National Security Bill (Seventh sitting)

Holly Lynch Excerpts

Committee stage
Tuesday 19th July 2022 Public Bill Committees

[The Chair]

The learned Clerk also agrees that it should read “section 26”. We are most grateful to the hon. Gentleman for pointing that out.

Question put and agreed to.

Clause 27 accordingly ordered to stand part of the Bill.

Clause 28

Offences by bodies corporate etc

Question proposed, That the clause stand part of the Bill.

[Holly Lynch (Halifax) (Lab)]

Clause 28 deals with offences committed by bodies corporate. It is a significant clause. I imagine that this legislative area will continue to need to evolve as threats continue to emerge. The clause asserts that where a corporate body commits an offence under part 1 of the Bill

“the officer, as well as the body, is guilty of the offence”.

Finding the right balance here will not be straightforward, but this will become a key battleground, as the Government acknowledged with the National Security and Investment Act 2021.

In its report, the Law Commission outlined that classified evidence, which it was considering, could be explained using the following hypothetical example. P, an IT services company headquartered in a foreign state, has a managed services contract for a large Department. As part of that contract, P creates back-ups in the UK of the Department’s corporate email and file storage system. P is compelled under the foreign state’s national security legislation to share that information with the foreign state’s intelligence services, which use it to target UK interests. Worryingly, that will not be an uncommon scenario; we see such examples regularly in the UK press, and a range of stakeholders need to be alive to the risks. I am afraid to say that the Government have been too slow to respond.

In December 2020, the US Department of Homeland Security issued a data security business advisory, which

“describes the data-related risks American businesses face as a result of the actions of the People’s Republic of China (PRC) and outlines steps that businesses can take to mitigate these risks. Businesses expose themselves and their customers to heightened risk when they share sensitive data with firms located in the PRC, or use equipment and software developed by firms with an ownership nexus in the PRC, as well as with firms that have PRC citizens in key leadership and security-focused roles…Due to PRC legal regimes and known PRC data collection practices, this is particularly true for data service providers and data infrastructure.”

The advisory was issued as a result of several new laws passed in China in recent years—not least the national intelligence law of 2017, which compels all PRC firms and entities to support, assist and co-operate with PRC intelligence services, creating a legal obligation for those entities to turn over data collected abroad and domestically to the PRC.

A UK employee working for a Chinese company will need really robust legislative support in pushing back against the obligations placed upon Chinese businesses by those new laws under the Chinese Communist party. For that reason, we welcome clause 28, and believe that the provisions are sufficiently broad to include anyone in a company who may commit an offence under part 1 of the Bill, and to provide clarity in this space, with a need to consider employees who stand to find themselves in a difficult position due to the Chinese legislative framework.

Subsection (5) will allow the Secretary of State to make regulations to improve the clause through secondary legislation. I have said that I recognise that legislation will need to be dynamic if it is to be effective, but any such regulations should be laid under the affirmative procedure, and must be debated and actively approved by both Houses of Parliament. I hope the Minister will confirm that that will be the case.

[Stephen McPartland]

The clause provides that where a body commits an offence under part 1 of the Bill

“the officer, as well as the body, is guilty of the offence”

if it is attributable to the officer’s consent, connivance or neglect. The provision is based on a similar one in the Official Secrets Act 1911. For example, where a body commits an espionage offence of obtaining protected information under the direct guidance of the head of the body, both the body and its head would be guilty of the offence. Clause 28 mirrors the provisions found in section 36 in part 3 of the National Security and Investment Act 2021, which makes suitable provision for when an offence under that part is committed by a body corporate.

It is worth noting that in a similar provision in the 1911 Act, a director would automatically be held liable unless they could prove that they did not consent or were unaware. Rightly, the provisions move beyond that burden of proof: the prosecution must now demonstrate beyond reasonable doubt that an officer was culpable in such a case, which provides more safeguards. This is therefore an important provision to ensure that both companies and relevant officers can be held liable for their involvement in state threat activity, and that where there is wrongdoing on the part of an officer of the company that officer can be appropriately prosecuted for the offences.

