Investigatory Powers (Amendment) Bill [HL]

Lord Fox Excerpts

2nd reading
Monday 20th November 2023 Lords Chamber

[Lord Fox (LD)]

My Lords, it is a great pleasure to follow the noble Lord, Lord Coaker. I look forward to a fascinating and intimidatingly expert debate. Before commenting on the Bill, I feel that it is important to contextualise what we are discussing today.

Many of us enjoy books that depict the intelligence services. In the main, the George Smileys who appear within their covers are practising in a world that is very far from the lived experience of most people in this country. However, the reality is very different. The work of the intelligence services impacts very many people’s lives in the UK. It is not just bombs and guns but drugs, people trafficking and other exploitation, financial and cybercrime, extortion and many other crimes. The perpetrators are Governments, terrorist organisations, criminal gangs and lone individuals. Crime and terror merge and are socially unjust activities that prey on the weak. The victims are most often the vulnerable and those with the least ability to resist. Within this depressing tapestry, we rely on our intelligence services to help keep us safe and we need a police force that can cope with the complexities of those crimes. Liberal Democrats wholeheartedly support the services that seek to do this and we welcome this debate.

We also believe that these vital tasks have to be balanced against the freedoms and liberties at the heart of our country’s values. Every new power must be weighed in that balance and the noble Lord, Lord Coker, just explained that from his perspective. As we have heard, this Bill proposes some specific amendments to the original Investigatory Powers Act 2016. I was not involved in the scrutiny of the Bill at that time; that fell to my noble friend Lord Paddick, and the noble Baroness, Lady Williams, was in the ministerial chair, so it is a new set of eyes looking at this legislation.

I remind your Lordships’ House of some of the key priorities that my noble friends here and my colleagues in the Commons applied to the 2016 Bill. The first of these is that there should be no weakening of encryption. The second is the vital role of judicial authorisation and the third is that, when it comes to the bulk collection of information or mass surveillance, British residents have a right to expect privacy. These principles were central to our response to the last Bill and will be to this.

Today’s Bill, as we have heard, is the product of deliberation over years. Your Lordships should particularly thank the noble Lord, Lord Anderson, for his work on it. However, given the time taken to get this far, it is very disappointing that the Government chose to introduce the Bill in such a rush that it gave just eight working days for parliamentarians and civil society to prepare for the specific scrutiny of it. If the Government were seeking to ensure that they took people with them, this is a way to antagonise them. There are already comments about haste being an effort to railroad people.

I am afraid my speech today is quite a long one because I did not have time to write a short one. I turn to the Bill. As the Minister set out, the original Bill established a set of protections under Part 7; this Bill introduces two new levels of security, Parts 7A and 7B. Part 7A is introduced in Clause 2 and concerns bulk datasets, as we have heard, with

“low or no reasonable expectation of privacy”.

These so-called low/no datasets may be in three types, each with slightly different rules.

I have enjoyed helpful discussions with the Minister’s department and for that I appreciate his facilitation and engagement. During those discussions, the basic explanation has been that these datasets are needed to train tools using machine learning, that they already exist and are being used in the commercial world, but the Part 7 process makes them at best clumsy and at worst impractical to be used by the intelligence services. I take those points. Furthermore, the introduction to Part 7A includes a requirement for approval from judicial commissioners. Had it not, this discussion would have been much harder.

If training Al tools is the stated prime mover for Part 7A, the inclusion of urgent data as one of the three types of data clearly indicates it is also needed for ongoing investigations. I can imagine why urgent data might be needed, but it is the investigators who will define the urgency. Additionally, new Section 226BC refers to a relevant period of three working days between the acquisition of the urgent data and full judicial approval. Yet, after three days, the judicial commissioner may decline to permit the use of the data that has already been employed in an investigation using rapid Al-enabled analysis.

Taken together, I have my worries. There needs to be a duty to immediately notify the judicial commission. Secondly, there should be guardrails helping define “urgent” and finally we need to discuss how information discovered using data that is subsequently ruled ineligible is, shall we say, unremembered. Without these, the use of low/no datasets in this way for operational issues is concerning.

I have gone into this in some detail because I see it as a serious operational concern but also because I wanted to illustrate the sort of scrutiny the Government should expect from these Benches throughout this debate. There are other examples as we go through the Bill, but I will refer to those only broadly now. Clause 5 introduces a second new category of approval, Part 7B, this time for datasets held in third party assets to which the intelligence services have access. As far as I can deduce, this brings into the orbit of the IPA data which was previously not included and mandates both Secretary of State and judicial commission levels of approval. Unless I learn otherwise, that is a good starting point.

That said, we will seek to initiate explicit discussion around the use of medical, genetic and genomic data and how this can be protected. Here I note that anonymised data can be relatively easily reassigned, so anonymity in health databases is no actual protection. This is important on several levels, not least for public confidence in the digitisation and legitimate use of this very important information.

Part 2 allows the deputisation and delegation of some of the powers to broaden the number of people responsible involved. I just ask whether the Minister believes that this heralds a massive increase in workload.

In Part 3, I thank the Minister for his explanations around Clause 11, which I shall read carefully, and I will be coming back for some more details about how that will work in practice. Clause 14 creates a new condition for the use of internet connection records by the intelligence services and the NCA. Broadly, this removes the need for exact times when seeking connection records, substituting time ranges. This seems acceptable, as long as the Minister can assure your Lordships’ House that this will still require Secretary of State and judicial commission approval.

Part 4 moves into the area of retention notices and away from issues covered by the report of the noble Lord, Lord Anderson. I believe that Clause 15 is focused on bringing inbound roaming on foreign SIM cards into the frame, so I would appreciate details of how this will work. For example, if I am in the UK using a SIM that I bought in Dubai from a UAE-based telecoms provider, how does the intelligence officer proceed?

Clause 20, as we have already heard from the noble Lord, Lord Coaker, is one that has already raised eyebrows in the industry. Proposed new subsection 258A requires telecoms operators to inform the Secretary of State if they propose to make changes to their products or services that would negatively impact existing lawful access capabilities. In reality, this can include changes in encryption, a topic which has recently been on a rocky journey through the passage of the Online Safety Act. This Bill proposes a number of changes, building on the current regime set out in the 2016 Act, that relate to decryption of private messages for law enforcement purposes. In short, we believe the amendments would, or at least could, grant the Home Secretary more extensive powers to intervene in, and in some cases block, communications providers’ operational decisions, including enhancing privacy settings for users, with potential knock-on implications for end-to-end encryption on those services for everyone. I think more debate will be needed in this area.

There are other issues of timing, the possible length of a review, extraterritoriality and the level of judicial commission oversight at the notice level. I am sure I will be told by the Minister that this is a narrow interpretation, but it is an interpretation that has legs outside your Lordships’ Chamber. How will this power be used and what are the implications? Will we perhaps see British law officers beating a path to California to serve these notices? In a sense, how far does this go?

Finally, Part 5 invokes some interesting questions, some of which the noble Lord, Lord Coaker, has already asked and we will surely want to probe. We will want to introduce a requirement that the Investigatory Powers Commissioner is informed of, and records in their annual report, the number of warrants authorised each year to permit surveillance of Members of relevant domestic legislatures. For now, perhaps the Minister could tell your Lordships’ House what the process is for gaining permission to intercept and examine the Prime Minister’s communications.

We will also be probing two other important areas on which there is no time to expand today. The first is specific protections to avoid either cementing or introducing systemic bias against certain sections of the community from the AI models of the future that will be built as a result of this legislation. The second is the use of facial recognition technology on the back of the tools created using the low/no databases, a point that the noble Lord, Lord Coaker, raised.

To conclude, we are concerned that the Bill could push legislation further past the point of balance that we started to discuss. We need to ensure that judicial oversight extends right through the activities enabled by the Bill, and there should be no weakening on the encryption issue. I hope the Minister views this critique in the spirit of constructive support that I have sought to invoke, and I look forward to the rest of the debate and the further stages of the Bill. As he can see, our work will be built on the foundation that British residents have a right to expect privacy.

Investigatory Powers (Amendment) Bill [HL]

Lord Fox Excerpts

Committee stage
Monday 11th December 2023 Lords Chamber

As I said to the Minister, we accept the changes the Bill is bringing forward; it will improve the situation. There are much-needed amendments in this group and the others we will discuss, but the clarifications I have asked for should help those who seek to interpret the Bill, and, indeed, those who will use the increased powers in it. With that, I beg to move.

[Lord Fox (LD)]

I rise to speak to Amendment 2 and several others in this group in my name. This amendment probes the extent to which paragraphs (d) and (e) of proposed new Section 226A(3) depart from current privacy laws. Like the noble Lord, Lord Coaker, we seek clarification. Also like the noble Lord, as far as we are concerned the purpose of this Committee is to probe, get information and understand how the Government interpret some of the measures in the Bill.

