Investigatory Powers Bill (Second sitting)

Keir Starmer Excerpts

Thursday 24th March 2016 Public Bill Committees

[The Chair]

Excellent.

[Keir Starmer (Holborn and St Pancras) (Lab)]

Q We have a definition in the Bill, as I am sure you know, of an internet connection record. What is recorded by BT or any other service provider if I book a train ticket on my mobile phone? What comes up on your record?

Mark Hughes: I would like to answer that question looking more at the Bill itself, and then come back to your question. There are clearly quite specific provisions in the Bill on what we are there to collect.

[Keir Starmer]

Q We have a definition—I would have copied it to you, but you probably have it there—in clause 54(6). You probably know it backwards.

Mark Hughes: Some examples of what we are talking about—I am sorry to be technical, but it is important that I refer to some technical matters—are the customer line reference number, which we perhaps know in common parlance as the account number, and the source and destination host IP addresses. The port to and from it provides content that we have to collect. There are also mass data sets. The Bill is quite clear about what we are there to collect.

On your specific question about a service where you are booking a train journey, we retain various components of the types of data that I just spoke about. It would be things such as source and destination IP addresses and the handset you used, which you mentioned specifically. The IMEI, for example, is another piece of data that associates you to that handset.

[Keir Starmer]

Q If I went to the Trainline website, for example, although it would not come up as Trainline, could you work out that I had been using that website to book my ticket?

Mark Hughes: No, not at the moment. That is not how it currently works. As I understand it, there are four purposes of internet connection records in the Bill, which are to link an IP address to a person or apparatus; to identify the comms service a person is using; to identify where a person is accessing illegal material; and finally, to identify the internet services a person is using, which is pertinent to your question.

What the Bill proposes we are to collect—some of which, by the way, is drawn from data sets that we collect for normal business purposes—may be used to constitute an internet connection record, which would then satisfy those purposes. It is not something we currently retain. The Bill is clear about the ingredients of an internet connection record and its purpose. At the moment, we are still working out with the Home Office exactly how we would compile those pieces of information to create internet connection records and find out which website someone was visiting.

[Keir Starmer]

Q I am sure all that is right, but I am still not sure that I have an answer. If I book a ticket now on the Trainline website, would it come up on your record that I had done it?

Mark Hughes: It is not something that we currently collect and retain.

[Keir Starmer]

Q Not currently, but when the Bill is law.

Mark Hughes: Yes, the Bill quite clearly states the purpose about identifying the internet service that the person is using—

[Keir Starmer]

Q So it would come up?

Mark Hughes: One of the purposes is that we would then be under notice to retain and create that record, which we do not currently do at the moment.

[Keir Starmer]

Q So if the Bill becomes law and I then book a ticket on the Trainline website, you would record it?

Mark Hughes: Under the Bill, once we had been through the consultation process and notice was given, that would be one of the purposes.

[Keir Starmer]

Q Sorry—I probably should have said that I am not that interested in the process at the moment. I understand the process and of course all the proper processes would have to be followed. I am just interested in what you would get before the process starts.

May I try a different question? If I go through the tube using electronic means of payment, would that—if the Bill becomes law and assuming that all the processes are followed—show up on my record?

Mark Hughes: That would not be information that we had access to. It is not our information; you would have to ask TfL that.

[Keir Starmer]

Q What about a feature that I have on my phone called Onefootball? Unbeknown to everybody else, my phone asks for the football scores all the time. What would show up on my record if the Bill became law and assuming that all the processes were followed and all the rest of it?

Mark Hughes: Again, it depends. There is some technical detail underneath here in respect of how that particular service provided by that service provider, Onefootball, polls out and how it would use the services that underlie that—that is, the services that we provide. That would obviously then be subject to the process that would then end up with an internet connection record, if that were appropriate in that case. Or it might be that you would have to go to that service provider to gain information.

[Keir Starmer]

Q But if it were you, would it show that I had been asking for football results all afternoon?

Mark Hughes: If there was an internet connection record under the definition of the Bill, one of the purposes of which would be to identify which internet services you had been using, yes, we would then retain that and disclose it under the appropriate instrument.

