Investigatory Powers Bill (Tenth sitting)

Gavin Newlands Excerpts

Committee Debate: 10th sitting: House of Commons
Thursday 21st April 2016 Public Bill Committees

[The Solicitor General (Robert Buckland)]

On a point of order, Mr Owen. May I add my remarks to yours? We wish my hon. Friend well and hope that he has a swift recovery from his operation.

Clause 109

Implementation of warrants

[Gavin Newlands (Paisley and Renfrewshire North) (SNP)]

I beg to move amendment 293, in clause 109, page 87, line 39, leave out subsection (3).

This amendment would remove the provision which allows a targeted equipment interference warrant to be served on a person outside the UK for the purpose of requiring that person to take action outside the UK.

[The Chair]

With this it will be convenient to discuss the following:

Amendment 645, in clause 109, page 87, line 41, at end insert—

“(3A) Subsection (3) shall not be applicable where the person outside the United Kingdom has its principal office where it is established for the provision of services in a country or territory with which the United Kingdom has entered in to an international mutual assistance agreement or is subject to an EU mutual assistance instrument.”

This excludes the extraterritorial provision in cases where any mutual assistance arrangement exists between the UK and the provider’s jurisdiction while enabling the government to seek voluntary assistance from CSPs in non-MLA countries.

Amendment 679, in clause 110, page 88, line 9, at end insert—

“(1A) Where such a warrant is to be served upon a person outside the United Kingdom the warrant shall be served at that person’s principal office outside the United Kingdom, where it is established, for the provision of services.”

Amendment 694, in clause 110, page 88, line 10, at beginning insert—

“Where service of a warrant in the manner envisaged in subsection (1A) is considered unfeasible or inappropriate in the circumstances,”

Amendment 647, in clause 110, page 88, line 10, after “Kingdom”, insert—

“the warrant shall be served at that person’s principal office outside the United Kingdom where it is established, for the provision of services. Where it is considered unfeasible or inappropriate in the circumstances,”

The Home Secretary confirmed at second reading that a UK agency would only serve a notice on an overseas entity that is capable of providing assistance under the warrant. UK agencies today routinely use secure means of communication to transmit notices directly to the main office of overseas CSPs. This would make government’s commitment clear on the face of the Bill (as it is in the relevant code of practice) and address contradictory provisions that remain in the Bill.

Amendment 648, in clause 111, page 89, line 19, after “take”, insert—

“which for a relevant operator outside the United Kingdom shall include—

(a) any steps which would cause the operator to act contrary to any laws or restrictions under the law of the country or territory where it is established, for the provision of services, or

(b) where a warrant could be served pursuant to an international mutual assistance agreement or subject to an EU mutual assistance instrument.”

This amendment clarifies the reasonableness test for overseas CSPs.

[Gavin Newlands]

It is a pleasure to serve under your chairmanship, Mr Owen. May I add to your comments that I will miss the exchanges with the hon. Member for North Dorset? I wish his replacement well.

Clauses 109 and 110 deal with issues about compelling a third party to provide assistance in the execution of a warrant and extraterritoriality, which is the subject of amendment 293. In speaking to the amendment, and to the clause more generally, I will unavoidably stray into matters relating to clause 110, as the two are inextricably linked.

Clause 109 provides the UK Government with the power to issue warrants that in turn force third-party organisations or individuals outside the UK to assist in acquiring information for the means of equipment interference. The clause states that

“any person whom the implementing authority considers may be able to provide such assistance”

can be served with a warrant to assist in carrying out a targeted hacking warrant. Under clause 110(2), this warrant may be served at a person’s principal office or specified address in the UK, or by making it available for inspection in the UK after appropriate steps have been taken to bring the contents of the warrant, and its very existence, to the attention of the person.

First, the problem here is the lack of judicial authorisation in this part of the process. Privacy International rightly points out that this compelled assistance will not be subject to judicial authorisation. Although law enforcement and security and intelligence agencies will have to seek a warrant to gain access to people’s devices and computers, it is correct that those authorities are not required to seek judicial approval to compel technology companies to assist in their investigations.

