Investigatory Powers Bill (Eighth sitting)

Joanna Cherry Excerpts

Committee Debate: 8th sitting: House of Commons
Tuesday 19th April 2016 Public Bill Committees

[The Chair]

Thank you very much.

Clauses 70 and 71 ordered to stand part of the Bill.

Clause 72

Lawfulness of conduct authorised by this Part

[Joanna Cherry (Edinburgh South West) (SNP)]

I beg to move amendment 246, in clause 72, page 57, line 35, leave out from “subsection (1)” to end of line 40.

This amendment ensures that if conduct cannot be justified it must remain unlawful.

[The Chair]

With this it will be convenient to discuss amendment 148, in clause 72, page 57, line 36, leave out paragraph (b).

[Joanna Cherry]

I think I can take this in fairly short compass. The clause deals with the lawfulness of conduct authorised by this part of the Bill. The amendment would delete clause 72(2)(b), the effect of which would be that conduct would have to remain unlawful if it could not be justified. As it is currently worded, the clause allows an exception to that principle, and that is not an appropriate exception. Conduct is either lawful or unlawful. If it is unlawful, it should be characterised as such and should not be justified. Strictly, if the amendment were to be passed, subsection (3) would have to be left out as well, for tidying-up purposes.

[The Solicitor General (Robert Buckland)]

May I reassure the hon. and learned Lady that the provisions relating to lawfulness of conduct authorised by part 3 of the Bill replicate those that currently apply in the Regulation of Investigatory Powers Act 2000, and the Bill goes no further in providing indemnity from civil liability for conduct incidental to or reasonably undertaken in connection with a communications data authorisation? The clause is drafted to ensure that a person who engages in conduct only in connection with an authorisation cannot be subject to civil liability unless that activity could itself have been authorised separately under a relevant power. It must follow that the removal of that provision would mean that a person who was acting lawfully under an authorisation that had properly been granted under the Bill would be at risk of civil liability if some incidental or reasonably connected conduct were not expressly covered by the authorisation.

I can see the thrust of the hon. and learned Lady’s argument, but I hope that I have reassured her that the Bill does not go any further than the status quo. For that reason, I urge her to withdraw the amendment.

[Joanna Cherry]

I beg to ask leave to withdraw the amendment for the time being.

Amendment, by leave, withdrawn.

Clause 72 ordered to stand part of the Bill.

Clause 73 ordered to stand part of the Bill.

Clause 74

Certain transfer and agency arrangements with public authorities

Question proposed, That the clause stand part of the Bill.

[Keir Starmer (Holborn and St Pancras) (Lab)]

There are matters relating to this clause on which I would like to press the Minister. This is the clause that provides for what is effectively the transfer of certain functions between the Secretary of State and other public authorities. The functions to be transferred are the functions in clauses 58 to 60, at which we looked in some detail last week: the filtering arrangements for obtaining data. As set out in clause 58, it is for the Secretary of State to maintain and operate arrangements. It is then for the relevant public authority, acting through a designated senior officer, to effectively carry out the exercise, using authorisations as and where necessary and appropriate. We discussed that arrangement.

Clause 74 provides for a transfer of functions of the Secretary of State—which I take to include establishing, maintaining and operating arrangements—from the Secretary of State to another public authority. That seems to me to cut through the thrust and the purpose of clause 58, which has a clear hierarchy to it: the Secretary of State, then the designated senior officer. Subsection (1)(b) is freestanding and transfers any function exercisable by a public authority back the other way to the Secretary of State, so there is a complete provision for a swap of roles. Subsection (3) indicates that:

“Regulations under subsection (2) do not affect the Secretary of State’s responsibility for the exercise of the functions concerned”.

Then schedule 5, in the back of the Bill, is referred to, but that does not add a great deal.

The question for the Minister is: how is it anticipated that these powers are to be exercised? On the face of it, this is an odd structure for a Bill to set out. This structure goes from the Secretary of State down to the relevant public authority, with the Secretary of State having a much wider role of setting up the arrangements, only for us to find, several clauses later, that it is possible to flip the functions and have the public authority making the arrangements. That seems to remove some of the formality and the safeguards intended by clause 58.

--- Later in debate ---

[Keir Starmer]

I indicated would not press the amendments at this stage. I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Question proposed, That the clause stand part of the Bill.

