Draft Investigatory Powers Bill

Lord Paddick Excerpts

Wednesday 4th November 2015 Lords Chamber

[Lord Rosser (Lab)]

I thank the Minister for repeating the Statement made in the Commons earlier today on the draft investigatory powers Bill, which the Government intend should receive Royal Assent before the sunset clause in the Data Retention and Investigatory Powers Act 2014 comes into effect at the end of next year. An important stage in the consideration of this Bill will be undertaken by the pre-legislative scrutiny committee and its findings will, I am sure, be awaited with considerable interest.

We have also had a number of different reports on this issue in the last few months including from, but by no means only from, the Independent Reviewer of Terrorism Legislation, David Anderson QC, the Intelligence and Security Committee, and the review convened by the Royal United Services Institute. All three of those reports supported an overall review of the current legislative framework for the use of investigatory powers and the replacement of legislation such as the Regulation of Investigatory Powers Act 2000.

The Anderson report was commissioned on the basis of an opposition amendment when Parliament was asked to legislate very quickly to introduce the Data Retention and Investigatory Powers Act 2014. We argued then that it was the right time for a thorough review of the existing legal framework to be conducted as we, and others, no longer felt that the current arrangements were fit for purpose. Fast-developing technology and the growing threats we face internationally and domestically have left our fragmented laws behind and made the job of our police and security services, to whom we all owe a considerable debt of gratitude, harder.

We support the Government in their attempt to update the law in this important and sensitive area, particularly since the Statement appears to indicate that the Government have listened to at least some of the concerns that were expressed about the original proposed legislation put forward during the last Parliament. However, we hope that this Statement and the draft legislation does not prove to be a bit like some Budget speeches where it is only afterwards that some of the detail proves to put a rather less acceptable gloss on aspects of some of the changes and measures proposed.

Although it is becoming something of a cliché, the need is to secure the appropriate balance between the requirement to safeguard national security and the safety of our citizens, and the requirement to protect civil liberties and personal privacy, which is surely one of the hallmarks of a democracy compared to a dictatorship. The extent to which the proposals set out in the Statement, and in the draft legislation, achieve that difficult balance is clearly going to be the subject of much discussion during the consideration of the Bill. However, the Statement indicates stronger safeguards than were previously being proposed, including in the important area of judicial authorisation, and it appears as though in broad terms that difficult balance may be about right. We will examine carefully the detail of the Bill and where necessary seek to improve the safeguards to increase the all-important factor of public trust.

The proposals set out today do not of course relate just to national security. They also have relevance to preventing serious and abhorrent crimes and apprehending those who commit them, including murder, major fraud and child sexual exploitation. In that regard, can the Minister confirm that the far-reaching powers of content interception will be used only for the most serious crimes, as applies under RIPA? The Statement indicated that the detailed web browsing of individuals will not be accessible, which we support, but will the Minister set out precisely what internet activity of an individual will be accessible without a warrant?

Clearly, vulnerability of information has gone up the agenda of public concern in light of the attack on TalkTalk. Since data retention and bulk storage were referred to in the Statement, what steps do the Government intend to take to ensure the security of bulk storage of data by public and private bodies?

The Statement referred to the change of approach on encryption from the possible ban previously mentioned by the Prime Minister, and reference was also made to communication providers and legal duties. Are the Government satisfied that they can make any such legal requirements stick against some of the largest and most popular online names, many of whom have headquarters overseas?

The Statement also referred to the protection of communications for parliamentarians. Will that protection also apply to people communicating with parliamentarians, whether on personal matters or on providing information? What protection arrangements will there be for sources of information used by journalists? The Statement said that, if it were proposed to intercept the communications of a parliamentarian, the Prime Minister would also be consulted. What in this context does “consult” mean? Does it mean that the Prime Minister would have to give his or her agreement?

The Statement also addressed the issue of authorisation, and set out a two-stage process which is clearly intended to address the twin points of accountability to Parliament on the one hand and sufficient independence from the political process on the other in order to build trust—an issue referred to by David Anderson QC in his report. What will be the powers of the judges involved in the authorisation of warrants process in view of the reference in the Statement to a warrant being “formally” approved by a judge, and will judges have to sign off warrants in all cases? Will the information made available to the judge in order to make his or her decision be the same as the information made available to the Home Secretary? Will the criteria against which the judge will make a decision be the same as the criteria against which the Home Secretary makes her decision, or will the judge have a different remit? Who, or what body, will appoint the judges who will be involved in the authorisation of warrants process? How long is it expected to take to go through the double-lock authorisation process outlined in the Statement, and what will happen if there is an emergency requiring immediate authorisation of a warrant?

One of the key themes of the report by David Anderson was that a core objective for the renewal of legislation concerning investigatory powers ought to be public trust from all sections of our community in the use of those powers by government agencies, since public consent to intrusive laws depends on people trusting the authorities to keep them safe and not to spy needlessly on them. That in turn, as David Anderson said in his report, requires knowledge, at least in outline, of what powers are liable to be used, and visible authorisation and oversight mechanisms in which the wider public can have confidence.

The Bill will go through its stages in the Commons before coming to this House. It is, of course, a matter for the other place to determine, but one can only express the hope that a Bill of this importance will have received full and proper consideration before it gets to this House, although I am sure there will be no lack of willingness in this place to make up for any deficiencies in that regard and to ensure that the powers being sought are necessary and proportionate in relation to the issues and potential dangers they are intended to combat and address.

