Investigatory Powers (Amendment) Bill [HL]

Baroness Manningham-Buller Excerpts

Report stage
Tuesday 23rd January 2024 Lords Chamber

[Lord West of Spithead (Lab)]

My Lords, I rise to speak to Amendments 2, 3 and 6. As I made clear in Committee, the Intelligence and Security Committee broadly welcomes the introduction of this legislation as a means of addressing significant changes to the threat and technological landscapes that have the potential to undermine the ability of our intelligence agencies to detect threats and protect our country. There are, however, several areas in which the Bill must be improved and, in particular, safeguards strengthened.

The draft codes of practice published by the Government contain indicative safeguards. This is not a substitute, however, for putting such provisions on the face of the Bill, which is essential if we are to ensure that those safeguards cannot be changed or diluted by subsequent Administrations. This is particularly important when we are discussing necessary scrutiny and oversight. The ISC is still, therefore, seeking amendments to several sections of the Bill.

It is important to remember that the Bill seeks an expansion of the investigatory powers available to the intelligence services. We consider that this expansion is warranted. Any increase in those powers, however, must be accompanied by a proportional increase in oversight. Sadly, the Government have previously been reluctant to ensure that democratic oversight keeps track of intelligence powers—particularly where it is related to the remit and resources of the ISC. This House has made its views on this long-standing failure known during debates on several recent Bills, and yet again in Committee on this Bill. The Government have so far refused to update the remit of the ISC or provide the necessary resources for its effective functioning, such that it has

“oversight of substantively all of central Government’s intelligence and security activities to be realised now and in the future”—

as was the commitment given by the then Security Minister during the passage of what became the Justice and Security Act.

The House of Lords made its views on this long-standing failure known in debates over several recent national security Bills, including what became the National Security and Investment Act, the Telecommunications (Security) Act and the National Security Act. Despite these repeated attempts by this House to ensure effective oversight, this has been ignored by the Government. The Government cannot continually expand and reinforce the powers and responsibilities of national security teams across departments, and not expand and reinforce parliamentary oversight of those teams as well. The committee expects the Government to take this opportunity to bolster the effective oversight it purports to value. It is therefore imperative that Parliament ensures that, in relation to this Bill, the role of the ISC and other external oversight bodies, such as IPCO, is well defined and immovable from the outset. Fine words in a code of practice are, I am afraid, hardly worth the paper they are written on. They must be written into statute.

On the detail of Amendment 2, as I have noted in my previous speeches, Section 226DA of the current Bill requires that each intelligence service provide an annual report to the Secretary of State detailing the individual bulk personal datasets it retained and examined under either a category authorisation or an individual authorisation during the period in question. My amendment would ensure that there was independent oversight of this information, rather than just political oversight, as at present. It would achieve this by providing that the annual report be sent also to the Intelligence and Security Committee of Parliament and the Investigatory Powers Commissioner.

IPCO does have a degree of oversight included in the Bill already, alongside its existing powers of inspection, but it is not full oversight. Further, there is currently no parliamentary oversight of category authorisations at all. This is not appropriate. My amendment will, therefore, enshrine within legislation that IPCO and the ISC will have oversight of the overall operation of this regime.

At this point, I acknowledge the amendment tabled by the Government. I thank the Minister for his engagement with the ISC; we have had some useful dialogue and I thank him very much for that. It is reassuring that there may finally be some recognition of the strength of feeling in this House that was apparent through noble Lords’ interventions at Second Reading and in Committee that the ISC must have a role in scrutinising this new regime.

However, what is not clear is why the Government chose to table their own amendment rather than accept the ISC’s amendment. Both amendments would seemingly provide the ISC with information on category authorisations that are granted or renewed in the given period. Without wishing to sound suspicious, I think the House requires an explanation as to what the Government see as the difference.

The first difference appears to be that the government amendment is less specific on the information to be provided and does not include individual authorisations within its scope. It therefore does not give the same level of assurance to Parliament and the public that the ISC is fully sighted on the operation of the regime.

The second difference is that the government amendment would seem to create more work for the intelligence community, as rather than simply sending the existing annual report to the ISC, a separate report would have to be produced instead. The Minister has been very keen to emphasise the need to minimise the burden on the agencies—we agree entirely with him; they are very busy—when it comes to other elements of the Bill, so it is most peculiar that the Government are deliberately choosing to increase the burden.

The third point I would note is that if the intention of this proposal is to carefully curate the information provided to the ISC regarding the Part 7A regime, it is rather undermined by the fact that the committee would still be able and willing to request a full report be provided to the Secretary of State, under the existing powers in the Justice and Security Act.

My fourth and final point is that the government amendment excludes the Investigatory Powers Commissioner. It is not clear why. IPCO and the ISC are both essential to oversight.

I trust noble Lords can recognise that, despite what I am sure are the Government’s best intentions, the ISC amendment provides the most robust assurance to Parliament and the public regarding oversight of the new regime, and the most streamlined mechanism for delivering this. I therefore urge the Minister and noble Lords to support this amendment to ensure that the robust safeguards and oversight mechanisms so carefully considered by Parliament in respect of the original legislation are not watered down by changes under this Bill. If investigatory powers are to be enhanced, so must oversight. This is what the ISC seeks to achieve by this amendment and those others that I have tabled.

I will touch very briefly on my noble friend Lord Coaker’s Amendment 5. I support it fully and I have raised those issues to do with the ISC.