[Joanna Cherry]

I oppose the clause. I hear what the Minister has to say, but I am not reassured by the Government’s approach. Harking back to something I said last week, I do not think that the Government have got the balance right, because in seeking to gather to themselves an extraterritorial application through United Kingdom law, there are hidden dangers.

If international companies are required to arbitrate between conflicting legal systems, it is leaving the protection of human rights to the good will and judgment of those companies. Companies such as the ones the hon. and learned Member for Holborn and St Pancras mentioned have already expressed concerns to David Anderson, for his report “A Question of Trust”, that

“unqualified cooperation with the British government would lead to expectations of similar cooperation with authoritarian governments, which would not be in their customers’, their own corporate or democratic governments’ interests.”

In my view, the most appropriate way forward is to pursue the route, which I am pleased the Minister has assured us that the Government are well down, of mutual legal assistance agreements with other states. If we do not pursue that route in the way that both David Anderson and Sir Nigel Sheinwald recommended with appropriate alacrity, and instead rely simply on clauses such as this one, which are spread throughout the Bill, we will create real difficulty for corporate entities. We will also create difficulties for the international enforcement of human rights, which I consider a bit more important than difficulties for corporate entities, although we should not set the latter to one side, because they are significant. For that reason, notwithstanding the Minister’s assurances, the SNP opposes clause stand part.

[Mr Hayes]

I will not make a case again for the clause, but I shall say this, in the spirit of helpfulness and kindness. It is really important that the Committee sends out a combined message to overseas communications service providers—on which the obligations will have an important effect because their commercial endeavours have a significant relationship with the powers we are trying to cement in the Bill—so that they have a very clear impression that we as a Committee of this Parliament are clear that we expect them to do their bit to do what is right. We should not, out of a sense of good will, allow ourselves to be misled and encouraged not to have high expectations or make serious demands of those organisations.

I simply say to the hon. and learned Lady that clause 76 is about giving a clear signal, as does clause 57, with which it should be read in tandem, that telecommunications operators should comply with the notice given, whether or not they are in this country. I accept that that is difficult and challenging—I made that point at the outset—but my goodness, it is vital that we take these steps. I know that she is open-minded and a woman of great good will, but we should not allow that to dilute in any way that common message to those big companies. I do not want those companies to get away with anything that that should not get away with.

[Joanna Cherry]

I am not so much concerned about the message we send out to the companies; I am more concerned about the message we send out internationally and potentially to authoritarian regimes. The difficulty is that if the British Government demand from these companies unqualified co-operation with British laws, that might encourage authoritarian Governments to do likewise. We clearly would not want that, so we need to be very careful about the messages we send out and think carefully about their full implications. That is why such matters should be approached by way of mutual legal agreement internationally, rather than the unilateral imposition of one Parliament’s will outwith the area where its sovereignty operates.

Question put, That the clause stand part of the Bill.

--- Later in debate ---

[Keir Starmer]

The message to my and all of our constituents is that, even if they are not a target, a record of the websites they have visited can be retained under a data retention order, and if retained will be retained for 12 months—every website they have visited. But if somebody later wants to access it, there is then a tighter test for that. The chilling effect of clause 78 is that the websites visited will be retained if a retention order is issued. We need to be absolutely clear about that. The tighter definition does not kick in until a later stage of the exercise, and that is a cause of real concern to our constituents, certainly to the people who have engaged with me on the topic, and to our fellows across both sides of the House.

[Joanna Cherry]

I note what the hon. and learned Gentleman says about web addresses being revealed. Is it not also the case that we see from the data released by the Home Office, after being pressed about its factsheet accompanying ICRs, that what will be revealed is not only web addresses and IP addresses, but the names, addresses, email addresses, phone numbers and billing data of customers—our constituents?

[Keir Starmer]

I cannot double check on my feet, but that sounds like the further evidence that was put before the Joint Committee when it was in the middle of its deliberations. In fairness, the Home Office did go beyond websites to include some, maybe all, of the matters to which the hon. and learned Lady just referred.

The way this will operate in practice is a cause of real concern. The Secretary of State, without the double check of a judicial commissioner, and operating against a low-level threshold—clause 53(7)—can issue a retention order that will permit the retention of a record of all the websites that somebody has visited. That record will then be kept for 12 months, albeit with a different test if it is to be accessed later.

