(7 years, 10 months ago)
Lords ChamberMy Lords, the amendment is in my name and that of my noble friend Lady Hamwee. I shall speak also to all the other amendments in this group, Amendments 203B to 203D, 204A to 204F, 205A, 208A to 208C, 209A, 210A and 210B, 215A, 217A and 218A. The sole effect of all the amendments would be to remove from the Bill the power to engage in bulk equipment interference.
This is a new power for the security and intelligence agencies to carry out equipment interference in bulk overseas. It is not a power they currently have and, according to David Anderson QC, it is not something that they currently do. As a result, David Anderson said in his review of bulk powers that the operational case for bulk equipment interference was “not yet proven”. The noble Lord, Lord Murphy, has said:
“The case for bulk equipment interference was less strong, but nevertheless still there”.—[Official Report, 7/9/2016; col. 1049.]
As the noble Lord, Lord Rosser, said in Committee, there is a difference between an operational case, let alone an unproven one, and proportionality or desirability. Quoting Mr Anderson, he pointed out that Mr Anderson assessed only the operational cases in his review, saying that the issues of proportionality and necessity were a matter for Parliament—which is why we are debating these amendments today.
We heard in earlier debates about the potentially broad scope of targeted equipment interference warrants. They can specify all equipment used by anyone in a particular organisation or more than one organisation involved in a single investigation or operation; all equipment used by members of a group with a common purpose or engaged in a particular activity; equipment in a particular location or more than one location for the purpose of a single investigation or operation; and equipment being used or that may be used for a particular activity or activities. That is all contained in Clause 108.
Although I realise that the primary focus of this House should be to protect the citizens of this country, I ask noble Lords to consider how they would feel if overseas Governments took our lead and enacted similar legislation that could be deployed against the UK and its citizens. UK citizens’ communications could be acquired through the use of bulk equipment interference warrants if they communicated with others based overseas.
In paragraph 7.37 of his report into bulk powers, David Anderson QC warns that considerable caution is required for a series of reasons. He concludes in paragraph 7.38:
“All this means that bulk EI will require, to an even greater extent than the other powers subject to review, the most rigorous scrutiny not only by the Secretary of State but by the Judicial Commissioners who must approve its use and by the IPC which will have oversight of its consequences”.
It is the nearest David Anderson comes to expressing an opinion on necessity and proportionality and, reading between the lines, it is clear that he is not keen.
For those reasons—and as the Intelligence and Security Committee initially recommended, although it was subsequently persuaded—we believe that bulk equipment interference warrants should be removed from the Bill. I beg to move.
My Lords, these amendments would remove the bulk equipment interference provisions from the Bill. Before I address the amendments specifically, it is worth pausing to reflect briefly on the importance of bulk powers in the round and the very significant steps that the Government have taken to ensure both that a robust operational case has been made for their necessity and that the most rigorous safeguards will apply to their use.
Extremely detailed and extensive scrutiny has been applied to bulk powers during the passage of the Bill, both in Parliament and, of course, by David Anderson QC as part of his bulk powers review. The conclusion of that review was that bulk powers,
“have a clear operational purpose”;
that they,
“play an important part in identifying, understanding and averting threats in Great Britain, Northern Ireland and further afield”;
and that where alternatives exist to their use,
“they were likely to produce less comprehensive intelligence and were often more dangerous (for example to agents and their handlers), more resource-intensive, more intrusive or—crucially—slower”.
The Government have now tabled amendments giving full effect to the sole recommendation of that review, establishing in statute a Technology Advisory Panel to the Investigatory Powers Commissioner. We have also accepted an amendment tabled by the Intelligence and Security Committee which introduces a specific offence in the Bill to address deliberate misuse of the bulk powers. We have addressed wider concerns of that committee by adding very significant detail to the Bill on the safeguards that will regulate the use of these powers. I am grateful for the intensive scrutiny that has been applied to the bulk provisions in the Bill and believe that those provisions are all the stronger for it. There should now be no question that these powers are necessary and they are subject to world-leading safeguards.
I can certainly tell the noble Lord that Yahoo! was one of the operators, but I do not have a list to hand.
My Lords, Amendment 250A would define a technical capability notice as,
“specifying the distinct service or product to which the notice applies”.
I do not believe this amendment is necessary. The safeguards that apply to the giving of a notice under the Bill already ensure that a technical capability notice cannot be of a generic nature. I will not go into detail here about the lengthy process that must be undertaken before a notice can be given; we have discussed them at length previously and we will undoubtedly review them again shortly during our discussions on encryption. But it might be helpful for me to summarise.
Before giving a notice, the Secretary of State must consult the company concerned. This process will ensure that the company is fully aware of which services the notice applies to. The decision to issue a notice must be approved by the Secretary of State and a judicial commissioner. The obligations set out in the notice must be clear so that the Secretary of State and judicial commissioner can take a view as to the necessity and proportionality of the conduct required. As I have already mentioned, we propose a similar role for the judicial commissioner when a notice is varied. The operator may raise any concerns about the requirements to be set out in the notice, including any lack of clarity regarding their scope, during the consultation process. The operator may also seek a formal review of their obligations, as provided for in Clause 233. The safeguards which apply to the giving of a notice have been strengthened during the Bill’s passage through Parliament, and will ensure that the regime provided for under the Bill will be more targeted than that under existing legislation. It is for these reasons that I consider the amendment unnecessary.
Amendment 251A seeks to narrow the category of operators to whom a technical capability notice could be given. This change would exclude operators that provide services that have a communications element but are not primarily a communication service. This amendment, which has already been discussed in the Commons, is also unnecessary and, in my view, risks dangerously limiting the capabilities of law enforcement and the security and intelligence agencies. We are aware that the manner in which criminals and terrorists communicate is diversifying, as they attempt to find new ways to evade detection. We cannot be in a situation where terrorists, paedophiles and other criminals can use technology to escape justice. As David Anderson said,
“no-go areas for law enforcement should be minimised as far as possible, whether in the physical or the digital world”.
It is important that the Government can continue to impose obligations relating to technical capabilities on a range of operators to ensure that law enforcement and the security and intelligence agencies can access, in a timely manner, communications of criminals and terrorists using less conventional services, such as those offered by gaming service providers and online marketplaces. It may be appropriate to exclude certain categories of operators from obligations under this clause, such as small businesses, but it is our intention to use secondary legislation to do so. It would not be appropriate to impose blanket exemptions on services that have a communications element but are primarily not a communication service, since to do so would make it clear to terrorists and criminals that communications over such systems could not be monitored.
For all the reasons I have set out, I hope that the noble Lord, Lord Paddick, will feel able to withdraw his amendment.
With the leave of the House, I am grateful to the noble Lord for raising that point, which I think will come up in the next group of amendments when we discuss encryption because it is centre stage in that issue. He is absolutely right and I hope that I can assuage his concerns in the next debate.
I am very grateful to the Minister, particularly for his explanation around Amendment 251A. I completely accept that the whole range of ways in which people can communicate potentially needs to be covered. I am encouraged by the fact that there may be some exceptions in secondary legislation. It is unfortunate that we do not have sight of that before I withdraw this amendment but life is like that.
Bearing in mind the fact that the Minister did not articulate any downside to Amendment 250A, I wonder why the Government will not accept it, given that it appears not to limit the Government’s action in any way. However, at this stage, I beg leave to withdraw the amendment.
(7 years, 10 months ago)
Lords ChamberMy Lords, Amendment 131A seeks to provide in the Bill for an investigatory powers commission in addition to a commissioner. I listened with care to the noble Lord, Lord Paddick, and I understand how strongly he feels about this issue. The Government have been clear throughout the passage of the Bill that the Investigatory Powers Commissioner will lead a powerful new body—the noble Lord and I are, I think, in agreement on that principle. However, the Government have been equally clear that there is no need to create that body in statute. Our principal reason for adhering to that view is that doing so would not confer any new powers, duties or responsibilities on those working for the commissioner, nor would it affect their ability to audit, inspect and oversee public authorities.
I am the first to recognise the importance of public perception. However, as to whether it would benefit public perception to create a commission, I cannot see what advantages an anonymous quango holds over a senior, independent judge. The oversight and authorisation of investigatory powers are vital tasks that need to be performed and need to be performed well. Therefore, in my submission, it is right that an identifiable individual is ultimately responsible for them.
It is the difference between having a person with a public face and a body that risks being seen by the public as faceless. Since the oversight powers and duties are ultimately placed on the Investigatory Powers Commissioner, we logically expect that commissioner to be the public face of the body. It is the commissioner who will be called on to lead the public debate on these issues and to give his or her expert and considered legal view on the matters in the Bill. If, for example, someone receives a notification of an error under Clause 209, or if a report is made under Clause 212, it is better that such communications should come from a senior, named judicial figure rather than a faceless organisation.
