Investigatory Powers (Amendment) Bill [HL]

Lord Fox Excerpts

2nd reading
Monday 20th November 2023 Lords Chamber

[Lord Fox (LD)]

My Lords, it is a great pleasure to follow the noble Lord, Lord Coaker. I look forward to a fascinating and intimidatingly expert debate. Before commenting on the Bill, I feel that it is important to contextualise what we are discussing today.

Many of us enjoy books that depict the intelligence services. In the main, the George Smileys who appear within their covers are practising in a world that is very far from the lived experience of most people in this country. However, the reality is very different. The work of the intelligence services impacts very many people’s lives in the UK. It is not just bombs and guns but drugs, people trafficking and other exploitation, financial and cybercrime, extortion and many other crimes. The perpetrators are Governments, terrorist organisations, criminal gangs and lone individuals. Crime and terror merge and are socially unjust activities that prey on the weak. The victims are most often the vulnerable and those with the least ability to resist. Within this depressing tapestry, we rely on our intelligence services to help keep us safe and we need a police force that can cope with the complexities of those crimes. Liberal Democrats wholeheartedly support the services that seek to do this and we welcome this debate.

We also believe that these vital tasks have to be balanced against the freedoms and liberties at the heart of our country’s values. Every new power must be weighed in that balance and the noble Lord, Lord Coker, just explained that from his perspective. As we have heard, this Bill proposes some specific amendments to the original Investigatory Powers Act 2016. I was not involved in the scrutiny of the Bill at that time; that fell to my noble friend Lord Paddick, and the noble Baroness, Lady Williams, was in the ministerial chair, so it is a new set of eyes looking at this legislation.

I remind your Lordships’ House of some of the key priorities that my noble friends here and my colleagues in the Commons applied to the 2016 Bill. The first of these is that there should be no weakening of encryption. The second is the vital role of judicial authorisation and the third is that, when it comes to the bulk collection of information or mass surveillance, British residents have a right to expect privacy. These principles were central to our response to the last Bill and will be to this.

Today’s Bill, as we have heard, is the product of deliberation over years. Your Lordships should particularly thank the noble Lord, Lord Anderson, for his work on it. However, given the time taken to get this far, it is very disappointing that the Government chose to introduce the Bill in such a rush that it gave just eight working days for parliamentarians and civil society to prepare for the specific scrutiny of it. If the Government were seeking to ensure that they took people with them, this is a way to antagonise them. There are already comments about haste being an effort to railroad people.

I am afraid my speech today is quite a long one because I did not have time to write a short one. I turn to the Bill. As the Minister set out, the original Bill established a set of protections under Part 7; this Bill introduces two new levels of security, Parts 7A and 7B. Part 7A is introduced in Clause 2 and concerns bulk datasets, as we have heard, with

“low or no reasonable expectation of privacy”.

These so-called low/no datasets may be in three types, each with slightly different rules.

I have enjoyed helpful discussions with the Minister’s department and for that I appreciate his facilitation and engagement. During those discussions, the basic explanation has been that these datasets are needed to train tools using machine learning, that they already exist and are being used in the commercial world, but the Part 7 process makes them at best clumsy and at worst impractical to be used by the intelligence services. I take those points. Furthermore, the introduction to Part 7A includes a requirement for approval from judicial commissioners. Had it not, this discussion would have been much harder.

If training Al tools is the stated prime mover for Part 7A, the inclusion of urgent data as one of the three types of data clearly indicates it is also needed for ongoing investigations. I can imagine why urgent data might be needed, but it is the investigators who will define the urgency. Additionally, new Section 226BC refers to a relevant period of three working days between the acquisition of the urgent data and full judicial approval. Yet, after three days, the judicial commissioner may decline to permit the use of the data that has already been employed in an investigation using rapid Al-enabled analysis.

Taken together, I have my worries. There needs to be a duty to immediately notify the judicial commission. Secondly, there should be guardrails helping define “urgent” and finally we need to discuss how information discovered using data that is subsequently ruled ineligible is, shall we say, unremembered. Without these, the use of low/no datasets in this way for operational issues is concerning.