Bulk personal datasets represent the largest part of the Bill, and this amendment primarily probes the differences in the definitions in the Bill and those set out in Schedule 10 to the Data Protection Act 2018. The Bill creates a new and essentially undefined category of information where there is deemed to be low or no reasonable expectation of privacy: so-called low/no datasets. This is a departure from existing privacy law, in particular data protection law. With regard to low-privacy bulk datasets, the relevant circumstance, in Schedule 10 to the DPA, is that

“information contained in the personal data has been made public as a result of steps deliberately taken by the data subject”.

This is a different standard from the expectation of privacy in the new BPD category, whereby information is considered low privacy according to

“the extent to which the data is widely known about”

and if it

“has already been used in the public domain”.

As your Lordships will observe, there is a big difference between those two definitions. For example, whereas facial images from public CCTV may be considered low-privacy BPD under the Bill, they would be considered personal data and possibly subject to sensitive processing under the DPA. As the Minister knows, this is a contentious area of law, and a real-life example is Clearview AI’s database of 30 billion facial images harvested from social media platforms for highly facial recognition searches. Some could have been classified as low privacy, as the photos have already been made public by the individuals, but the Information Commissioner’s Office found Clearview AI in breach of the DPA.

Similarly, a database of all public Facebook or other social media posts could be argued to be a low-privacy database, despite the fact that it will be a comprehensive database of billions of people’s social networks, sexual orientations, political opinions, religion, health status and so on. Under the DPA, much of this data qualifies as sensitive personal data, incurring extra protections when it comes to retention and processing, regardless of whether the information can be considered to have been made public.

The DPA would still apply to the intelligence agencies in processing—at least, that is our view, and we would like to like the Minister to comment on that—but under the Bill as drafted the contradictory standards would also apply. How do these two standards work together? I assume the department has looked at the likelihood of possible challenges to this new category of data, and indeed the likelihood of such challenges being successful, so it would be helpful if the Minister could enlighten us in that regard.

Schedule 10 to the DPA sets out circumstances in which the agencies can conduct sensitive processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; data concerning health or sexual orientation; biometric or genetic data that uniquely identifies an individual; and data regarding an alleged offence by an individual. Does Schedule 10 apply in the case of data identified as “low” or “no” by the Bill?

An example highlighting the potential divergence is data that has been hacked and then leaked out. While not deliberately made public, as per the DPA requirement, it is arguably public and available in the public domain. What is the Minister’s view as to how the Bill regards that sort of data in a low/no context? To test this, the amendment seeks to strengthen the condition in proposed new Section 226A(3)(b) by aligning it with the test in the Data Protection Act for sensitive processing. Data protection law is currently constructed according to the sensitivity of information rather than the individual’s expectations of privacy concerning personal information. As we know, expectations differ greatly from reality, and from person to person. The central questions this poses are: why does the new Bill deviate from Schedule 10 to the DPA, and how will the DPA and the IP work together using the new definition of this Bill?

We are debating a small number of quite large groups today which, unfortunately, means that quite a number of my amendments appear one after another. I will speak as briefly as I can, but I am afraid there is quite a lot of detail coming up. I will speak first to Amendments 4, 5, 6 and 7. Amendment 4 probes the purpose for which bulk datasets will be used by the intelligence services. Amendments 5 and 6 probe the circumstances in which an authorisation is urgent and therefore not authorised in advance by a judicial commissioner. Amendment 7 would require the person granting an authorisation in urgent cases to immediately notify the judicial commissioner that they have done so.

These amendments are similar in purpose and spirit to Amendment 3 from the noble Lord, Lord Anderson, which I have co-signed and support. The basic explanation from the Government for proposed new Part 7A has been that these datasets are needed to train tools using machine learning and that they already exist and are being used in the commercial world, but the Part 7 process makes them difficult for the intelligence services to use. If training AI tools is the stated prime mover for Part 7A, the inclusion of urgent data as one of the three types of data clearly indicates it is also needed for ongoing investigations.

In that regard, proposed new Section 226BC refers to a “relevant period” of three working days between the acquisition of the urgent data and the granting of full judicial approval, giving the relevant service three days to work with data and information that might eventually be ruled out of bounds by the judicial commissioner. All the amendments are intended to understand how Part 7A is to be used in operations, rather than tool training, and what urgent circumstances are envisioned that would negate the need for prior JC approval of an authorisation.

Amendment 4 seeks to restrict the application of Part 7A powers to training and learning functions of the intelligence services, meaning that operational purposes would be excluded. This is designed to get the Minister to explain the operational needs which define an urgent need.

Amendment 5 removes the ability of a person to grant an authorisation if there is an urgent need. Clearly, this gives the Minister a chance to justify why such data might be operationally needed. Amendment 6 provides a definition of what might be considered “urgent circumstances”. The Minister might want to contribute a different definition, but we feel the definition of “urgent” should be included in the Bill. Amendment 7 provides an additional safeguard by requiring a JC to be notified immediately where an authorisation has been granted in an urgent case. This essentially creates an opportunity to close the potential gap between when the data is deployed and when the JC rules on its admissibility—but not, of course, removing the gap entirely.

--- Later in debate ---

[Baroness Manningham-Buller (CB)]

My Lords, I do not know whether I can help the noble Lord, Lord Fox, on his question of urgency. One of the things that the Security Service and the other intelligence agencies do is deal with matters of life and death, of imminent terrorist threats, of states pursuing one of their dissidents. There is many an occasion when moving at vast speed outside the hours when IPCO is available is necessary and proportionate. I am out of date, so it is hard to give lots of current examples, but many a time there is an urgent need to move fast to try to save life.

On the point from the noble Lord, Lord Murphy, about the ISC—we will come on to look at these amendments in more detail—as far as my service is concerned, we did not need to get used to the ISC in that we had been demanding its creation for a number of years, with resistance from the Prime Minister of the day until it actually came into being. And when it did, we very much welcomed it.

I have hardly had more pleasure since I have been in this House than from the amendment in the name of the noble Lord, Lord Fox, on seeking to forget stuff. Like some noble Lords, I have difficulty in remembering things—I am sorry, I should speak only for myself—but if I was legislated to forget something, it is almost certain that I would be capable of remembering it.

[Lord Fox (LD)]

That is exactly the case.

[The Parliamentary Under-Secretary of State, Home Office (Lord Sharpe of Epsom) (Con)]

My Lords, I am grateful for the contributions to this debate, which have been very interesting. I thank all noble Lords for the points raised. I shall do my very best to address all of them and apologise in advance for going into significant detail. I also thank everyone in the Committee for their broad support for the Bill.

I will start with the low/no privacy factors on bulk personal datasets, which I will henceforth call BPDs, and the various amendments relating to the test set out in Clause 2, to be applied when an intelligence service is considering whether a particular dataset is one that can be retained, or retained and examined, under new Section 226A in the new Part 7A. This test requires that regard must be had to all the circumstances, and that particular regard must be had to the factors set out in new subsection (3). The list of factors is not exhaustive and other factors may be considered, where relevant.

Schedule 10 to the Data Protection Act is related to Section 86 of that Act, which is concerned with sensitive processing of personal data by the intelligence services. Schedule 10 sets out a list of conditions which must be met for such processing to be lawful for the purposes of the Data Protection Act. There is a risk that applying these words here, in a different context and for a different purpose, may be seen to create a link, albeit fallacious, between the type of datasets that will be retained and examined under new Part 7A and sensitive processing under the Data Protection Act. For that reason, their inclusion here risks doing more harm than good, as the noble and learned Lord, Lord Hope of Craighead, noted.

In any case, the safeguards in new Part 7A are already sufficient to ensure due regard for privacy. Every dataset proposed to be retained, or retained and examined, must be individually authorised. In addition to the test at new Section 226A, as new Section 226B makes clear, an individual authorisation may be granted only if it is both necessary and proportionate.

The factors have been chosen because they are most relevant to the context in which the test will be applied and have been drawn from existing case law. They provide a guide to the decision-maker in reaching a conclusion as to the nature of the dataset. Furthermore, a form of prior judicial approval will apply to all authorisations so that there is independent oversight of the conclusions reached.

Amendment 1, tabled by the noble Lord, Lord Coaker, seeks to replace factor (b) with language drawn from Schedule 10 to the Data Protection Act 2018. Factor (b) is concerned with the extent to which an individual has made public the data in the dataset, or has consented to the data being made public. The Government do not consider the amendment necessary. I am sure the noble Lord’s aim is to improve the safeguards in the Bill, and he has drawn inspiration from existing precedent to do so in an effort to bring consistency across statute. However, the amendment fails to achieve that aim, and risks creating an unclear and unnecessary link between this Bill and the Data Protection Act, which I have already explained. I will return to the Data Protection Act in due course.