[Keir Starmer]

Q And if I went to the website of The Guardian and clicked on “Brussels attack” and then clicked on “Another bomb”, what would be on your records—assuming that the Bill becomes law, that all the processes are complied with and that there is a proper purpose? I am making all those assumptions. I just want to know what would be on the record.

Mark Hughes: We have obviously been spending a lot of time in consultation with the Home Office. There are varying degrees of capability that the Home Office wants. There is a technical element to how far one goes in terms of the amount of data—there is a trade-off between the amount of data that you collect, retain and then disclose. As the Bill stands, that would also constitute an internet service that someone was using so that would be something on the Bill that we would retain.

[Keir Starmer]

Thank you.

[Joanna Cherry]

Q At the Joint Committee, Mr Hughes, you said that BT had never collected internet connection records before, that you would have to deploy new equipment to comply with the legislation and that that would come at a cost. That is correct, is it not?

Mark Hughes: That is correct, yes.

--- Later in debate ---

[Gavin Newlands]

Q So at the moment the Bill is not clear enough on that aspect?

Mark Hughes: It could be clearer, and we are thinking about proposing an amendment specifically to over-the-top providers, making it clear that they are responsible for that.

[Keir Starmer]

Q Can I come back to the question of what constitutes an internet connection record? It is the record that you may be responsible for keeping and passing over, so it is important that you have clarity. I take it from your previous answers that you have said some of it will be data that you are already collecting for your own purposes, and some of it will be other data that you are not currently retaining but will retain as a result of the Act. What are the data you are currently retaining? What is the bit that you keep already?

Mark Hughes: I gave an account number as an example. We obviously know our customers’ account numbers, so that is something that we currently have, and we have other types of information, as I went through, which are potentially subject to other pieces of legislation on retaining data. The point about the internet connection record is that it is rather like a series of ingredients, which you have to put together to create the record.

[Keir Starmer]

Q I have got that. The account number is fine. That does not tell you very much; it is just the account number. When someone does something using the account, what else do you keep at the moment?

Mark Hughes: There are other records associated with other types of services that we have.

[Keir Starmer]

Q I am sorry; I am struggling with this. Can you give me an example?

Mark Hughes: A source-destination IP port, for example. That is something that has to be available to allow traffic to route around the internet. That is the type of data that we have.

[Keir Starmer]

The IP port?

Mark Hughes: The extent to which we collect and retain that at the moment is clearly going to depend on our being clearer about what an internet connection record is through the work of the consultation. That will drive how long we have to hold the source-destination IP.

[Keir Starmer]

Q What data that you do not currently retain or keep will you have to add as an ingredient?

Mark Hughes: As far as I am aware, nothing. At the moment, we have—

[Keir Starmer]

Nothing?

Mark Hughes: Well, we have information at the moment that we might not retain for a period of time, but which would be commensurate with what the internet connection record is going to be. It is less about the type of data and more about the length of time that we have to retain it. That is the thing that we need to work out through the consultation process. Does that make sense?

[Keir Starmer]

Q Just to clarify, I heard you say earlier that some of the data you keep and some you would have to constitute. Now, you are saying that it is all data you have got; it is just about how long you keep it for.

Mark Hughes: No. Sorry if I have not been clear on that. The ingredients are there in some shape or form. Some stuff we mainly retain for a very brief period. There are elements of the data that we would have to look at very differently if the Bill became law, in terms of the length of time, how we retain them and how we use them to produce the internet connection record. That would be different.

[Keir Starmer]

Q If I were your customer and this Bill were law and I accessed The Guardian through you, would you think that one of the ingredients is the page within the home page that I went to? Is that an ingredient that you anticipate that you will have to keep?

Mark Hughes: Sorry, I did not hear the question.

[Keir Starmer]

Q If I go on the Guardian website, I can start clicking between different parts of the website for different bits of information. You can go on a hyperlink to different pages. Do you anticipate keeping any of that data in the future if I were your customer?

Mark Hughes: As drafted, the Bill talks about identifying the internet service that a person is using. The extent to which that capability will be required on the face of it is subject, as I mentioned earlier, to some of the technical considerations. For example, for what you are describing, if every single thing you were to click on on that particular website needed to be retained, that would require a lot of information, which we would have to generate from our network. Technically speaking, it would require a lot of sampling of traffic to achieve that.