For an officer to be held liable, they must consent or connive to the act or be negligent in relation to it, which is a higher bar than simply being unaware of the act, as the prosecution would need to demonstrate not just a lack of awareness but that, in being unaware, the person was failing to properly discharge their duties. The clause goes on to define a number of terms, such as a “body” and an “officer of a body”, and it provides that the Secretary of State may make regulations to modify the section in relation to

“its application to a body corporate or unincorporated association formed or recognised under the law of a country or territory outside the United Kingdom.”

That may be required as a result of differences in the nature of bodies corporate, their structures or their terminology under the laws of foreign jurisdictions. This ensures that bodies corporate outside the UK that commit offences under part 1 of the Bill can still be caught under these offences.

I will refer to the example given by the hon. Member for Halifax. We have tried throughout the Bill to demonstrate that the offence will be based on an individual acting directly or indirectly on behalf of a foreign power, and on whether they should reasonably know that that behaviour is on behalf of a foreign power. I understand her point about foreign-owned companies, but the Bill does not say that whole companies are acting on behalf of a foreign power. As she rightly says, there will be a whole range of UK individuals engaged in completely legitimate activity within the UK, and we do not want to give employees of those companies any problems.

The regulations will involve technical, rather than substantial, changes, so they will not widen the scope whatsoever. That is why they will be made under the negative procedure.

Question put and agreed to.

Clause 28 accordingly ordered to stand part of the Bill.

Clause 29 ordered to stand part of the Bill.

Clause 30

Consents to prosecutions

--- Later in debate ---

[Stuart C. McDonald]

Very educational; I have learned something new. I am grateful to the Minister for his explanation, and I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 30 ordered to stand part of the Bill.

Clause 31

Power to exclude the public from proceedings

Question proposed, That the clause stand part of the Bill.

[Holly Lynch]

I wish only to add that I imagine we would all agree that transparency in this legislative area should be the default, especially given the need to raise awareness of the challenges we face as a country and the individual responsibilities that we all share in combating those challenges with the arrival of these new offences. That said, it is of course right that clause 31 provides power to the court to exclude the public from any part of proceedings or offences under part 1, or for proceedings relating to the aggravation of sentencing, or other offences where the foreign power condition applies, should the evidence being considered deem it to be in the interests of national security to do so.

[Stephen McPartland]

As the hon. Member said, clause 31 provides those protections. It builds on the Official Secrets Act 1920, which gives the court the power to exclude the public from any proceedings if the publication of any evidence to be given would be prejudicial to national security. However, the passing of the sentence must still take place in public.

One important point is that the decision to exclude the public will be made by the court, not the prosecution. It is also important to reiterate that the power does not grant the use of closed-material proceedings. Therefore, as is the precedent in our criminal justice system, the defendant and their legal team will have access to all the evidence, as they would in other criminal proceedings.

I will end by reassuring the Committee that the clause is not meant to limit the transparency of our justice system or the independence of the judiciary, but to ensure that—only where necessary—the courts themselves have the power to protect the United Kingdom’s national security.

Question put and agreed to.

Clause 31 accordingly ordered to stand part of the Bill.

Clause 32

Power to impose prevention and investigation measures

Question proposed, That the clause stand part of the Bill.

[The Chair]

With this it will be convenient to discuss the following:

Amendment 57, in schedule 4, page 111, line 1, leave out paragraph 12.

This amendment would remove the power to require participation in polygraph sessions.

That schedule 4 be the Fourth schedule to the Bill.

[Holly Lynch]

Clause 32 is the first clause of part 2, and introduces the state threat prevention and investigation measures, or STPIMs, replicating the terrorism prevention and investigation measures, or TPIMs, framework, which is already in existence. Like TPIMs, STPIMs impose significant restrictions on a person’s freedoms without that being the consequence of a crime having been committed and tried before the courts.

Schedule 4 sets out a list of the types of measures that may be imposed on an individual under this part. The Secretary of State may impose any or all the measures that he or she reasonably considers necessary, for purposes connected with preventing or restricting the individual’s involvement in foreign power threat activity.