Amendment 2, tabled by the noble Lord, Lord Fox, probes the inclusion of factors (d) and (e), relating to publicly available datasets that are already widely known about or are already used in the public domain—for example, in data science or academia. As I mentioned, the test in new Section 226A is one in which

“regard must be had to all the circumstances”.

The removal of factors from new subsection (3) would not, therefore, fundamentally change the test; it would mean simply that the decision-maker would not be bound to have particular regard to the absent factors. This amendment would, in fact, result in less transparency in the considerations the intelligence services apply when assessing expectation of privacy in relation to Part 7A authorisations.

The Government consider it important that particular regard is had to these factors. I know that noble Lords particularly enjoy the example of the “Titanic” manifest. It is a useful example of where such factors would be relevant, as it is a dataset that is widely known about and widely used, and contains real data about real people who would, unfortunately, no longer have an expectation of privacy. I also point to the helpful example in the independent review by the noble Lord, Lord Anderson: the Enron corpus. This is a large dataset of emails that came into the public domain following the investigation into the collapse of the Enron Corporation. Although initially sensitive, the dataset has been available in various forms for almost 20 years and is widely used in data science. It is right that such datasets are in scope of the new regime.

The noble Lord, Lord Fox, asked specifically about the extent to which these factors depart from existing privacy laws. The law concerning the reasonable expectation of privacy is likely to develop over time, and new Section 226A is intended to be sufficiently flexible to accommodate future changes. Rather than departing from the law, new Section 226A is intended to ensure that the intelligence services can continue to apply the law as it develops.

On Amendment 3, I thank the noble Lord, Lord Anderson, for tabling this helpful probing amendment. I am afraid the Government do not think it is necessary in order to achieve what we understand the intended effect of the amendment to be. The amendment does, however, provide an opportunity to better explain the difference between what the Bill calls “individual authorisations” and “category authorisations”. An individual authorisation will authorise the retention, or retention and examination, of a dataset under the new Part 7A being inserted into the Investigatory Powers Act—which I will henceforth refer to as the IPA—by this Bill.

All datasets that are to be retained under Part 7A must have an individual authorisation. Individual authorisations are subject to prior approval by a judicial commissioner unless the dataset described falls within an existing category. A category authorisation will not authorise the retention, or retention and examination, of a dataset. Instead, it is a mechanism through which a judicial commissioner’s permission may be sought in order to depart from the normal rule on prior approval, but only in respect of datasets that meet a particular description.

--- Later in debate ---

Turning to Amendment 9, I am sure noble Lords were as surprised as I was to hear that the noble Lord thinks that the intelligence services ought to “forget” intelligence they have gathered, creating a clear risk that could jeopardise national security and be contrary to their statutory functions, as well as Article 2 of the Human Rights Act, on the right to life.

[Lord Fox (LD)]

If the Minister and indeed the noble Baroness had listened to what I said, they would know that I do not think it is forgettable; I just wanted the Minister to confirm that point.

[Lord Sharpe of Epsom (Con)]

Thank you; point taken.

Section 226D provides a mechanism to achieve what I understand the intent of the amendment to be. It is clear that remedial action must be taken if it is discovered that Section 226A does not apply or no longer applies to part of a dataset authorised under Part 7A. Anything in the process of being done must be stopped as soon as possible, and that part of the authorisation is treated as cancelled. The effect of that part of the authorisation being treated as cancelled is that the data to which it relates must be deleted unless there is some other lawful basis for its retention. It may well be that it is appropriate for the intelligence service to continue to retain the data. That is why subsection (3), in effect, puts that part of the dataset back into the decision-making machinery in Section 220 of Part 7 of the IPA—so that such a decision can be made. We provide a fuller explanation of that in the draft code of practice for Part 7A, at paragraphs 4.26 and 5.39.

In conclusion on this amendment, if the noble Lord is suggesting that any actionable intelligence that has been identified while the agency was operating on the basis of that retention and examination being lawful under Part 7A should not be acted on, I am afraid I must playfully suggest that it is he who ought to forget his amendment.

I turn now to the various amendments on reporting on BPDs, including several that seek to amend the provisions set out in Clause 2, under Section 226DA, which require the heads of the intelligence services to provide an annual report on Part 7A to the Secretary of State. The first amendment proposed by the noble Lord, Lord Fox, Amendment 11, seeks to mandate that certain statistical information in a given year—specifically, the numbers of authorisations sought and granted—be provided to the relevant Secretary of State. This amendment is not necessary or appropriate. First, those Secretaries of State who are politically accountable for the intelligence services will have in place arrangements to that end and may demand of the relevant intelligence service any additional information he or she feels necessary. This may go beyond the level of detail the noble Lord has proposed be included in the annual report and may be more frequent. This is not a matter for the Bill, because the exact information the Secretary of State requires may evolve over time. Secondly, if this sort of specific reporting requirement is found to be necessary or desirable, it is more appropriate for inclusion in a code of practice, rather than being in the legislation. Indeed, the draft code of practice for Part 7A sets out some relevant details under paragraph 7.4.

I turn now to Amendments 10 and 12, proposed by the noble Lord, Lord West, and I take this opportunity to reassure him and the noble Lord, Lord Murphy. On behalf of the Security Minister, we thank them for their valuable work on the ISC and for the constructive engagement with the Bill Committee to date. I am pleased to see the noble Lord, Lord West, in his place today, and I am glad that he is on a more or less even keel.

The amendments the noble Lord has tabled would require the intelligence services to provide the same annual report that they provide to their Secretary of State, on the operation of Part 7A, to the ISC and the Investigatory Powers Commissioner. I do not believe that this additional requirement would provide the enhanced oversight of the regime that the amendments purport to provide. The annual reporting requirement is a formal statutory mechanism by means of which the Secretaries of State will receive information from the intelligence services about their use of Part 7A on an annual basis. This is a mechanism intended to ensure effective political oversight by the Secretary of State.

The ISC is a committee of Parliament. Oversight by the ISC is neither of the same nature as, nor a replacement for, the oversight of the Secretary of State. The ISC, as a committee of Parliament, already has a long-standing and well-established role in the oversight of the intelligence services to which these provisions will apply, and that role will continue here.

Sending the annual report to the Investigatory Powers Commissioner will not increase the level of independent oversight provided, for the following reasons. First, the Investigatory Powers Commissioner will be required to keep this new regime under review, as he does with the current Part 7 regime, and he will continue to report annually on his findings. Secondly, the information these amendments seek to include in the annual report is already information that the draft code of practice will require the intelligence services to keep, as is clear from paragraphs 7.1. and 7.2. The commissioner, and anyone acting on his behalf, has access to all locations, documentation and information systems as necessary to carry out a full and thorough inspection regime. The intelligence services are legally obliged to provide all necessary assistance to the commissioner, or anyone acting on his behalf, including by providing documents and information.

The noble Lords, Lord Fox, Lord Murphy and Lord West, asked about the continued engagement with the ISC. On both the policy proposals informing the Bill and the Bill itself, through a combination of ministerial, operational and official engagement, we have maintained continual engagement, which includes recent sessions with the Security Minister and the agency heads. As I said earlier, we are grateful to the committee for its engagement and scrutiny of the Bill. We will continue to involve it throughout the Bill’s passage, and I am more than happy to take the noble Lords’ comments back to the Home Office and make sure they are widely understood.

Amendment 13 would see the intelligence agencies notify the Investigatory Powers Commissioner every time an individual authorisation is granted in reliance on a category authorisation. I have already set out the distinct processes for individual and category authorisations under new Part 7A. As I set out earlier, categories will be authorised only with the prior approval of a judicial commissioner. IPCO inspectors will then be able to review the individual authorisation granted in reliance on a category authorisation during their regular inspections of the intelligence services throughout that time. Category authorisations will expire at 12 months and will then need to be renewed and that decision reapproved by a judicial commissioner.

--- Later in debate ---

Moved by

[Lord Fox]

20: Clause 11, page 30, leave out lines 38 and 39
Member's explanatory statement
This amendment is intended to probe the legal basis for surveillance of the type of data described in new subsection (3A)(e).

[Lord Fox (LD)]

My Lords, Amendment 20 is intended to probe the legal basis for surveillance of the type of data described in new Section 11(3A)(e). This amendment would prevent public authorities—councils, police forces, intelligence agencies, government departments including the DWP and HMRC, the Gambling Commission, the Food Standards Agency, and many more—having “lawful authority” to obtain and use communications data from a telecommunications or postal operator solely because the information is available to the public or a section of the public even if only on a commercial basis.