Of course, it is necessarily the case that the commissioner will rely on the work of an extensive staff of expert inspectors and advisers. Again, though, I argue that that does not necessitate the creation of a commission in statute. When an inspector walks into a public authority, the fact that they are an employee of an investigatory powers commission would not give them any greater powers than if they are a representative of the Investigatory Powers Commissioner. I agree with one element of what the noble Lord, Lord Paddick, said: it is right that, in such circumstances, those employees should wield appropriate authority. The Government have listened to concerns expressed on this point and tabled amendments, which we will come to later, to make clear that the commissioners can delegate powers under the Bill to their staff. That will make absolutely clear that when the experts and inspectors employed by the commissioner go about their work, they do so with the full force of the commissioner behind them.
Moreover, creating a new body in statute would require the establishment of a board to run that body, complete with at least three non-executive directors. I was grateful to the noble Baroness, Lady Hayter, for her remarks on this point. In the eyes of many, this would muddy the waters of accountability and introduce considerable new bureaucracy into the work of the commissioner. It is much better that the commissioner’s resources and attention should be focused on overseeing the work of public authorities and providing public assurance, rather than on servicing a burgeoning bureaucracy.
Can the Minister reassure me that the circumstances that the Intelligence Services Commissioner found himself in—that is, with one of his investigators effectively being excluded when he was involved in investigating what the intelligence services knew prior to the murder of Fusilier Lee Rigby —could not happen in the absence of a body corporate being set up, as this amendment suggests? There are concerns that people in the security services might not acknowledge the authority of the inspectors if it is not the case.
I fully believe that the amendments we have tabled will give inspectors the authority that is equivalent to that of a judicial commissioner. Although I was not aware of the case that the noble Lord cites, I think the government amendments will put the situation beyond doubt, if ever there was any. I do not believe that the problem the noble Lord refers to has ever impacted more widely on the ability of inspectors to do the job that is required of them; I like to hope that that was a one-off problem. However, with the benefit of the government amendments, it simply should not be an issue.
I hope I have reassured the noble Lord. Certainly, we cannot overlook the point that the creation of a new body would come at significant financial cost that would be of no gain in terms of public reassurance or effective oversight. As I have argued, it might risk making the oversight regime less clear. For a bunch of reasons, I hope the noble Lord will feel comfortable in reconsidering his amendment.
I am very grateful to the Minister. I am not sure that he is entirely reassured that the government amendments will deal with this issue, but I accept that that is because he did not have sight of my example prior to the debate. I regret not giving him notice that I would be bringing it up. However, given all the circumstances, I beg leave to withdraw the amendment.
(7 years, 10 months ago)
Lords ChamberMy Lords, I feel that I have to begin by saying to the noble Lord, Lord Paddick, that he has got this one wrong—indeed, very wrong. I am grateful to the noble Lord, Lord Carlile, the noble Viscount, Lord Brookeborough, my noble friend Lady Harding and the noble Lord, Lord Rosser, for the contributions that they have made.
The amendments seek to remove Clauses 64, 65 and 66 from the Bill, which provide that the Secretary of State may establish, maintain and operate filtering arrangements for communications data—colloquially referred to as the “request filter”—and detail the appropriate safeguards and restrictions around its use. Throughout the passage of the Bill we have repeatedly highlighted the many misconceptions and misrepresentations around the filtering arrangements, and we have demonstrated how the provisions in fact provide an important safeguard in the acquisition of communications data. It is therefore perplexing that the noble Lord, Lord Paddick, has given notice that he remains opposed to the clauses providing for the filtering arrangements to stand part of the Bill. It may therefore be helpful if I set out again what the filtering arrangements will actually do and not do.
Public authorities currently need to receive all the communications data disclosed by communications service providers in response to specific requests. In certain circumstances this amounts to more data—sometimes much more data—than are relevant to their investigation, and they will then need to determine which specific pieces of communications data are relevant. Perhaps I could illustrate with an example. The police may need to make a complex query, such as asking multiple communications service providers for data to identify an unknown person who is suspected of having committed a crime, such as armed robbery, at three different places at different times. Currently, public authorities might approach communications service providers for location data to identify all the mobile phones used in those three locations at the relevant times to determine whether a particular phone and a particular individual is linked to the three offences. This means that the public authority may acquire a significant amount of data relating to people who are not of interest but who just happened to be in the location at the time of the robbery.
The significance of the request filter is that, when a police force makes such a request, they will see only the data that they need to. Any irrelevant data about people who are not suspects will be deleted and not made available to the public authority. That is why I maintain that the filter acts as a vital safeguard, protecting privacy by ensuring that the police see only the data they need to. These amendments would remove that important safeguard—so it is perplexing, as I say, that the noble Lord wishes to do this.
To further reassure the House, I remind noble Lords of what the Joint Scrutiny Committee on the draft Bill stated about the filtering arrangements. It stated:
“We welcome the Government’s proposal to build and operate a Request Filter to reduce the amount of potentially intrusive data that is made available to applicants”.
The Joint Committee believed that the requirement upon law enforcement to state the operational purpose of accessing data through the filter and the oversight of the Investigatory Powers Commissioner will ensure the appropriate use of the filter.
The noble Lord, Lord Paddick, said that the Bill provided for unfettered access to private and confidential information. But access is not unfettered—and nor does the Bill permit fishing expeditions, as the noble Lord, Lord Carlile, rightly emphasised. The filtering arrangements can operate only in response to a specific, necessary and proportionate authorisation for the acquisition of communications data. That request must already have gone through all the existing communications data safeguards, such as authorisation by a designated senior officer of a rank specified by Parliament, who must be independent of the investigation.
I noted with some dismay the aspersions cast by the noble Lord on the likely integrity of those individuals actually retrieving the data—including, to my surprise, the integrity of the police. I am pretty shocked by the language that he used. The noble Lord also described the filter as a “database”. A database has to contain data. The filter will not hold any communications data. Once a request has been processed by the filter, any data—that is to say, all data—will be discarded. I hope that that does clear some of the fog.
The request filter will act as an important safeguard. It will ensure that police officers and others will see only the information they really need to in those cases where it is used. Accordingly, I respectfully request that the noble Lord, Lord Paddick, withdraws his amendment.
I thank the Minister for his remarks, and other noble Lords who have contributed. I acknowledge the great experience of my noble friend Lord Carlile of Berriew both as a lawyer and as a former Independent Reviewer of Terrorism Legislation. However, it is clearly untrue for him to say that, in his judgment, excluding the request filter from the Bill would reduce the capacity of the authorities to investigate cases. The request filter does not exist at the moment, so it cannot possibly reduce the capacity. It may restrict the capacity of the agencies in the future, but it will certainly not reduce it, because the authorities do not have a request filter at the moment. The “monster” that I alluded to is nothing other than the mechanism—the request filter—that these clauses and this amendment are all about.
My noble friend described two murder cases where convictions could not have happened were it not for the sort of data that we are talking about here. Those two convictions were obtained in the absence of a request filter, because the filter does not exist. So it is clearly nonsense for my noble friend to say that excluding the request filter from the Bill was likely to have impacted on convictions that relied on something that does not even exist at the moment.
I acknowledge the experience of the noble Viscount, Lord Brookeborough, in Northern Ireland. As the Minister said, this is not a database. It is not intelligence information that is gathered and stored. It is a mechanism—a piece of kit, if you will—that reaches out into databases held by private companies, such as the internet service provider led by the noble Baroness, Lady Harding of Winscombe, retrieves data and brings it back. As the noble Earl said, it is not about a real database but a virtual or federated one. In other words, the tool will effectively act as a database rather than being an actual one. I am sorry that, in the number of times that I have used this expression—at Second Reading, in Committee and now on Report—I have not been able to get my message across about the difference between a virtual database and a real one. But I think that it is time I stopped flogging that horse.
The noble Lord, Lord Rosser, is reassured that Clause 2, the overarching privacy clause, applies to every power in the Bill. This is not a power: it is a piece of kit, a search engine. The Government have said nothing in their response to this amendment to reassure us that Clause 2 applies to this, because it is not actually a power. The Minister used the example which I spoke to, almost exactly, when I moved the amendment. To use his word, it is “perplexing” that the noble Earl did not hear my objections to that as a good example.
The unfettered access that I am talking about is not unfettered access to data by the police and the security services, and I never suggested that it was—but there will be unfettered access by those who operate the request filter because the request filter will have direct access to the databases operated by the communications providers. So I am not saying that there would be unfettered access to data by the police and security services; what I am saying is that government officials, or those acting on behalf of the Secretary of State, would have unfettered access to these databases were the request filter to come into existence. So I, too, am perplexed that the Government have not responded positively to this amendment and I wish to test the opinion of the House.