The amendments—I think you have called them the first set of amendments, Ms Dorries—are intended to construct in the first instance a different framework around this power, because it is so extensive, and put it in the hands of a judicial commissioner rather than the Secretary of State. That would provide a greater safeguard in relation to clause 78, with independent oversight through the function of the judicial commissioner. Alternatively, amendments 152, 153 and 222 would give the Investigatory Powers Commissioner some oversight. In other words, the intention behind these amendments is to put some rigour and independence into the exercise of what is a very wide power that, in fact, is the starting point for the exercise of all the other powers under the parts of the Bill that we are now concerned with.

Anxiety has been expressed on a number of occasions about cost. Huge amounts of data could be required for retention under clause 78. The Government have estimated the cost at £170 million. That is considered to be a gross underestimate by those who will no doubt be called upon to actually retain the data. For those reasons, these amendments are intended to tighten up a clause that is very wide and very loose. It permits a huge amount of data to be retained, including websites visited by you, by me, or by our constituents.

--- Later in debate ---

[Joanna Cherry]

The Minister talked about the duty to take into account the likely benefits of the notice, but does my hon. Friend agree that something may be beneficial without being necessary?

[Gavin Newlands]

I agree with my hon. and learned Friend. We are not opposed to every measure in the Bill. There are benefits, but unfortunately they are not covered by enough safeguards and are not drawn tightly enough. I would like to make progress but I will give way once more.

--- Later in debate ---

[Gavin Newlands]

I appreciate what the hon. Lady says but, as I am not a lawyer, I am struggling to distinguish the difference between Scottish and English law. Perhaps my colleague could address that.

[Joanna Cherry]

My hon. Friend will no doubt agree that, in Scotland at least, it is the police who investigate serious crime, under the direction of the Lord Advocate.

[Victoria Atkins]

Will the hon. Gentleman give way?

--- Later in debate ---

[Gavin Newlands]

I hear what the Solicitor General has said, but I do not wholly agree with him. I reserve the right to bring this back at a later stage. I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

[Joanna Cherry]

I beg to move amendment 306, in clause 78, page 61, line 18, at end insert—

‘(2A) A retention notice may not require a telecommunications operator to retain any data belonging to a third party data, unless that third party data is retained by the telecommunications operator for their own business purposes.”

[The Chair]

With this it will be convenient to discuss amendment (a) to amendment 306, leave out “notice” and insert “warrant”.

[Joanna Cherry]

Amendment 306 would insert at the end of clause 78(2) a provision in relation to third party data. Third party data are defined in the code of practice as data that a communications service provider is able to see

“in relation to applications or services running over their network…but does not process that communications data in any way to route the communication across the network”.

To its credit, the Home Office has been unequivocal that such third party data would not be covered in the Bill; the Home Secretary informed the House on 4 November 2015 that the Bill

“will not include powers to force UK companies to capture and retain third party internet traffic from companies based overseas”.—[Official Report, 4 November 2015; Vol. 601, c. 969.]

The draft code of practice for communications data states at paragraph 2.61:

“A data retention notice can never require a CSP to retain the content of communications or third party data”.

The overly broad definition of relevant communications data, which now extends to 16 different definitions and sub-definitions, could however be interpreted as giving the Secretary of State the power to require a communications service provider to retain third party data, since the definition does not expressly exclude third party data unless this amendment is agreed. There are currently no clauses in the Bill that explicitly state that communications service providers will not be required to retain third party data. That is the purpose of the amendment. Given that they have been so clear on the Floor of the House and in the code of practice that that is their intention, if the Government will not accept the amendment, the Minister must tell us why. Where we are dealing with such potentially intrusive powers, we must be as clear as possible.

[The Solicitor General]

Amendment 306 is tabled, quite properly, to tease out from the Government the more detailed reasoning behind the important statement made by the Home Secretary on Second Reading. The hon. and learned Lady is quite right to refer to that statement. I once again reiterate the Government’s position that we will not be requiring the retention of third party data through these provisions.

The question is how best to achieve that; therein lies the tension. Attractive though the approach advanced by the hon. and learned Lady might be, there are some drafting issues and problems about legal certainty, which mean that putting those provisions in the Bill with suitable detail is problematic.

One of the main functions of the Bill—and one of my desiderata—is to ensure that it is resilient and stands the test of time. My concern is that if we end up with a definition that is too technologically neutral, it will either fail the test of time in this place, or be subject to challenge. As a Law Officer, legal uncertainty is something I have to take very seriously when considering how legislation is presented. That is why I commend the detailed provisions within the draft code of practice on third party data—paragraphs 2.68 to 2.72—that the hon. and learned Lady referred to. That is not only an explicit reiteration of our commitment but the sort of detail needed for those operating the provisions, which could not be properly put in the Bill.

