Investigatory Powers Bill (Tenth sitting)

Lucy Frazer Excerpts

Committee Debate: 10th sitting: House of Commons
Thursday 21st April 2016 Public Bill Committees

[Joanna Cherry]

To deal with clause 119, I must outline why the Scottish National party wishes the entirety of part 6 to be removed from the Bill until such time as a convincing case has been made for the use of bulk powers and the legality of bulk powers has been determined. In our view, it is important not to pre-empt the terms of court judgments in cases currently considering bulk powers, as they will have a significant impact on the lawfulness of the approach set out in the Bill, which at present must, at the very least, be open to question.

The Government have produced an operational case in response to remarks made by a number of witnesses before the Joint Committee on the Draft Investigatory Powers Bill, who were concerned about the lack of such a case, and to the Joint Committee’s recommendation 23. The Home Office published a 47-page operational case for bulk powers alongside the Bill. That document was produced within three weeks, and the first half of it is introductory, covering topics such as how the internet works and what the dark net is. Only the second half of the document, characterised as an operational case, addresses the capabilities with which we are concerned.

Going goes through the operational case, we can see that each power—bulk interception, bulk equipment interference, bulk communications data acquisition and bulk personal datasets—has an average of about five pages devoted to it. Bulk interception has only about four. Most of the material dealt with is already public in other explanatory documents. It seems that, despite the opportunity to provide concrete, solid examples of how bulk powers bring unique value, most of the material in each section is kept at a high and general level.

For example, the first three pages of the four-page case justifying bulk interception cover an introduction to the power, the current legal position and new safeguards in the Bill. The fourth and final page provides three one-paragraph case studies, which members of the Committee will all have had the opportunity to read. One in particular deals with counter-terrorism, giving an example of where the security and intelligence agencies’ analysis of bulk data uncovered a previously unknown individual in 2014 who was in contact with a Daesh-affiliated extremist in Syria suspected of involvement in attack planning against the west.

The case study says:

“As this individual was based overseas, it is very unlikely that any other intelligence capabilities would have discovered him. Despite his attempts to conceal his activities, the agencies were able to use bulk data to identify that he had recently travelled to a European country. Meanwhile, separate intelligence”—

that is, separated from the bulk-generated intelligence—

“suggested he was progressing with attack planning. The information was then passed by the agencies to the relevant national authorities. They disrupted the terrorists’ plans and several improvised explosive devices were seized.”

Undoubtedly, every hon. Member on the Committee and in the House would wish such activities to be intercepted and prevented by the security services. I applaud the security services for the work that they do, but what concerns me is that analysing this case study in any meaningful way is challenging, because there is inadequate information to begin to test the accuracy of the case study or to challenge its conclusions. Nevertheless, I have had some initial analysis of it carried out, which suggests that perhaps the ends could just as easily have been achieved by the use of targeted interception. I will give a couple of examples to show why.

The case study refers to a previously unknown individual who was in contact with a Daesh-affiliated individual, who presumably was known. It is possible, therefore, that targeted interception may have uncovered this previously unknown individual. Although the Daesh-affiliated individual was already being monitored, there is no clear explanation in the case study of why bulk interception was necessary. It seems likely that intercepting the Daesh-affiliated individual’s contacts in a targeted manner might have identified the previously unknown individual.

That is just one of a number of issues raised about this case study by the analysis that I have had carried out. I will not take up the Committee’s time with them all, but that is one example.

The value that this case study has is that in this case a previously unknown individual was identified. Questions as to why targeted interception would not have worked are not addressed, nor are questions as to why other targeted capabilities were not used. The case study suggests that the initial identification is the only aspect in which bulk interception played a role, with the rest of the case study a result of other capabilities and separate intelligence. No information is provided about the scale of collateral intrusion undertaken when intercepting in bulk and there is no assessment of the proportionality of bulk interception. Also, given that the attack was not in the UK, there is no explanation of the necessity of UK agencies playing a role, although that is perhaps a slightly lesser consideration.