(7 years, 12 months ago)
Lords ChamberMy Lords, I will speak to our Amendments 218A, 218B, 219A, 223A and 223D, and question whether Clauses 185 and 186 should stand part of the Bill. The purpose of Amendments 218A and 218B, and of the question whether Clauses 185 and 186 should stand part of the Bill, is to ensure that each bulk personal dataset is separately authorised by the Secretary of State and a judicial commissioner, and to exclude class bulk personal dataset warrants. It is our intention not to disallow specific bulk dataset warrants, but to remove class bulk personal dataset warrants from the Bill.
Both the Joint Committee on the Bill and the Intelligence and Security Committee recommended that class bulk personal datasets should be removed from the Bill, yet they remain part of it. The Intelligence and Security Committee reported that the acquisition, retention and examination of any bulk personal dataset is sufficiently intrusive that it should require a specific warrant. I accept what the noble Earl said on working with the ISC to try to meet it half way by adding these additional safeguards, but we maintain that it still does not go far enough, because bulk personal datasets containing private information on a large number of people are of no relevant or legitimate interest to the agencies.
I appreciate that the amendments we have proposed do not make every amendment necessary to completely remove the provision of class bulk personal datasets from the Bill, but at this stage we believe it is sufficient to raise the point of principle. I ask the Minister to justify going against the recommendations of the Joint Committee and the ISC.
Amendment 219A is an amendment to government Amendment 219. It would require the head of the intelligence service to consult the judicial commissioner when deciding whether the nature of a bulk personal dataset acquired through a class bulk personal dataset warrant requires a separate warrant. It would require consultation with the judicial commissioner where there is a sense from the head of the security services that a particular bulk personal dataset requires separate authorisation.
Amendment 223A relates to Clause 186(6), which states that a separate warrant is not required to retain and examine a bulk personal dataset that may reasonably be regarded as a replacement for a bulk personal dataset for which a warrant already exists—for example, the latest edition of the electoral roll. The amendment would exempt from this automatic authority for a replacement dataset—
It may be for the convenience of the Committee to appreciate, as I understand it, that the noble Lord would like to put this group with the group that I think was originally separated out; that is, the group beginning with government Amendment 221. Is it his wish that we should deal with everything comprehensively in one go or shall we split the groups as originally proposed?
I do apologise; perhaps I have an out of date list. It would be helpful if we could deal with all these matters together if that is possible. The noble Earl indicates that it is and I am grateful.
Amendment 223A refers to Clause 186(6), which states that a separate warrant is not required to retain and examine a bulk personal dataset that may reasonably be regarded as a replacement for an updated bulk personal dataset for which a warrant already exists. The amendment seeks to exempt from this automatic authority a replacement dataset which contains new and additional information that was not included in the original bulk dataset. For example, if a new electoral roll was to contain the email addresses of voters as a new category of information, a new warrant would be required even though it might be considered a replacement for a bulk personal dataset that was already in existence.
Amendment 223C refers to Clause 187 and the definition of “health record” under subsection (6)(c). It states that a,
“‘health record’ means a record, or a copy of a record, which … was obtained by the intelligence service from a health professional”.
Should this not be “would be obtained” to cover the situation where the authority to obtain the record was not given? Whether something is a health record or not should not depend on whether it has or has not been obtained by the intelligence service.
Amendment 223D requires that the judicial commissioner who approves bulk personal dataset warrants, in addition to those matters contained in Clause 188(1)(a), should also consider in the case of health records the additional safeguards set out in Clause 187(3); that is, that there are “exceptional and compelling circumstances”. Following on from our previous amendment, we would say exceptional and compelling,
“circumstances ‘relating to national security’”.
My Lords, given that we are grouping everything together in the way we have agreed, perhaps it would be appropriate if I complete my remarks on the government amendments before addressing the noble Lord’s amendments. The amendments that I have not yet spoken to are government Amendments 221 and 222. These are related to and consequential on the government amendments introducing restrictions on the use of class warrants that I have already spoken to. They are part of a set of amendments that honour the Government’s commitments in the other place that we should provide further restrictions on the use of class BPD warrants. Amendments 221 and 222 amend Clause 186, which makes provision for specific BPD warrants. In particular, Amendment 221 adds to the circumstances in which an agency may apply for a specific BPD warrant the situation in which it is prevented from relying on a class BPD warrant by the new clause placing restrictions on the use of those warrants that we debated earlier. Amendment 222 builds on this by placing an obligation on the agency in such circumstances to include an explanation of why it cannot rely on a class BPD warrant in its application for a specific BPD warrant. These amendments thus ensure that the provisions in the Bill setting out the circumstances in which class and specific BPD warrants should be used will operate coherently together. These amendments thus also respond to the constructive engagements we have had with the ISC and the other place.
Turning to the amendments of the noble Lord, Lord Paddick, I understand that the intention behind Amendments 219A and 218B and the stand part debate is to remove the provisions allowing for class BPD warrants. Perhaps it is worth reminding ourselves that class BPD warrants provide an appropriate means of authorising the retention and use of datasets that are similar both in nature and in the level of intrusion that their retention and use would result in. This would, for example, allow the Secretary of State to authorise a class of dataset relating to travel covering datasets that are similar in nature but refer to different travel routes, or perhaps where they were provided by different sources. The decision to issue a warrant for a particular class of data would be subject to approval by a judicial commissioner before being issued.
Removing class warrants would increase bureaucracy without increasing safeguards. It is also unnecessary because such warrants are subject to the “double lock” authorisation process by a Secretary of State and judicial commissioner. If they considered that a class bulk personal dataset warrant was too broad, they would not issue it.
It is quite true that the ISC and the Joint Committee which scrutinised the draft Bill did not endorse class BPD warrants in their original reports on the draft Bill, but the ISC’s view on this has changed. As the chair of the ISC said at Third Reading of the Bill in the other place,
“we then had further evidence—as has happened in the dialogue with the Government and the agencies—in particular from the Secret Intelligence Service, about the rationale for retaining class warrants in the Bill. In particular, the evidence highlighted the fact that many of these datasets covered the same information or type of information. In those circumstances, we considered that a class warrant would be appropriate, as the privacy considerations were identical”.—[Official Report, Commons, 7/6/16; col. 1063.]
He then made additional comments on restrictions on their use. The Government accepted in principle the ISC’s arguments for restrictions on the use of class BPD warrants, and we have already discussed amendments brought forward by the Government to reflect this. So I hope that, on reflection, the noble Lord will want to think further about those amendments that seek to excise class BPD warrants.
Amendment 219A adds to Amendment 219—the government new clause on restricting use of class bulk personal dataset warrants—that the judicial commissioner must be consulted before a decision is taken. This is an unnecessary amendment. The Secretary of State and judicial commissioner double lock will apply not only to new class and specific BPD warrants, but also to renewals of both types of warrants. This gives them effective oversight of the datasets that appear under each type of warrant. These decisions will also be subject to retrospective oversight by the Investigatory Powers Commissioner. To add another pre-consultation is not necessary or efficient. Moreover, the draft code of practice includes detailed guidance on when a specific BPD warrant should be sought. It also makes it clear, for example, that if required in an individual case, the security and intelligence agency can seek guidance from the Secretary of State or a judicial commissioner on whether it would be appropriate for a specific BPD warrant to be sought. So again, I hope that the noble Lord will want to reflect further on that amendment.
Amendment 223A would restrict the extent to which a specific BPD warrant could extend to replacement datasets. In effect, it would mean that only absolutely identical datasets could be covered by these provisions. The provision for a replacement dataset would be relevant only where a specific BPD warrant has been authorised and is already in place. The provision is a pragmatic and sensible approach to situations where a dataset is regularly or continually updated; for example, a particular dataset may be updated weekly or monthly. These updates would, by definition, include additional information, but in these cases the necessity and proportionality case and operational purposes would not alter. To require repeated new warrants in this scenario would not be proportionate; the notion of a replacement dataset allows the agencies to use these amended and updated data in line with the existing authorisation. Again, I hope the noble Lord will find that acceptable.
(7 years, 12 months ago)
Lords ChamberMy Lords, I shall speak also to Amendments 198, 207, 208, 213, 214, 227, 228 and 223, all of which relate to operational purposes on bulk warrants.
The amendments tabled by the Government add significant detail to the provisions in the Bill on operational purposes—that is, the purposes for which data collected under a bulk warrant may be selected for examination. Operational purposes are an important new safeguard and we are committed to ensuring that the Bill includes as much detail as possible about how they will operate in practice. These amendments respond to amendments tabled in the House of Commons by the Intelligence and Security Committee, and they address concerns raised during the Committee stage in the Commons that operational purposes could be “general”.
