Investigatory Powers Bill

Lord Harris of Haringey Excerpts

Tuesday 19th July 2016 Lords Chamber

[Lord Paddick]

My Lords, this amendment is one of several in this group in my name and that of my noble friend Lady Hamwee. Amendment 158A probes what is meant by the term “any other information” in terms of the purpose of an equipment interference warrant. Clause 93(2) states that an “equipment interference warrant”,

“requires the person to whom it is addressed to secure interference … for the purpose of obtaining—(a) communications”,

which is defined in Section 126(1); “(b) equipment data”, defined in Section 94; and “(c) any other information”, which is not defined. Can the Minister at least give some examples of what “any other information” means? Amendments 185B and 185C cover the same point in other subsections of Clause 93.

Amendments 158D to 158M and Amendments 169B to 169T make a different point—to try to ensure greater targeting of equipment interference warrants. Clause 95 sets out the subject matter of targeted equipment interference warrants. Clause 95(1)(b) states that the warrant may relate to,

“equipment belonging to, used by or in the possession of a group … who share a common purpose or who carry on, or may carry on, a particular activity”.

Such a broad and potentially large group of people can only in the loosest sense be described as targeted.

Amendment 158J applies the same arguments to targeted examination warrants in Clause 95(2)(b). Similar arguments of not being too broad and not being sufficiently focused apply to Clause 95(1)(f):

“equipment which is being, or may be, used for the purposes of a particular activity or activities of a particular description”.

Instead, Amendment 158H would insert:

“A targeted equipment interference warrant may be issued only if the persons or equipment to which the warrant relates are named or specifically identified using a unique identifier”,

which could, for example, be the IP address for a particular device. Similar wording in Amendment 158M would apply to targeted examination warrants.

It is worth remembering what targeted examination warrants are for. If, as a result of the bulk collection of the content of overseas communications, the security services discover UK-based communications that they want to examine the content of, they must first have a targeted examination warrant. This is to prevent the bulk collection of the content of communications of UK citizens. How then can it be right that such a targeted examination warrant applies to such a broad range of communications as,

“a group of persons who share a common purpose or who carry on, or may carry on, a particular activity”?

If the security services know that the communication is UK-based, they must also know whose communication it is and can therefore specify that in the warrant.

Subsections (1)(g) and (h) and (2)(d) and (e) of Clause 95 make provision for the issuing of targeted equipment interference warrants and targeted examination warrants for the purposes of testing, maintenance of equipment and the training of people. Amendments 158F, 158G, 158K and 158L would leave out those provisions.

In the first Committee sitting we discussed the issuing of interception warrants for the purposes of testing equipment and training agents, and the noble and learned Lord responded to the debate at cols. 105 and 106. In response to the Minister’s explanation, I said that I was still puzzled about training and testing warrants. I accepted that new equipment required testing and individuals needed to be trained in real-life situations but said that I was concerned about who the individuals or organisations were that might be targeted in these training exercises, bearing in mind that the normal provisions regarding proportionality and necessity in terms of suspicions that these individuals were up to no good would presumably not apply in training and testing situations. If they were real bad guys, a non-testing and training warrant could be issued. The noble and learned Lord failed to convince me then, but perhaps he can try again now.

Amendments 169B and 169T make the necessary consequential changes to the requirements that must be met by warrants in terms of the details that must be included in equipment interference warrants. I beg to move.

[Lord Harris of Haringey (Lab)]

My Lords, I listened very carefully to the noble Lord, Lord Paddick, and his explanation of his amendments, but I was not at all convinced. If we believe that there is a need for the Bill, which I do, but have reservations about some of the issues around encryption, we have to ensure that the relevant agencies have some tools in their kit box. One of those tools has to be the ability to interfere with or look at the specific equipment. What the noble Lord is trying to do is to restrict the availability of that power to such an extent that it would effectively become almost useless. It would simply be available if you have one named individual. Therefore surely it is right that a significantly broader power should be available to engage here.

The question that the Minister who is going to respond needs to answer is this: how will the test of proportionality be applied in such cases? Presumably it is not proportionate to have such a broad sweep contained within the authorisation that it is inappropriate and overly onerous. The mechanism is therefore this: how is it determined that this is a proportionate and proper use of the power, and can we and the public be reassured that the mechanisms exist to ensure that that proportionality is adhered to?

[Lord Keen of Elie]

I am obliged to noble Lords. I know that these are probing amendments and I shall address them in that light. Of course some of these amendments were discussed in the other place and, as noted, were considered again by this Committee in the context of interception.

Amendments 158D to 158M and 169B to 169T would remove the ability of the warrant-requesting agencies to apply for a warrant against an organisation, a group of persons with a common purpose, or a group of persons carrying out the same activity. They would require a warrant to name or identify each person or piece of equipment to which the warrant relates and they would remove the ability to obtain warrants for testing and training activity. As I have already set out when we considered similar amendments in the context of interception, it is important that those responsible for keeping us safe have the powers they need. These amendments would undermine their ability to employ those powers.