Secondly, we should be mindful of the difficulty that this places on any individuals or organisations who are forced to comply with the Government’s demands. These issues were heard by the Science and Technology Committee, where serious concerns were raised about the security implications of forcing companies to, for example, upload and install malware, as well as the fear that equipment interference could jeopardise their business model. The Science and Technology Committee took note of these issues and concluded that

“the industry case regarding public fear about ‘equipment interference’ is well founded.”

Amnesty International UK is deeply concerned about the dangerous precedent that this broad, aggressive power will set in forcing third-party companies to engage in hacking without any independent provision or scrutiny, and to do so in secret.

Thirdly, the extraterritorial measures in clauses 109 and 110 may cause more problems than they solve. That is why amendment 293, which stands in my name and that of my hon. and learned Friend the Member for Edinburgh South West, seeks to delete subsection (3) entirely, thereby removing the extraterritorial aspect. If we serve hacking warrants on those outside the UK, what sort of message does that send to other countries? We need to be mindful that introducing this type of clause could open the floodgates for other countries to follow suit, which will ultimately have an impact on companies based in the UK. That point was articulated by Yahoo!, which said:

“Extraterritoriality encroaches on the sovereign rights of other governments and risks retaliatory action, including against UK CSPs operating overseas.”

On that point, the Government’s independent reviewer’s report suggests that, when countries seek to extend their legislation extraterritorially, those powers may come into conflict with legal requirements in the country in which companies being asked to comply with a legal request are based. Companies explained to the reviewer that they did not consider it was their role to arbitrate between conflicting legal systems. The protection of vital human rights should not be left to the goodwill and judgment of a company. The concerns of the industry were articulated in this perfect quote. The industry

“expressed concerns that unqualified cooperation with the British government would lead to expectations of similar cooperation with authoritarian governments, which would not be in their customers’, their own corporate or democratic governments’ interests.”

I shall finish with this comment from Yahoo! It states:

“The current legal framework comprises the law in the requesting country, law in the receiving country and the international agreements that connect the two.”

It is additionally possible that the requesting and receiving countries’ laws may be in conflict. For example, the receiving country’s law may outlaw the provision of content data outside their own legal process. It continues:

“Taken as a whole, this framework is fragmented, with gaps and conflicts which have gone unaddressed for many years. In this more global communications environment, this fragmentation has become more and more obvious and creates a patchwork of overlapping and conflicting laws which overseas and domestic UK CSPs must navigate in order to discharge their legal obligations to safeguard users’ privacy and to respond appropriately to valid requests for access to data… It also creates a complex environment for users to navigate and establish their privacy rights.”

This issue is global, and national laws cannot resolve global issues.

[Keir Starmer (Holborn and St Pancras) (Lab)]

I will be brief. Members will have observed that the amendments in my name are in keeping with my previous amendments about implementation, service and extraterritoriality in relation to other warrants. I will not repeat the points I made then. The only one that is different is amendment 646, a simple proposed change to clause 109 that would add the provision:

“A warrant may be implemented only to the extent required for the purpose for which the warrant was issued.”

I think that may be implicit. If the Minister could indicate that that is his understanding, that might allay concerns and the amendment would not need to be pressed.

[The Minister for Security (Mr John Hayes)]

As the hon. and learned Gentleman says, we have been down this road before. I well recall discussing similar amendments to the targeted interception provisions in part 2. The Bill maintains the existing position in relation to extraterritorial jurisdiction and those obligations that apply to overseas companies. I am unhesitating in my view that overseas companies, because of their important role in communications, must do their bit to do the right thing, as I said previously and memorably. As a result, I will not tire the Committee by going into that argument in great detail.

Amendment 293 to clause 109 seeks to remove the ability to serve a warrant on an overseas provider and amendment 645 seeks to remove the ability to serve a warrant on an overseas provider when a mutual legal assistance agreement is in place. I draw the Committee’s attention once again to David Anderson’s comments in his report, in paragraph 11.26:

“There is little dispute that the MLAT route is currently ineffective.”

I will not quote it at length but he goes on to say that it is because it is too slow and so on. I do not think that those amendments are in line with either his view or mine.

The effect of accepting the first amendment is evident. It would mean we could serve an equipment interference warrant only on a provider based in the UK. The second amendment seeks to assert mutual legal assistance arrangements as the only route. For the reasons I have already given, that is not appropriate.