[Keir Starmer]

Q That is a technical issue, but legally do you think it is within the definition you are working to?

Mark Hughes: Absolutely. I think it is within the definition as it is written in the draft Bill at the moment.

[Lucy Frazer]

Q Following on from Keir’s questions, there is a concern about the hackability of the volume of data that we have already got. Have we just heard that you already collect this data, albeit not necessarily in the same form or for the same length of time? Is it all still there for someone who wants to access it immediately?

Mark Hughes: No. Not all of the data is collected. We retain lots of data for business purposes, which we therefore retain and secure proportionately and appropriately for that type of information. As I said, there are things in the Bill that are about us having to generate additional records, based on some of the existing information that we have and other types of information that may be necessary in the future.

--- Later in debate ---

[The Chair]

Colleagues, before we see our next panel, may I say that we need to exercise some extraordinary self-discipline with two of these panels? We have three witnesses coming forward on this occasion, before we go back to a single witness. We then have four witnesses for half an hour. Can I ask Front Benchers particularly for discipline and sharpness in questioning, so they are razor sharp?

Thank you, witnesses: do sit down. Because time is pressing, will you tell us briefly, in no more than 10 words, who you are and whom you represent?

Richard Berry: I am Richard Berry, the assistant chief constable from Gloucestershire and the national policing lead for communications data.

Chris Farrimond: I am Chris Farrimond, from the National Crime Agency. I am the deputy director for intelligence collection.

Simon Grunwell: I am Simon Grunwell from Her Majesty’s Revenue and Customs’ fraud investigation service.

[Keir Starmer]

Q We are trying to get to the bottom of what an internet connection record means in the Bill. We have the words on the page in front of us. From a practical point of view, should this Bill become law, what do you think is going to be made available to you when you need to get an internet connection record?

Chris Farrimond: We put law enforcement requirements into the Home Office, which we gave quite some detail around—the who, where, when and how of internet connection—and the internet connection record has been defined as a result of that. We believe that what we will get is down to the domain name, so it will give us, for example, The Guardian newspaper website, the easyJet website, or thetrainline.com. It will not give us beyond that. If we wanted to go beyond that, we would then have to go to that company with the appropriate authorisation in order to obtain any further details. What we need is to get to the front door. That is what we have been asking for.

[Keir Starmer]

Q Can I just make sure I have understood that? For booking a train ticket or something, I can understand that you need to go to the next level if you want to find out the particulars. If it is The Guardian website, what comes up first is a website. You can then click on it if you want to go to national news or international news, and within international news, you could go to Brussels, for example, as many people might have done in the last day or so, so you have gone through a couple of hyperlinks to a different page. Will the fact that you have done that come within what you consider to be an internet connection record? I can see for booking a rail ticket that you would have to go in to get the detail of what ticket, where to and all the rest of it, but when someone clicks through to linked sites on let us say, The Guardian, would you expect that to come within the definition of internet connection record?

Chris Farrimond: Our understanding, and what we have been asking for, is just to get us to the front door—the front door that is marked The Guardian, at which point, if we needed to go to The Guardian newspaper to ask for any further details, we would do that.

[Keir Starmer]

Q On internet connection records, as I have understood it, the purpose of getting the internet connection record in practically all cases is to bridge pretty swiftly into content using other lawful means.

Chris Farrimond: No, I would not agree with that.

[Keir Starmer]

Q What would you use them for?

Richard Berry: From our perspective, the use of the internet connection record would be very similar to that for which we use communications data anyway. That is potentially to identify further lines of inquiry—for example, that communications service that is accessed. It could be for evidence of illegal material, or the use of illicit material, whether that be child abuse imagery or counter-terrorism-related material, but also to provide a seed for further inquiry, such as thetrainline.com for us to establish, for example, where a suspect has travelled to and where they are intending to travel to. It is about an evidential line of inquiry. It could be evidence in itself, but also a seed for further investigation.

[Keir Starmer]

Q But in most cases it would be the seed for further investigation. Would it be rare for it to be an end in itself?

Richard Berry: Indeed, because of its high granularity.

[Keir Starmer]

Q No other country is going down this route to solve the problem of access, which is a growing problem. What are other countries doing if they are not doing internet connection records?