It is generally well understood what third party data are, but perhaps I should briefly explain the important areas of detail that could not be covered on Second Reading. Where one communications service provider is able to see the communications data in relation to applications or services that run over their network, but does not process that communications data in any way to route the communication across the network, then that is regarded as third party data. For example, an email provider, such as Yahoo or Gmail, knows that a certain internet access service, such as BT Internet, was used to send email, but that fact is not needed or used to send it. So it is in everybody’s interest, not least that of the service providers themselves, that there is sufficient clarity about the data that can be retained under the provisions. As I have said, I think the code of practice is the right vehicle for this. It is also the appropriate vehicle for ensuring that there can be a sufficiently detailed definition of third party data for the reasons I have outlined. In those circumstances, I respectfully ask the hon. Lady to consider withdrawing her amendment.

[Joanna Cherry]

I am not happy about withdrawing the amendment in the absence of elaboration of what the Solicitor General means by drafting issues and problems of legal certainty. I am not clear at the moment why we cannot have both the amendment and the further elaboration that will be provided in the codes of practice.

Amendment proposed to amendment 306: (a), leave out “notice” and insert “warrant”.—(Gavin Newlands.)

Question put, That the amendment be made.

--- Later in debate ---

[The Solicitor General]

The hon. Gentleman makes a proper point about security. This, in respect of the code of practice and in collaboration with the industry, will be at the forefront of everybody’s mind. What is important is that the Government do not have a pick-and-mix or help yourself avenue within which they can mine data for their own capricious purposes.

The framework of the Bill quite properly severely circumscribes the circumstances within which the Government can seek access to that material. Most importantly, when it comes to content, the warrantry system—the world-leading double lock system we are proposing—will apply. An internet connection record is not content; it is a record of an event that will be held by that telecommunications operator. It relates to the fact of whether or not a customer has connected to the internet in a particular way. If it goes further into content, the warrantry provisions will apply. It is important to remember that framework when determining, and describing and putting into context, what we are talking about. The Committee deserves better than indiscriminate shroud-waving about prospects and concerns that simply do not arise from the measures in the Bill.

The hon. Gentleman quite properly raised the Danish experience. The Danish Government and authorities are in regular conversation with the United Kingdom Government. That dialogue goes on because they are naturally very interested to see how our model develops, although there are important differences that should be set out briefly. The Danish legislation was not technology neutral, unlike these proposals, because it specified two options that proved unworkable. We work with operators case by case so that the best option for their network at the appropriate time will be determined. The Bill builds on existing data retention requirements, such as the retention of data necessary to resolve IP addresses, which regime already exists under the Counter-Terrorism and Security Act 2015. The full cost recovery underpinning by the Government means that there is no incentive for communications service providers to cut corners, as I am afraid happened in Denmark. There are important differences between the two.

The hon. Gentleman rightly talks about IPV6. Although it is a great aim and something that all of us who have an interest in this area will have considered carefully, it still is, with the best will in the world, a way away, I am afraid. It will take a long time for all service providers to implement in full, and until then, there will be both types of system. Even with IPV6, CSPs may choose to implement address sharing or network address translation, meaning that it is not the guaranteed solution that perhaps has been suggested. Servers who host illegal material are much less likely to move to that system, meaning that, in practice, IPV4 may well remain with us. We therefore have to act in the interim, because, as has been said, the drift away from what I have called conventional telecommunications to the internet carries on whether we like it or not. We have to face up to the world as it is, rather than the world as we would love it to be, and therefore take into account the fact that we are in danger of being unable to detect criminality and terrorism.

[Joanna Cherry]

The Solicitor General says we have to face up to the world as it is. Why is it, then, that no other democratic nation in the world is implementing legislation of this sort?

[The Solicitor General]

The hon. and learned Lady has asked that question before, and I have said to her before that somebody has to step up, try it and make that change. I am proud that the United Kingdom is prepared to do that, as we have done it in so many ways.

[Joanna Cherry]

Is the Solicitor General aware that it is not that other countries have not looked at the problem? They have looked at the problem and decided that this is not the way to solve it.

--- Later in debate ---

[Keir Starmer]

As members of the Committee will have observed, these tidying-up amendments are consistent with previous amendments that would have entrusted decision making to a judicial commissioner rather than the Secretary of State. We had the discussion in principle in relation to those earlier amendments, which I withdrew, and I will not repeat my arguments now, although I would like to return to them at a later stage.