There is no information outside this case study as to the frequency of events of this kind or whether in similar cases different methods produced different results. As such, it is impossible to analyse it and make any kind of independent assessment of the necessity or proportionality of bulk power.

This is not nit-picking. These are very wide-ranging powers. The hon. and learned Member for Holborn and St Pancras, who speaks for the Opposition, described them as breathtakingly wide powers. They have never before been debated or voted on in this Parliament, and it is crucial that we get them right. We are debating and voting on them, at a time and in a climate whereby there is quite a lot of independent evidence available from the United States of America that suggests that bulk powers are not as efficacious as is suggested in the operational case produced by the Government.

I will say a little about what happened in the States, because it is important to loop to that to understand what the Scottish National party says would be the appropriate way to approach the production of an operational case to justify bulk powers.

In the USA, the Snowden revelations revealed that the National Security Agency was running a bulk domestic telephone records programme. The US intelligence community put forward strong arguments for keeping that programme going, and to bolster its position it compiled a list of 54 counter-terrorism events in which it said that section 215 of the USA Patriot Act, which underlined that bulk collection, contributed to a success story.

In America, two independent bodies undertook reviews related to those powers to determine whether the case studies put forward by the intelligence agencies were credible and accurate. They determined that only 12 of the 54 counter-terrorism events cited by the security services had any relevance to the exercise of bulk powers under section 215 of the USA Patriot Act. With access to classified material, one of the independent groups— the President’s Review Group on Intelligence and Communications Technologies, which is a very high-powered body set up under the auspices of President Obama—concluded:

“Our review suggests that the information contributed to terrorist investigations by the use of section 215 telephony metadata was not essential to preventing attacks and could readily have been obtained in a timely manner using conventional section 215 orders”.

The other body, the Privacy and Civil Liberties Oversight Board, concluded very similarly that the programme of bulk collection under section 215 had

“shown minimal value in safeguarding the nation from terrorism. Based on the information provided to the Board, including classified briefings and documentation, we have not identified a single instance involving a threat to the United States in which the program made a concrete difference in the outcome of a counterterrorism investigation. Moreover, we are aware of no instance in which the program directly contributed to the discovery of a previously unknown terrorist plot or the disruption of a terrorist attack.”

I quote those two bodies because they are independent.

I am aware that Mr William Binney, who previously worked for the National Security Agency, gave evidence to the Joint Committee. His evidence could be summarised as “bulk powers cost lives”. He is concerned about the “needle in a haystack” argument. I am aware from previous discussions that certain members of the Committee have concerns about the evidence of Mr Binney. Even if we set his evidence to one side, we cannot set to one side the evidence of those two very high-level, independent American committees that looked at bulk collection in the USA. Their conclusions seriously question the information they were given by the security services that the bulk powers were necessary to prevent terrorist outrages. They also made suggestions on existing targeted capabilities.

[Lucy Frazer (South East Cambridgeshire) (Con)]

We have the analysis by David Anderson of the efficiency and efficacy of bulk powers, and he talks from paragraph 7.22 onwards about the importance of bulk powers. For example, he states:

“GCHQ explained that its bulk access capabilities are the critical enabler for the cyber defence of the UK, providing the vast majority of all reporting on cyber threats and the basis for counter-activity.”

[Joanna Cherry]

I cannot gainsay that. I am well aware that David Anderson would not go as far as I am going in these submissions. He has reached the conclusion that some bulk powers are necessary, but the passage in his report that the hon. and learned Lady quotes basically starts with a phrase along the lines of “GCHQ has assured me”. My point in drawing Members’ attention to what happened in the USA is that, although the US security services compiled a list of 54 counter-terrorism events in which they said bulk powers had contributed to a success story, one of the two committees I have quoted reached the view that it could not identify a single instance where bulk powers had contributed to a counter-terrorism success story. There is a debate to be had here.