Chris Farrimond: Sorry, I am not convinced that you are correct in that last statement that no other country is going down the same route. I believe Australia has gone down a similar route. Perhaps we need further clarification on that, but my understanding is that Australia has gone down exactly the same route.

[Keir Starmer]

Q Yes, but I think they have backed up a bit. Which other countries, to your knowledge, have a power to access internet connection records in the way proposed in the Bill or a similar way?

Richard Berry: None at this stage. I think there is a common view within the law enforcement community globally that all eyes are very much on the UK to pave the way in this respect. We are aware of the danger of the Danish experience and the difficulty the Danes had with the type of data they collected to achieve the investigative aims, but while the Australians are making steps in that direction, as Chris has highlighted, at this stage it is very much the UK leading the way.

[The Chair]

Thank you.

Joanna Cherry, if I give you six minutes—I gave Keir six minutes—you will know what you are working with.

--- Later in debate ---

[Gavin Newlands]

I might not have used easyJet for several months, but the app still connects my phone to easyJet’s service provider. Likewise, I have a British Airways app. None of that limits any effectiveness for you?

Chris Farrimond: What I would expect to get is something showing you connected to easyJet for two minutes rather than for a nanosecond, or for an upgrade coming through. If we saw two minutes, we would say, “He did something with easyJet at that point.”

Richard Berry: Things like the tracking cookies you have on normal websites are not relevant information for our purposes. To offer a point of reassurance, we have a decade of experience of looking at what relevant data should be retained. ICRs are no different to that principle. Prior to any retention notice being served on a particular provider, law enforcement, the Home Office and the provider will be looking at the operational benefit, the cost and the technical feasibility of what data they hold and what data we would use. It almost takes each provider on a case-by-case basis to ensure we are gathering only relevant information. We could see those feeds back—the little connections you are talking about—being ruled out of the data we need to retain.

[Keir Starmer]

Q May I go back to the definition of internet connection record? To take it in stages, you are obviously concerned about your ability to deal with serious crime and the visibility of what you can do; I completely understand that. You make an ask of the Home Office, which as you said, is basically, “Who? When? Where? How?” That is where you think you need to go next, to maintain the ability you have now, because of the different ways people are communicating.

From that, you said, “Well, therefore The Guardian is enough for us, not that someone went to a page on Libya or clicked on something about Libya bombings, because that is not within our ask.” My difficulty is not to challenge why you want that, what you use it for or its utility. I just cannot see how the definition in the Bill is limited to your ask; in other words, it appears to go as far as you want to go.

Tell me if this is an unfair question, because it is about the words on the page, but which bit of the definition you understand to be the word or words that limit it to what you say you are asking for, rather than letting it go any further? At the moment, I cannot see that bit of the jigsaw. In other words, which is the trigger word in the definition of internet connection record that says The Guardian website but not “within The Guardian, the words ‘Libya’ or ‘bomb’” or whatever it may be that means we cannot go beyond what you have asked for?

Chris Farrimond: It is a bit difficult for us, because as law enforcement officials, we have no hand in writing the Bill.

[Keir Starmer]

Fair point.

Chris Farrimond: We simply have presented our case to the Home Office, and in quite some detail we have explained what we think we need to be able to protect the public. I am afraid I cannot speak to the actual words on the page.

[Keir Starmer]

Q Can I follow that question with this last one? If the definition were to be reworded in a way that reflected what you had asked for but made absolutely clear that it did not go beyond that, would that not trouble you at all? In other words, if there were a word, a phrase, a group of words or a definition that made it clear in technical, legal terms that we are talking about The Guardian but not certain clicks within The Guardian website.

Chris Farrimond: As long as it meets the requirement we have put forward, absolutely.

[The Chair]

Joanna Cherry, you have five seconds, and anyone who wants to answer has 10 seconds.

--- Later in debate ---

[The Chair]

Fantastic—that is an even shorter introduction than the one I have in front of me that details your distinctions.

[Keir Starmer]

Q From your perspective—the anti-fraud perspective—which of the powers in the Bill are most important to you and why?

Mark Astley: The powers to access communications are very important to our members. Trading standards are our main users. They are not high users but it is important for them to be able to investigate those crimes so they can support their community and the businesses that they are working for and on behalf of.

