Investigatory Powers Bill (First sitting)

Joanna Cherry Excerpts

Thursday 24th March 2016 Public Bill Committees

[Joanna Cherry (Edinburgh South West) (SNP)]

I was previously standing junior counsel to the Scottish Government, which has some tangential interest to the serious crime provisions.

[The Chair]

Okay; that is all the interests out of the way. We will now hear oral evidence from David Anderson QC, independent reviewer of terrorism legislation. Before calling the first Member to ask a question, I remind all Members that questions should be limited to matters within the scope of the Bill, as always, and that we must stick to the timings in the programme motion that the Committee has agreed. For this session, we have until 12 noon. Could the witness please introduce himself for the record?

David Anderson: I am the independent reviewer of terrorism legislation and the author of the report “A Question of Trust”.

--- Later in debate ---

[The Chair]

Yes, but as briefly as you could, please. If not, you can provide a written answer.

David Anderson: Internet connection records are a form of communications data. I said rather conservatively in my report that there were some forms of communications data that should be independently authorised, including novel and contentious ones. One of the respects in which the Bill did not really follow my report—I should add that in most respects it did—was in not providing for that outside the protected categories of journalists, lawyers and so on. I could well understand it if members of the Committee or others were to take the view that ICRs were of such a nature that to allow self-authorisation by the police might not be a sufficient safeguard.

[Joanna Cherry]

Q It is a privilege to serve under your chairpersonship, Ms Dorries.

Good morning, Mr Anderson. The first question that I want to ask you follows up on questions about the operational case for bulk powers. We heard on Second Reading of this Bill in the Chamber that in the United States of America, the bulk collection of citizens’ data has been heavily curbed, as it was considered to be

“not essential to preventing terrorist attacks”.

Most damningly, the American President’s privacy and civil liberties oversight board said that it was

“aware of no instance in which the”

National Security Agency’s bulk records programme had

“directly contributed to the discovery of a previously unknown terrorist plot or the disruption of a terrorist attack.”

Bearing that in mind, do you agree that a proper independent assessment of the utility and effectiveness of bulk powers would need to look at the experience of their use in other jurisdictions?

David Anderson: What you are referring to is one type of bulk power that I myself looked at the necessity for in a great deal of detail. It is difficult, of course, to read across from section 215 in the US to what we have here, which is rather different. What we have here is service providers being required to keep phone logs, details of when emails were sent and so on.

If you look at my report, “A Question of Trust”, you will see that there are several annexes there and quite a bit of text in which I set out just how useful the police find that power to be. I also found when I was in Germany, where at the time they did not have the power because Germany’s constitutional court had removed it, that the police and the internal security service were crying out for something along those lines. So, that is one aspect.

I cannot speak for the US position—different power, different circumstances—but particularly in dealing with paedophile crime, I was satisfied that this, if you like, plain vanilla element of bulk collection communications data was something for which there was an operational need.

[Joanna Cherry]

Q So, in your investigations for your report, you looked at the experience of at least some other jurisdictions. Is that correct?

David Anderson: I did, yes.

[Joanna Cherry]

Q So would you agree that a proper independent operational case for the support of this Bill should look at the experience of other jurisdictions?

David Anderson: Well, we have had three detailed reports. We have had the pre-scrutiny reports, as well. Evidence was heard by some of those Committees from people from other jurisdictions. It is always nice to think one is fully informed about what goes on in the rest of the world. Incidentally, that is very difficult in this field, because very few countries have been as up front as this Bill is about exactly what powers are used and how they are used.

For example, you mentioned the US and section 215, but of course there are other bulk powers that have not been curbed in the way you suggest. There is section 702, which was given a clean bill of health by the privacy and civil liberties oversight board. There is also executive order 12333, about which very little is known, but which seems to give very intrusive and extensive powers outside the US. So I am hesitant about drawing these country comparisons, although I accept that evidence from other countries is always useful.

[Joanna Cherry]

Q Bearing in mind the pressures of time, may I move on to my next heading, which is the scope of bulk powers? On Second Reading, the Home Secretary said that

“certain bulk powers are predominantly those for foreign usage, rather than in relation to the United Kingdom.”—[Official Report, 15 March 2016; Vol. 607, c. 823.]

Would I be correct in understanding that most of the bulk powers proposed in the Bill could, in fact, apply to the data of UK citizens?

David Anderson: The way it works, as I understand it, is that the use of the bulk powers must be motivated by a desire to retrieve data relating to people outside the UK. Of course, there will be what fishermen call a “bycatch” of people in the UK whose data are unavoidably retrieved during that process. The safeguard for people inside the UK is that if anyone wants to look at the content of that stuff, they need an individual warrant relating to that person.

[Joanna Cherry]

Q But would we be correct in understanding that, for example, bulk personal datasets will comprise the personal data of United Kingdom citizens?

