Investigatory Powers Bill (Second sitting)

Christian Matheson Excerpts

Thursday 24th March 2016 Public Bill Committees

[The Chair]

We clearly have two excellent witnesses here, and I am sure that many colleagues will want to ask questions. Who is trying to catch my eye? Would Mr Matheson like to ask a question?

[Christian Matheson (City of Chester) (Lab)]

Q I remind the Committee that Mr McClure is known to me, as he is my constituent.

Good afternoon, Mr McClure. The case of your nephew obviously involved a criminal offence and was clearly terrorist-related. There have been suggestions, and we have heard evidence as a Committee, that the failure was not necessarily one of electronic intelligence, but of human intelligence and a lack of resources, because the security services were already aware of the then suspects—the people convicted of your nephew’s murder. How do you react to that?

Ray McClure: It is a bit of both, to be honest. The report by the Government into Lee’s murder, “Report on the intelligence relating to the murder of Fusilier Lee Rigby”, highlighted failings in the intelligence services and their processes. I do not know personally whether the recommendations have all been implemented, but I have got to assume that they have been, because they were taken very seriously.

Also, the report highlighted other major failings. The ones that caused me the greatest concern were those where the warrants issued by the UK Government were not complied with by American internet companies. [Interruption.] Sorry, I am going to pick up my notes. The report made it absolutely clear that the attack by the two murderers of Lee was planned on the internet; they made contact with people on the internet. Yes, opportunities were missed, but internet service providers failed to review any suspicious contacts and they did not obey UK warrants—they went out of their way to obstruct UK warrant providers.

Paragraph 401 says

“some overseas CSPs do not comply with UK RIPA warrants, as they do not consider themselves bound by UK legislation.”

That is a failure not of the security services, but of those other people—the internet service providers. Paragraph 457 says:

“The number of different forms of communication now available presents the Agencies with significant challenges in terms of their ability to detect and prevent terrorist threats”.

If the internet companies are not co-operating with the intelligence services, there is a big hole there—a big gap that needs to be plugged.

“CSPs based in the US have, for the most part, refused to recognise UK legislation requiring them to provide the content of communications on their networks: they do not consider themselves to be bound by the legal obligations set out in RIPA”—

warrants, etc.

To me, this is a big hole—a big issue. Being somebody from an IT background, I was horrified at some of the stuff I was reading. These companies—Apple, Facebook, Google, Microsoft, Twitter, etc.—are companies that we grew to respect, but the actions that they are undertaking now in not supporting the security and intelligence services, the forces of law and order, to prevent crimes like what happened to Lee, leave a big hole that has to be plugged.

[Christian Matheson]

Q You talk about the lack of co-operation from some of these large corporations based outside the UK. When considering your own investigations and inquiries surrounding the murder of your nephew, have you seen any evidence that that is quite a common trait?

Ray McClure: That is a good question. Yes, I have. I can give two very clear examples. One example is Microsoft, which has been fighting a warrant issued by the US Government to gain access to a drug dealer’s emails. It claims that, because the emails are not held on US territory, the US Government cannot have access to them. The emails are actually held in the cloud, and their physical location is in Ireland. Microsoft claims that the emails are a customer’s personal documents and that, because they are outside the US’s jurisdiction, the US Government and US law-enforcement agencies cannot access them.

That raises a big question mark. Today, when you send an email, you do not know where the physical data will be held—it is held somewhere in the cloud, but you do not know where. That creates a problem for all security and law-enforcement forces. Where does the jurisdiction lie for gaining access to that data? It is a black hole. It is wrong. Microsoft’s actions are protecting the drug dealer, not helping law enforcement.

The biggest concern right now—it is a very hot topic—is Apple’s stance over the San Bernardino terrorist. He killed 14 people, yet Apple refuses to co-operate with the FBI and allow it to access the data on his iPhone, which might help the police identify his accomplices. That is protecting terrorists, not helping law and order. Quite frankly, I am at a loss as to why the IT companies are so opposed and why they are fighting law and order as they are doing. It is wrong.

[Christian Matheson]

Q Looking at the specific provisions in the Bill, as far as you have been able to check them, are you satisfied that your concerns have been addressed, or was there something else that you were specifically looking for?

Ray McClure: I do not believe that this Bill is adding new powers to the police and the security forces; I think that it is clarifying the existing powers and bringing them together. It makes it a lot clearer where responsibility lies in obtaining warrants and what the powers are. I think that bringing that clarity is a major step forward. Yes, I am happy, and I urge you all to support the Bill. My only concern—it is a personal concern—is that, frankly, I would prefer warrants to be authorised by the judiciary, not by politicians, such as the Home Secretary, but that is my personal opinion; it is down to you guys to make the laws.