The amendments would do a number of key things. They would create a requirement that the heads of the intelligence services must maintain a list of all operational purposes. The maintenance of this list would ensure that the security and intelligence agencies are able to assess and review all the operational purposes that are, or could be, specified across the full range of their bulk warrants at a particular time. This would ensure that these purposes remain up to date and relevant to the current threat picture, better enabling the agencies to identify warrants that need to be modified, adding or removing operational purposes. The maintenance of the central list would also make sure that the Investigatory Powers Commissioner is able to oversee, in one place, the full range of purposes for which a bulk warrant could authorise the examination of material.
The amendments would apply robust controls to the addition of an operational purpose to the central list, requiring that any such addition must be approved by the Secretary of State. They make clear that the Secretary of State may approve the addition of an operational purpose to that list only if satisfied that it contains more detail than the statutory grounds on which the warrant was issued, such as in the interests of national security.
The amendments would also enhance the oversight and transparency of the use of operational purposes. As well as the rigorous independent oversight that the Investigatory Powers Commissioner will apply to the exercise of bulk powers, these amendments would also require the following: that the list of operational purposes must be reviewed annually by the Prime Minister; that the list must be provided to the Intelligence and Security Committee every three months; and that the Investigatory Powers Commissioner must publish a summary of the use of operational purposes in each of his or her annual reports.
The amendments would also take out references in the Bill to operational purposes being able to be “general purposes”. This provision was inserted in the Bill to ensure that operational purposes do not have to be drawn so tightly that they are operationally unworkable. While it has never been the case that this language meant operational purposes could be vague or lacking in detail, the Government have listened to concerns that this language could be misinterpreted and that is why these amendments would remove it.
These amendments would significantly enhance the Bill’s provisions on operational purposes, adding absolute clarity as to how this important safeguard will operate in practice. I hope that the Committee will approve them. I beg to move.
My Lords, I am very grateful to the Minister for those amendments. They bring a significant improvement to the Bill and are extremely welcome. We were faced previously with the situation in which operational purposes were to be part of the Bill but we would never know what those operational purposes were. I appreciate that they are not going to become public knowledge, but at least we will now have a review by the Intelligence and Security Committee every three months and the annual review by the Prime Minister as well. Removal of the term “general” is greatly reassuring and we wholeheartedly support these amendments.
My Lords, Amendments 201ZA, 210ZB, 217A and 231ZA seek to insert a provision into the clauses that enable the modification of bulk interception, acquisition, equipment interference or bulk personal dataset warrants. The amendments would require that persons who can make a minor modification to remove an operational purpose from a warrant must keep under review the operational purposes on each bulk warrant. The intended effect of these amendments, as I understand it, is that such persons will be aware when one of those purposes is no longer necessary and can remove it from the warrant.
These amendments are not necessary because the relevant draft codes of practice, which were published when the Bill was introduced to Parliament, already make clear that the security and intelligence agencies must keep bulk warrants under ongoing review. In addition, the draft codes set out specific requirements in relation to operational purposes. This includes a requirement that the security and intelligence agencies will need to ensure that bulk warrants are relevant to the current threat picture and will therefore need to identify operational purposes that need to be added to or removed from bulk warrants.
Further to the requirements in the draft codes, the government amendments, as I explained earlier, would create a requirement in the Bill that the heads of the intelligence services must maintain a list of all operational purposes. I set out the rationale and utility of that list in the preceding group of amendments. The provisions in the Bill and the detailed requirements set out in the draft codes of practice already make clear that the operational purposes on any bulk warrant will be kept under review. This will ensure that where an operational purpose is no longer necessary on a particular warrant it can be identified and removed. I hope the noble Lord will feel able to withdraw these amendments.
Amendments 201ZB, 210ZC, 217B and 231ZB make a modification to remove an operational purpose from a bulk warrant a major modification. Currently, a modification removing an operational purpose is a minor modification, meaning that it may be made by a Secretary of State or a senior official acting on their behalf. This amendment intends that such a modification would instead be subject to the double lock and must therefore be made by a Secretary of State and approved by a judicial commissioner before taking effect. That would be entirely unnecessary. A modification removing an operational purpose from a bulk warrant reduces the scope of the conduct that the warrant authorises, conduct that will already have been approved by the Secretary of State and a judicial commissioner. Subjecting such a modification to the double lock is superfluous. Accordingly, I invite the noble Lord to withdraw these amendments.
Amendments 201ZC and 217C relate to the modification of bulk warrants for the purpose of allowing examination of material after acquisition has ceased. These amendments would remove important technical provisions from the Bill. The Bill enables a bulk interception or bulk equipment interference warrant to be modified such that it no longer authorises the acquisition of any material but continues to authorise the selection of material for examination. This provision caters for limited circumstances where it may no longer be necessary or possible to continue the collection of data, such as where a communications service provider who is providing assistance in giving effect to the warrant goes out of business but where the data collected up to that point remain pertinent. In such circumstances, it may continue to be necessary and proportionate to examine data that have already been collected under the warrant.
The subsections that these amendments would remove simply clarify that a warrant that has been modified in this way remains a valid bulk warrant in spite of the provisions in Clauses 127(2) and 162(1). This is necessary because these clauses state that one of the conditions of the warrant is that its main purpose is to acquire data, but, of course, a warrant that has been modified in the manner I have described will no longer meet this condition, given that it will no longer authorise the collection of data. I hope the noble Lord will agree that these provisions are necessary and recognise that they serve only to reduce the activity that would have been authorised by the original unmodified warrant.
On Amendment 201ZJ, Clause 142 prohibits the selection for examination of intercepted content using criteria referable to an individual known to be in the British Islands, except where a targeted examination warrant—subject to the double lock—has been issued. I hope it is helpful if I draw the noble Lord’s attention to Clause 142(5), because there is one additional exception to this prohibition. That subsection addresses cases where there is a change of circumstances such that a person whose content is being selected for examination enters, or is discovered to be in, the British Islands. The subsection provides that selection for examination may continue in these circumstances for five working days with the approval of a senior official. This is vital to cater for circumstances such as where a member of an organised crime group travels into the British Islands. Any selection for examination after the five-day period will require the issuing of a targeted examination warrant.
I hope and believe that that explanation addresses the query the noble Lord, Lord Paddick, put to me. I understand his amendment as intended to capture the set of circumstances I just outlined, but it would also lead to a diminution in safeguards, given that it would enable selection for examination to continue for what I would judge to be an unnecessarily long period—in the absence of a targeted examination warrant—where there is a change of circumstances and someone has entered or is discovered to be in the UK. I hope that explanation will allow the noble Lord to feel comfortable in not pressing this amendment.
I am very grateful to the noble Earl for those explanations. Regarding Amendments 201ZA and that group, I am still concerned that the Minister or senior official is reliant on the security services flagging up to them that they need to withdraw operational purpose or even cancel a warrant. It is trusting the head of the intelligence services to flag that up. I will read very carefully what the noble Earl said about that.
I am grateful for his confirmation of when a bulk interception warrant is not a bulk interception warrant but still is. The only difference between us was that I asked whether it was right that analysis needs to continue after content is not being added to, whereas the correct term was “examination” continues. I think we are on all fours as far as that is concerned.
On Amendment 201ZJ, I accept that if there is a change in circumstances, whether a foreign terrorist or a foreign criminal arrives in the UK, the switch is not immediately flipped in that a five-day grace period is provided by Clause 142(5) for that content to continue to be allowed to be selected, even though the person is in the British Islands. However, it seems an unnecessary hurdle for the security services to have to apply for a targeted examination warrant in those circumstances, if it is a known terrorist coming into the UK. Presumably the five days are simply to allow enough time for a targeted examination warrant to be applied for, but I illiberally suggest that that is unnecessary bureaucracy for the security and intelligence services to go through. However, if the Government, the Home Office and others are content for the intelligence and security services to jump through that particular hoop, who am I to argue? On that basis, I beg leave to withdraw the amendment.
(7 years, 12 months ago)
Lords ChamberMy Lords, Amendment 191 is in my name and that of my noble friend Lady Hamwee. It would insert a new clause after Clause 206 requiring the Investigatory Powers Commissioner to notify those who have been subject to the powers contained within the Bill, as set out in Clause 205(1) to 205(3), once the operation against them is complete or the warrant is cancelled. There are various conditions for notification and the ability to postpone notification in certain circumstances following discussion with the person to whom the warrant is addressed.