[Joanna Cherry]

As the hon. and learned Gentleman says, the amendments would require that review under clause 80 be by a judicial commissioner rather than the Secretary of State. Will the Government tell us why the provision of such a route of review would not, in their opinion, give the telecommunications providers greater reassurance that notices are not only lawful, necessary and proportionate but stable and legally certain? It seems to me that a review by a judicial commissioner, or at the very least by the Investigatory Powers Commissioner, would provide that reassurance.

[The Solicitor General]

The hon. and learned Lady asks a perfectly proper question. I reiterate the position that we have taken in principle: the Secretary of State is the appropriate and accountable person to be responsible for reviewing retention notices. However, although the Secretary of State must be responsible for giving notices and must therefore be the person ultimately responsible for deciding on the outcome of the review, that does not mean that she or he can make the decision on the outcome of the review without consultation—far from it.

Clause 80(6) ensures that the Secretary of State must consult both the Investigatory Powers Commissioner and the technical advisory board. The commissioner must consider the proportionality of the notice; the board must consider the technical feasibility and financial consequences of it; and both must consult the operator concerned and report their conclusions to the operator and the Secretary of State. Only then can the Secretary of State can decide whether to vary, revoke or give effect to the notice. That system provides rigorous scrutiny of the notice and maintains the accountability of the final decision resting with the Secretary of State. We therefore believe it is the best mechanism for review. Accordingly, I commend the unamended clause to the Committee.

--- Later in debate ---

[Joanna Cherry]

The clause relates to extraterritorial effect and the SNP’s opposition is for the same reasons as outlined in relation to clause 76.

Question put, That the clause stand part of the Bill.

--- Later in debate ---

[Keir Starmer]

I am grateful to the Minister. If he could point to the provision that makes good the submission he has just made, then that will deal with this particular point. Just to be clear, subsection (6) is intended to ring-fence and exclude from one of these warrants communications the interception of which would

“constitute an offence under section 2(1)”,

but only in relation to communications in the course of their transmission in the real sense of the term, not including those that are “stored”. I put on the record—if this is capable of being answered, so be it—that “stored” in subsection (6) has the same meaning as in clause 3, which is intended to include stored communications within the prohibition. I will not take it any further; the Minister has my point, which is that one would expect subsection (6) to protect the same content that is expressly protected by clause 3(4), but it does not—unless he or somebody else can point to another provision that adds to subsection (6), though that would be an odd way of doing it.

I will move on. Subsection (9) defines targeted examination warrants. This is important because subsections (1) to (8) deal with targeted equipment interference warrants—warrants issued in a targeted way; the targeted examination warrant deals with examining material obtained by way of a bulk warrant. It therefore serves a different purpose. Subsection (9) is an extremely wide provision:

“A targeted examination warrant is a warrant which authorises the person to whom it is addressed to carry out the selection of protected material…in breach of the prohibition in section 170(4)”.

To understand that, we need to turn to section 170(4), which raises questions that relate to an argument I made earlier on another, not dissimilar, provision. It states:

“The prohibition…is that the protected material may not…be selected for examination if (a) any criteria used for the selection of the material for examination are referable to an individual known to be in the British Islands at that time, and (b) the purpose of using those criteria is to identify protected material consisting of communications sent by, or intended for, that individual or private information relating to that individual.”

That is intended to give protection to individuals known to be in the British islands, by placing limits on the examination of their material: in relation to their material or their communications one needs a targeted examination warrant to get around the prohibition in clause 170(4). The point I make here is similar to the point that I made before: this is temporal. Whether a person is in the British islands or not depends on where they are physically. I am protected so long as I am in the British islands, but I fall out of protection—as would everybody else—the moment I leave them, whether I am leaving for a day, a week, a month or a year. That is a real cause for concern, as is the wide definition of protected material that immediately follows in clause 88(9); amendment 382 would limit the extent of that definition by stopping the clause after the words “Part 6”, which are on page 67, line 40, of the draft Bill.

In conclusion, this is a very wide-ranging clause, and it contains insufficient safeguards—if there are safeguards, they should be in the Bill. There are questions on subsections (6) in (9), taken in conjunction with clause 170(4), that the Minister will have to deal with.