Communications data is defined in the IPA as data that may be used to identify, or assist in identifying, the sender, recipient, time, duration, type, method, pattern, or fact of a communication, along with the system used to make a communication, its location and the IP address or other identifier of any apparatus used. The broad list of public authorities able to obtain communications data is set out in Schedule 4 to the IPA.

Clause 11 of the Bill before us now amends the Section 11 IPA offence of unlawfully obtaining communications data from a telecommunications or postal operator. Whereas the IPA currently defines an offender as,

“A relevant person who, without lawful authority, knowingly or recklessly obtains communications data from a telecommunications operator”,


this Bill would add a list of examples to the Act of what constitutes lawful authority.

--- Later in debate ---

I believe that I have set out clearly the Government’s position in respect of these important areas. Again, I thank noble Lords for prompting this debate, but I respectfully ask that they do not press their amendments, for the reasons I have set out.

[Lord Fox (LD)]

My Lords, this has been a really worthwhile part of our debate, and I thank those who have tabled amendments and the Minister for his response. I was particularly interested to hear both the substance of and response to the amendments of the noble Lord, Lord West of Spithead. I think it best that we spend some time reviewing this in Hansard in deciding what, if anything, needs to come back. With that said, I beg leave to withdraw Amendment 20.

Amendment 20 withdrawn.

--- Later in debate ---

Debate on whether Clause 16 should stand part of the Bill.

[Lord Fox (LD)]

My Lords, in opposing that Clause 16 stand part of the Bill, I shall also speak to the clause stand part notices on Clauses 17 and 20.

This is one part of the Bill that has attracted a huge amount of external interest and deserves some positioning to understand why external parties might be suspicious of what they see. We should recognise that one of the most important security features available to protect personal information, both on a device and in the cloud, is end-to-end encryption. That encryption technology ensures that only users, and not the companies which provide the cloud services, can access their personal data and communications. Computer scientists and cryptographers have argued for many years that there is no safe way to decrypt one person’s messages without compromising the whole system’s security infrastructure. As soon as a backdoor, as it is called, is created to scan private messages, a security vulnerability is created that can be exploited by bad actors as well as good actors. I assume that that was why the Online Safety Bill left things hanging, waiting for a technological breakthrough, though I was not party to the processes of that Bill.

I remind your Lordships that once the company has created a backdoor key for encrypted systems, even for a single user in a single case, and certainly for any mass scanning, it has created a vulnerability that can eventually be abused by bad actors as well as law enforcement. I also remind your Lordships that the Home Office already can and presumably, on occasion, does require companies to weaken their security apparatus in the interests of law enforcement and national security.

To a great extent, the proximity of this Bill to the debate in the Online Safety Bill, has not helped matters: sensitivities were raised during that debate, and this is a chance for the Minister to try to calm them. As I mentioned earlier, the impending arrival of the Data Protection and Digital Information Bill is also putting people’s nerves on edge. There is a deal of management required here.

End-to-end encrypted messaging service providers were vociferous in their concerns during the passage of the Online Safety Bill, yet Section 121 of the Online Safety Act remains. However, Ministers clarified that Ofcom could only require scanning once it becomes technically feasible to do so—that is, when the technology is invented and allows scanning without violating encryption. But Ofcom retains the power to order service providers to use their “best endeavours” to develop that technology.

It is not surprising that some of those same encrypted message service providers were raising flags when it came to some of the clauses in the Bill. The IPA, as it stands, already enables the Home Office to instruct service providers to remove electronic protection for communications of interest to the police or security services by issuing them with a technical capability notice—a TCN. This effectively empowers the Home Secretary to require the removal of end-to-end encryption on those services across any number of suspects and criminal offences. Currently, for the Home Secretary to issue a TCN to a service provider under the IPA, they have to satisfy a number of considerations, which your Lordships will be pleased to hear I am not going to list. Even if the answers to all those conditions is positive and leads to a TCN, a process of checks and balances sits alongside the request, including informal and formal consultation between the Home Office and a service provider before the TCN is issued, oversight by the independent judicial commissioner assessing the request’s proportionality and, of course, recourse for the service provider to request a review of the TCN, allowing it and the Home Secretary to make representations to the judicial commissioner and the technical advisory board for assessment. Crucially, the service provider is not required to start acting on the notice until the review process is concluded.

--- Later in debate ---

Finally, as noble Lords will have seen, the Government have tabled Amendments 33 and 42 to clarify that the route of judicial redress to the Investigatory Powers Tribunal applies to notification notices. Amendments 40 and 41 ensure consistency across the language used throughout the IPA. I trust that noble Lords will welcome and support those amendments and I ask them, respectfully, not to press their own amendments.

[Lord Fox (LD)]

My Lords, I thank the Minister for an admirably comprehensive response. That was what we were looking for—perhaps not everyone, but certainly our Front Benches. There is a lot to get our heads around, so we will take this away and look into it.

There are a number of observations I would make. First, the Minister emphasised co-operation, collaboration and discussion. Of course, the legislation does not look like that, so it would help if the Government could find some confidence-boosting measures, be they from the code or the draft annexe, or something that enables the Government to signal their continued intention to co-operate and collaborate.

The Minister talked about an interconnected data world—that is exactly the point the operators are making. Because of that interconnection, a hiatus in delivering a service in the UK could also be a hiatus in delivering that service to the rest of the world, given that everyone is using the same service. That is one of the points that was not picked up by the Minister at the time. That interconnectedness is the very issue that some operators have: if they are prevented from doing it in one place, how do they do it elsewhere?

The issue of corporate entities is interesting. What the Minister described was something I used to call “corporate veil”, and I am interested to know how robust that is in corporate law. With corporate veil, it became very difficult, even at court level in the United States, to break down the corporate entities and their interconnections. For no other reason than making an observation, I am interested to see how that works. I certainly see why the Government are putting it forward in their legislation.

There is a lot for us to digest, which we certainly will, between now and the next stage; it gives us something to get our teeth into over Christmas. That said, I beg to withdraw my proposal that Clause 16 stands part of the Bill.

[The Deputy Chairman of Committees (Baroness Fookes) (Con)]

I am afraid that the noble Lord is not in a position to do that. This is a clause; one votes for it or against it.

Investigatory Powers (Amendment) Bill [HL]

Lord Fox Excerpts

Committee stage
Wednesday 13th December 2023 Lords Chamber

I repeat: we support the Bill. As the noble and learned Lord, Lord Hope, the noble Lord, Lord West, and I have said—I am sure that the noble Lord, Lord Fox, and others will say the same—we are seeking some clarification and certainty on some of its provisions so that it is fit for purpose and delivers what we all want it to.

[Lord Fox (LD)]

My Lords, I rise to speak to the amendments in my name in this group. First, I shall make some brief and broadly supportive comments regarding the amendments proposed by the noble and learned Lord, Lord Hope, and the noble Lords, Lord West and Lord Coaker.

As we have heard, all these amendments are designed to tighten up or clarify the triple lock and the changes introduced in the Bill. As your Lordships know, the triple lock relates to circumstances where UKIC and law enforcement may obtain and read the communications of MPs, et cetera; we will talk about the “et cetera” in a minute. Currently, the usual double lock is supplemented by an unqualified requirement that the Secretary of State may not issue the warrant without the Prime Minister’s approval.

As we heard from the noble and learned Lord, Lord Hope, the report from the noble Lord, Lord Anderson, explores the circumstances in 2020 when the Prime Minister was hospitalised and the triple lock was therefore rendered unavailable. The noble Lord recommends the use of a deputy for the purposes of the triple lock when the Prime Minister in unable to approve a warrant in the required timescale, particularly through incapacity, conflict of interest or an inability to communicate securely. As we heard from the noble and learned Lord, “unable” has been substituted with “unavailable” in the Bill. I really am not sure why—perhaps the Minister can explain why—but that is a different context. In his normal, forensic way, the noble and learned Lord explained the difference between those words; that is why I was happy to sign Amendment 51A, which reverts back to the originally recommended “unable”.

The amendments in the name of the noble Lord, Lord West, are more probing but interesting. We will be interested to hear how the Minister responds to them; I look forward to that.

Amendment 47 in the name of the noble Lord, Lord Coaker, seeks to limit the number of Secretaries of State who can be designated in that deputy role. This seems a reasonable suggestion. Others may want to change the list, but a senior group of Ministers should be listed; surely having three or four of them on that list should be sufficient to deal with the issue.

The noble Lord, Lord Coaker, spoke to Amendment 55A. There are elements of reporting there that are reflected in my Amendment 55, which I will come to shortly.