David Anderson: That is certainly true.

[Joanna Cherry]

Q Would we also be correct in understanding that bulk communications data will comprise data relating to British citizens?

David Anderson: Indeed, that is true and has been the position for, we now know, some 10 or 15 years.

[Joanna Cherry]

Q So if an impression were to get about that bulk powers are merely about obtaining information on people who live overseas, that would be incorrect.

David Anderson: That would be incorrect, but of course neither of the two examples you gave me was about the content of people’s communications. The first was about lists and registers, and the second was about communications data.

[Joanna Cherry]

Q My third heading is legalities. You will be aware that the United Nations special rapporteur on the right to privacy has expressed concern that some aspects of the Bill may not comply with either European Union law or the UK’s obligations under the European convention on human rights. He expressed particular disquiet about bulk surveillance and bulk hacking, and suggested that those powers prima facie failed the benchmark set by the European Court of Justice in the Schrems case and by the European Court of Human Rights in the Zakharov case. Have you had a chance to consider his report?

David Anderson: I have.

[Joanna Cherry]

Q Do you have any view on what he has said in that regard?

David Anderson: I think he is advancing one view of what European law or international law might require. I do not think that it is the only possible view, and I would apply the same comment to the letter signed by 250 very distinguished lawyers and sent to The Guardian.

May I give you an example of the latest case in Europe to deal with these issues? In Szabó and Vissy v. Hungary, which was decided in January, the European Court of Human Rights described

“the massive monitoring of communications susceptible to containing indications of impending incidents”

as “progress” and suggested only that these powers needed proper legal safeguards, with which I think any sensible person would agree.

I think that there are two views at the moment, even within the European Courts. Where I disagree with the rapporteur and the 250 lawyers is on the suggestion that the position is now clear. It may of course become clearer, perhaps as soon as this summer when the Davis and Watson case is determined in Luxembourg, but I do not think that the case law has yet solidified.

[Joanna Cherry]

Q So your view would be that there are potentially two competing arguments as to where the case law is heading, but we do not know ultimately what the situation is, although we may have a better indication when there is a judgment in the Davis and Watson case later this year.

David Anderson: There are also the Strasbourg cases of Big Brother Watch and Liberty. I do not know when those judgments will come, but there are two views, basically. One is that bulk access to content, even only by machines, is just wrong and that, however strong the operational case for it and however minimal the actual intrusion into people’s private lives, it cannot be justified. The other, more pragmatic view is that it is a question of proportionality and that one ought to look at the strength of the operational case, just as one ought to look at the degree of intrusion into privacy.

[Joanna Cherry]

Q I want to ask you briefly about bulk personal datasets. It is possible, is it not, that medical information pertaining to every single citizen of the United Kingdom could be scooped up in a bulk personal dataset?

David Anderson: I do not believe that there is any statutory exclusion. Whether there is a justification for doing such a thing would depend, first, on whether the Secretary of State signed off on it and, secondly, on whether the judge was prepared to approve it.

[Joanna Cherry]

Q It would also be possible for bulk personal data sets in relation to children to be scooped up under this legislation as currently drafted. Is that right?

David Anderson: Again, I do not believe that there is any statutory exclusion.

[Joanna Cherry]

Q Do you agree that in the investigation of threats to national security and terrorism there can really be no justification for scooping up personal data in relation to children?

David Anderson: I am going to duck that one because bulk personal datasets were outside my remit. The use of bulk personal datasets, we now know, has been subject to annual review by the Intelligence Services Commissioner for several years. Perhaps he is the appropriate person to ask about that.

[The Minister for Security (Mr John Hayes)]

Q Thank you for coming, David. On bulk personal datasets, I note that you say that the members of the intelligence community that you have met, and what you have seen and heard from them, have confirmed the view that was expressed by the ISC and others. Are you clear about their efficacy and utility?

David Anderson: I think what I said was that bulk personal datasets had been looked at by the Intelligence and Security Committee and by the Intelligence Services Commissioner. I have read what they have said about that, including in closed hearings, and I said that what I was shown by the agencies was consistent with that, but I was not trying to do the same exercise that they had done of deciding whether these things were necessary or proportionate.

--- Later in debate ---

[Keir Starmer]

I can see other hands going up, so I will end there.

[Joanna Cherry]

Q To be clear, Mr King, is your evidence in relation to bulk interception and collection of data that there is intrusion and analysis of them by computer programs prior to any warrant being applied for?

Eric King: No. There will be warrants at the collection stage but at the moment it is simply 10. Those 10 warrants that are authorised every six months permit the agencies to intercept at an extraordinarily large scale: 50 billion connections every single day, and growing. We know that, in the past five years, that has increased by 7,000%. I say that those 10 warrants do not appropriately assess the proportionality requirements, and I do not think they are necessary in the current climate.