[Lord Paddick (LD)]

My Lords, I, too, thank the Minister for repeating the Statement made by the Home Secretary in the other place. Clearly, we would like to be reassured by the Home Secretary’s claim that the draft Bill is not a return to the draft Communications Data Bill 2012, which the Liberal Democrats in the coalition Government quite rightly blocked, and from which this Government now appear to want to distance themselves.

There are some clear and very welcome changes proposed, including judicial authorisation of interception warrants and a promise not to interfere with encryption, but we must look very carefully at the detail of what is being proposed, particularly in relation to what the Home Secretary calls, “internet connection records”. Clearly, there has been a great deal of concern about communications service providers storing everyone’s web browsing history and handing over this information to the police and the security services. While the Home Secretary says that the proposed Bill would not allow that, I will probe very gently whether that is the case, so as to dispel concerns that this is just smoke and mirrors.

Intuitively, the Home Secretary must be right that if the police can use mobile phone data to find an abducted child, they should be able to do so if criminals are now using social media or communication apps instead of cellular data. Our concerns are: first, whether this is technically feasible; secondly, whether it is technically feasible without prohibitive costs to communications service providers; and, thirdly, whether it is possible without the risk of disproportionate intrusion into innocent people’s privacy, whether by the forces of good or by hackers such as those who breached TalkTalk’s security, as the noble Lord, Lord Rosser, mentioned.

Talking to experts, I was told that communications service providers would be unable to tell the police or the security services whether someone had used the internet to communicate, as opposed to just browsing, without storing content. This requires billions of pounds of hardware investment, and even then it may not be possible to tell the difference between browsing and communication. Determined suppliers of applications that enable people to communicate covertly could disguise internet communication as passive browsing, for example. Will the Minister say whether the Government know that it is technically possible for internet service providers to provide a record of the communications services a person has used without a record of every page they have accessed? What would be the cost to communications providers? Has a risk assessment been undertaken of the possibility that, having stored sensitive personal information, that information might be accessed unlawfully?

Finally, in 2005 the police, backed by the then Labour Government, asked for a power to detain terror suspects without charge for up to 90 days—a power that the security services did not ask for and that Parliament, quite rightly, rejected. Will the Minister also confirm whether the requirement to store internet communication records has come from the police alone or from the police and the security services?

[Lord Bates]

My Lords, I thank the noble Lord, Lord Rosser, for his broad welcome of this. He is right to point to the antecedents of this whole process. It rests very much in a cross-party approach. We recognise the seriousness of the problems we face. This legislation is important to see in a context. Although it is very different from the draft communications data Bill in 2012, it is part of a long string and timeline of argument and debate that we have had. All of the recommendations in the report of my noble friend Lord Blencathra’s Joint Committee on that Bill have been accepted here. More than 200 recommendations were made in the three reviews to which the noble Lord, Lord Rosser, referred. They are also reflected in the draft Bill. He is absolutely right on that.

I turn specifically to the questions that the noble Lord asked. He asked whether the serious crime threshold will still be there. The answer is yes, absolutely. Warrantry will be undertaken in the same way as it currently is. There is no change in that. Bulk storage of data is a critical issue currently being discussed with the communications service providers. That covers some of the points that the noble Lord, Lord Paddick, raised. I will come back to that. We are in constant dialogue with them. My noble friend Lady Shields, who is the Minister for Internet Safety and Security, plays a crucial role in that dialogue, as did Sir Nigel Sheinwald, who produced his report last year. That work with the industry is ongoing.

In respect of parliamentarians, there was the Wilson doctrine in 1966, which was about wire-tapping. I do not want to have a whole debate about that but it is quite interesting to go back and look at what the Wilson doctrine actually was: effectively a requirement, as I understand it, for the Prime Minister to make a statement when communications had been intercepted, at a time when it was appropriate for national security to allow him to do so. That additional element—requiring the Prime Minister to be consulted—is a very real safeguard. In terms of the appointment of judges, we are in dialogue with the Ministry of Justice, as would be expected, and also with the Lord Chief Justice, to ensure that the appointments process is done correctly and we identify the specific skills that we are looking for in the team of judges. We anticipate that about seven judges—judicial commissioners—will be required.

On the point raised by the noble Lord, Lord Paddick, about social media, what we are really getting at here—what the police and the security services are saying—is that wireless telephony, in the space of just five years, has gone from a position where a mobile phone was the way in which people communicated, to one in which they now use Skype, WhatsApp and other social media. A third of calls are made through internet service providers, and everything suggests that that proportion will increase. That is why the argument for going for the internet records—specifically which app or site they were using to communicate—is so important.

The noble Lord’s question quite rightly referred to the fact that when David Anderson did his review he said, “If the case was made”. The noble Lord is right to pick up on that point: we discussed it a lot. That is why the operational case for the powers that was put forward by the police is also being published today. It is available on the website, but I can make sure that copies are available in the Printed Paper Office, if that is helpful.

In regard to the costs of doing this, an impact assessment accompanies the Bill. That puts the cost to the industry at about £174 million over 10 years. Those costs, and the impact assessment, will be precisely the types of detail that the process of pre-legislative scrutiny should thrash out and test. I hope that it will do so.