Citizens are entitled to the protection of the law but, as the Bill is drafted, it is impossible to challenge the Government and the use of state instruments of interference in people’s private lives if they have no idea that they have been the subject of surveillance. To quote the briefing provided by Liberty, if a person’s Article 8 rights—to a private and family life—and other Human Rights Act rights have been engaged and potentially violated,
“in order to have access to an effective remedy, as required under human rights law, the person must first be made aware of a possible breach”.
Cases in 1978 and 2006 before the European Court of Human Rights upheld this view. In 2007, the court went further and said that,
“as soon as notification can be made without jeopardising the purpose of the surveillance after its termination, information should be provided to the persons concerned”.
Post-event notification is already in place in some form in Germany, Belgium and the state of California in the United States of America.
There must of course be safeguards and these are built into the amendment, allowing the Investigatory Powers Commissioner to postpone notification if he assesses that it might defeat the purposes of an ongoing serious crime investigation or national security operation, after consultation with the body that issued the warrant. The right honourable Theresa May, the Prime Minister, repeatedly stated when she was Home Secretary that this is world-leading legislation. If that is the case, let us be radical and implement this amendment. I beg to move.
My Lords, as the noble Lord explained, Amendment 191 would insert a new clause that would see subjects of the lawful and proper use of investigatory powers notified of that fact.
There are a number of problems with that proposition, both in principle and from a practical perspective. First, let me be clear that I agree with the principle that where a serious error has occurred in the use of the investigatory powers, the commissioner should be able to inform a person affected. Clause 198(1) makes this absolutely clear.
However, I do not agree with the principle that, as a matter of course, anyone subject to the lawful use of an investigatory power must be notified, unless it would damage an ongoing serious crime or national security investigation. A principle of that kind would mean, for example, that we would need to notify suspected criminals and terrorists that they have been under investigation just because a specific ongoing investigation had stalled or, indeed, had concluded with evidence of wrongdoing but with insufficient evidence to bring a prosecution.
As noble Lords will know, suspected criminals and terrorists will often appear on the radar of the police and the security services at different times in the context of different investigations. It would clearly not be appropriate to inform them that investigatory powers had been used against them in a particular case as this could prompt them to change how they behave or communicate, which could hamper a future investigation. This is particularly important in relation to national security because this amendment would require the commissioner to make the subject of interest aware of,
“the conduct that has taken place”.
That would not just run contrary to the long-standing policy of successive Governments of neither confirming nor denying any specific activity by the security and intelligence agencies, but would essentially require the techniques the agencies use in specific cases to be made public. That would clearly assist terrorists in their operations, allowing them to stay one step ahead of the agencies.
Beyond the principled objections to this amendment, there would be numerous practical problems. It would not be practical, for example, for the commissioner to make everyone whose data were subject to a data retention notice aware of that fact. For example, he would have to require the relevant telecommunications operator to provide him with a list of all relevant customers, and it would have to inform him every time a new customer joined its service. It would not be difficult for criminals to use that process to identify services that they could use to avoid detection.
Equally, I suggest to the noble Lord that it would put unreasonable burdens on all public authorities covered by this Bill to require them constantly to need to make a case to the commissioner as to whether it would hamper national security or serious crime investigations if subjects were told that investigatory powers had been used against them. It would surely be better for the police to spend time and money on investigating criminals, rather than on determining whether individuals should be informed about perfectly lawful investigative activity.
Furthermore, in the context of bulk warrants under parts 6 and 7, the public authority or commissioner would need to examine all the data collected under the warrant to identify the individuals whose data have been collected. That would not only be impractical, but data would be looked at that otherwise there would have been no need to examine. This new clause would therefore actually lead to greater intrusions into privacy than would otherwise be necessary, which I am sure cannot be the intention.
I submit to the noble Lord that the proposed amendment is at best unnecessary and at worst threatens fatally to undermine the work of law enforcement and the security and intelligence agencies.
Let us be clear what the effect would be. It is not innocent, ordinary, law-abiding people who would be notified, because the agencies do not seek or obtain warrants against such people; it is suspected criminals and terrorist suspects. They would then change their behaviour, and we would have less chance of bringing them to justice. That point lies at the nub of the argument I have put to the noble Lord. I am sure that cannot be his intention, so I hope he will consider it the right thing to do to reflect on this point between now and Report, and withdraw the amendment at this stage.
My Lords, I shall briefly respond to the points that have been made. I am grateful to the noble Lord, Lord Beith, for amplifying the case that his noble friend made in introducing the amendment. In the end, we come back to the point that the noble Lord, Lord Carlile, has just articulated. We are talking here about the proper, legitimate use of the powers that the Bill contains, with robust oversight and mechanisms for redress built in, and the Investigatory Powers Commissioner is indeed an important safeguard in that context.
We are absolutely on board with the proposition that where an innocent person has been completely wrongly subject to the use of the investigatory powers—that is, where a serious error has occurred—there is no argument that that person should be informed. However, I submit that one cannot talk in the abstract about someone who has been “wrongly investigated”, which I think was the phrase used by the noble Lord, Lord Beith. You can be wrongly investigated if you are completely innocent, but you can also be wrongly investigated if there is perhaps not enough to pin on you as the culprit in a particular case but you might nevertheless, subject to further evidence, be implicated in a serious crime or a threat to national security. So we have to be clear about our terms in this context.
I come back to the fact that there are issues of principle and practice here that make this particular amendment unworkable. I also take on board the very good point made by the noble and learned Lord, Lord Hope, that it is not just an individual who could react to the news that they had been investigated in a way that would frustrate law enforcement agencies or intelligence services but a whole group of people. That in turn could affect national security, or indeed the conduct of criminals, much more widely.
I am grateful to the Minister and to other noble Lords who have contributed to this short debate. I was heartened when the Minister started to say that he could see in principle what the amendment was driving at and therefore the merit of it to that extent. He then gave a lot of practical reasons why it would not work in practice. I have to say that I found a lot of those unconvincing, particularly when you look at the wording of the amendment and the fact that:
“The Investigatory Powers Commissioner may postpone the notification … if the Commissioner assesses that notification may defeat the purposes of an ongoing serious crime or national security operation or investigation”—
which would cover the point made by the noble and learned Lord, Lord Hope. Presumably the police and security services would know that this individual was part of a wider network and therefore would not inform that individual—at least, not at that stage.
So I think we are on to something here in principle, although I accept the practical difficulties that the Minister pointed out. We need to go back and rethink the amendment to address the practical problems that he highlighted and see whether we can allay his fears at Report. But, at this point, I beg leave to withdraw the amendment.
(8 years, 1 month ago)
Lords ChamberMy Lords, as the noble Lord, Lord Paddick, has explained, these three amendments all deal with the issue of third-party data. Amendment 116 seeks to prevent public authorities from acquiring third-party data, Amendment 154 seeks to put the Government’s commitment not to require retention of third-party data on to the face of the Bill and Amendment 235 seeks to amend the definition of communications data to exclude from it third-party data.
On the acquisition of third-party data, the Bill maintains the existing position under RIPA that public authorities can acquire third-party data where necessary and proportionate to do so. But I want to be clear here—a provider is required to comply with a request for communications data, including a request for third-party data, only where it is reasonably practicable for them to do so. It is absolutely right that, where a communications service provider holds, or is able to obtain, communications data, whether in relation to its own services or those provided by a third party, then the data should be available to public authorities for the statutory purposes in the Bill. Put simply, data that already exist, are already held and which could save a life, convict a criminal, prevent a terrorist attack or provide an alibi, should not be put out of reach of law enforcement based solely on which company it is that holds the information.
Amendment 154 deals with the retention of third-party data. As I am sure the noble Lord knows, this matter was considered in the Commons, where the Government gave a commitment to consider it further. I am grateful to the noble Lord and the noble Baroness for tabling this amendment and giving me an opportunity to update the Committee on those considerations. My right honourable friend the Home Secretary has given a clear commitment that we will not require a telecommunications operator to retain third-party data, and that commitment is given effect to in the Communications Data Draft Code of Practice. However, distilling that commitment into primary legislative drafting is complex. We do not want to include provisions in the Bill that are not entirely clear in scope or which put in place restrictions that are broader, or indeed narrower, than intended. But we have been making good progress and are close to a provision that we think achieves the desired outcome. Of course, we need to test that drafting with operational stakeholders and with those telecommunications operators likely to be affected by the legislation, but we hope to be able to return to this issue on Report.
Finally, on Amendment 235, the principle of what are communications data is clear. Changing that position so that the classification of data changes depending on which provider holds them would no doubt cause confusion among providers as to how the data should be handled. While I understand the concerns around third-party data, and hope that what I have said today lays some of those to rest, amending the definition of communications data is not the right way forward. I invite the noble Lord to withdraw Amendment 116.