[Joanna Cherry]

Q Once the intercept has been collected, there is a stage of the process at which it is analysed by a computer, and that stage is not currently the subject of any legal regulation.

Eric King: That is right. It is internal authorisation by the agencies. We have no visibility on that. There has been no published material about that. In various court cases, disclosure has been sought better to understand those points, but we have not got it. The best I can gather, the internal authorisations inside GCHQ are at a very low level, mostly analyst by analyst even rather than going up to senior directors inside the agency.

[Joanna Cherry]

Q Just so we can be clear, does anything in the Bill involve legal regulation of that stage of the process?

Eric King: No, not at all. Our model is the same as it was 15 years ago. It is a very simplistic model that applies interception at one stage and then, when a human looks at it, an additional safeguard. However, that does not match the reality and, as a result, our warrantry, in my view, does not allow you to assess proportionality and necessity to an adequate level.

[Joanna Cherry]

Q We know now, because it has been avowed, that previous Administrations had unacknowledged arrangements for bulk interception of the internet in the United Kingdom. Can you tell us whether those resulted in the collection and analysis of ordinary British citizens’ communications?

Eric King: In the Bill and previous practice, there was a lot of focus on the fact that this would be foreign-focused—that the goal is to collect material outside the United Kingdom. The practical reality is that you cannot do that any more. All our communications slush around through the exact same undersea fibre optic cables as foreigners’. In terms of GCHQ’s collection programme, we do not know the exact percentage. I would encourage the Committee to try and seek out how many British communications are collected into this, but there is no way for them to distinguish between them at this point. When there is a foreign-focused power, at least for interception, the reality is that it is a massive amount of British communications. Your communications are not exempt from that and neither are mine, no matter quite what we might try.

[Joanna Cherry]

I would like to ask Ms Ogilvie a couple of questions if I may, Madam Chairman.

[The Chair]

Order. Time is very short now, because we have seven more people waiting to speak.

[Joanna Cherry]

Q I will ask one question briefly then. Liberty looked at the investigation by the Intelligence and Security Committee into the brutal murder of Fusilier Lee Rigby in May 2013. Did those inquiries suggest that if the security services had had more resources to cover lower priority level targets, the outcome could or would have been different?

Sara Ogilvie: The Intelligence and Security Committee report found that there were a number of failings that may or may not have led to the murder, but basically, the two suspects had both been known to the security services at various points. It had been decided not to treat them as priorities. When that decision was later changed and a warrant was sought to place one of the individuals under surveillance, delays meant that that warrant was not granted in enough time for that individual to be under surveillance at the appropriate moment. Those are absolutely not the powers in this Bill, or the use of powers in this Bill, that we have any exception with at all. That seems to us to be absolutely the right way to use powers. It was not a lack of information or a lack of target in this case; it was the fact that there was perhaps too much information to be used.

[Simon Hoare (North Dorset) (Con)]

Q Mr King, I am not a lawyer, so forgive me. Are you a parent?

Eric King: Pardon?

--- Later in debate ---

[The Chair]

If there are no further questions for Members, I thank the witnesses for their evidence, and we will move on to the next panel.

[Joanna Cherry]

On a point of order, Ms Dorries. In any forum that I have appeared in where the witness is being asked a question about a document, particularly a lengthy document, it is customary to afford them the courtesy of having a copy of the document in front of them. Might I suggest that if we are going to ask further witnesses about documents, we afford them that dignity?

[Simon Hoare]

Further to that point of order, Ms Dorries. To put the contra view to that expressed by the hon. and learned Lady, should not the Committee expect witnesses who are giving evidence to be properly briefed and to have in front of them documents on which they are likely to be cross-examined?

[The Chair]

I shall answer the substantive point of order. The information that the witnesses bring with them is their responsibility. It is not the normal procedure for them to have documentation in front of them or for the panel to know what information they have with them. As we decided at the start, they can always follow up in writing if they feel they did not have the right information.

[Joanna Cherry]

I am very grateful to you, Ms Dorries, for clarifying that questions and answers can be followed up in writing.

Examination of witnesses

Nigel Inkster and Lord Evans gave evidence.

--- Later in debate ---

[Keir Starmer]

Q I have one final question for either or both of you. Am I right in thinking that, as far as internet connection records are concerned, although the security and intelligence services would not say, “There are no circumstances in which we’d really need them,” in reality, they are relied on much less by the security and intelligence agencies than by law enforcement, as a separate component?

Lord Evans: It is not impossible that they could be of value in an intelligence sense, but I think the principal driver for using them or for obtaining them is for evidential purposes, and that is made clear publicly. It is principally a law enforcement and evidential issue to inform cases coming before the courts more often than it is an intelligence issue. You could construct a scenario in which it might be of value, but the purpose of putting them in the Bill, as I understand it, is law enforcement and providing criminal evidence.