Taken cumulatively, the measures will restrict the freedoms of the STPIM subject in a way that is normally possible only during criminal or immigration proceedings, or restrictions under the Mental Health Act 1983. Inevitably, we are looking for assurances that measures of this kind are necessary and effective, especially as the threshold for applying an STPIM is naturally lower than the threshold for a criminal conviction.

In considering the balance, we have looked to the efficacy of TPIMs as a starting point, and at the invaluable work of the independent reviewer of terrorism legislation, Jonathan Hall QC, who provides an ongoing assessment in his annual review. According to the latest independent annual review of terrorism legislation, between the Terrorism Prevention and Investigation Measures Act 2011 receiving Royal Assent and 31 December 2020, only 24 individuals were served with a TPIM notice. That would suggest that they are not used often.

In 2020, all but one of the TPIMs in force were against members of the proscribed terrorist network ALM—al-Muhajiroun. The report makes clear that ALM’s direct or indirect impact on UK terrorism includes the 2013 murder of Fusilier Lee Rigby, the 2017 London Bridge Attack and the 2019 Fishmongers’ Hall attack. That underlines the severity and level of risk that those measures are seeking to manage and suppress, when considering the terrorism equivalent.

Jonathan Hall was asked whether he thought the STPIMs might be used more readily that TPIMS when he gave evidence in the Committee’s first session. He said,

“if the regime operates as it is intended to, because the Bill replicates the obligation for the Secretary of State to consider whether it is possible to prosecute in the first place. I do not think in practice that they will become a measure of first resort, just because they are so resource-intensive and complicated.”––[Official Report, National Security Public Bill Committee, 7 July 2022; c. 10, Q16.]

When asked about the efficacy of STPIMs, he said,

“I expect that they will be effective because the agencies and the Home Secretary will only think about imposing one when they think it is going to work.”––[Official Report, National Security Public Bill Committee, 7 July 2022; c. 6, Q6.]

We are reassured by Jonathan Hall’s contributions in that first session of the Committee. We will revisit some of his other comments in debates on other clauses, particularly around oversight in clause 49 and the ongoing review process under clause 40.

--- Later in debate ---

[Holly Lynch]

I was reassured by some of the detail in these clauses about that point, but the impact assessment from the Home Office says:

“It is assumed that the prosecution rate of state threats investigations is 33 per cent. This is an internal estimate from CPS, based on prosecution of previous OSA 1911-1939 cases.”

Based on where we envisage we might have challenges in securing prosecutions, I wonder whether STPIMs are also for the other side of a prosecution, as well as for when we cannot secure prosecution and get there in the first place.

[Stephen McPartland]

I am grateful to the hon. Lady for that point. I understand that our responsibility is to scrutinise the legislation to make sure that, as the hon. Member for Dundee East made clear, we do not open up a can of worms that can lead to greater and greater unintended consequences, but the reality is that the provision is to be a last resort.

If we are talking practically, counter-terrorism police are responsible for enforcing STPIMs. The amount of resources required to enforce and monitor a TPIM or STPIM is so great and so large that, as Members can imagine, it is not something that any of the agencies or anybody in Government wants to do, so it is not something that we will look to push. First and foremost, this is about prosecution by any means possible.

To give some kind of hope and clarity, I would like to make the point that the number of TPIMS currently in use is less than four. The number of TPIMs that have been used throughout the 10 years of their existence is less than the clause number that we started on today. I hope that gives some reassurance on how limited the measures will be, and on how few occasions they will be used.

We have been looking at the specific time limit, and we are including a specific condition to have a maximum of five years for the duration of an STPIM. Again, that is to mirror what is in the TPIM legislation. Additionally, subsection (4) requires the Secretary of State to publish factors that she considers are appropriate to take into account when deciding whether to restrict a person’s movement in the UK—for example, ensuring that they have access to appropriate medical facilities.