Can I make one other point about Apple and Microsoft? These companies are building solutions that we use every day. Let us be honest: these phones that we use today are brilliant, with the address book and everything else. But to make that a no-go area for law enforcement is wrong. There should be no such thing as a no-go area for law enforcement. If you cannot enforce the law, you have a situation in which you are protecting evil, and when you protect evil, evil will thrive, and that is wrong.

[The Chair]

Thank you, Mr McClure. We have so many colleagues who want to ask you questions.

Ray McClure: Sorry, Sir.

--- Later in debate ---

[Mr Hayes]

Q Presumably you also welcome the right to review a technical capability notice and the commitment that there will be further discussion with you before you are obliged to meet obligations.

Mark Hughes: Yes, indeed, and not only that, but there is now on the face of the Bill a right of appeal to the Home Secretary if a notice is issued to us and we disagree with it. That has not existed in the past. In the past, under other legislation, we have had occasion to make representation, but it is much clearer in this Bill than it has been in the past.

[Christian Matheson]

Q Under the terms of the Bill, you are being asked to collect a large amount of data, some of which will be quite personal and some private. How confident are you of BT’s capability in terms of maintaining the security of those data from hacking or theft, particularly bearing in mind the fact that other communications service providers have been hacked into? When you consider the rest of the industry more broadly—without naming names—do you think BT is in a stronger position than other CSPs to maintain security against hacking or theft where there might be vulnerabilities elsewhere?

Mark Hughes: The security of any data we hold and retain is clearly a matter that we take extremely seriously. That is of the utmost seriousness for our organisation for any type of data. The type of data that the Bill refers to specifically is, though, perhaps different from other types of data that need to be interfacing the public on a bigger scale, for example. This is not that type of data; it is going to be restricted and allowed to be viewed by only very few individuals who have the correct authority to be able to get to the data when they need to.

The level of security applied to this type of data is clearly factored into the type of data that is being retained, so we have to put very significant security measures around it to ensure that the access is controlled properly and that the data are very secure when stored. That absolutely has to be factored into the cost and the way we operate. It is not something new. We are currently subject to laws and regulations under which we have to make sensitive data available, so we are used to doing it, but that clearly has to be factor in for, for example, some of the new datasets we are potentially going to be asked to retain under the Bill.

[Matt Warman (Boston and Skegness) (Con)]

Q On the Joint Committee on the draft Bill and on the Science and Technology Committee, we heard CSPs talking about the level of engagement they have had from the Home Office, and we have heard from the Home Office that that has increased recently. That seems to tally with what you are saying. Could you give us a sense of the scale and extent of that engagement, and some reassurance that, in this fast-moving world, you are confident that the relationship is such that that engagement would be there in future as well, rather than it just being about getting the Bill to this stage?

Mark Hughes: We have had extensive periods of consultation and meetings on a very frequent basis. The Home Secretary has invited many of us representatives of the CSP community to meetings with her on two occasions before this, as well as to many working-level meetings with various Home Office officials. We discussed the technical, legal and procedural points about the proposed legislation as well, which is markedly different from how things have been before.

On the point about the future, which is important here, the Bill itself clearly specifies and puts in place a regime whereby consultation is enshrined in the legislation through the consultation process that has to happen before a notice is issued and, indeed, because the reconstituted technical advisory board can be called to come together at any time. That power did not exist in the past. The consultation is in a better place and I think that the Bill itself will help to ensure that that continues in future, because it will be a point of law.

--- Later in debate ---

[The Chair]

With the permission of the Committee, I might suspend the sitting for 10 minutes at 10 minutes to 4 to allow people to have a quick break, because this is quite a long sitting. Is that with the permission of the Committee? Brilliant.

[Christian Matheson]

Q I have two questions. Mr Astley, there are two opposing schools of thought relating to this Bill. There are those of us who recognise the need to update the legislation as it is to provide protection for children against sexual abuse and to provide protection against terrorism, terrorist atrocities and terrorist threats, and at the far end of the scale are those who believe that there is an absolute right to privacy and that no price is worth paying to imperil that privacy.

The job of Parliament is to find the correct balance on the scale between those two extremes. I do not think it would be too difficult to find justification, for example, for the protection of children against sexual abuse or for the defence of the realm against foreign threats and foreign terrorists. Justify to the Committee, if you will, the use of some of these powers, limited though they are in the Bill, for offences at the lower end of the scale.