I have gone into this in some detail because I see it as a serious operational concern but also because I wanted to illustrate the sort of scrutiny the Government should expect from these Benches throughout this debate. There are other examples as we go through the Bill, but I will refer to those only broadly now. Clause 5 introduces a second new category of approval, Part 7B, this time for datasets held in third party assets to which the intelligence services have access. As far as I can deduce, this brings into the orbit of the IPA data which was previously not included and mandates both Secretary of State and judicial commission levels of approval. Unless I learn otherwise, that is a good starting point.

That said, we will seek to initiate explicit discussion around the use of medical, genetic and genomic data and how this can be protected. Here I note that anonymised data can be relatively easily reassigned, so anonymity in health databases is no actual protection. This is important on several levels, not least for public confidence in the digitisation and legitimate use of this very important information.

Part 2 allows the deputisation and delegation of some of the powers to broaden the number of people responsible involved. I just ask whether the Minister believes that this heralds a massive increase in workload.

In Part 3, I thank the Minister for his explanations around Clause 11, which I shall read carefully, and I will be coming back for some more details about how that will work in practice. Clause 14 creates a new condition for the use of internet connection records by the intelligence services and the NCA. Broadly, this removes the need for exact times when seeking connection records, substituting time ranges. This seems acceptable, as long as the Minister can assure your Lordships’ House that this will still require Secretary of State and judicial commission approval.

Part 4 moves into the area of retention notices and away from issues covered by the report of the noble Lord, Lord Anderson. I believe that Clause 15 is focused on bringing inbound roaming on foreign SIM cards into the frame, so I would appreciate details of how this will work. For example, if I am in the UK using a SIM that I bought in Dubai from a UAE-based telecoms provider, how does the intelligence officer proceed?

Clause 20, as we have already heard from the noble Lord, Lord Coaker, is one that has already raised eyebrows in the industry. Proposed new subsection 258A requires telecoms operators to inform the Secretary of State if they propose to make changes to their products or services that would negatively impact existing lawful access capabilities. In reality, this can include changes in encryption, a topic which has recently been on a rocky journey through the passage of the Online Safety Act. This Bill proposes a number of changes, building on the current regime set out in the 2016 Act, that relate to decryption of private messages for law enforcement purposes. In short, we believe the amendments would, or at least could, grant the Home Secretary more extensive powers to intervene in, and in some cases block, communications providers’ operational decisions, including enhancing privacy settings for users, with potential knock-on implications for end-to-end encryption on those services for everyone. I think more debate will be needed in this area.

There are other issues of timing, the possible length of a review, extraterritoriality and the level of judicial commission oversight at the notice level. I am sure I will be told by the Minister that this is a narrow interpretation, but it is an interpretation that has legs outside your Lordships’ Chamber. How will this power be used and what are the implications? Will we perhaps see British law officers beating a path to California to serve these notices? In a sense, how far does this go?

Finally, Part 5 invokes some interesting questions, some of which the noble Lord, Lord Coaker, has already asked and we will surely want to probe. We will want to introduce a requirement that the Investigatory Powers Commissioner is informed of, and records in their annual report, the number of warrants authorised each year to permit surveillance of Members of relevant domestic legislatures. For now, perhaps the Minister could tell your Lordships’ House what the process is for gaining permission to intercept and examine the Prime Minister’s communications.

We will also be probing two other important areas on which there is no time to expand today. The first is specific protections to avoid either cementing or introducing systemic bias against certain sections of the community from the AI models of the future that will be built as a result of this legislation. The second is the use of facial recognition technology on the back of the tools created using the low/no databases, a point that the noble Lord, Lord Coaker, raised.

To conclude, we are concerned that the Bill could push legislation further past the point of balance that we started to discuss. We need to ensure that judicial oversight extends right through the activities enabled by the Bill, and there should be no weakening on the encryption issue. I hope the Minister views this critique in the spirit of constructive support that I have sought to invoke, and I look forward to the rest of the debate and the further stages of the Bill. As he can see, our work will be built on the foundation that British residents have a right to expect privacy.