I am grateful to the Minister for his explanation and am encouraged by the promise of government amendments on Report. I have to say that I am still a little confused. The former Home Secretary, in her commitment, said that third-party data of telecommunications operators from abroad would not be required to be retained by UK telecoms operators. If the third-party data are of a different UK telecoms operator, surely the Secretary of State can make an order to get the data from that operator. But I will read carefully in Hansard what the Minister has said. As he has made a commitment, we will come back to this on Report. For the moment I beg leave to withdraw the amendment.
My Lords, in moving Amendment 124 I shall speak also to Amendment 127. We consider the requirement for an authorising officer to be independent of the operation or investigation being worked on an important safeguard and intend the exceptions to be drawn as narrowly as possible. That is why we welcomed the Intelligence and Security Committee amendments on this in the House of Commons and why we have tabled these amendments, which fully reflect the substance of the ISC’s intention and more narrowly define the national security exceptions. I beg to move.
My Lords, my noble friend Lady Hamwee and I have Amendment 126 in this group. It attempts to challenge the fact that the size of the relevant public authority, which may make it difficult to find a senior officer independent of the investigation to which the authorisation relates, makes it an exceptional circumstance, which it would be if the Bill is accepted as drafted.
My Lords, Amendment 126, as the noble Lord, Lord Paddick, has just explained, concerns the independence of the authorising officer. As I mentioned a moment ago, the Bill provides for a very limited set of circumstances in which the designated senior officer need not be independent of the investigation or operation; for example, where delays in locating an independent officer may pose a threat to life, or in specific cases where the interests of national security prevent it. As we have heard, the intention behind the amendment is to ensure that an authorising officer is always, without any exceptions, independent of the investigation. I beg the noble Lord’s pardon.
I am grateful to the noble Earl for giving way. We entirely accept that some public authorities will be so small, or some investigations so important, that there cannot be someone independent of the investigation who can give the authority. As the Bill is drafted, however, simply the size of the public authority is seen as an exceptional circumstance. It is not an exceptional circumstance and the amendment attempts to allow the size of the authority to be a reason why an independent senior officer cannot give the authority without making it an exceptional circumstance.
I am very grateful to the noble Lord. He is right: in some small public authorities there will be only a small number of staff sufficiently senior to take on this important responsibility. Where he and I part company is over the question of whether the rank of the designated senior officer should be lowered to ensure that there are sufficient numbers of them to always be independent of the investigation. I do not feel able to agree to that, because to do so would lower the safeguards that form an integral part of the communications data regime. Equally, I am afraid the Government are not prepared to remove these powers from some of the smaller authorities. They may be small, but they often do vital work in keeping the public safe and investigating crime.
I would be happy to discuss this further outside the forum of Committee, if that would help the noble Lord. I understand where he is coming from, but we have a fundamental disagreement of view on this.
I would just add that we do not disagree that a public authority may be so small that there is no independent senior officer who can grant the authority; the problem is whether that situation would amount to an exceptional circumstance. However, I would be very happy to discuss that situation with the noble Earl between now and Report.
My Lords, Amendments 146 and 147 in this group are also in my name and the name of my noble friend Lady Hamwee. Much concern has been expressed about the number of public authorities that can intrude into people’s privacy, and as a result, restrictions have been put in the Bill. If the Bill is enacted there will be fewer public bodies with that ability, and that is to be welcomed. We therefore do not think it is right that under Clause 67 the Secretary of State should be allowed by regulation to add a public authority. Amendment 145 would delete this power from Clause 67(2)(a) and Amendment 146 would make a similar change to subsection (3).
Amendment 147 would impose a duty on the Secretary of State to consult representatives of local authorities—for example, the Local Government Association—if she intends to make regulations to change a local authority-designated senior officer to someone of lower office, rank or position, in addition to consulting each of the local authorities concerned, as set out in Clause 69(5). I beg to move.
My Lords, these amendments all concern the public authorities that are able to acquire communications data. I should take this opportunity to mention a document which we published last week and which is available in the Printed Paper Office: Operational Case for the Use of Communications Data by Public Authorities. It sets out why it is essential that the authorities listed in Schedule 4 to the Bill are able to acquire communications data. It is important to recognise that the crimes they investigate are not trivial. They include offences such as bribery and corruption, defrauding vulnerable people of their life savings, stealing sensitive personal information and supplying dangerous counterfeit medicines. That document is pertinent to this group of amendments, because Amendments 145 and 146 would remove the ability of the Secretary of State to add public authorities to Schedule 4 by regulations.
I recognise the well-intentioned purpose of the amendments. However, it is not something that the Government can support because it goes against our stated aim of ensuring that the Bill is future-proofed. Although we have no plans to use the regulation-making power, and, indeed, we think it unlikely that any additional authorities will be identified, it would not be good policy to specifically rule it out. That is because communications data are an essential investigative tool for numerous investigations and they are used by a number of different authorities. As I said, we have published the operational case demonstrating why it is so essential that the authorities listed in Schedule 4 continue to be able to use these powers.
As that operational case demonstrates, the authorities that acquire communications data, including the so-called “minor users”, often do so to investigate serious crime and, in some cases, save lives. Should a new investigative body be established—for example, with a remit to investigate a specific type of serious crime—we would want the flexibility to give it the powers that it needed. Similarly, we need to be able to adapt the list if changes in the roles and responsibilities of public bodies mean that it falls out of date.
Of course, there should be full and proper scrutiny of any decisions to provide powers to an additional body. The Government will consider giving powers only where a public authority can make a robust case and, perhaps more importantly, the Bill allows a public authority to be added to Schedule 4 only under the enhanced affirmative procedure. This procedure requires additional consultation above and beyond the affirmative procedure and ensures that a parliamentary committee is provided with an opportunity to consider the draft regulations.
This power has been considered by the Delegated Powers and Regulatory Reform Committee. In her letter to the Joint Committee that scrutinised the draft Bill, my noble friend Lady Fookes reported that the committee accepted the need for the delegated power and welcomed the strengthening of scrutiny procedures under the Bill. She said that,
“the enhanced affirmative procedure ... provides an appropriate level of Parliamentary scrutiny”.
I hope that that reassures the Committee that sufficient scrutiny is already built into the process to ensure that an additional public authority would be added to Schedule 4 only where it had a robust and compelling need for the powers.
My Lords, I was referring to the procedure relating to the enhanced affirmative process. That procedure is set out in Clause 239 of the Bill. Importantly, it provides for a relevant parliamentary committee to report on the regulations. I do not think that I can be more specific at this stage. The enhanced affirmative procedure has been used in the past, albeit not very frequently, and is there as an additional safeguard. I endorse everything that my noble friend said in support of my remarks. He is absolutely right that we cannot foresee at this stage the need to add to the list, but we must and should provide for the circumstances where that becomes necessary.
I am grateful for the noble Earl’s explanation. The noble Lord, Lord King of Bridgwater, raised this important concern that people have about the range of public authorities that will be able to access this data. There is a real concern that the Secretary of State by regulation can simply add to the list included in the Bill. As a general principle, to have provisions in a Bill in order—to quote the noble Earl —to future-proof it, even if those are unlikely to be used, is not the ideal way forward. However, the enhanced affirmative procedure does give some reassurance on that issue.
On the other matters, I will read carefully what the noble Earl has said, but at this point I beg leave to withdraw the amendment.
My Lords, I hope the noble Lord will accept that, in the context of training and testing, those activities are essential if we are to have fully functioning services. It should not only be current investigations that are used for training as that could jeopardise operations. Current investigations may not give the full range of testing and training opportunities to prepare staff and equipment for all necessary eventualities. I will write to the noble Lord on the precise procedures involved in authorising testing and training as I do not have the information in front of me. However, appropriate safeguards will be built into those procedures.
I come back to the point I was making about these amendments in general. I contend that they are not necessary because the Bill and the draft statutory code of practice already require that the impact on people’s privacy, including in respect of collateral intrusion and cybersecurity, is properly considered in every single case. The draft codes will, of course, also be subject to parliamentary scrutiny and agreement before they come into force. I hope that those remarks are helpful in reassuring the noble Lord and that he will withdraw his amendment.
I thank the Minister for responding to these amendments. I have to say that I am a little sceptical. Yes, of course, as I think he just mentioned, one part of GCHQ is responsible for improving cybersecurity and identifying vulnerabilities around it. However, the role of another part of GCHQ is to breach cybersecurity in order to access information on terrorists’ and serious criminals’ devices. Indeed, when I was at GCHQ it was accepted that there was a tension between the two parts of that organisation as far as that is concerned.