[Lucy Frazer]

David Anderson goes on, in the same section of his report, to acknowledge that it is difficult for the public to take examples on trust. He recognises the limitations of what was shown to him, but states:

“The six outline examples at Annex 9 to this Report go a little way towards remedying that defect. They illustrate the utility of bulk data capabilities more generally”.

He recognises the limitations, but still acknowledges the efficacy of the powers.

[Joanna Cherry]

The hon. and learned Lady makes a good point. David Anderson acknowledges the efficacy of the powers and has been privy to certain information as he has a high security clearance. Not all of us can be privy to that information. I am suggesting that there should be an independent evidence base for the bulk powers. That would involve independent assessors with high security clearance undertaking forensic examination of the necessity and effectiveness of the bulk programmes.

We know, because the Home Secretary has told us—there was an interesting article about this in The Guardian today—that the bulk powers have been running for a long time. The headline of the article is, “UK spy agencies have collected bulk personal data since 1990s, files show”.

I will come back to that article in a moment, but we know that the bulk powers are operational. Given that they have been running for a while, a full list of cases where they have been required should be easy to provide. That should not be to this Committee, but to an independent review staffed by high-level individuals with the highest security clearance—the sort that David Anderson has. I have in mind such people as retired judges and retired professionals with an interest in the area.

--- Later in debate ---

[Joanna Cherry]

These powers are not being used only in emergencies. That is the point. We are told that the powers are being used daily and that those data are being sucked up and collected daily, and the Bill seeks to put that on a legal footing. I am saying that there is not sufficient independently assessed evidence to justify the continuation of such powers and that we need a proper independent review.

I am suggesting that there should be independent, security cleared assessors to consider whether such powers pass the legal tests of necessity and proportionality. They would need to conclude that the powers were strictly necessary and that the same results could not be achieved using more proportionate and less intrusive means. The two American committees I mentioned concluded that the same information could be achieved using more proportionate and less intrusive means, so we in the United Kingdom should not legislate gung-ho for the continuation of such breathtakingly intrusive surveillance powers without being certain that they are necessary and proportionate. We do not have sufficient evidence to reach that conclusion.

[Lucy Frazer]

What does the hon. and learned Lady think the independent reviewer of terrorism legislation is for, other than to review these powers? He reviewed the powers in his report.

[Joanna Cherry]

I do not accept that the independent reviewer has carried out the exercise that I am suggesting. He fulfils a particular function, and we are talking about setting up a panel of individuals to consider the necessity and proportionality of these powers. They could consider in detail certain information that we, as hon. Members, would not be able to see. David Anderson is one individual who fulfils an important function and whose work has greatly assisted everyone on the Committee, and all hon. Members, in trying to understand what underlies the Bill.

--- Later in debate ---

[Joanna Cherry]

David Anderson said the following in paragraph 1.12 of his report, “A Question of Trust”:

“Though I seek to place the debate in a legal context, it is not part of my role to offer a legal opinion (for example, as to whether the bulk collection of data as practised by GCHQ is proportionate). A number of such questions are currently before the courts, which have the benefit of structured and opposing legal submissions and (in the case of the IPT) the facility to examine highly secret evidence, and which are the only bodies that can authoritatively determine them.”

There we have the words of the man himself. Although David Anderson seeks to place the debate in a legal context, he does not see it as part of his role to offer a legal opinion on the proportionality of GCHQ’s bulk collection of data. At least two cases now before the courts will result in judgments on whether the powers are proportionate.

[Lucy Frazer]

If the hon. and learned Lady reads the next paragraph, she will see that David Anderson is simply making a broad statement about the fact that he is not giving legal advice generally. He is putting forward recommendations for Parliament to consider.

[Joanna Cherry]

Indeed; he is putting forward recommendations. I am advocating an independent review looking at the operational case for bulk powers. It would look at whether the powers are necessary and proportionate, and it would provide an opinion that could then be laid before both Houses, for us to see if the Government’s case has been made. I am concerned that the case is not sufficient at the moment. I say that against the background not of Mr Binney’s evidence, but of the findings of high-level USA investigatory bodies.