Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2020

Lord Rosser Excerpts

Wednesday 2nd September 2020 Grand Committee

[Lord Rosser (Lab) [V]]

We are not opposed to either of these two draft orders. The first of the two draft orders we are debating adds a further five additional public authorities to the list that are now deemed to have a “necessary and proportionate” requirement to obtain communications data, which is, of course, information about communications rather than what was said or written.

This power to obtain communications data is, according to an extra government factsheet memorandum explaining the purpose and effect of the draft instrument, on the basis that these five public authorities

“are increasingly unable to rely on local police forces to investigate crimes on their behalf”.

The five additional public authorities are the Civil Nuclear Constabulary, the Environment Agency, the Insolvency Service, the UK National Authority for Counter Eavesdropping and the Pensions Regulator. Can the Minister explain why it is that, in the light of cuts in police numbers since 2010, each of these five additional public authorities

“are increasingly unable to rely on local police forces to investigate crimes on their behalf”?

Could the Minister say whether this inability to investigate these crimes applies across all local police forces or only to some police forces, and if the latter, which ones?

We will support measures that cut crime and deal effectively and meaningfully with offenders. Can the Minister explain why the remedy is not to increase the capacity of local police forces so that they can investigate these crimes, rather than give powers to obtain communications data to civilians within these five public authorities? On the latter point about civilians, can the Government give a categorical assurance that this draft instrument does not lower the rank or seniority of designated officers and that there is no widening of the authority to exercise the powers here within the organisations covered by this or by previous orders?

The Explanatory Memorandum states that in deciding whether to grant these powers to the public authorities concerned, the Government consider the seriousness of the offences they investigate and the number of requests for data the public authorities each estimate they will make. Can these powers be used only in respect of serious offences or can they be used in respect of any offence? Can the Minister also say how many such requests for communications data each of the five additional authorities have estimated they will make and how that compares with the number being made currently by local police forces investigating crimes on their behalf? How do the estimates of the number of requests each of the five public authorities have said they will make compare with the number of requests being made by broadly comparable public authorities that already have these powers?

Currently, the public authorities that can obtain communications data under the provisions of the 2016 IP Act include, among others, intelligence agencies, law enforcement agencies, the Food Standards Agency, the Gambling Commission, the Prison and Probation Service, and the NHS Counter Fraud Authority. Can the Minister give details of which public authorities have already been given powers in relation to investigating crimes because increasingly they too cannot rely on local police forces being able to investigate crimes on their behalf? Can she also say if any public authorities for whom powers to obtain communications data have been sought have had that request declined by the Government? This point was raised by the noble Lord, Lord Paddick.

The IP Act sets out the circumstances in which various investigatory powers may be used and the safeguards that apply in relation to ensuring that any interference with privacy is strictly necessary, proportionate, authorised and accountable. Since the Government are not required to report on the operation of the Act until five and a half years from Royal Assent, what assurances can the Government provide now that the statutory safeguards in relation to interference with privacy are proving to be effective and are delivering in line with the intentions of Parliament? What views did the Investigatory Powers Commissioner express about the addition to the list of these five further public authorities, and did the commissioner have any reservations or other comments?

The second draft instrument provides the statutory basis for the Investigatory Powers Commissioner to have the required oversight of compliance by UK public authorities on access to electronic data in relation to serious crime, as provided for in the 2019 international agreement between the UK and USA and exercisable under the Crime (Overseas Production Orders) Act 2019 and the IP Act 2016. According to the Explanatory Memorandum, this arrangement, which presumably relates to the IPC providing independent oversight of UK activity under the agreement with the USA, has been agreed with the US Department of Justice. However, to avoid any misunderstanding, can the Minister place on record in her response exactly what it is that has been agreed with the US Department of Justice? Can she also place on record in her response what arrangements the US Department of Justice has agreed with the UK in relation to independent oversight of USA activity under the agreement, since presumably there is reciprocity when it comes to agreeing each other’s arrangements?