[Keir Starmer]

Q At the moment, you do not have access to internet connection records.

Mark Astley: Correct.

[Keir Starmer]

Q How does that inhibit you, if at all?

Mark Astley: At present, the impact is uncertain.

[Keir Starmer]

Q The impact of not having it.

Mark Astley: Of not having it—yes. There are areas, as colleagues have previously mentioned where, in the digitisation world that we are moving towards, everything is being conducted over the internet. That is something that may affect and have an impact on investigations for local authorities.

[Keir Starmer]

Q But at the moment you cannot say how not having it affects your ability?

Mark Astley: No.

[Keir Starmer]

Q And what do you think you will get when you get access to internet connection records?

Mark Astley: At the moment, I understand that we are not going to receive that access. Local authorities are not being included in having access to internet connection records.

[Keir Starmer]

Q No, local authorities are not.

Mark Astley: No, but some of the other public bodies may get access to that. That would give them the front door to the internet provider that they have entered.

[Keir Starmer]

Q But your network is not just limited to local authorities.

Mark Astley: Currently it is for communications data, as the legislation stands.

[Keir Starmer]

Q Within your network, what are the other bodies and agencies?

Mark Astley: Can I just elaborate a little bit more about our organisation? We provide a service to assist them in obtaining data and intelligence to assist investigations. However, from a telecommunications perspective, we are only able legally to operate on behalf of other local authorities. We are not able to represent other public agencies such as the Food Standards Agency, although the intention of the Bill is to introduce those collaboration agreements, so we could facilitate that.

[Keir Starmer]

Q I see, so at the moment, your function is limited in this particular field to local authorities.

Mark Astley: Correct.

[Joanna Cherry]

Q Your organisation has identified a range of crimes that local authorities use communications data to tackle. Do you think the Bill ought to identify the crimes more precisely to prevent data from being used in relation to, for example, rubbish collection or school places?

Mark Astley: I believe that the process is in place for identifying necessity and proportionality. The three bar process that we currently have in place will deal with that. To actually identify particular legislation could become more constraining and difficult to administer and, as more legislation comes along, more changes may be required to the Bill.

--- Later in debate ---

[The Chair]

Welcome to the panel. In a matter of a few words, please introduce yourselves.

Jo Cavan: I am Joanna Cavan. I am the head of the Interception Commissioner’s Office.

Sir Stanley Burnton: I am Stanley Burnton. I am the interception of communications commissioner.

Lord Judge: I am Igor Judge, the chief surveillance commissioner.

Clare Ringshaw-Dowle: I am Clare Ringshaw-Dowle, chief surveillance inspector.

[Keir Starmer]

Q Thank you to our distinguished panel for their time this afternoon. I think this is a first—me asking distinguished judges a question. It has always been the other way round for my entire career. I shall try to keep it short and sweet.

Can I start on the issue of the approval of warrants by judicial commissioners under the Bill, and the proposed test? Clearly judges perform different functions every day. One function is to issue a warrant—to search a premises, for example; judges do that day in, day out. They are the decision maker. An application is made to them and they look at it and make their own decision, and they issue or do not issue the warrant as the case may be.

A different function is a reviewing function—a public law function where a judge is essentially reviewing somebody else’s decision. On my reading of the clause on approving warrants, clause 21(1) and (2)—if you do not have it in front of you, I have copies of it—it appears to be clearly a reviewing function. The judge is reviewing the decision of the Secretary of State, not actually making a decision him or herself on the warrant. Do you agree with that?

Sir Stanley Burnton: I do, certainly.

Lord Judge: I agree too, but you have a problem: what do you mean by judicial review?

[Keir Starmer]

Can I explore that?

Lord Judge: You asked me for a short answer, and that is a short answer. [Laughter.]

[Keir Starmer]

Q Judicial review covers a range of different approaches depending on subject matter, intensity of review and so on. As worded, how much deference or margin do you anticipate judges will give to the decision maker, the Secretary of State, in exercising these functions?

Sir Stanley Burnton: In theory, you have a complete spectrum. A judge can operate at one end of the spectrum when he just accepts what the authority is putting to him, and at the other end he can be quite stringent in reassuring himself that the statutory tests have been properly applied and satisfied. Frankly, it is going to be the commissioner who will decide—fairly early on, I would have thought—how stringent the test should be in this case. My own view is that it should be quite stringent, approaching the one that was applied in the case of control orders.