Part 1 to schedule 4 sets out 16 measures. Right hon. and hon. Members will know there are 17 measures in TPIM legislation for differences around drug testing, but we do not believe that is applicable in this case. The measures have to be tailored to the specific threat that an individual poses.

I want to touch on the polygraph measure, as it has been raised by a number of colleagues. It is designed to allow the Secretary of State to require an individual to take a polygraph test at a specific date, time and location. The purpose of the measure is to assist operational partners to assess whether an individual is complying with the other measures under their STPIM. The outcome of the session may be used to make changes to the individual’s suite of measures—for example, removing or adding specific measures to prevent or restrict their involvement in state threat activity. Again, this measure is expected to be used exceedingly rarely.

Let me reassure the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East that the polygraph session cannot under any circumstances be used to gather evidence for a future prosecution. I am stating on the record that polygraph measures cannot be used to gather evidence for a future prosecution, and I hope that that provides reassurance.

--- Later in debate ---

[Stephen McPartland]

I am always willing to write to the Committee, as the right hon. Member knows. I am happy to go away, think about this issue and then write to the Committee, so that I can put in writing the safeguard that I do not want a polygraph test to be able to lead to future prosecutions. I think that would work.

[Holly Lynch]

Before the Minister moved to the polygraph point, he was talking about cryptocurrencies and said that they are already quite a dated concept; however, my proposal is that we add cryptocurrencies to the list, in paragraph 5 on financial service measures, that includes postal orders, cheques and bankers’ drafts. With that in mind, it might be worth making an explicit reference in that list to whatever form of digital currency or cryptocurrency, given that we know it is a focus for hostile state activity.

[Stephen McPartland]

The hon. Lady makes a very good point. As she knows, I am always prepared to improve legislation so that we are happy with it on a cross-party basis, it goes through the House and we can support our intelligence communities. I am very happy to look at that issue. I did not even know we could still get postal orders and bankers’ drafts.

Let me give some examples of how STPIMs could be used, specifically for the right hon. Member for North Durham—I know that he would like that. If a British national were recruiting, talent spotting and reporting for a foreign intelligence service, and the evidence to prove the foreign power links was too sensitive to be used in court, meaning that a prosecution was not viable, an STPIM that might prevent harm could include a financial order, to prevent the person from accessing funds from the foreign intelligence service; a restriction on contact or association with individuals, to prevent the person from being debriefed by the foreign intelligence service handler; and electronic communications device measures, to ensure full coverage of devices used by the subject. That is one example of how an STPIM could be used.

Another example relates to a British national working in one of our defence companies, and would prevent sensitive technology transfer. Suppose a disgruntled British national employee of an advanced technology company is seeking to market specialised, valuable and unclassified knowledge to foreign companies. The investigation and disruptive conversation means that the individual is moved to less sensitive work and their company computer access is restricted, but they cannot be dismissed. They remain disgruntled, but prosecution is not viable. In that case, we could disrupt travel to prevent an individual from meeting foreign representatives abroad, so that they could not pass the secrets over to them, and we could restrict contact and association with individuals in the UK for the same purposes.

This example relating to the intimidation of dissidents is particularly important. Suppose a senior member of, for example, a cultural organisation from a foreign Government based in the UK is seeking to exert pressure on dissident diaspora through intimidation, harassment and damaging rumours. The individual cannot be expelled or deported, so victims are afraid to make criminal complaints for fear of recrimination in their home country. The STPIM could be imposed, because prosecution is not viable—the victim will not testify or make a statement. We could put measures in place to prevent an individual from associating with the victim or members of their family. We could prevent serious violence by ordering the subject to relocate to an alternative area in the UK. The STPIM could be justified in closed court proceedings, because it would prevent any identification of the victim. I hope the right hon. Member for North Durham enjoyed those examples.

--- Later in debate ---

[Holly Lynch]

I will keep my remarks brief. Conditions A to E, set out in subsections (1) to (5), provide a clear framework that the Secretary of State must work within, with conditions that would then be tested by the court. I listened carefully to my friend the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East. His amendment probes whether clause 33 should apply the civil standards of proof in relation to the decision to impose prevention and investigation measures, by proposing that “reasonably believes” be replaced with

“believes on the balance of probabilities”.