[Joanna Cherry]

I rise to support the hon. and learned Gentleman in his submissions on these two amendments. As we have just reached part 5, I want to take the opportunity to make some general comments on it. Powers to conduct equipment interference—or “hack”, which is the more generally used term—are new; they do not exist in any previous legislation. They therefore require significant scrutiny, by the Committee and by parliamentarians generally, before they are added to the statute book. By its very nature, hacking is an extremely intrusive power, because it grants the authority to see all past and future information and activity on a computer or other device. Beyond the implications for privacy, the potential ramifications for the whole country’s cyber-security and for fair trials mean that hacking should be used only as a tool of last resort. The SNP’s position is that stronger protections must be added to the Bill.

--- Later in debate ---

[Keir Starmer]

I beg to move amendment 384, in clause 89, page 68, line 13, leave out from “information” to end of line 15.

This amendment acknowledges that “data” relating to the fact of a communication or the existence of information has meaning and must not be exempt from privacy protections afforded to other categories of data.

This amendment deletes the words

“or from any data relating to that fact”.

It is important because an equipment interference warrant can permit interference with equipment data, as in clause 88(2)(b). As we have seen, clause 88(9) makes provision for protected material, the definition of which includes equipment data. Over the page, clause 89 deals with the meaning of “equipment data”:

“(a) systems data;

(b) data which falls within subsection (2).”

Subsection (2), broadly speaking, refers to systems data as identifying data that are included in, attached to or associated with a communication but that can be separated from it and that, if separated,

“would not reveal anything of what might reasonably be considered to be the meaning (if any) of the communication”.

That is a logical way of approaching it—data linked to a communication that can be separated from it, but if separated, they would not reveal the meaning of the communication. Thus, it does not undermine the special protection given to the communication.

Then the final part of clause 89(2), paragraph (c), says

“disregarding any meaning arising from the fact of the communication”.

As has been said today, the fact of the communication, in many respects, can be as revealing as the content. However, the provision goes on to say

“or from any data relating to that fact”,

which broadens even further the exclusion from protection intended for communications.

In that way, the clause undermines the very protection being given to communications, so this short amendment would omit the words that I have indicated, in order to limit the exclusion from protection for the communication.

[Joanna Cherry]

May I add my supportive comments? This is a joint amendment from the Labour party and the Scottish National party.

--- Later in debate ---

On resuming—

[Joanna Cherry]

I rise to add my support to amendment 384 on behalf of the Scottish National party. Historically, communications data were considered much less revealing than the content of the communication, and consequently the protections offered to communications data under RIPA were weaker than those existing in the interception regime. However, as communications have become increasingly digital, the data generated are much more revealing and copious than before, allowing the state to put together a complete and rich picture of what a person does and thinks, who they do it with, when they do it and where they do it.

As the Bill stands, clause 88(9) would allow for the examination of potentially vast amounts of data on people in Britain obtained under bulk equipment interference warrants, as vague categories of “data” in 88(9)(a) and (b) are asserted to have no meaning. Data relating to the fact of a communication or the existence of information do have meaning and must not be exempt from the privacy protections afforded to other categories of data.

I urge the Committee to ensure that the Bill does not treat data relating to the fact of a communication or the existence of information relating to that fact as unimportant. In fact, there is extraordinarily high value to such material, precisely because it is highly revealing. It therefore demands equal protection.

[Mr Hayes]

All these disruptions and delays are adding interest and variety to our affairs. There is a straightforward argument for why the amendment is unnecessary, which I will make. If that is insufficient to persuade the Committee, I will add further thoughts.

The straightforward reason why the amendment is unnecessary is that it would undermine the principle that the most robust privacy protections should apply to the most intrusive kinds of data. I simply do not agree with the hon. and learned Lady that, for example, systems data—the highly technical data that will be separated out as a result of the endeavours in this part of the Bill—are better excluded from those extra protections. The unintended consequence of the amendment—at least, I hope it is unintended—is that it would lead to disproportionate access requirements for less intrusive data. That would be unhelpful and could, through confusion, hamper the work of the services.

--- Later in debate ---

[Keir Starmer]

I am grateful to the Minister, first for spelling out in detail the intended operation of the clause and, secondly, for indicating his willingness to write on the matter. This is something that ought to be in the Bill. My clear reading is that the amendment would not ring-fence anything from examination; it would simply require a warrant under clause 88 if equipment data, having satisfied all the other provisions under subsection (2)(a) to (c), included anything where there was a meaning arising from fact communication and so on. I will therefore press the amendment to a vote.