I will now speak to Amendments 50, 54 and 55 in my name. Amendments 50 and 54

“would require that members of a relevant legislation who are targets of interception are notified after the fact, as long as it does not compromise any ongoing investigation”.

Amendment 55 seeks to ensure that the Investigatory Powers Commissioner reports annually on the operation of surveillance warrants and safeguards in relation to parliamentarians. This should include records in the annual report of the number of warrants authorised each year to permit surveillance of the Members of relevant domestic legislatures. This would ensure transparency, at least over the rate at which the power is being used.

Before talking a little more about this, it is worth recapping the history of political wiretap legislation. I am sure there are others who know it better than I, but it was helpful for me to understand the context. As we have heard, the IPA permits the interception or hacking of parliamentarians or the Members of other domestic legislative bodies via this triple-lock system, whereby the Secretary of State can issue a warrant with the approval of the Prime Minister, as per Sections 26(2) and 111(3). Until October 2015, it was widely understood that the communications of MPs were protected from interception by the so-called Wilson doctrine. This protection extended to Members of the House of Lords in 1966, and was repeated in unequivocal terms by successive Prime Ministers. Tony Blair clarified in 1997 that the policy

“applies in relation to telephone interception and to the use of electronic surveillance by any of the three security and intelligence agencies”.—[Official Report, Commons, 4/12/1997; col. 321W.]

Despite this clear and unambiguous statement that MPs and Peers would not be placed under electronic surveillance, an October 2015 decision by the Investigatory Powers Tribunal held that the doctrine had been unilaterally rescinded by the Executive. We pick up from there, so it is an interesting evolving power and we are part of that evolution in this Bill.

This evolution has also coincided with the meteoric rise in electronic communication that now offers the possibility of vastly more information being unearthed than was the case with a simple wiretap back in the Wilson days. First, there are clearly times when this sort of interception is necessary, and that is why the triple lock is such an important safeguard. But I have a couple of modest suggestions contained in these amendments. I must say now that I am in a state of deep trepidation, as not only has the noble Baroness, Lady Manningham-Buller, given me notice that she is on my case but she has actually moved five Benches closer than she was on Monday, so my boots are shaking.

These amendments would introduce a post-notification procedure to inform parliamentarians where they have been affected by targeted surveillance powers, but only if it does not compromise any ongoing investigation. Clearly, they would have to be deemed innocent or beyond suspicion for that notification to happen. I agree that it would be unfortunate, to say the least, if, for example, the announcement of any investigation revealed confidential sources that led to the initial investigation. I had hoped that my wording implied that, but I will be very happy to work with the noble Baroness on improving the wording on Report if she deems it necessary.

We got to the fourth group of amendments to the Bill without my raising the European Convention on Human Rights. Now is the time. Happily, I am sure that the Minister has been reading up on this for other reasons, and he will no doubt be familiar with this important bastion of freedom. I refer in particular, in this case, to Article 8: the right to respect for private and family life, home and correspondence. I feel sure that most surveillance interventions would meet the terms of Article 8, which are summarised as:

“There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others”.


As I say, it is unlikely that the activities we have been describing will break that.

In the unlikely event that they do and there is a misstep, in order to bring a case under the Article 8 right it is necessary for a person to know that their privacy was breached in the first place, hence Amendments 50 and 54. I refer the Minister to two Article 8 rights cases heard by the European Court of Human Rights: Klass v Germany in 1978, which was reiterated in Weber and Saravia v Germany in 2006.

Amendment 55 is a bit simpler. It would ensure that the Investigatory Powers Commissioner’s annual report provides information about the operation of safeguards in relation to surveillance of Members of Parliament et cetera, as is already required for journalists. It would mandate that

“information in particular about warrants … considered or approved”

that are targeted at MPs et cetera is included, further to the requirement to provide information on general targeted interception and hacking warrants. I believe that is not a controversial ask, and I hope the Minister agrees.

I would like to use these amendments to do some probing as well as changing words, by confirming the “et cetera” part of MPs et cetera. My understanding, which I am sure is correct, is that as things stand that includes Lords and elected Members of the devolved authorities. But our democratic system is changing and evolving as we go. We now have very powerful elected mayors with very large electorates—much larger than any MP’s. I wonder whether there is an argument that they too should be included within the triple-lock umbrella going forward. I have one additional question in this vein. Once out of office, do all these individuals no longer attract triple-lock protection? Are ex-First Ministers, ex-MPs and ex-Prime Ministers all no longer subject to the triple-lock safeguards?

This sort of legislation breeds suspicion. The two measures I propose here are sincere attempts to help tackle some of these suspicions and create sufficient transparency to allay the fears that there is widespread and extensive activity of this type—assuming, of course, that this activity is indeed a rare occurrence.

[Baroness Manningham-Buller (CB)]

My Lords, the noble Lord, Lord Fox, is quite safe; I am not going to come and hit him, but I am going to try to demolish a few of his arguments.

I will start with the word “transparency”, which appears again in some of the amendments in the name of the noble Lord, Lord Coaker. The work of the security and intelligence agencies can never be transparent. It is in the interests of those agencies that as much as can safely be known of what is done in their name is known, which is why my organisation sought law in the 1980s. But there will always be things that cannot be made public because, if they are, we might as well pack up and go home.

Appealing as the amendments in the name of the noble Lord, Lord Fox, might be on the surface, for a start, telling people that they have been subject to interception would require us to alter earlier parts of the IPA because it would be illegal. To do so would also risk sources and methods. Of course, they would not be itemised, but let us consider a speculative case of a Member of the other House who has a relationship with a young Chinese lady. Let me emphasise strongly that this is not based on any knowledge of anything. Indeed, when I was director-general of MI5, we still operated the Wilson doctrine. Somebody in that MP’s office approaches my former colleagues and raises concerns with them. A warrant is obtained, signed by the Prime Minister, and subsequently it becomes clear that the concerns of the individual in the office—the source of the information—were absolutely justified. Now, we cannot tell that individual at any stage whether he or she is acquitted of any wrongdoing or ends up care of His Majesty’s jails. We cannot at any stage tell him because it risks sources and methods.

[Lord Fox (LD)]

I do not think I was saying that.

[Baroness Manningham-Buller (CB)]

No, this is what I want to establish. Just saying that he has been intercepted will lead that person to wonder how, so we cannot act covertly if there is any danger of sources being revealed or future operations being compromised.

Additionally, it raises the question of why Members of legislatures should have the privilege of being told that they have been subject to interception when members of the public never are. It is wrong, as it was, to treat parliamentarians as a particularly special case. Of course, such cases are highly sensitive, hence the triple lock; hence, I suggest, the rarity of this, but I think Amendments 50 and 54 are potentially damaging. I will shut up now.

--- Later in debate ---

Before I conclude, the noble Lord, Lord Coaker, asked me a specific question about a Mail on Sunday story about the Defence Intelligence situation. The Ministry of Defence did provide some analytical capability to augment capacity in government departments during the pandemic. This was done through established government processes: military aid to the civilian authorities—MACA—which allows for military support to government departments in exceptional circumstances, such as the pandemic. My noble friends in both DSIT and the MoD would be happy to follow up on any further questions on that.

[Lord Fox (LD)]

I am anticipating the Minister sitting down shortly. I remind the Minister that I asked a specific question on directly elected regional mayors, their rise, and the role that they play in democracy, which is so different to when the IPA was originally conceived. The Minister may not have an answer now, but a written answer would be very helpful.

[Lord Sharpe of Epsom (Con)]

I am happy to acknowledge that the noble Lord is right: their powers have expanded, as have their influence and celebrity over the years. I do not have an answer now, but I will come back to the noble Lord on that.

The objective of these clauses is to provide greater resilience in the process. It is critical that we do not undermine this from the off. I therefore hope noble Lords feel reassured by the explanations given, and the information set out in the draft code of practice, which is the appropriate place to set out the detail of this alternative process.

--- Later in debate ---

[Lord Murphy of Torfaen (Lab)]

My Lords, when I started life in politics a long time ago—50 years or so ago—when the general public, or people who had political ideas, thought about the security services they were generally criticised because they were spying on people who should not be spied on, such as political activists and all the rest of it. By the time the noble Baroness, Lady Manningham-Buller, and myself worked together with the intelligence and security agencies, the criticism that would come was whether the intelligence services had not done enough to protect us. That is the way in which things have changed over the last 40 or 50 years, so we have to be very careful how we balance this idea of accountability on the one hand and inevitable secrecy on the other. How do we do it?