In considering that, as the hon. Member said, we look to Jonathan Hall’s evidence in this Committee’s first sitting, and then to the Terrorism Prevention and Investigation Measures Act 2011, and we can see that the wording has pretty much been copied verbatim to this Bill.

With that in mind, and given Mr Hall’s assessment that the measures have not been overused, the lower numbers subject to TPIMs and the reality of just how resource intensive they are, I am satisfied that “reasonably believes” is justifiable, but I look forward to hearing the Minister’s response to the points raised by the SNP spokesperson.

[Stephen McPartland]

Clause 33 mirrors TPIMs, in that it specifies the conditions that must be met in order for the Secretary of State to impose prevention and investigation measures on an individual under an STPIM. Condition A is that the Secretary of State must reasonably believe that the individual is or has been involved in foreign power threat activity. Condition B is that some or all of the foreign power threat activity is new. That ensures that when a notice has expired after the five-year limit provided by clause 34, a further notice may be imposed only where the individual has re-engaged in further foreign powers threat activity since the start of the five-year period.

Conditions C and D outline the two limbs of the necessity test for imposing the measures, so the Secretary of State must reasonably consider, first, that the notice is necessary for protecting the UK from the risk of foreign power threat activity, and secondly, that it is necessary to prevent or restrict the individual’s involvement in foreign power threat activity by imposing the specific measures.

Those two conditions provide an important safeguard that makes it clear not only that must it be necessary in general terms to impose measures on the individual, but that, in addition, each individual measure that is imposed must be necessary in its own right. Condition E requires the Secretary of State to have obtained the court’s permission before imposing measures on an individual. The function and powers of the court on such an application are set out in clause 35.

In urgent cases in which the Secretary of State considers that measures must be imposed immediately, the case must be referred to court for confirmation immediately after measures are imposed. In practice, we expect the emergency power to be used very rarely. The conditions are designed to ensure that STPIMs are used only where they are necessary and proportionate, and they cannot be imposed arbitrarily. There are also several stages at which the courts will be involved in the STPIM process, including granting permission before a notice may be served or confirming one that has been made in an urgent case. The automatic substantive review of the decision to impose the STPIM and all its obligations and a right of appeal against decisions taken in relation to the STPIM provide checks and balances to the decisions taken by the Secretary of State, so I encourage fellow members of the Committee to support the clause.

I thank the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East and the right hon. Member for Dundee East for tabling their amendment. It proposes amending one of the conditions for imposing an STPIM by changing the wording from the Secretary of State “reasonably believes” to

“believes on the balance of probabilities”.

I reassure the hon. Gentleman and the right hon. Gentleman that in the development of the measures consideration was given to the conditions that must be met in such cases. The Government consider reasonable belief of a person’s involvement in foreign power threat activity to be the appropriate test for STPIMs. Foreign state intelligence operatives are highly trained, sophisticated and equipped to obfuscate in relation to their activities and avoid Government security measures. Given that, it is important that the threshold is not too high.

--- Later in debate ---

[Stuart C. McDonald]

The clause allows part 2 notices, or STPIMs, to be extended by a year. Not only that but, as drafted, the clause allows for up to four further extensions, thus allowing an STPIM to be in place for five years, even if there has been no new foreign power threat activity.

As we know, these measures can place really significant restrictions on people’s liberty. The ability to extend TPIMs was controversial and only happened after they had been in place for a significant period. The views of the previous Independent Reviewer of Terrorism Legislation, Lord Carlile QC, have been summarised as:

“The TPIM Act 2011 was a balance between on the one hand enabling administrative controls to be imposed outside the criminal process for a significant period of time, and on the other hand ensuring that individuals were not controlled indefinitely on the basis of an assessment that they had once engaged in terrorism-related activity, unless there was evidence that they have done some further act.”