[Keir Starmer]

Q Do you agree with me that as the Bill is currently drafted, it is not clear what Parliament intends, and therefore it will fall to the judges? In other words, it is broadly enough drafted to cover a longer-arm review or a closer intense review depending on what judges decide as cases evolve. It could accommodate both approaches.

Sir Stanley Burnton: It is left to the judges, is it not, to decide what the proper approach is?

[Keir Starmer]

On this draft.

Sir Stanley Burnton: On this draft. It may be difficult to draft more tightly. The other thing I would say is that whether the judge is a decision maker or an approver, he necessarily has to give a lot of weight to the opinion of the person who is making the application to him.

If the secret service is saying, “Our assessment of this man is that he is a dangerous terrorist”, it may be very difficult to go behind that, and there is no reason why the judge should go behind it unless there is material before him that indicates that that is a wholly unreasonable and unsupported assessment. But you are compelled to give weight to the opinion of the people who are actually involved in whatever the subject matter is.

Lord Judge: I do not go all the way along the route with Sir Stanley about this. I think “judicial review” is a very easy phrase to use. It sounds convincing, but it means different things to different people. People say, “Wednesbury unreasonableness”—that was a case decided by the Court of Appeal in 1948 or 1947, and it has evolved. Personally, I think that when Parliament is creating structures such as these, it should define what it means by “judicial review”. What test will be applied by the judicial—I call him that—commissioner, so that he knows what his function is, the Secretary of State knows what the areas of responsibility are and the public know exactly who decides what and in what circumstances? I myself do not think that judicial review is a sufficient indication of those matters.

[Keir Starmer]

Q Thank you. Sticking with functions, if I may, as the Bill is drafted, the body responsible for authorising investigatory powers, as we have just described, is also the body responsible for oversight after the event. On the face of the Bill, there is no structural distinction between those functions. Is that sensible, or could it be improved?

Lord Judge: As that is the way in which the surveillance commission works, I strongly recommend it to you. There are different people exercising different functions. The pre-authorisation that goes on in our section of the system involves a commissioner being satisfied—I am sure you all know about the relevant tests—and either agreeing or not agreeing; that is a very important moment. In most cases, happily, because people make responsible applications, they are agreed to. Sometimes it is suggested that they should be amended, and very occasionally they are refused.

That process then unfolds, and whatever happens happens. My inspectors annually inspect the entire force—not just the individual who made the application in the first place, but each police force and each prosecuting authority—to see whether their systems are effective and check, and not just on the ones that have come through, to ensure that the process was brought to an end speedily or, when nothing further happened, that the authorities did not go on too long and so on. It is also to ensure that when the authorisation was originally given, it was founded on proper evidence and then correctly given.

Normally, this has all worked perfectly well, but there is a danger in underestimating the value of the inspectors; I shall come to a different point on that when I can give a longer answer. The process works very well in this way. They report to me as chief surveillance commissioner. I then digest the report and go see the chief constable of each force, or get one of my commissioners to go see them, to say, “This is where you are going wrong, and this is where you must do this and that.”

That is because the inspectors have taken the thing apart. They go to police forces for days; the whole lot of them go to the Metropolitan police for a week. They have the right to see anything they like, and they demand to see it. The commissioners would not be best able to exercise that function, because they are judges. They are not qualified.

Jo Cavan: There are a number of important points around these clauses in the Bill. First, we are really disappointed to see that although the Government are talking about creating a world-leading oversight body, the clauses as currently drafted do not actually create a commission. They simply create an investigatory powers commissioner and a number of judicial commissioners.

When we look at approval by those commissioners, the reality is that they are only going to be approving 2% of the authorisations that will actually be undertaken under the Act—arguably, the more highly intrusive authorisations. The remaining 98% of authorisations will only be overseen post facto, and the reality is that they will be overseen by staff within the commission.

If we look at some of the judgments coming out of the European Court of Human Rights and the European Court of Justice, there are some really important safeguards on post facto oversight, looking at the retention, storage and destruction of material, how it has been used and any infringements or breaches around the acquisition post-approval. We really feel that the Government need to create this body in the clauses.