[Joanna Cherry]

I have nothing to add in support.

Question put, That the amendment be made.

--- Later in debate ---

[Joanna Cherry]

I want to add my voice in support of the hon. and learned Gentleman’s suspicions—sorry, submissions! We share suspicions about this clause. The clause unamended permits thematic, suspicion less warrants and these shade into general warrants. General warrants are anathema to the common law of England and Scotland and fall foul of international human rights law.

I am pleased that the hon. and learned Gentleman prayed in aid what David Anderson QC said about clause 90. If Members have read his supplementary written evidence to the Committee, they will have seen that at paragraph 5a he expressed grave concern about clause 90, describing it as “extremely broad” and continuing:

“The ISC noted this in relation to the EI power in February 2016…The Operational Case lodged with the Bill also acknowledged…that a targeted thematic EI”—

equipment interference—

“warrant may ‘cover a large geographical area or involve the collection of a large volume of data’. This matters, because as the Operational Case also acknowledged…the protections inherent in a thematic warrant are in some respects less than those inherent in a bulk warrant. The very broad clause 90 definition effectively imports an alternative means of performing bulk EI, with fewer safeguards. The Government’s explanation for this–that it will opt for a bulk warrant where extra safeguards are deemed necessary–may be argued to place excessive weight on the discretion of decision-makers.”

That concern—that it gives excessive discretion to decision makers—is one that the Scottish National party has as a thread running through the Bill. David Anderson goes on to say:

“If bulk EI warrants are judged necessary, then it should be possible to reduce the scope of clause 90 so as to permit only such warrants as could safely be issued without the extra safeguards associated with bulk.”

Even if the Minister does not consider the SNP’s and the Labour party’s concerns valid, what does he have to say about the lengthy passage that David Anderson has devoted to the matter in his supplementary written evidence?

[Mr Hayes]

I spoke earlier about velocity; now I will talk about breadth and speed. I emphasise that the powers in clause 90 are not new. They are existing powers used by law enforcement, for example, in a range of serious criminal investigations.

[Joanna Cherry]

Will the Minister tell us the legal basis of the existing powers?

[Mr Hayes]

I have done so already, but I will repeat it for the sake of the record. The powers are contained in the Intelligence Services Act 1994 and the Police Act 1997. I am more than happy to provide more information to the hon. and learned Lady on that detail, should she want me to do so.

[Joanna Cherry]

I am looking at the 1994 Act and it seems to me that it contains broad and vague enabling powers, which bear no resemblance to the powers in the Bill. Can the Minister contradict that?

[Mr Hayes]

One of the stated purposes of the Bill is to bring together those powers—to cement them and to put in place extra clarification and further safeguards. I have argued throughout that the essence of the Bill is delivering clarity and certainty. I would accept the hon. and learned Lady’s point if she was arguing that, at the moment, the agencies draw on a range of legal bases for what they do, for that is a simple statement of fact. We are all engaged in the business of perfecting the Bill, because we know it is right that these powers are contained in one place, creating greater transparency and greater navigability, and making legislation more comprehensible and more resistant to challenge. That is at the heart of our mission.

I said I would talk about breadth. The breadth of the circumstances in which equipment interference could be used reflects the fact that, at the time of making an application for a warrant, the information initially known about a subject of interest may vary considerably. Last week, we spoke about the kind of case in which there may be an unfolding series of events, such as a kidnapping, where a limited amount might be known at the outset when a warrant is applied for. The warrant’s purpose will be to gather sufficient information as to build up a picture of a network of people involved in a gang or an organised crime. That is very common and I intend to offer some worked examples in a number of areas.

Identifying members of such a gang can often come from interception arising from a thematic warrant. That might apply to interception, but frankly it might also apply to equipment interference where that is a more appropriate and more effective means of finding the information. Another example may be a group of people involved in child sexual exploitation. Frequently, partial information will allow for further exploration of a network of people who are communicating over a wide area, and who are careful about how they communicate, mindful of the activity that they are involved in. They will not be easy to discover or find, as they will very often disguise their identity. For that reason, it may be necessary to start by looking at sites commonly used to share indecent images of children and from there uncover information that leads, through the use of equipment interference, to those who are driving that unhappy practice. Those examples are not merely matters of theory; they are matters of fact. I know that in cases of kidnapping and in cases of child sexual exploitation, those techniques have been used and continue to be used.