Mark Astley: From a local authority perspective, they are a small user of telecommunications data. It has never been abused or misused from a local authority perspective, but they investigate some quite serious crimes. We had a particular case of advance-fee fraud, which was worth £7.5 million.

If you look at the majority of the applications that local authorities make, an extremely high percentage in the last two years—96%—was purely for subscriber data, or what is currently known as “c data”. That is the basic information about the subscriber to a telecommunication service and sometimes that is the key information that investigators need. An example would be someone who is trafficking illegal tobacco and the shopkeepers they are speaking with only have a telephone number for the delivery person. Therefore, in order for people to investigate successfully, which they have the powers to do—provided by Parliament—it is important that they have that access.

[Christian Matheson]

Q Let me ask you then, finally, why in that case, if a crime is sufficiently serious, can the involvement of the police not take over the requirements for access to electronic communications data, as opposed to, for example, your members?

Mark Astley: Yes. As I have previously mentioned, our members are very highly trained; they are commensurate in some respects to what the police investigate. But they deal with their local community on a more local basis and they have the powers and expert knowledge, in particular about rogue traders, about illicit tobacco and about counterfeit items. They have that experience.

[Christian Matheson]

Q You could still handle those investigations and deal with them, but when it was apparent that they are of a sufficiently serious nature you can involve the police, who are then able to make the applications on your behalf, so you would not need access under the terms of the Bill.

Mark Astley: It is a valid point, but I believe that the powers are there for the trading standards, who do a really good job, and they have done an excellent job so far in dealing with high-level crime.

[The Solicitor General]

Q In the last year for which records are available, which I think is 2015, about half a million applications for access to comms data were made. About 0.4% of those were local authority applications.

Mark Astley: That is correct.

Investigatory Powers Bill (First sitting)

Christian Matheson Excerpts

Thursday 24th March 2016 Public Bill Committees

[Lucy Frazer (South East Cambridgeshire) (Con)]

David Anderson was my pupil master when I was a barrister.

[Christian Matheson (City of Chester) (Lab)]

I do not know this witness, Chair, but Mr McClure, a witnesses this afternoon, is my constituent and is known to me personally.

[Byron Davies (Gower) (Con)]

I was a member of some of the agencies that will attend today.

--- Later in debate ---

[Suella Fernandes]

Q Evidence was given to the Joint Committee by Sir Stanley Burnton, the Interception of Communications Commissioner, and Lord Judge, the Chief Surveillance Commissioner. Both said that the double lock involves an intensive analysis including analyses of necessity and proportionality. It is not simply rubber-stamping. Again, do you maintain your disagreement with those senior judges?

Sara Ogilvie: I respect and agree with the fact that an extent of necessity and proportionality analysis will be done, but there is still very limited capacity for judges and judicial commissioners to undertake this exercise. We have seen, and judicial review case law tells us, what level of scrutiny can be applied to different kinds of decision, and we know that where a decision does not involve a restriction on the physical liberty of an individual, a lesser scale of judicial review scrutiny will be applied.

We also know that where cases involve national security, judges must apply a lesser level of review. Although I recognise that there is a difference of views, I think it needs to be much clearer in the legislation. Judicial review should be avoided as a standard in this circumstance.

[Christian Matheson]

Q I will ask only one question. Mr King, you talked about the astonishing amount and huge volumes of data that are collected. Can you both comment on the statement that the sheer volume of information means that there is less of a threat to personal privacy, simply because individuals’ personal data are almost swamped within the mass of data collected?

Eric King: It is an interesting idea, isn’t it, that the more widespread the intrusion, the less potentially bad it is. That is not a view that I can understand myself, particularly now. Computer analytics of such material is going to increase. It is going to get better and faster. The more data being collected, the more intrusion will be applied year on year as GCHQ engineers find cheaper, better and faster ways to process it. Perhaps five years ago, swamping agencies with material might have resulted in people passing through, but every day, that becomes less likely and less real.

We have seen in the last five years a 7,000% increase inside GCHQ of the analytical capability on material. That means that 7,000% more material is being touched, analysed and scrutinised by those agencies. Perhaps it was an idea that could be comprehended 20 years ago, when it involved physical piles of paper that no one ever looked at, but now it is all being automated, and I am not sure that the notion stands up today.

Sara Ogilvie: I clearly agree with what Eric has said. The only thing I would add is that I ask you to consider the fact that we are not just concerned about the state having this information. All this information that is stored somewhere can be accessed by other individuals for nefarious purposes. We have seen the TalkTalk hacks this year. We have seen the VTech hacks. There are real and legitimate concerns about the way this vast amount of personal information can be used, not just by the state but by other people who really do wish to do us harm.