[Keir Starmer]

Q One final swift question on thematic warrants and the breadth of the powers proposed in the Bill. Do any of the witnesses have headline concerns that the Committee can take away to work on as we consider the Bill line by line?

Sir Stanley Burnton: First, the existing formulation in RIPA is very unsatisfactory and unclear, and it does not cover many cases in which it would be sensible to have a so-called thematic warrant. However, the wording of clause 15(2) is very wide. If you just have a warrant that gives a name to a group of persons, you have not identified—certainly not in the warrant—all those persons to whom it is going to apply. There could be substantial changes in the application of the warrant without any modification. At the moment, the code of conduct envisages a requirement that names will be given so far as practicable. Our view is that the warrant should name or otherwise identify all those persons to whom the warrant will apply, as known to the applicant at that date.

The other concern is that substantial modifications can be made to a warrant under the Bill with no judicial approval or even notification. That needs to be changed.

Lord Judge: I agree with Sir Stanley. I will not say anything more on the second point he made, but on the first, a part of the process that all of us involved in supervising surveillance attach a great deal of weight to is that we are looking at individuals. There has to be evidence that X requires this, that there is a situation in which it is necessary for this to happen, that it is proportionate in this particular individual’s case and that there is no collateral interference. For example—there are many different examples—why should a women who happens to be married to or living with a man who is suspected and so on have her life entirely opened up in this way? Not having specific identified individuals leaves a very delicate situation. I suspect that the commissioners would find it very difficult to just say, “Well, we’re satisfied. There’s this gang here and they’re all pretty dangerous.” They might not be, and we have to be very alert to that.

[Joanna Cherry]

Q I have questions for Jo Cavan. In your organisation’s written evidence, you have picked up on earlier concerns about the draft Bill and updated them in the light of the finalised Bill. In the first point, you say that you have concerns about the “aggressive timeline” for the Bill. Can you explain what you mean by that?

Jo Cavan: It is a really complicated and significant piece of legislation. Although I broadly support the Bill, because it is a good thing to put a number of the powers used by the intelligence agencies on a clearer statutory footing and to try to improve transparency, I do think that the scrutiny process has been very hurried. That is of concern because there are some significant privacy implications to the clauses in the Bill. There is still a long way to go towards strengthening some of the safeguards. Also, a lot of the operational detail is in the codes of practice. It is really important that those are scrutinised properly, line by line.

--- Later in debate ---

[The Chair]

Thank you, both distinguished former Home Secretaries. I will not ask you to introduce yourselves because I think that would be a little impertinent of the Chair. Let us go straight to Keir Starmer.

[Keir Starmer]

Q Thank you both for coming to give evidence to us this afternoon. We are really appreciative. Can I dive in with the question that I think the whole Committee is intrigued by or interested in? You have experience of carrying out authorisations and signing warrants. We know there are a number every day. Can you give us an example of the exercise you both carried out when you were looking at warrants so that everyone in the Committee can understand what the role of the Secretary of State was before, as is now proposed, it goes off to a judge or commissioner?

Charles Clarke: The submission is made by the officials and the services, and says there is a suspected threat in a certain area and that they recommend authorising a power to surveille a group of individuals. The judgment that the Secretary of State then has to make is whether he or she does or does not accept that there is a case for surveilling the individual. According to the time available—some of the issues do not give you a great deal of time to decide what is happening because things can be moving very quickly in both serious and organised crime and counter-terrorism—you might decide to seek more information about the particular circumstances and why the judgment is being made. I think that you would always—I don’t know what John’s experience was—have at least a brief discussion with the officials concerned about the particulars of the case. It would not necessarily be extensive and the longer you are Home Secretary, the more experience you gain of the circumstances in which these sort of things are requested.

I am sure all Home Secretaries take the decision very seriously and seek to come to a judgment about it. I do not know whether that sounds familiar to you, John, but that is certainly how I felt I was trying to deal with it.

Lord Reid: That is roughly the process. Obviously each individual case is somewhat different. Some are hugely different from others. Each individual case may have a different timescale. Without going into individual cases, you can imagine that, certainly on occasions, I had to deal with—I am sure Charles did, too—warrants in connection with an ongoing hostage situation, when there was an imminent threat to life. There is obviously a degree of urgency about that, and that constrains the time for consideration and, no doubt, the time for judicial review.