[Joanna Cherry]

Q Lord Evans, I want to ask you about the savage murder of Fusilier Lee Rigby and the Intelligence and Security Committee investigation into that. It reported to Parliament that his killers had previously come to the attention of the Security Service on multiple occasions and that, in its view, intelligence reports were mishandled. I think I am right in saying that its inquiry suggested that, if the Security Service had more resources to cover more and lower-priority level targets, the outcome could or would have been different. Would you like to comment on that?

Lord Evans: The Lee Rigby murder took place after my time as director general—not that there is any connection between those two—so I am not very close to the actual facts. In general, one of the critical decisions—certainly for MI5, but it applies by logic to other people on counter-terrorism—is what you do not do. We have more leads which might connect to possible terrorist attack or to violent extremism than we can thoroughly investigate at any one time, so the service has created a quite rigorous triage process that ranks the seriousness of the available information, which is updated on a regular basis, and that drives therefore the allocation of resources.

The difficulty here is self-evident: obviously, sometimes you are working on the basis of fragmentary intelligence or unclear intelligence, so you have to make the judgment as to whether you put resources in to pursuing that or whether you put the resources in to something else. The fact is that sometimes you make a judgment on the available best evidence and then find out later that, actually, the situation was more serious than was apparent. That appears to have been the case with Lee Rigby.

Exactly the same issue came out after the 7 July bombings in London. Mohammad Sidique Khan had appeared in the context of Security Service investigations and police investigations a couple of years before. At that stage, he was assessed to be not a very serious threat and therefore he was put aside so that we could come back to him later while we did other things that were more immediately pressing, but in the interim his activities developed.

It is a problem. The question of course is: how do you get around that problem? The first thing is to use the best quality information available. The second is that the more resources you have, the more yesses you can give as to whether we investigate any one individual, but then you get into a judgment about how many people we think it is proportionate and necessary to investigate. If you doubled the resources of the Security Service again, there would still be cases where you might say, “We don’t have the resources to pursue that.” You ultimately get into a political judgment as to how much resource you want put into this and how much intrusion you have into the activities of people who might not be quite as threatening as others. That is a judgment that has to be made.

[Joanna Cherry]

Q If the Government had given you more resources for more boots on the ground, would it have been possible for the security services perhaps to have had targeted surveillance on lower priority targets prior to this particular dreadful murder?

Lord Evans: There is no doubt that to some extent intelligence activity in counter-terrorism is scalable. What has happened since 9/11 is that the resources available to the Security Service and the other agencies have increased very considerably under both Governments—or all three Governments, if you want to put it in those terms. We have therefore probably got within the Security Service three or four times as much resource as we had previously.

There has been a very considerable uplift, but it is not just a question of people. Importantly, it is also a question of powers. Your capability to cover and monitor threats is not very often, although it sometimes is, a matter of boots on the ground; it is a matter of the overall toolbox available. One of the attractions of digital intelligence and the sort of powers that are outlined in the Bill is that it enables considerable coverage of threats without having to deploy lots and lots of people following people around and so on, which in some ways would be more intrusive.

[Victoria Atkins]

Q We talk about the security services and the other agencies as block organisations, but of course the quality and effectiveness of an organisation depend on the people who make up that organisation. Could you give us, as far as you are able, an assessment of the qualities and character of the people who work for the agencies that you have led?

Nigel Inkster: In the United Kingdom, we like to maintain the position that intelligence and security work is a high-status profession. We look for quality people who might otherwise go into areas such as the law, merchant banking and that sort of thing. That is the level that we are pitching for, and that is not always the case around the world. In that regard, the United Kingdom distinguishes itself in the right way, in my view. We have very well educated and well motivated people. In my service, for example, we had people joining us in the wake of 9/11 who had taken very significant salary cuts and left high-paid jobs in the City to come and do this work precisely because they were motivated by and committed for what we regarded as the right reasons.

During my time in SIS, I was responsible inter alia for compliance with all the different oversight mechanisms to which we were subject. I had extremely long conversations with the various commissioners responsible for overseeing those activities. In all cases, their judgment was that the people we employed were highly motivated, took their responsibilities seriously and understood the powers that they had, the need to act lawfully and the need to use those powers in a wise, measured and proportionate manner. I think we are very fortunate as a country.

Lord Evans: I would agree with that. I think we have employed people who are intellectually able, are motivated by public service and are ethically sensitive. It might be useful to the Committee to invite the Clerk to find comments made by Lord Brown of Eaton-under-Heywood, a former Supreme Court judge and former intelligence commissioner, when the 2015 Counter-Terrorism and Security Bill was being discussed in the House of Lords. He gave a very, very strong endorsement of his experience of the quality and integrity of the members of the intelligence services that he had seen. If you want an independent voice, rather than a voice from inside the agencies, that might be worth finding.