rights, that,

“review by a judge or other independent and impartial decision-making body”,

is the most significant safeguard required to protect the confidentiality of a journalist’s source. The Bill introduces that safeguard across all warrants. It specifically provides for judicial approval of any authorisation to acquire communications data for the purpose of identifying or confirming a journalist’s source.

Amendment 25 would apply a standard set of protections across the different powers provided for in the Bill. While I commend the intention to strengthen protections, the Government do not consider this blanket approach to be the right one. The powers in the Bill are not the same; they vary both in the material that can be acquired and the level of intrusion that such an acquisition represents. That is why the Bill ensures that additional protections are applied where they are most appropriate, providing for judicial authorisation of the most intrusive powers and mandating the use of less intrusive powers where that is possible. Indeed, journalists have it made clear to me that, uniquely, they consider communications data to be at least as intrusive as content, since they allow a source to be identified. That is exactly why the Government have, also uniquely, provided for judicial authorisation of communications data requests to identify a journalist’s source.

This Government agree—indeed they forcefully advocate—that confidential journalistic material and journalists’ interaction with their sources must be protected, but that does not mean that a journalist should receive blanket protection from legitimate investigation simply because of their chosen profession. The Bill ensures that protections are applied where they are required, that those who commit a crime or pose a threat to national security can be investigated, regardless of their chosen profession, and it does so in a way which is compatible with all our ECHR obligations. I should be clear that the Bill already requires any authorisation to relate to a legitimate ECHR Article 10 aim, as part of the amendment demands.

Extending protections to all,

“activities relating to journalistic information”,

as the amendment seeks to do, brings real practical implications which the Government do not consider appropriate. For example, it is clear that the content of an interview conducted in public should not be subject to the same stringent protections as a dossier of private, undisclosed material passed by a source and held in confidence. That would render meaningless those protections which are appropriately applied to confidential journalistic material.

In addition, the amendment would mean that a journalist suspected of committing a crime could be investigated only in an emergency situation where immediate action was necessary and an order to use the powers in the Bill was obtained from a judge—that is, if the crime had already taken place and there was no immediate danger, the powers could not be used to bring that individual to justice, nor could they be used to prove that individual’s innocence. I suggest that that is the wrong approach, and that is without considering the question, which even the National Union of Journalists has admitted is extremely difficult, of defining who is and who is not a journalist in the digital age.

Finally, on the question of the key decision-maker in this process, the Bill upholds the important principle of judicial involvement. A number of bodies representing the journalist profession have argued that the only way to prevent the powers in the Bill being misused is to allow a journalist to be involved in the judicial commissioner’s decision. The Government do not agree.

Of course, our security and intelligence and law enforcement agencies will in very limited circumstances have a legitimate need to investigate a journalist or their source. Where a journalist is suspected of a crime, it is clearly not appropriate that they should be alerted to the investigation, but there is a fundamental consideration here: these powers are by their very nature covert. Requiring prior notification would undoubtedly undermine the key purpose of the powers, whose use in relation to journalists, we should be clear, is already extremely limited.

Instead, the Bill provides for a robust regime to govern the use of the powers, with a clear role for judicial commissioners in authorising and overseeing their use by public authorities. It also sets out the offences that apply in the event that any of the powers are misused and provides for a world-leading oversight regime, led again by senior and independent judicial figures. The Bill takes a reasoned, balanced approach—the right approach—to protecting the important role of the media in a democratic society. It applies protection where it is needed without unduly hampering our law enforcement and security and intelligence agencies when they truly require the use of the powers. It is on that basis that I invite the noble Viscount to withdraw his amendment.

The noble Lord, Lord Strasburger, asked about protection for whistleblowers. The Joint Committee that was convened to scrutinise the draft Bill recommended that it make it clear that members of the intelligence services can raise concerns about the misuse of investigatory powers with the Investigatory Powers Commissioner without being at risk of prosecution for breaching the Official Secrets Act—that was recommendation 61. The Government included Clause 203—now Clause 212—on the Bill’s introduction to the House of Commons to give effect to the committee’s recommendation. The Bill will allow an individual to provide information on a voluntary basis to the Investigatory Powers Commissioner without that individual committing a criminal offence or incurring civil liability. Of course, any use of these investigatory powers must be for one of the purposes specified in the Bill, such as the prevention or detection of a crime or in the interests of national security. They cannot be used simply to protect any organisation’s reputation.

Amendment 148 would apply protections designed to provide the appropriate safeguards for a specific power to entirely different circumstances. “Exceptional and compelling” is a phrase which relates to a very specific set of circumstances: those in which the Secretary of State is satisfied, and the judicial commissioner agrees, that it is necessary to issue a warrant where the intention is to acquire legally privileged communications. Such circumstances will arise only in a very restricted range of cases, such as where there is a threat to life or limb or in the interests of national security and the interception is reasonably regarded as likely to yield intelligence necessary to counter the threat.

The test which the Government introduced into Clause 73 in the other place relates to the acquiring of communications data to identify or confirm a journalist’s source. It requires the judicial commissioner to have regard to the public interest in protecting journalists’ sources and then to consider, as I explained earlier, that there is another overriding public interest before granting the request. I suggest that that is the appropriate test because it reflects the requirements of freedom of expression under Article 10 of the European Convention on Human Rights.

This amendment also seeks to apply the arrangements provided for in relation to material acquired under an interception warrant to the handling, retention, use and destruction of communications data. While I commend the intention of this element of the amendment, it is unnecessary as equivalent safeguards are already to be found in chapter 11 of the Draft Communications Data Code of Practice. This chapter provides significant detail on the handling arrangements for communications data, placing stringent safeguards around how it is held: for instance, restrictions on who may access the data and for what purposes; when the data may be disclosed; and that when it is no longer necessary or proportionate to hold the data, it must be destroyed. These are strong safeguards which provide the appropriate protections for data.

As I noted earlier, the Bill takes what I would contend to be a reasoned and balanced approach—the right approach—to protecting the important role of the media in our society. I hope that, on that basis, the noble Baroness will not press her amendment.