In Northern Ireland, lives were often plainly at risk. In those cases, you have a time constraint. In other cases, you have a pretty bulky file, sometimes on a renewal. As it happens, we had consecutive periods so, on occasions, I would have got an application to renew a warrant that perhaps had initially been okayed by Charles. Nevertheless, with duty and diligence, you would spend a bit of time going through it yourself—sometimes going through the papers that he went through. In other cases, there might be less information to be examined because it might be—for instance, in the case of an ongoing and imminent terrorist plot—that a telephone number, a name or some association had been picked up tangentially in relation to someone else that you had been looking at for some time.

The only other thing that I would say is that I suspect that, during the time that Charles and I were Home Secretary or, indeed, in any other position authorised to issue intercepts, because of the exponential rise of communication through cyber and the internet, the number of applications would be getting greater and greater.

Charles Clarke: Can I just add one point, Mr Starmer? There is an important conceptual point here, which is that modern detection of organisations which are criminal in intent—serious and organised crime, and terrorism—is basically about building up a pattern of what networks of relationships exist between different people.

You collect information, as John just implied, about particular nodes of the situation. Then the question is what forms of communication they have with others and who they are communicating with in order to try to better understand what the actual networks are and who is talking to who and, in certain circumstances, what they are actually intending to do. That is just the background that you should have in your mind when thinking about what kind of surveillance requirements are necessary to look at that.

[Keir Starmer]

Q I know there is no such thing as a typical case because they are all shapes and sizes but, in the main, would you have expected a signed statement from somebody setting out the case for necessity and proportionality—why it was necessary—and drawing your attention to the relevant material?

Lord Reid: Yes. That would be the top introduction, but there may well be further papers behind it. In some cases, there may be papers behind it in some depth.

Charles Clarke: If the question is whether there would normally—I am trying to think whether there is any exception to this—be a recommendation by an official based on the data that existed, the answer is yes. I am trying to think whether there are any exceptions to that. I cannot think of any offhand.

[Peter Kyle]

Q One of the innovations of the Bill is the double lock. When you were Home Secretaries, most warrants would have been signed just by the Home Secretary. Will the knowledge of having judicial oversight and a second authorisation before the warrant comes in change the behaviour of the Home Secretary when approaching the decision?

Charles Clarke: I tend to doubt it. Speaking for myself and, I am sure, for John—actually, for all Home Secretaries I have ever discussed this with—we have all been exceptionally aware of the severity and seriousness of what we were looking at. I do not think that the idea that there was going to be a judicial review of what we were doing would have changed our behaviour significantly. There is quite a serious, in-principle issue about the role of the judge as opposed to the role of the Executive.

I saw you taking evidence from Lord Judge just now. I bumped into him as I was coming in. The question of the relationship between the judiciary and the Executive is a key point. I gave evidence on it to the House of Lords Constitution Committee in 2007 because I think it has all been changed by the Human Rights Act 1998. I think there has been insufficient consideration of the changing nature of the relations. In response to your particular point, Mr Kyle, I do not believe that there would have been a significant change in behaviour.

Lord Reid: I do not think there will be a change in behaviour from the point of view of the person who is ultimately accountable to Parliament for the decisions, which is the elected Member and appointed Minister. Probably even before RIPA, which I think Charles took through the House of Commons, there was an awareness that there were degrees of oversight and you were working within certain constraints and certainly with oversight.

I confess that where I would worry—you would perhaps say, “Well, he would, wouldn’t he? He was the Home Secretary.”—is in case the judicial oversight became a co-decision. I think that is a recipe, in some cases, for obstacles to the efficient operation of aspects that I mentioned earlier, for instance in a hostage situation. I know that allowances are being made for that.

I guess that the additional oversight—judicial oversight—that is in the Bill is a result of a number of factors. One is the concern—I do not know whether it is public concern; I do not think it is, but it is certainly published concern—over the Snowden revelations, the general distrust of politicians and the fact that there was a Liberal-Conservative coalition. All of this is compromise, is it not?

I have no in-principle objections to it, provided that the first decision is made by the person accountable for it, through Parliament, to the public and the role of judicial oversight is the judicial element of it.