There are reports by the Investigatory Powers Commissioner and the intercept commissioners. When I had to intercept, I was overseen by a commissioner every year. I had a meeting with him—a former judge—on whether I did this or that right, and on whether this or that was important. I come back to the point I have made in the last two days of Committee about the Intelligence and Security Committee itself. That is the vehicle by which Parliament holds the security services accountable. My noble friend Lord Coaker has been making that distinction all the time: the services being accountable to Government for what they do is very different from being available to Parliament.

Of course, details of who has been tapped and details of intelligence operations cannot come here, to this House or the other House—of course not. However, they can go through the committee which both Houses have set up, which meets in private, is non-partisan, and which has Members of both Houses who have great experience on it, to deal with these issues. That is why I appeal to the Minister—we had the debate on the issue on Tuesday—to think again about using the ISC to answer some of the issues that my noble friend Lord Coaker quite rightly raised.

[Lord Fox (LD)]

My Lords, I shall be brief. Just on the subject of suspicion, which I think I raised it, I was thinking—perhaps I did not articulate it well—that it was at the political-class level. It is not hard to construct a suspicious scenario where a Westminster-based Executive are hacking an Edinburgh-based politician—I am sure that suspicion would apply there. However, the noble Baroness is right about the public.

The amendment in the name of the noble Lord, Lord Coaker, is important, not because this sort of thing needs to go into primary legislation, but because his point around emphasising public understanding and support which has come out is really important. He picked out the fact that a number of officeholders have worked hard at generating a positive profile for the services, and for that they should be thanked and congratulated. I would add GCHQ, the public profile of which probably did not even exist a decade or so ago. I have several very sad friends who can hardly wait with excitement for the annual GCHQ quiz to arrive. Things like that essentially draw attention to the nature of the work that such organisations do. I laugh at those friends but then I cannot solve it and they can, so perhaps they are the winners there. Those sorts of things do not shed light and throw open the doors on the things the noble Baroness and others fear should not be public, but they create an ambience around those services which is important.

Nobody has mentioned the amendments in the name of the noble Lord, Lord Sharpe, which I guess is exactly what he wanted, and I have nothing to add to them either.

[Lord Sharpe of Epsom (Con)]

My Lords, I thank the Committee very much indeed for the points raised in this short debate, which eloquently explained the fine balance that needs to be struck in this area. As this is the last group, I take this opportunity to thank all the men and women in all the security services, who do so much to keep us safe.

Investigatory Powers (Amendment) Bill [HL]

Lord Fox Excerpts

Report stage
Tuesday 23rd January 2024 Lords Chamber

Moved by

[Lord Fox]

1: Clause 2, page 6, line 7, after “must” insert “, as soon as possible and in any event within 24 hours,”
Member’s explanatory statement
This amendment requires a person granting an authorisation in urgent cases to notify a Judicial Commissioner within, at most, 24 hours that they have done so.

[Lord Fox (LD)]

My Lords, I will speak also to Amendment 7, which is in my name. These amendments require a person granting an authorisation in urgent cases to notify a judicial commissioner within, at most, 24 hours. This amendment would make it mandatory that, when the intelligence services use type 7A and 7B data for urgent operational purposes, they must report this to a judicial commissioner within 24 hours.

As your Lordships know, the current proposal in the Bill is three days. As it stands, the intelligence services can use those three days to interrogate a dataset that is ultimately ruled offside by the judicial council—three days to deploy AI models that work very quickly, in moments. The Minister responded, highlighting extra cost as a possible reason not to pursue this. Plainly, with all due respect, that is not true, because the data has to be reported anyway, and bringing it forward by a couple of days is not a relevant concern.

The spectre of weekends has also been raised. I assume that, given that this process is to facilitate urgent investigations, the intelligence services themselves will be working on Saturday and Sunday, and it is up to them to report their activity. Amendments 1 and 7 do not change the time duty for the judiciary to respond, so this would not affect the operation of the urgent inquiry. Should they not respond until Monday or otherwise, it is not the concern of the services. Clearly, it puts pressure on the judicial commission to some extent, but the intelligence services will have met their side of the obligation and can carry on with their important and urgent work until such time as the judicial commissioner makes a ruling. In any case, I am sure that there will be duty rosters and such things going on for this, so, again, I am not sure that the weekend is a concern.

Another argument that has been advanced and may yet return is that other legislation uses three days, so this should, too. The whole point of the Bill is to take advantage of new and innovative technology. It seeks to recognise the differences and change regulations accordingly. If the technology changes, as it does as a result of the Bill, so should reporting criteria. If there are other times that are different, perhaps we should be looking at those rather than at this amendment. In this case we are dealing with new technology, where artificial intelligence, once trained, can be deployed on data—which may or may not be allowed until such time as the judicial commissioner has ruled—and AI can produce its answers in minutes, perhaps hours.

In Committee I proposed that the use of this data for urgent operations should be reported immediately. I recognise that that was a very unreasonable suggestion, which is why these amendments specify within 24 hours, which is a fairer proposal.

In Committee, the Minister’s words on what happens to information retrospectively ruled unusable were helpful:

“The relevant information must be removed from the low/no dataset and either deleted or a Part 7 warrant sought”.—[Official Report, 11/12/23; col. 1743.]


However, additionally in Committee, various ex-services Peers confirmed what I knew, which is that once a fact is known by service personnel, it is not forgotten—it cannot be unknown. The noble Baroness, Lady Manningham- Buller, and other noble Lords were very clear on that.

This amendment is designed to limit the amount of unforgettable information that can be derived from inappropriate datasets. I will listen hard to the Minister’s words, but, unless he has found a different and more compelling argument than those already deployed, I will press Amendment 1.

I am pleased that the Government have agreed that, in the event of Amendment 1 being agreed, Amendment 7 will be treated as consequential. I beg to move.

--- Later in debate ---

[Lord Butler of Brockwell (CB)]

My Lords, as a former member of the Intelligence and Security Committee, perhaps I may say how much I endorse what has been said by the noble Lords, Lord West and Lord Murphy, and welcome many elements in the—

[Lord Fox (LD)]

We have had the speeches on this group and are moving to a vote. I am sorry to interrupt the noble Lord.

I thank the Minister for his comments and, indeed, the noble Baroness, Lady Manningham-Buller. My interpretation—perhaps I am wrong—of the nature of this Bill was that it was to introduce a new class of data and to deal with it. It was not to reach back into existing law and change it. The noble Baroness raised some important points about why I should have been concerned about the other data, which I did not reach back into. I am happy to advise my colleagues in the Commons and perhaps they can do that, too. However, taking on face value the nature of what we were seeking to achieve today, we looked at this data and came up with this conclusion. We have heard the arguments, but I am afraid that I am not persuaded by them and I would like to test the will of the House.

--- Later in debate ---

[Lord Fox (LD)]

I shall be brief. Not for the first time, your Lordships are in debt to the noble Lord, Lord Anderson, for intervening on an issue that I think all of us failed to note. His request of the Minister is helpful, and I hope the Minister will be able to respond. There is an alternative process which I could suggest to the Minister—I have not had a chance to talk to the noble Lord, Lord Coaker, about this. If the Minister wanted to withdraw this amendment and bring it back at Third Reading, which is applicable in certain circumstances. I am sure we would be very flexible in permitting that as well.

[Lord Ponsonby of Shulbrede (Lab)]

My Lords, we support the introduction of the Government’s amendments. I echo what the noble Lord, Lord Fox, said about the amendment in the name of the noble Lord, Lord Anderson, and I look forward to the Government’s response on that point.

I would also be interested to hear what the Government have to say about my noble friend Lord West’s amendments. He has taken a keen interest in this part of the Bill, and I hope the Government will be able to answer the questions, in particular on data disclosure powers, as I think they can give a more detailed response to the expansion of disclosure powers to regulatory bodies than was given in the original legislation. It is also very likely to be further analysed and looked at as the Bill moves down to the other end of the Corridor. Nevertheless, we support the amendments as they are currently.

--- Later in debate ---

Moved by

[Lord Fox]

21: Clause 16, page 34, line 29, leave out from “insert” to end of line 30 and insert ““(where the requirement or restriction applies to a person within the United Kingdom)”.”
Member's explanatory statement
This amendment specifies that enforcement of retention notices applies only to UK recipients of such notices.

[Lord Fox (LD)]

My Lords, I will move Amendment 21 and speak to the other amendments in this group in my name.

Amendment 21 specifies that the enforcement of retention notices applies only to UK recipients of such notices. It is one of a suite of amendments in this group that return to the issue of extra-territoriality— I see the Minister blow out his cheeks at the prospect. Amendments 22, 25, 28 and 31 are similarly directed and each largely seeks to limit extra-territoriality by ensuring that operators can make changes to their services for users outside UK jurisdiction.