[The Chair]

Can we keep questions and answers as brief as possible to get everybody in, please?

Investigatory Powers Bill

Christian Matheson Excerpts

Tuesday 15th March 2016 Commons Chamber

[Mrs May]

Although one person will oversee the Investigatory Powers Commission as the Investigatory Powers Commissioner, they will have under them a number of judicial commissioners who will have extensive experience and will undertake certain tasks—first, on the new process of the double-lock authorisation for warrantry that we are introducing. They will also undertake the inspection and review of the operation of the agencies in the same way that the three commissioners have done so far. Far from reducing oversight, this Bill will enhance the oversight that is available.

The pre-legislative scrutiny that the Bill has undergone builds on the previous work of the Intelligence and Security Committee in its “Privacy and Security” report; the independent inquiry into surveillance practices by a panel convened by the Royal United Services Institute; and the review of investigatory powers carried out by David Anderson QC, the independent reviewer of terrorism legislation. All three reviews made it clear that legislation relating to interception and communications data needed to be consolidated and made subject to clear and robust privacy safeguards. Taken together, the scrutiny that this Bill has received may well be without precedent. Three authoritative reports informed the Bill’s drafting, three influential Committees of Parliament then scrutinised that draft, and now the Bill proceeds to full and proper consideration by both Houses of Parliament.

The Bill will provide world-leading legislation setting out in detail the powers available to the police and the security and intelligence services to gather and access communications and communications data. It will provide unparalleled openness and transparency about our investigatory powers, create the strongest safeguards, and establish a rigorous oversight regime.

As the House is aware, the Data Retention and Investigatory Powers Act 2014, which the Bill is intended to replace, contains a sunset clause requiring us to pass legislation by the end of 2016. That is the timetable set by Parliament, and the grave threats we face make it imperative that we do so. Today terrorists and criminals are operating online with a reach and scale that never existed before. They are exploiting the technological benefits of the modern age for their own twisted ends, and they will continue to do so for as long as it gives them a perceived advantage. We must ensure that those charged with keeping us safe are able to keep pace. The Bill will provide the police and the security intelligence agencies with the powers they need, set against important new privacy protections and safeguards. It will ensure that they can continue in their tremendous work, which so often goes unreported and unrecognised, to protect the people of this country from those who mean us harm.

I turn now to the contents of the Bill. In its scrutiny of the draft Bill, the Intelligence and Security Committee quite rightly concluded that

“privacy protections should form the backbone”

of legislation in this most sensitive area. That is indeed the case, and privacy is hardwired into the Bill. It strictly limits the public authorities that can use investigatory powers, imposes high thresholds for the use of the most intrusive powers, and sets out in more detail than ever before the safeguards that apply to material obtained under these powers. The Bill starts with a presumption of privacy, and it asserts the privacy of a communication. Part 1 provides for an offence of unlawful interception, so that phone tapping without a warrant will be punishable by a custodial sentence, a fine, or both. It creates a new offence of knowingly or recklessly obtaining communications data without lawful authorisation, so misuse of those powers by the police or other public authorities will lead to severe penalties. It abolishes other powers to obtain communications data. Subject to limited exceptions, such as court orders, public authorities will in future be able to obtain communications data only through the powers in the Bill, with all the accompanying safeguards.

[Christian Matheson (City of Chester) (Lab)]

We know that internet service providers and telecoms companies are vulnerable to hacking, and that some newspapers are not averse to passing brown envelopes to their sources in order to obtain information. Is the Home Secretary satisfied that the provisions in the legislation will prevent such hacking and such unauthorised, and perhaps salacious, access to individuals’ personal information?

[Mrs May]

As I have just said, the Bill sets out new, enhanced safeguards and oversight arrangements for the investigatory powers that are available to the authorities. As the hon. Gentleman will be aware, inappropriate access to information that is held has been the subject of court cases recently. It is entirely right that if information is being accessed in a criminal fashion, that should be dealt with in the appropriate way. I have just set out that there are new offences in the Bill to deal with the question of people obtaining, knowingly or recklessly, communications data without lawful authorisation.

Return of Kings

Christian Matheson Excerpts

Thursday 4th February 2016 Commons Chamber

[Karen Bradley]

My hon. Friend will understand that I cannot comment on individual cases, but I agree that it is much better to exclude than to deal with such people when they are here. This Home Secretary has excluded more foreign national offenders and foreign nationals than any other.