Let me start with the amendments regarding unique identifiers. As I explained in the context of interception warrants, it is not always possible at the outset of an investigation to know or have identified all of the individuals who may be subject to a warrant over the course of that investigation. The example of a kidnap gang applies to equipment interference just as it applies to interception. When a warrant is granted against a gang, the person applying for the warrant may not know that there are four members of the gang rather than three. The ability to grant a warrant against the gang in order to establish its size and to identify co-conspirators is precisely why the Bill provides for thematic warrants. Thematic warrants are already available to the equipment interference agencies under the Intelligence Services Act 1994 and the Police Act 1997 and they are invaluable when investigating complex or fast-moving threats. It is right that the Bill should not undermine their ability to do this.

I would seek to reassure your Lordships that the Bill already provides in Clause 107 that the warrant has to describe the relevant persons, locations, activity or groups and the type of equipment to which the warrant relates in so far as it is reasonably practicable to do so. This is an important safeguard which will assist the oversight of thematic targeted warrants. The Investigatory Powers Tribunal recently considered the use of equipment interference in this way. It determined that,

“a warrant is lawful if it is as specific as possible in relation to the property to be covered by the warrant”,

and that,

“it need not be defined by reference to named or identified individuals”.

Let me turn to the amendments that seek to remove the ability to grant a warrant relating to particular subject matters. This was also discussed at some length in the other place and very recently in this Committee, again in the context of interception. Such a change would be operationally damaging and is moreover unnecessary. The Bill and the statutory code of practice impose strict limits on the issue of warrants, including in relation to organisations or groups of persons. I should emphasise that such warrants are not open-ended. Their scope must be sufficiently limited that the issuing authority can properly assess the necessity and proportionality of the interference. Further, under the Bill a judicial commissioner will need to approve the issuing authority’s decision. So the clause does not allow for overly broad warrants to be issued. Moreover, removing the ability to seek warrants against persons carrying out the same activity could prohibit the agencies from, for example, seeking a warrant against individuals accessing a particular website in order to access child abuse images. In such cases it is vital that law enforcement should be able to identify suspects and bring them to justice.

--- Later in debate ---

[Lord Harris of Haringey]

My Lords, as I said earlier in Committee, it is important that, in assessing any proposal made in the Bill, we strike the balance between the need for it and any possible negative consequences, and whether that may weaken the security of a device, enabling the malign elements, as opposed to benign, to penetrate systems. As I understand it, the purpose of the amendment is to try to ensure that that balance is clear in the Bill. It would place an obligation on those seeking warrants and those considering them to look at whether that balance has been struck and ensure that it has.

It is reasonable for those seeking warrants to demonstrate that they have considered whether there are any negative consequences of the action they are prepared to take, particularly if it leads to a weakening of the general security of a wider system that may mean it is prone to attack from cybercriminals or others accordingly, or that there is likely to be a large amount of collateral damage in other people’s information being made available to the authorities.

I make it clear that I do not think the fact that the information of other people who are not the purpose of a warrant may be compromised is necessarily a reason why we should not proceed with this. It should be balanced with the consequences. For example, I can conceive of circumstances where a warrant might be sought for a machine in an internet café. Clearly, that is because certain individuals are thought to be using it. In any application I would want consideration to be given to what would be done about those other, presumably entirely innocent individuals who might use the same machine.

I am concerned that, as part of the process, there should be consideration of the downsides of a particular application: whether it is weakening the system or interfering with the privacy of other people who are not specifically targeted. If either is the case, there should be clear consideration of what can be done to minimise those risks. The fact that another person is not the subject does not necessarily mean that it should not be proceeded with. It is a matter of proportionality—the benefits that will be gained from the action being taken and whether those are properly considered by those making the application and those considering whether to approve it. For those reasons, the amendment is broadly helpful. I hope that Ministers may be prepared to accept this or something like it to provide that assurance.

[Baroness Hayter of Kentish Town (Lab)]

My Lords, I added my name to Amendments 159 and 160. Amendment 164 is in my name and that of my noble friend Lord Rosser. Our points are much the same as those made by my noble friend Lord Harris. I do not think there will be planting of evidence, for example. Our concern is much more about the risk to any public cybersecurity system, and we would want that to be taken into account. These amendments follow the recommendations of the Joint Committee. The idea is to minimise any potential risks. If, for example, the Secretary of State has to take into account any risk to the security and integrity of the networks, that by itself will ensure that any applicant sets that out in the form they submit. We hope the Government will respond, as my noble friend Lord Harris said, not necessarily by using these exact words but in the spirit of these amendments in order to retain overall security.