I am also not convinced that it is absolutely clear and obvious in the Bill that there is a need to consider the unintended consequences of damage to networks or devices. I accept what the noble Earl says about collateral intrusion but not in terms of damage to devices or networks. However, at this stage—
Before the noble Lord decides what to do with his amendment, it might be helpful if I amplify my earlier comments. It is perfectly right to say that some equipment interference operations involve taking advantage of weaknesses, generally in how users are interacting with the internet, but sometimes vulnerabilities in the software or hardware themselves. However, I also contend that the use of equipment interference does not in itself create those weaknesses. While the security and intelligence agencies might on occasion—as I say—exploit such capabilities, they are at the same time committed to making the internet as secure as possible. As I mentioned, the security and intelligence agencies regularly highlight such vulnerabilities to industry.
There is a simple point to be made here. To leave targets open to exploitation by others would increase the risk that their privacy would be unnecessarily intruded upon. It would also increase the risk of those who wish to know who our targets are identifying the security and intelligence agencies’ tools and techniques. Therefore, operations must be carried out in such a way as to minimise that risk. I come back to the point I made near the start of my remarks: the purpose of GCHQ is to protect the public in that sense.
(8 years, 1 month ago)
Lords ChamberMy Lords, I shall also speak to the other government amendments in this group. These amendments seek to make minor changes to the notice-giving provisions in Part 9 of the Bill. Clause 225 provides for the Secretary of State to give a notice to a telecommunications operator in the United Kingdom requiring it to take steps in the interests of national security. Such a power is a critical tool in protecting our national security.
The power can only be exercised if the Secretary of State is satisfied that the steps required by a notice are necessary in the interests of national security and proportionate to what is sought to be achieved. The Government amended the Bill in the other place to provide for the application of the double-lock authorisation process to national security notices. This means that a national security notice could not be given unless a judicial commissioner had approved it.
This will replace the existing power in Section 94 of the Telecommunications Act 1984 which has been used for a range of purposes, including for the acquisition of communications data in bulk. This is now provided for in Part 6 of the Bill. Section 94 of the Telecommunications Act will be repealed. The power provided for by this clause will be used for a much narrower set of purposes than Section 94, but those purposes are nevertheless critical to our national security. The type of support that may be required from communication service providers includes the provision of services or facilities which would assist the intelligence agencies to carry out their functions more securely, or in dealing with an emergency as defined in the Civil Contingencies Act 2004.
A national security notice cannot be used for the primary purpose of obtaining communications or data. Clause 225(4) provides that a national security notice may not require the taking of any steps the main purpose of which is to do something for which a warrant or authorisation is required under the Bill. This amendment makes it clear that it is also the case that a notice may not require the taking of any steps the main purpose of which is to do something for which a warrant or authorisation is required under legislation which authorises the use of investigatory powers.
Amendment 90 lists the other statutes that provide for agencies to obtain data covertly—namely, the Regulation of Investigatory Powers Act 2000, the Regulation of Investigatory Powers (Scotland) Act 2000 and the Intelligence Services Act 1994. The amendment puts it beyond doubt that a national security notice cannot be used to circumvent the need to obtain a warrant or authorisation provided for in the Bill or in other relevant statutes.
I turn to Clause 226, which provides for the Secretary of State to give a technical capability notice to a telecommunications or postal operator requiring the operator to maintain permanent technical capabilities. The power builds on the current power in the Regulation of Investigatory Powers Act 2000 where a company can be obligated to maintain a permanent interception capability. The purpose of maintaining a technical capability is to ensure that, when a warrant is served, companies can give effect to it securely and quickly. The provision is particularly important when law enforcement or the security and intelligence agencies need to work at pace to identify and counter the actions of those who pose an immediate threat to the UK.
Subsection (7) of that clause provides for a technical capability notice to specify the period within which the steps set out in the notice are to be taken by the relevant operator. In practice, it will often be the case that a notice will require the creation of new technical systems. The time taken to design and construct such a system, including developing new pieces of technical hardware and implementing appropriate security measures, may lead to different elements of the notice taking effect at different times.
Government Amendments 94 and 95 propose a minor change to subsection (7) of the clause to make it clear that, where appropriate, a notice will permit different steps required in the notice to be taken at different times. The amendment will provide clarity to operators and ensure that the Bill reflects what needs to happen in practice. The Government propose a further minor amendment to the notice-giving provisions, this time to Clause 229, which provides for the Secretary of State to vary or revoke technical capability notices and national security notices.
Amendment 106 reads across provisions in Clause 228 that provide for the primacy of national security notices over aspects of the Communications Act 2003. The amendment does not change the effect of the provision but would make explicit that, when a national security notice is varied under Clause 229, the obligations in the notice as varied continue to have primacy over obligations imposed by Part 1, or Chapter 1 of Part 2, of the Communications Act 2003. The amendment replicates a provision previously provided for in the Telecommunications Act 1984, as amended by the Communications Act 2003, and removes any ambiguity about how the obligations set out in a national security notice as varied relate to those provided for in relevant parts of the Communications Act 2003.
Lastly, the Government propose Amendments 107, 110, and 111 to Clause 230. This clause makes provision for a person to request a review of the requirements imposed on them in a technical capability notice, or a national security notice. A person may refer the whole or any part of a notice to the Secretary of State for review after a notice is given or varied. The Government amended the Bill in the other place to provide for the double lock to be applied to the giving of notices. This means that a judicial commissioner must approve the Secretary of State’s decision to give a notice. The amendments that we are now considering would revise the review process to reflect this new role.
The proposed revised process is as follows: before reaching a decision on the outcome of the review, the Secretary of State must consult a judicial commissioner and the technical advisory board. The technical advisory board, a group of experts drawn from telecommunications operators and the intercepting agencies, will be required to advise on the technical feasibility of the requirements set out in a notice and the costs. The judicial commissioner will consider the requirements imposed by the notice on proportionality grounds.
As was previously the case, the judicial commissioner and the technical advisory board will be required to provide an opportunity for the person to whom the notice has been given and the Secretary of State to present evidence or make representations. The conclusions of the judicial commissioner and the board will be reported to the person and the Secretary of State. After considering these conclusions, the Secretary of State may decide to confirm the effect of the notice, vary the notice or withdraw it. Where the Secretary of State decides to confirm the effect of a notice or vary a notice, the Investigatory Powers Commissioner must approve the decision. Until the commissioner has approved the review decision, there is no requirement for the person who has referred the notice to comply with the specific obligations under review.
These amendments will strengthen the review process and will properly reflect the role of a judicial commissioner in approving the decision to give a notice. I hope the Committee will feel able to accept these amendments, and I beg to move.
My Lords, my noble friend Lady Hamwee and I have three amendments in this group. As a means of probing concerns about both national security notices and technical capability notices, we are suggesting that Clauses 225 and 226 stand part of the Bill, but we propose, in Amendment 92, that the provision in Clause 226(5)(c),
“obligations relating to the removal by a relevant operator of electronic protection applied by or on behalf of that operator to any communications or data”,
be deleted. These provisions are some of the most concerning for communications companies and the technology sector in the UK as they appear to provide open-ended and unconstrained powers, although I accept that the amendments that the Government have put forward today, as outlined by the Minister, provide significantly more oversight than was originally suggested in the Bill.
National security notices can require a communications provider in the UK,
“to carry out any conduct, including the provision of services or facilities, for the purpose of”—
this is in Clause 225(3)(a)(i)—
“facilitating anything done by an intelligence service under any enactment other than this Act”.
So the power is not limited to facilitating the use of powers under the Bill but any other legislation as well. The power is to do anything that the national security notice requires.
Technical capability notices enable the Government to require communications operators to comply with any “applicable obligations” specified in the notice, and the recipient must not only comply but must not disclose that they have been served with the notice, seemingly including, under Clause 226(5)(c), to remove encryption. However necessary or proportionate such notices may be—and I accept that, with the double lock now in place, that will be tested—there could be a suspicion that UK communications companies and the UK technology sector are subject to such notices, undermining customer confidence in the security of the network or device that they are using.
Although such a notice may be served to persons outside the UK, and may require things to be done outside the UK, such notices are not legally enforceable outside the UK. As well as undermining public confidence in the security of UK networks and technology, such notices have the potential to act as a competitive disadvantage to UK technology businesses. Instead of the power to force a company to remove encryption from a whole service or technology, alternative and more targeted powers should be used instead.
Can the Minister comment on the fact that increasingly, encryption is end-to-end, and can he say whether national security notices and technical capability notices would be of any use in circumstances where people were using end-to-end encryption? Can he also comment on a suggestion that instead of these notices, targeted equipment interference would be more useful in that it could deal with the problem of end-to-end encryption?