The reason for tabling the amendments, the others of which I will not move, is that there remains a huge gulf of understanding between the tech companies and the Government when it comes to the interpretation of the Bill with respect to its territorial reach. I am again presenting the Minister with a golden opportunity to set out in clear language the territorial ambitions that the Government have for this Bill. I believe there is some element of miscommunication going on here, though I am not sure in which direction. I hope that the Minister can dispel that.

Clearly, we have international tech companies that are incorporated in another country with subsidiaries all around the world and data residing in many different domains—companies that offer services to customers all over the world. In essence, we need to understand what would happen as a result of this Bill if such a business proposed to change a global service that is used by consumers all over the world, including in the UK. How do the Government use this Bill to deal with such situations? I am looking forward to the response.

Amendments 23, 24, 29 and 30 would raise the threshold for calling in a change from “negative effect” to “substantially limit”. Again, this increases the bar before the Government can start the process. Negative effect is a very low bar which will catch almost everything. It is not in the interests of the authorities to have everything coming through. There needs to be some sense of funnel. This is an opportunity for the Minister to define what negative effect is and what it is not, because it is a very low bar. He would be wise to take our advice and look at the language there, certainly when it comes to the code coming later.

Moving on, my Amendment 27 is a retread of an amendment I tabled in Committee, and it was there as a placeholder. I am pleased to see that it is unnecessary, as government Amendments 26 and 32 very much embrace the spirit of what I was seeking to achieve in that amendment. I thank the Minister for responding, and therefore will not be speaking to or indeed moving Amendment 27.

I now turn to Amendment 35. Currently, while there is a requirement for the Secretary of State to consult the operator before giving notice, there is no requirement on the Secretary of State to consult ahead of making regulations that will specify what “relevant change” includes, and therefore what needs to be notified. My Amendment 35 therefore introduces a requirement for pre-legislative consultation on the definition of “relevant change”. The amendment specifies that the Secretary of State must consult the Technical Advisory Board. There is a precedent for consultation with this board in Section 253(6) of the 2016 Act. As your Lordships know, the Technical Advisory Board is comprised of independent and industry representatives; the amendment also specifies a wider range of consultees.

The amendment then requires the Secretary of State to have regard to the impact on users, including on their privacy and on operators’ ability to innovate. Again, there is precedent for this in the 2016 Act. Such considerations must be taken into account when a public authority is deciding whether to issue a TCN or NSN, or where a judicial commissioner approves a DRN. As such, we feel it is worth while also to consider these factors when legislating for a “relevant change”, because delaying a critical security update could negatively impact users and operators. In a sense, all we are asking for is consultation. We are not asking to change the law, and this gives the Government a power to abide by that consultation or not. But we feel that this is an important definition, and it needs to be more widely consulted on.

I hope the Minister will agree, but in the event that he declines, I will be moving Amendment 35. I beg to move Amendment 21.

[Lord Ponsonby of Shulbrede (Lab)]

My Lords, we have had much welcome interaction from stakeholders on the issues summarised in this group, as well as some useful briefings from the Home Office and the noble Lord’s team, for which we are grateful.

As the noble Lord, Lord Fox, has just said, there appears to be a gulf in both position and understanding between the Government and the tech companies, both on the principle of the notice and its details, which is, in a sense, frustrating scrutiny of the Bill. I understand that there is a disagreement about the introduction of notification notices in general. It is right that we look at the details to ensure that the process takes place in a way that reflects the realities of international law, and the need of the intelligence services to maintain levels of data access and the necessary safeguards.

Concerns raised by stakeholders keep striking at the same places: how this notice would work with access agreements with other countries; why there is no double lock on the notification notice, despite the clear impact it would have on tech companies’ activities; and why the definition of telecoms operator is perhaps in reality wider than the Government intend.

We will not be supporting Amendment 35, in the name of the noble Lord, Lord Fox, although we understand the intent behind it. We encourage the Government to keep talking to stakeholders, and we believe that this part of the Bill will benefit from further discussion in the other place.

[Lord Sharpe of Epsom (Con)]

My Lords, I thank the noble Lords, Lord Ponsonby and Lord Fox, for their remarks in this debate. I reassure the noble Lord, Lord Fox, that any cheek-blowing he witnessed was more a reflection of the previous marathon speech than a reflection on his amendments.

Amendment 21, moved by the noble Lord, Lord Fox, would require that the enforcement of data retention notices—DRNs—would apply only to UK recipients of those notices. DRNs and technical capability notices—TCNs—can be given to a person overseas, but only TCNs are currently enforceable overseas. Clause 16 seeks to amend Sections 95 and 97 of the IPA to allow the extraterritorial enforcement of DRNs in order to strengthen operational agility when addressing emerging technology, bringing them in line with TCNs. It is vital to have this further legal lever, if needed, to maintain the capabilities that the intelligence agencies need to access the communications data they need to, in the interests of national security and to tackle serious crime.

The Government therefore oppose Amendment 21 as it goes fundamentally against what the Government are seeking to achieve through Clause 16 and would not provide any additional clarity to telecommunications operators. As DRNs are already enforceable against UK recipients, there is no need to re-emphasise that in the Bill.

I turn to the amendments to Clause 17 concerning the notice review period. This clause is vital to ensure that operators do not make changes that would negatively impact existing lawful access while a notice is being comprehensively reviewed. Maintaining lawful access is critical to safeguard public safety, enabling law enforcement and the intelligence community to continue protecting citizens during the review period.

Let me be clear: operators will not be required to make changes during the review period to specifically comply with the notice. Rather, under Clause 17 they will be required to maintain the status quo so that law enforcement and intelligence agencies do not lose access to any data that they would have been able to access previously. The review process is an important safeguard, and that right of appeal will remain available to companies.

On Amendment 27, tabled by the noble Lord, Lord Fox, the Government have noted the strength of feeling from parliamentarians and industry regarding the current uncertainty over the timeframe for conducting a review of a notice. We have therefore tabled Amendments 26, 32 and 33 to Clause 17 to address that uncertainty and provide further clarity and assurances regarding the notice review process.

The existing powers within Sections 90 and 257 of the IPA do not give the Secretary of State the power to specify in regulations the time period within which a review of a notice must be completed. The Government are therefore introducing a new regulation-making power to enable the Secretary of State to specify in regulations the length of time the Secretary of State can take to reach a decision on the review of a notice upon receipt of the report by the judicial commissioner and the Technical Advisory Board, and the overall length of time that a review can take.

The amendments will also make provision for a judicial commissioner to issue directions to the Secretary of State and the person seeking the review, as they see fit, to ensure the effective management of the review process. That will give the judicial commissioner the power to issue directions to both parties, specifying the time period for providing their evidence or making representations, and the power to disregard any submissions outside those timelines. These amendments will provide operators the certainty they require regarding how long a review of a notice can last, and therefore how long the status quo must be maintained under Clause 17. They will also provide further clarity on the process and management of that review.

Specifying timelines will require an amendment to the existing regulations concerning the review of notices. The Government commit to holding a full public consultation before the amendment of those regulations and the laying of new regulations relating to Clause 20, which provides for the introduction of the notification notices. Representations received in response will be considered and used to inform both sets of regulations, which we have clarified in the Bill are subject to the affirmative procedure.

Amendment 35, tabled by the noble Lord, Lord Fox, seeks to specify in statute who the Secretary of State must consult before laying regulations relating to Clause 20 and the introduction of notification notices, and the factors that the Secretary of State must have regard to when making those regulations. I hope the commitment that I have just made to hold a full public consultation provides the necessary reassurance to the noble Lord that all relevant persons will be consulted before making the regulations, and that he will agree that is it unnecessarily prescriptive, and potentially restrictive, to put such details in the Bill.

Amendments 22, 25, 28 and 31, also tabled by the noble Lord, Lord Fox, seek to limit the extraterritoriality of Clause 17 and ensure that operators can make changes to their services and systems for users in other jurisdictions during a review. To be clear, the Bill as currently drafted means that companies can make changes to their services during a review. They could choose to roll out new technologies and services while the review is ongoing, including in other jurisdictions, so long as lawful access is built into them as required to maintain the status quo. Furthermore, the status quo will apply only to whichever of their systems and services are covered by the notice in question. Naturally, anything outside the scope of the notice is unaffected by the requirement. I also emphasise that the control of telecommunications systems used to provide telecommunications services in the UK does not stop at borders, and it is highly likely that any such arbitrary geographical limitations would in fact be unworkable in practice.

Amendments 23, 24 and 29 seek to raise the threshold with regard to relevant changes that an operator must not make during a review period to a change that would “substantially limit” their ability to maintain lawful access. This would not make the position any clearer as “substantially” is a subjective test. Moreover, it would constrain Clause 17 in a way that would fundamentally prevent it from achieving its objectives: to ensure that the same level of lawful access available before the notice was issued is maintained during a review period.