[Christian Matheson (City of Chester) (Lab)]

I can see no possible benefit from this individual being allowed into the UK now or in the future, so may I add my voice to those of hon. Members who say that, although we understand that the Minister cannot comment on individual cases, we hope that very soon she will be able to do so by saying that this person is excluded permanently from the UK? She cannot talk about operational police matters; is there a general steer that she would hope to give to the police as to their response to this matter?

[Karen Bradley]

I am sure the hon. Gentleman’s comments will have been heard. I have the Police Minister sitting next to me and he has also heard the hon. Gentleman’s comments.

Serious and Organised Crime: Prüm Convention

Christian Matheson Excerpts

Tuesday 8th December 2015 Commons Chamber

[Mr Rees-Mogg]

My hon. Friend is right. The Danish question is one of the greatest importance. Denmark had a referendum, having trusted their people, which I believe we may be doing at some point. But of course we are not trusting them on this measure, because it is instrumental to catching terrorists, and the people cannot be trusted to decide whether they want to do that or not. No, this must be done by the Government after a three-hour debate—though lucky us to get even a three-hour debate. Last year we did not get a debate on the European arrest warrant. We had it on something else.

[Christian Matheson (City of Chester) (Lab)]

The hon. Gentleman appears to be suggesting that we have a series of bilateral agreements with 20-something EU member states, but is that not essentially what is being done tonight, albeit in a more efficient way?

[Mr Rees-Mogg]

The hon. Gentleman is only partly right—a bit of a curate’s egg, if I may say so, but it is regrettably rotten in parts. If the agreement is done in this way, it comes under the competence of the European Court of Justice and infraction proceedings can be brought by the European Commission. Why is that important? I accept that protections are built into Prüm, and that there are limits on the application of what the ECJ can do, but it needs to be seen as part of a whole package. We are agreeing today that the investigatory function in relation to data held by Governments should be centralised at a European level. We agreed a year ago that the arrest function should be centralised with a European competence. So we have investigation, we have arrest, and we have a proposal from the European Commission for a European public prosecutor—so far, resisted, but this measure was resisted a year ago, and the European arrest warrant was not Conservative party policy until a year ago.

I wonder whether the hon. Gentleman sees where I am going. This is part of a package of creating a European criminal justice system. It comes one by one and bit by bit. On every occasion, the measure is said to be essential and we are told that there is no opportunity of doing it differently, but if there is no opportunity of doing it differently, why is my right hon. Friend the Prime Minister racing around European capitals trying to organise a renegotiation? If there is never any other possibility, is that not banging our head against a brick wall? Surely we should be saying—the Government intimated this a year ago, but there has been no delivery at all—that we will make the European arrest warrant and all that goes with it part of the renegotiation. We would go back to the status quo ante—where we were prior to the Lisbon treaty: that we do these things on an intergovernmental basis.

My right hon. Friend the Member for Stone—I am sorry, I mean hon. Friend; he ought to be right honourable; it is extraordinary that Her Majesty has not yet asked him to join the Privy Council—pointed me in the direction of Denmark. Denmark has said no. Denmark will want to make arrangements with fellow European Union states to exchange data with their friends and allies, and we could make arrangements with our friends and allies to exchange data and do all the sensible things of which everyone in this House is in favour. It is the right thing for us to do, but it is better than that. If we did it on an intergovernmental basis we might decide that there are some EU member states whose criminal justice systems are not up to it. That is an important point. My hon. Friend the Member for South Dorset (Richard Drax) referred to his constituent and the disgraceful way in which he was treated in a country where we do not have the same confidence in the criminal justice processes that we have in, for example, Germany and France, or, for that matter, the United States and Canada. Such an arrangement would give us greater flexibility, and there are a number of ways in which it could be done. We could have intergovernmental agreements with the European Union as a body. The EU has legal personality, so it is possible to do it on that basis, but maintain control and keep the rights that we enjoy, and stop the rush—that is perhaps an exaggeration, as the last debate was a year ago, but it is a rush in European terms—to establish a single criminal justice system.

It is worrying that a Government who portray themselves in election campaigns, propaganda and statements as Eurosceptic, when it comes to the details of what they are doing, turn out to think that the answer is more Europe. They then say that this has to be done because we are in danger if we do not do it. The only reason we are in danger is that we assume that the EU and its member states are not rational in their dealings with us, so we must always give in to them. One of the greatest Prime Ministers that this country ever saw, William Pitt, said:

“Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.”

This argument is dependent on the necessity. I do not wish this Government to be tyrannical, nor do I wish to be a slave.