The hon. and learned Gentleman asked, in the context of his amendment, whether that matter was implicit. Yes, it is implicit and I can confirm what he thought might be the case.

The arguments have already been made and, on careful reconsideration, the hon. Member for Paisley and Renfrewshire North will realise that his amendment and argument are pseudodox and will withdraw on that basis.

[Gavin Newlands]

I thank the Minister for that response and I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

[The Chair]

We now come to amendment 646 to clause 109. I call Keir Starmer.

--- Later in debate ---

Question proposed, That the clause stand part of the Bill.

[Gavin Newlands]

I can deal with this in fairly short order. The Scottish National party tabled an amendment to leave out the clause, which places a duty on telecoms operators to assist with the implementation of equipment interference warrants. We agree with those in the industry who are rightly concerned about being forced by the state to engage in the legal hacking of customers and other individuals and groups.

The Bill defines a telecoms operator as

“a person who…offers or provides a telecommunications service to persons in the United Kingdom, or…controls or provides a telecommunication system which is (wholly or partly)…in the United Kingdom, or…controlled from the United Kingdom.”

That flexible and all-encompassing definition means that not only online companies such as Google, Facebook, Twitter, Dropbox and Yahoo!, but private offices, businesses, law firms, the networks of Departments such as the NHS and institutional networks such as those of universities would be forced to comply with the Government’s instructions to interfere with or hack the communications of an individual or group. That was confirmed by the Home Secretary in her evidence to the Joint Committee that scrutinised the draft Bill. That power will place those companies, whose services most, if not all, of our constituents use, in a deeply unsettling and invidious position.

I am not convinced that any of our constituents would be pleased to hear that we were passing legislation that would allow their email accounts or Facebook pages to engage in illegal hacking on behalf of the state. The extraordinarily expansive power that the clause gives the Government will force companies to engage in highly controversial work on their behalf, which will no doubt be in conflict with the interests of cybersecurity and product security that the companies work hard to innovate in, protect and extend. Forcing these companies to engage in legal hacking could seriously harm their business and operations. It will also lead to some of their customers and users losing trust in their businesses. I am not surprised that companies have long expressed deep concern about the powers laid out in the clause, as it is in direct conflict with their business interests. For those reasons, the SNP would like to see the clause deleted from the Bill.

[Mr Hayes]

I have nothing to add.

Question put, That the clause stand part of the Bill.

--- Later in debate ---

[The Chair]

I call Joanna Cherry.

[Gavin Newlands]

I shall do my best impression of her, Mr Owen, but I fear it will be inadequate.

I beg to move amendment 296, in clause 113, page 91, line 22, at end insert—

“(A1) Material obtained via a warrant under this Part may only be shared with overseas authorities in accordance with the terms of an international information sharing treaty.”

This amendment would require that information obtained via an equipment interference warrant is only shared with overseas authorities where a mutual legal assistance treaty has been put in place for the purpose of doing so.

Clause 113 deals in part with the overriding issue of information obtained through equipment interference being shared with overseas authorities. We should take note of the oral and written evidence submitted by Amnesty International on this point about the lack of any proper controls over intelligence sharing with foreign authorities. The human rights implications may be very serious indeed. For example, there is nothing in the Bill to prevent data being shared with an overseas authority when that might lead to the abuse, or possibly torture, of an individual or group. Surely we should set an example by ensuring that data gathering does not lead to torture; that should be the minimum standard expected of a civilised country such as ours.

However, if the SNP and Amnesty International are a little left-wing for hon. Members’ tastes, I give them the Intelligence and Security Committee, which also criticised the lack of clarity on this point when it noted that the Bill

“does not…meet the recommendations made in the Committee’s Privacy and Security Report that future legislation must set out these arrangements more explicitly, defining the powers and constraints governing such exchanges.”

The written evidence submitted by Yahoo! and others expressed concern that the Government’s apparently unilateral assertions of extraterritorial jurisdiction

“will create conflicting legal obligations for overseas providers who are subject to legal obligations elsewhere.”

David Anderson has also noted the lack of detail in this section of the Bill. He called for information sharing with foreign countries to be subject to strict, clearly defined and published safeguards. His report states:

“The new law should make it clear that neither receipt nor transfer as referred to in Recommendations 76-77…should ever be permitted or practised for the purpose of circumventing safeguards on the use of such material in the UK.”