Certainly, targeted equipment interference is, if you like, the next step should interception not be possible for any reason. However, I will answer the noble Lord’s first question, on end-to-end encrypted services. We start from the position that we do not think that companies should provide safe spaces to criminals to communicate. They should maintain the ability, when presented with an authorisation under UK law, to access those communications. We will work with industry to ensure that, with clear oversight and the legal framework I have in part alluded to, the police and intelligence agencies can access the content of terrorists’ and criminals’ communications when a warrant has been approved in the usual way.
We will of course consider what steps are reasonably practicable for an individual telecommunications operator, taking account of a range of factors, including technical feasibility and likely cost. We recognise that what is reasonably practicable for one telecommunications operator may not be for another, so any decision will have regard to the particular circumstances of the case. However, I cannot go into our relationships with individual companies, as the noble Lord will understand. It is important to understand that the Bill does not ban encryption or do anything to limit the use of fully encrypted services.
(8 years, 1 month ago)
Lords ChamberI am grateful to the Minister for his explanation. I did say that the amendments were probing ones and suggested that national security and politically sensitive issues—as with the Lee Rigby case, to which he referred—would have to be outside this provision. The fact is that in 2014 the Home Secretary personally authorised 2,345 interception and property warrants and renewals, which is about 10 a day. Even David Anderson was shocked by the number of warrants that the Home Secretary had to personally sign, which was why he came up with his recommendation. As the noble Lord, Lord Pannick, said, our understanding is that the number of warrants which the Secretary of State will have to sign will increase as a consequence of this legislation. David Blunkett, who has written of his time as Home Secretary, said that:
“My whole world was collapsing around me. I was under the most horrendous pressure. I was barely sleeping, and yet I was being asked to sign government warrants in the middle of the night. My physical and emotional health had cracked”.
I am sure that the current Home Secretary is more resilient than the noble Lord, Lord Blunkett, was in those circumstances.
Another issue, which I spoke about in the previous set of amendments, is the importance of international collaboration, particularly with the United States. I reinforce what my noble friend Lord Strasburger said. In America, federal investigative and law enforcement officers are generally required to obtain judicial authorisation for intercepting wire, oral and electronic communications. A court order must be issued by a judge of a US district court, a US court of appeals or a FISA judge. If we are to have these international co-operation agreements, again, as David Anderson pointed out in his report, it is important as far as possible to harmonise between different countries the authorisation levels of the system of authorisation. I will read what the Minister has said in his response and I agree that the amendments as drafted go too far, but this is something that we can hopefully discuss between now and Report. If not, we may have to bring this matter back on Report. At this stage, I beg leave to withdraw my amendment.
(8 years, 1 month ago)
Lords ChamberMy Lords, I am very grateful to those who have contributed to this short debate, and very grateful to the Minister. On Amendment 19, I think that I am right in saying that the issue around phone hacking was on whether a voicemail that had not yet been listened to was still in the course of transmission, whereas a voicemail that had already been listened to was not in the course of transmission. That was a reason that the police gave at one stage for not investigating some of the phone hacking. I find the wording rather curious. I should have thought that it would be sufficient to say that communication included communication stored prior to or following transmission. But I am not a lawyer—I accept that.
I accept what the Minister says on written consent, on Amendment 66, but surely there are other ways in which consent can be explicitly given. For example, if a telephone conversation was being recorded, both parties to that conversation could say on tape, as it were, that they consented to the interception of that conversation. Perhaps we could give that some further consideration. I beg leave to withdraw the amendment.
My Lords, the amendment is in relation to the mandatory use of equipment interference warrants. The wording of the relevant section says that security services must secure an equipment interference warrant if the “intelligence service considers that” the conduct would constitute an offence under the Computer Misuse Act. Surely, it must be something more than just whether the particular intelligence officer considers that the conduct would constitute an offence under that Act. Surely, an equipment interference warrant must be obtained because, otherwise, it would constitute an offence, rather than simply if the intelligence service considers that it is.
Amendment 24 makes a similar point about restrictions on the use of Section 93 of the Police Act 1997. In this case it states that a “targeted equipment interference warrant” is required,
“if the applicant considers that the conduct would … constitute”,
an offence under the “Computer Misuse Act 1990”. I would argue that exactly the same considerations apply as with Amendment 23. I beg to move.
My Lords, the amendments in this group seek to change the language used in relation to the equipment interference regime and Computer Misuse Act offences. Clause 13 provides that an equipment interference warrant under the Bill is mandatory if the intelligence service considers that the conduct would constitute a Computer Misuse Act offence and there is a British Islands connection. Similarly, Clause 14 provides that law enforcement agencies will be unable to authorise this type of equipment interference under the Police Act 1997 where the applicant considers that the conduct would constitute an offence under the Computer Misuse Act. This is an important safeguard.
The language in Clauses 13 and 14 reflects the fact that at the point of application the equipment interference agency may not be able to say with complete certainty whether the proposed interference will constitute an offence under the Computer Misuse Act. For example, when an MI5 officer is handed a compact disc by a source, it may not be clear whether the disc belongs to the source who intends the officer to use the disc, in which case the Computer Misuse Act would not be engaged, or whether it is owned by another person who does not intend the officer to access the disc, in which case the Computer Misuse Act would be engaged. In these circumstances, the applicant will need to consider the possibility of an offence occurring, consult legal advisers, where unclear, and seek the appropriate authorisation, if required. The language of the Bill reflects that it may not be certain whether the Computer Misuse Act is engaged. The language in the Bill and the code of practice anticipate that applicants will err on the side of caution.
Finally, and crucially, all equipment interference will be overseen by the new Investigatory Powers Commissioner, ensuring that there is independent and objective analysis of any decision regarding the possibility of conduct constituting an offence under the Computer Misuse Act. I hope that explanation will be helpful to the noble Lord and explains why this language is in the Bill. I therefore invite him to withdraw the amendment.
I am very grateful for that explanation. I understand that it may not be certain that something constitutes an offence under the Computer Misuse Act. Where it is an offence under the Computer Misuse Act, does the Bill allow a Security Service agent or law enforcement officer to ignore that provision?
That cannot happen. Without a valid lawful authority, interference with equipment that is prohibited by the Computer Misuse Act will remain illegal. If a member of an equipment interference agency considered that no Computer Misuse Act offence would be committed before beginning an operation but later determined that an offence was likely to be committed, they would be required to seek appropriate authorisation.
I am very grateful to the Minister. I beg leave to withdraw the amendment.
(8 years, 3 months ago)
Lords ChamberMy Lords, I am most grateful to the noble Lord, Lord Rosser, who asked a number of questions. The Daily Telegraph picked up the No. 10 statement and misconstrued it. No. 10 said that we would proceed with this programme as quickly as possible and that by the end of the year we will have seen children arriving in this country. That does not mean to say that it will be 31 December before any child arrives.
It is difficult for me to define the estimated timetable because of the need, as specified by the amendment in the name of the noble Lord, Lord Dubs, to consult local authorities before we are in a position to say how many children can be accommodated. I can only assure the noble Lord that we need to take necessary but not undue time to do that, that we are already engaged with the French authorities to ensure that the vulnerable children who I know the noble Lord, Lord Dubs, wants us to prioritise are identified as quickly as possible, and that we will do the same in Greece and Italy.
I cannot, as the noble Lord will therefore surmise, be specific about whether we will admit 300 children before the start of the school year. The very nature of this announcement means that we must take the necessary time to consult others before bringing forward final proposals on how to implement. All I can say is that we will not only implement the letter of this amendment but its spirit, and we will do so enthusiastically and as speedily as we can. Naturally, as I have already emphasised, those children in Calais are likely to be the first candidates.
My Lords, Save the Children, following extensive research and consultation, concluded that if the UK took 3,000 unaccompanied asylum-seeking children from within Europe, that would be a fair and proportionate number. I accept, as the Minister said, that there has to be consultation with local authorities, but we also heard earlier this afternoon in this Chamber that charities and other mechanisms can be used to help find homes for these children. Can the Minister tell the House how many of these children the Government intend to take: the smallest number they can get away with or the UK’s fair share?
It is not a question of the smallest number we can get away with. I hope that I have indicated that we are pursuing this amendment in its proper spirit. We have always been clear that we share the objective of identifying and protecting vulnerable refugee children wherever they are—our efforts to date have been designed to do just that—and we have heard many times about the measures that the Government have taken, particularly in the Middle East.
However, we were very clear that setting an arbitrary target, particularly one as high as 3,000, was the wrong approach. We cannot simply wade in and select some children whom we think would be better off in the UK, especially when some local authorities already care for very high numbers of unaccompanied asylum-seeking children—which in some cases is stretching services to breaking point. That is why we believe that the approach of the noble Lord, Lord Dubs, is the right one. We have to consult with local authorities before we can determine the number that we can accommodate, and we must observe the best-interests principle as well.