Indeed, the stated purpose of TPIMs when introduced by the 2011 Act was that they were

“targeted, temporary measures and not to be used ‘simply as a means of parking difficult cases indefinitely’”.

The case for and against lifting the two-year cap was considered in detail by another independent reviewer, Lord Anderson, in his report, “Terrorism Prevention and Investigation Measures in 2012”. He observed that it was tempting to wish for longer in the most serious cases, noting:

“The allegations against some subjects are at the highest end of seriousness”.

However, he concluded that the two-year limit was an “acceptable compromise” because, in summary,

“even 2 years was a serious length of time in the life of an individual, and TPIMs should not be allowed to become a shadow alternative to criminal prosecution with their lesser standard of proof…with the possibility of no serious thought being given to how the measures might come to an end.”

It is easy for the Government to say, “Let’s mirror the current TPIM time limit as it is now,” but why should we do that? Those time limits were extended to five years only after about a decade of use of TPIMs. Starting with a five-year time limit appears to be jumping off at the deep end. If we want to mirror TPIMs, we should start off with a much shorter time limit, as happened with TPIMs, and then if, over time, evidence shows that a longer limit is required, we can make that change. But it should be based on evidence about how the orders are operating in practice and not just on saying, “Let’s cut and paste the existing position with TPIMs.”

[Holly Lynch]

I thank the hon. Member for Cumbernauld, Kilsyth and—

[The Chair]

Kirkintilloch.

[Holly Lynch]

Kirkintilloch East. Thank you for that, Mr Gray—make sure that is in Hansard.

I thank the hon. Member for amendment 56. Clause 34 stipulates that a part 2 notice can remain in force for a limit of five years. There are a number of overlapping clauses in this part of the Bill, focusing on reviews and the ongoing considerations about the necessity of a TPIM. When we get to clauses 39 and 40, I will speak to the importance of the TPIM review group, which Jonathan Hall made very clear in his evidence is essential if we are to learn anything from the lessons of TPIMs. On clause 34, could the Minister confirm the due regard that the Secretary of State must have for other agencies and the review group when considering whether to extend a part 2 notice?

[Stephen McPartland]

I will start with the clause and then deal with the amendment. Clause 34 provides for when a STPIM notice comes into force, how long it will remain in force and how many times it can be extended. It sets a five-year limit in total. Once a notice has been imposed, it remains in force for one year. Unless renewed, it will expire after that time.

If the Secretary of State believes that conditions A, C and D, which we have just discussed, are met, it may be extended for a further year up to four times, taking the total to five years. A further STPIM notice cannot be imposed after this time unless new foreign power threat-related activity is uncovered. I would also like to make it clear that the notice is reviewed every quarter. Those measures ensure that STPIMs cannot be imposed indefinitely, and there are constant safeguards throughout their imposition.

The one-year period and the five-year limit balance the need to protect against threats to the UK from individuals, and allow further extensions to be granted if there continues to be evidence of the risk of involvement in foreign power threat activity. The provisions do not just look back, but recognise the important work that our security services and police would need to carry out both before and after a notice expires. I would therefore appreciate the Committee’s support for the clause.

Amendment 56 relates to the time limits placed on part 2 notices. Like hon. Members, the Government agree that it is important to ensure that individuals are not placed on STPIMs indefinitely. That is why we have included two important time-limit safeguards. The first is that STPIMs can be extended only after a year if the conditions on which they were imposed are still met. In particular, the approach we have taken contains a number of points where positive action is required to keep an STPIM in place. That important safeguard ensures that an STPIM cannot remain in force when it is no longer appropriate.

Secondly, STPIMs can be extended on only four occasions. The hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East asked why we had not opted for two occasions, mirroring the original TPIM legislation. That is because of evidence over the last decade from our operational partners about what they feel is appropriate and necessary. We are mirroring their experience with TPIM notices over the last decade, and we will work with them on STPIM notices.

The one-year period and the five-year limit balance the need to protect against further threats. Given the safeguards I have outlined, I ask the hon. Member to consider withdrawing his amendment.