However, such safeguards and guarantees are notably absent from the Bill. Furthermore, the independent reviewer’s report described the international trade in intelligence between the “Five Eyes” partners—the UK, the USA, Canada, Australia and New Zealand. In so far as material gathered by the British services is shared with other countries, the report explained that the security services take the view that, under their founding statutes, information should be shared only if it

“is necessary for the purpose of the proper discharge of the security and intelligence agencies’ functions.”

When it is considered that the test is met, certain safeguards apply under the Regulation of Investigatory Powers Act 2000. However, the report concluded that

“in practical terms, the safeguards applying to the use of such data are entirely subject to the discretion of the Secretary of State.”

The 2000 Act and the codes of practice are silent on British services receiving or accessing information from foreign services, with security services limited only by the general constraints placed on their actions by various statutes. It was only during Liberty’s legal action against the security services in the Investigatory Powers Tribunal that limited information was revealed about the way in which the security services approach such situations. In its first finding against the agencies, the IPT held that, prior to these disclosures, the framework for information sharing was not sufficiently foreseeable and was not therefore in accordance with law. The tribunal held that, because the litigation had resulted in disclosures of information, the security services were no longer acting unlawfully when accessing information from the US. Based on the concerns that Amnesty International, Liberty and others have raised, the SNP has tabled amendment 296, which would insert a new subsection into clause 113. The language of the amendment is plain.

[Keir Starmer]

I have listened carefully to the hon. Gentleman’s comments. On the sharing of information with authorities that may engage in torture or other serious ill-treatment, can the Minister confirm the long-standing practice that our security and intelligence services do not share information where there is a risk of torture, because of their obligations under other international treaties, and that this provision sits within that framework of assurances?

[Mr Hayes]

I can confirm that, and I can say a little more. My residual generosity is such that I take the view that these amendments are well intentioned, but they are unnecessary. Let me say why.

Clause 113 already provides that the Secretary of State must ensure that satisfactory and equivalent handling arrangements are in place before sharing UK equipment interference material with an overseas authority. The Secretary of State must determine that they provide corresponding satisfactory protections. Furthermore, those obligations sit alongside those in, for example, the consolidated guidance to intelligence officers and service personnel on the detention and interviewing of detainees overseas, and on the passing and receipt of intelligence relating to detainees, as well as the gateway provisions that allow for intelligence sharing in the Intelligence Services Act 1994 and the Security Service Act 1989.

In addition, the overseas security and justice assistance guidance provides an overarching mechanism that sets out which human rights and international humanitarian law risks should be considered prior to providing justice or security sector assistance. This is supplemented by the draft code of practice on equipment interference, which is clear about the safeguards on the handling of information. It seems to me that the protections, absolutely necessary though they are, are comprehensively dealt with by that variety of means, rendering the amendment unnecessary. I invite the hon. Gentleman to withdraw it.

[Gavin Newlands]

I thank the Minister for his comments, and I am somewhat reassured, but I still do not understand the Government’s reticence about putting this in the Bill; it is only a sentence that is required. Nevertheless, we are minded to withdraw the amendment at this time. I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 113 ordered to stand part of the Bill.

Clause 114

Duty not to make unauthorised disclosures

[Keir Starmer]

I beg to move amendment 649, in clause 114, page 91, line 42, after “not”, insert “without reasonable excuse”.

--- Later in debate ---

[Keir Starmer]

I have said all that I need to say on the amendment. Members of the Committee will appreciate that the amendment has been tabled for each of the offence provisions for the reasons I set out the first time we encountered it. That was dealt with by the Solicitor General, so I shall say no more about it at this stage.

[Gavin Newlands]

I will not detain the Committee long. I hear what the hon. and learned Gentleman says and broadly agree with it. I rise merely to point out the differences between the two amendments before us. The SNP’s amendment would insert an additional subsection that adds the additional defence and leaves subsection (3) in, whereas the Labour amendment removes that.

[The Solicitor General]

I am grateful to the hon. and learned Member for Holborn and St Pancras. We are familiar with the arguments and our response is that the information gateway, which allows people to take concerns directly to the Investigatory Powers Commissioner, caters for the public interest. For that reason I urge him to withdraw the amendment.