Lawful access provides critical data to law enforcement and intelligence agencies. Constraining access to data that was previously available, in a limited capacity or substantially, may seriously undermine investigations and the ability to protect our citizens. It is therefore vital that the status quo is maintained during the review period. It would also be difficult to define “substantially limit” without referring to a “negative effect on” a capability.

Amendments 36 to 38 to Clause 20, also spoken to by the noble Lord, Lord Fox, seek to raise the threshold and provide more proportionality. As I have emphasised on every occasion we have debated the Bill, necessity and proportionality constitute a critical safeguard that underpins the IPA. Authorisations are approved by an independent body and all warrants and notices must be approved by a judicial commissioner. There is considerable oversight of authorisations, meaning that the threshold is already high. Necessity and proportionality justifications are considered for every request for a notice, warrant or authorisation and, by extension, whether it is reasonable to issue that request to the operator. Once operators are in receipt of such a request, they are required to provide assistance. The proposed amendments are therefore not required.

Finally, government Amendment 34 is a consequential amendment necessitated by the introduction of Clause 19, which amends the functions of a judicial commissioner to include whether to approve the renewal of certain notices.

I am grateful to all noble Lords who have spoken in this debate—

[Lord Fox (LD)]

Before the Minister sits down, winding back to the point about territoriality, he spoke of national boundaries as being arbitrary. It would help me to understand what kind of activity the Government envisage reaching across those boundaries, which he refers to as arbitrary; in other words, what would the Government be seeking to do extraterritorially?

[Lord Sharpe of Epsom (Con)]

If it would help, I am happy to write to the noble Lord with some sensible and practical scenarios because I do not think it is appropriate to make them up at the Dispatch Box, if that is acceptable.

I was just about to thank the noble Lord for the time he has taken to talk me through his concerns ahead of Report and at various other stages of the Bill on various other issues. However, I hope that I have provided reassurances through my comments at the Dispatch Box and the government amendments that we have tabled. I therefore invite the House to support these amendments and invite the noble Lord to withdraw Amendment 21 and not move the others he has tabled.

[Lord Fox (LD)]

I beg leave to withdraw the amendment.

Amendment 21 withdrawn.

--- Later in debate ---

Tabled by

[Lord Fox]

35: Clause 20, page 39, line 23, at end insert—
“(3A) Before making regulations under this section the Secretary of State must consult the following persons—(a) the Technical Advisory Board;(b) persons appearing to the Secretary of State to be likely to be subject to any obligations specified in the regulations;(c) persons representing persons falling within paragraph (b); and(d) persons with statutory functions in relation to persons falling under that paragraph.(3B) When making regulations under this section the Secretary of State must have regard to—(a) the public interest in the integrity and security of telecommunications systems and postal services;(b) the impact on users arising from any delay to implementing relevant changes;(c) the desirability of encouraging innovation by relevant operators; and(d) any other aspects of the public interest in the protection of privacy.”Member's explanatory statement
This amendment, together with others in the name of Lord Fox, place a duty on the Secretary of State to consult with relevant persons before making regulations that will specify what a “relevant change” will include.

[Lord Fox (LD)]

I heard what the Minister said on Amendment 35, and it is reassuring that the consultation will be occurring, so I do not intend to move Amendment 35.

Amendment 35 not moved.

--- Later in debate ---

[Lord Fox (LD)]

My Lords, at Second Reading I raised the issue of the Prime Minister in a slightly different context, but it has taken the legal brains of the noble Lord, Lord Anderson, and the noble and learned Lord, Lord Hope, to put it into a frame. I am happy to have co-signed that, and happy to find myself back on the same side as them on this argument.

It is clear that we will not resolve this here today, but it is perhaps something that we will take to the gap between here and the Commons to try to resolve. I rely on the wisdom of noble Lords who have spoken to take this forward.

On the other point, I support the amendments of the noble Lord, Lord West, and I hope that the Government will find his persuasion conducive.

[Lord Hope of Craighead (CB)]

My Lords, I spoke in Committee about the difference between “unavailable” and “unable”. I am greatly encouraged by Amendments 39 and 43 proposed by the noble Lord, Lord West. The one point of difference between us is that he narrows the meaning of “inability”, for reasons he has explained. If it came to a vote, I think I would support his amendments—but, like the noble Lord, Lord Anderson, I think that further thought needs to be given to whether that narrowing of “inability” or “unable” is really appropriate, considering the effect that it has, particularly in situations of conflicts of interest.

Investigatory Powers (Amendment) Bill [HL]

Lord Fox Excerpts

3rd reading
Tuesday 30th January 2024 Lords Chamber

[Lord Anderson of Ipswich (CB)]

My Lords, I echo all the thanks that came from the Minister. I do not think I can add to his list, but I certainly endorse everything he said.

Bills of this nature can be controversial. We are seeing this in some other parts of the world at the moment. That was not the case in your Lordships’ House. That is testimony to the care with which the Bill was prepared, the civilised way in which it was debated and the openness of the Government to some of the important points made during our debates. I single out in particular the work of the Intelligence and Security Committee for the great scrutiny that it applied to it.

If I may, I will depart briefly from the studied impartiality associated with the Cross Benches. With the Government and Opposition so closely aligned on a Bill, it was particularly useful that we heard from the Liberal Democrats—with their sometimes annoying but rather necessary process of probing amendments. They caused everyone to think carefully about what we were doing. All in all, it was a happy experience for me. I hope that this is a good model for future Home Office Bills.

[Lord Fox (LD)]

My Lords, having been cleared to annoy your Lordships’ House, I will do my best to do so.

This Bill started in your Lordships’ House and now heads to the Commons. Its primary purpose of enabling the intelligence services to better build their data models and teach their AI systems has been left completely unmolested by your Lordships. However, other parts of the Bill have attracted a fanfare of concern from certain external parties—particularly the large platforms. Whether the Government and Apple are at cross purposes or the Minister really is out to get it, we in your Lordships’ House were unable to muster sufficient traction to find out or clarify. It is now up to the MPs if they choose to pick up that particular baton.

There was also an unresolved issue around the triple lock and the Prime Minister’s role when they might be in conflict. Again, this has moved from our orbit. I hope the tenacity of the noble Lord, Lord Anderson, and the noble and learned Lord, Lord Hope, might still be involved somehow between here and the other place. The Minister raised the important issue of legislative consent. I hope he is successful in these negotiations.

I echo what other noble Lords have said. This has been a well-mannered and constructive process of discussion, with everybody moving in the same direction, albeit at different speeds.

I thank the Minister and the team he named for their time, availability and openness in our discussions. I also thank all the many external organisations and individuals who took time either to meet and brief or to send information which helped inform our debate. The discussion was greatly enhanced by the noble Lords, Lord Coaker and Lord Ponsonby, from the Front Bench, and by colleagues on their Benches, as well as the Cross Benchers. They played a pivotal role in our discussions.

Finally, I thank the home team: my colleague, my noble friend Lord Strasburger, and, most of all, Elizabeth Plummer in the Lib Dem Whips’ Office, without whom nothing is possible.

Investigatory Powers (Amendment) Bill [HL]

Lord Fox Excerpts

Consideration of Commons amendments
Tuesday 23rd April 2024 Lords Chamber

[Lord Fox (LD)]

My Lords, when I heard that the Government were bringing forward amendments to this Bill in the Commons, I was somewhat suspicious, but I am pleased to say that it seems, after yesterday, the Minister has migrated to a slightly calmer situation today, as the amendments in front of us are all amendments that we can pass without too much ado. Amendments 3 to 6 are useful clarifications of where we should be; the Commons has done a good job in clarifying that area and that should be noted. I am sure that Amendments 15 and 16 will be an understandable change to the original amendment of the noble Lord, Lord West. I would like again to thank the Minister and the Bill team for their openness and their help in working through these amendments and, of course, the previous Bill. With that, we on these Benches are happy to accept these amendments.

[Lord Coaker (Lab)]

My Lords, once again, I thank those in the intelligence community who defend our country. I thank all MPs and Peers from both Houses for their dedicated scrutiny of the Bill, which we fully support. As the noble Lord outlined, it is a good Bill that has been improved by your Lordships’ scrutiny, and it benefited from starting in your Lordships’ House before it went to the other place. I thank—as did the noble Lord, Lord Fox—the Bill team for their work and for their genuine engagement with us as the Bill progressed. I thank the noble Lord, Lord Anderson, for the detailed report that he did, which led to much of what we see in the Bill, and it is good to see the noble Lord in his place.