Can the Minister also say if any UK public authorities have yet sought to obtain data directly from US-based telecommunications operators under the terms of the 2019 COPOA Act using an overseas production order? If so, on how many occasions? Likewise, have any US public authorities sought to obtain data from UK-based service providers under the same, or similar, arrangements? If so, on how many occasions? Have assurances been given in relation to the non-use of the death penalty, and has protection been given to journalistic sources and material? Finally, is the Investigatory Powers Commissioner likely to be using statutory oversight and compliance powers in relation to agreements between the UK and any other countries apart from the US?

[Baroness Williams of Trafford (Con)]

I thank all noble Lords who have taken part in the debate and the noble Lord, Lord Morris of Aberavon, for his brief appearance. I could not keep up with the questions from the noble Lord, Lord Rosser, so I have missed some bits out. I hope to pick them up in the answers to other questions, but I will write to him if not.

I was very pleased to hear the opening remarks from the noble Lord, Lord Blunkett; I thought he would be supportive. He admitted to never having heard of the UK National Authority for Counter Eavesdropping. I join him in that: neither have I. It is the national authority for technical security and counter-eavesdropping. It helps the Government on technical espionage attacks by hostile state actors. Its capabilities and purpose are distinct and focus on countering close-access technical operations that could ultimately damage national security.

As he will know only too well, hostile state actors currently have the desire and the means to gain access to or otherwise compromise the integrity of highly classified communications systems and secure facilities. They are known to be able to carry out close-attack technical attacks, as demonstrated by the attack on the Organisation for the Prohibition of Chemical Weapons in The Hague by the Russian intelligence services in 2018. In that case, the Dutch authorities were able to detect and apprehend the agents involved, along with a car full of equipment.

We assessed that Russia and other hostile state actors, particularly China, will continue to attempt to disrupt, attack and commit espionage in the UK. I do not think any noble Lords in the Committee would disagree with that. The Intelligence and Security Committee’s recent report into the interference by Russia in UK democracy demonstrates intent, capability and, indeed, tenacity.

There is also the insider threat to consider, whereby an individual in an organisation may place a device for eavesdropping purposes. Insider threats can be from corrupt, compromised, disgruntled staff or from contractors. They can be among the hardest threats to identify. In order to fulfil its role, the UK National Authority for Counter Eavesdropping needs to be able to identify illicit and covert eavesdropping devices that may be present in sensitive and classified areas and then identify the user behind the device using communications data. We are now all experts in that particular agency.

There were a number of questions, particularly from the noble Lords, Lord Paddick and Lord Foulkes, about agencies being added and taken away, about why that happens and about the purposes of the various agencies that have been added. For clarity, the authorities we are talking about are the Pensions Regulator, the Civil Nuclear Constabulary, the Environment Agency and the Insolvency Service. It was right that those powers were removed in 2015, just as it is right for them to be reinstated now. We cannot foresee how operational requirements will evolve in response to the crimes that public authorities are investigating. We need to have the option to add and remove authorities depending on the necessity of the powers; the noble Lord, Lord Paddick, was right that it is nothing to do with the coalition. This is precisely why the IPA included the power to add and remove bodies from Schedule 4.

These authorities have all demonstrated a strong necessity and proportionality case against similar criteria that the Home Office applied when removing powers in 2015. Those criteria were: the statutory responsibilities of the authorities with access; the seriousness of the offences that they investigate; and the number of requests that they made. As is demonstrated by the case of the Civil Nuclear Constabulary in particular, which does not expect to use the powers often, assessing the volume of applications made is perhaps not the most effective of criteria for deciding which bodies should be listed in Schedule 4. The risk here is just too high to ignore. A public authority can make infrequent use of powers, yet still lead on investigations where communications data is critical.

I congratulate my noble friend Lord Naseby on celebrating his diamond wedding anniversary today.