On Amendment 6, this Intelligence and Security Committee amendment is required in order to close a 12-month gap in oversight. This relates to the new Part 7A, to be introduced by this Bill, which provides for a lighter-touch regulatory regime for the retention and examination of bulk personal datasets by the intelligence services where the subject of the data is deemed to have low or no reasonable expectation of privacy. Approval to use such a dataset may be sought either under a category authorisation, which encompasses a number of individual datasets that may be used for similar purpose, or by an individual authorisation, where the authorisation covers a single dataset that does not fall neatly within a category authorisation or is subject to other complicating factors.

In the case of the category authorisation, a judicial commissioner will approve the overall description of any category authorisation before it can be used. A judicial commissioner will also approve any renewal of category authorisation after 12 months, and the relevant Secretary of State will receive a retrospective annual report on the use of all category and individual authorisations.

However, as I highlighted in Committee, this oversight is all retrospective. What is currently missing from the regime is any form of real-time oversight. Under the current regime, once a category authorisation has been approved, the intelligence services then have the ability to add any individual datasets to that authorisation through internal processes alone, without any political or judicial oversight. They will be able to use those datasets for potentially up to a year without anyone being the wiser. This would mean relying on the good intentions of a particular intelligence service to spot and rectify any mission creep up until the 12-month marker for renewal. Although we have every faith in the good intentions of the intelligence services, no legislation should be dependent on the good will of its subjects to prevent misuse of the powers granted therein, particularly where those powers concern national security.

It is important that we fill that 12-month gap in oversight, and my amendment does so very simply by providing a new Section 226DAA in Clause 2, which would ensure that IPCO is notified whenever a new, individual bulk personal dataset is added by the agencies to an existing category authorisation. The Government’s primary argument against this proposal appears to be that it would be too onerous for the intelligence community and would impair its operational agility. I do not believe this is the case.

Notification would entail the agency sending a one-line email to the Investigatory Powers Commissioner containing the name and description of the specific bulk personal dataset as soon as reasonably practicable after the dataset was approved internally for retention and examination by that intelligence service. The amendment would not require that the use of the dataset be approved by the Investigatory Powers Commissioner, merely that the commissioner be notified that it had been included under the authorisation. It does not, therefore, create extra bureaucracy or process—certainly not in comparison with an entire new annual report, as the Government were proposing in relation to my previous amendment.

Crucially, this will provide for IPCO to have real-time information to enable it to identify any concerning activity or trends in advance of the 12-month renewal point. Any such activity could then be investigated by the commissioners as part of their usual inspections. Aside from the supposedly onerous burdens that these one-line emails will place on the agencies, the Government are also seeking to argue that the safeguards of the Bill are currently calibrated to the lowest level of intrusion associated with low or no expectation of privacy datasets and that it would therefore be inconsistent for the agencies to provide notification regarding category authorisations, given that they do not provide notification for datasets under the current Part 7 class warrant regime.

This argument is similarly unpersuasive. In the first instance, the light-touch nature of our amendment, requiring simple notification rather than approval, is already calibrated to the lower level of intrusion. However, the key point is that the agencies do not have the same powers under Part 7 and Part 7A. This new regime gives the agencies greater powers specifically to internally add individual datasets to those categories without external approval. This is not a power given under the current Part 7 regime. The ISC agrees that the agencies should have this power in relation to low or no reasonable expectation of privacy datasets. However, to rehearse this argument yet again, we should not be creating greater intrusive powers without data oversight. This is a new power that should not be available without some form of real-time external oversight, which is what my amendment provides.

This combination of real-time oversight through the notification stipulated in this amendment and retrospective oversight through the involvement of judicial and political oversight bodies, as set out in my previous amendment, is necessary to provide Parliament and the public the reassurance that data is being stored and examined in an appropriate manner by the intelligence services. The ISC believes that this amendment strikes the right balance between protecting the operational agility of the intelligence services, which remains very important to us, and safeguarding personal data. I therefore urge noble Lords to support my amendment.

[Baroness Manningham-Buller (CB)]

My Lords, first, I apologise. Like the noble Lord, Lord West, who during Committee had a bionic knee, I may not last, because I had a new one installed a couple of weeks ago. My eyes turned to the noble Lord, Lord Fox, as he possibly expected, but I am out of reach today and I cannot hit him with my crutch.

It might help the House if I described the circumstances in which an emergency warrant is sought. There is a very long-standing system for this. In the days before we had judicial commissioners, it was if a Minister was unavailable, and now it is if the Minister and, of course, the judicial overseers decide that a warrant sought is wrong or inappropriate, all the material is destroyed.

At the earlier stage, I said that you cannot legislate to forget, but the noble Lord, Lord Fox, has slightly twisted what I was trying to say then. Of course, if the material is destroyed because the warrant was not approved, some people will remember what they read, but it cannot be used in any way.

These occasions occur nearly always at times when people are unavailable—in the middle of the night or at weekends—when there is a brief window of opportunity where it is a matter of life and death. I can see that, on the surface, it is appealing to bring the notification time down to 24 hours, but this is not rational or consistent with the rest of the legislation that we have. For far more intrusive techniques such as planting a microphone or intercepting a communication, it is three days. That said, I know that my former colleagues will endeavour to do it as soon as possible, but over the weekend the Investigatory Powers Commissioner’s Office is not open. People are not available. They will try to do it as soon as possible, but it does not make sense to reduce the time needed in these cases of low intrusion, with datasets of no or low expectation of privacy, to require a stricter regime than for very much more intrusive techniques such as the planting of a microphone in your house.