Investigatory Powers Bill (Second sitting)

Robert Buckland Excerpts

Thursday 24th March 2016 Public Bill Committees

[The Chair]

No, you are a very strong witness. Mr Buckland.

[The Solicitor General (Robert Buckland)]

Q Thank you, Mr Walker; it is a pleasure to serve under your chairmanship. Mr McClure, you have made some powerful points, so thank you very much indeed for giving your perspective on the IT, and as a bereaved relative. We all share your grief and anger about the atrocity.

Mr Wardle, I want to ask you about internet connection records, the new potential powers within the Bill and the purposes for which those records could be retained by an internet service provider. We know now that, as a result of the Joint Committee’s recommendations, there are four purposes for which those records could be retained for potential examination by the authorities. I think that they are very clearly set out: for the purposes of identifying who sent a communication; to establish what services either a suspect or a potential victim has been using; to establish whether or not a known suspect has been indulging in online criminality; and finally—the additional one—to identify services that a suspect has accessed, which could assist an investigation. If there was a narrowing of those purposes, what effect do you think that would have upon the authorities’ ability to investigate child abuse and related offences?

Alan Wardle: As I understand it, the previous draft Bill had a narrowing in the fourth one, and I appeared before the Joint Committee before Christmas to argue against that narrowing. I cannot remember the exact wording, but it was essentially where illegal activity was happening.

Again, I go back to the example of the grooming case I mentioned earlier. Grooming, by its very definition, takes place over a period of time. There are certain activities that you would want to investigate that are perfectly legal. Say a child has been trafficked across the country. Someone has hired a car, taken it from A to B and dropped it off, and they have gone on to the Travelodge website to book a hotel room. All of those are perfectly legitimate activities, but those activities—as part of a wider investigation—would be able to show the police that that person trafficked that child from A to B and that those activities took place. Clearly more would be needed, but the narrowing that was there before would, we believe, have unduly restricted the police’s ability to investigate those kind of crimes.

[Joanna Cherry (Edinburgh South West) (SNP)]

Q May I ask you some questions about internet connection records? Can you confirm that you have read the operational case for internet connection records referring to the case of Amy?

Alan Wardle: I do not think I have read that.

--- Later in debate ---

[Mr Hayes]

Q That is something the Joint Committee recommended and now forms part of the Bill. On internet connection records, can you give us a flavour, also from your case experience, of the kinds of crimes and circumstances in which they might be vital to an investigation and, ultimately, to catching and convicting people involved in serious crime?

Chris Farrimond: Let us just start with the fact that internet connection records are the new comms data; they are the modern equivalent of comms data, the normal itemised billing that we have had for years and years. Criminals are using internet communications even if they do not necessarily realise it—when they send an iMessage, for instance, in an internet communication, rather than a text message. That is happening the whole time, and it is happening right across the population, whether people are law-abiding or criminal, so internet connection records now feature in every type of criminality. They are featuring more in those types of crime where the internet plays a larger part—fraud, for instance. I can talk about child sexual exploitation, where the internet makes it so much easier to share images, so internet connection records would be extremely useful for us in those circumstances.

Simon Grunwell: HMRC’s business model going forward is to put more and more services online to enable taxpayers to do more themselves, a bit like an online bank account. We already have online frauds. We are quite attractive for fraudsters, in the sense that we collect £500 billion a year and we pay out £40 billion in benefits and credits. Comms data helps us directly prevent the loss of £2 billion in revenue. On the ICR point, in particular, we have already had online attacks against us. In one case alone we were able to prevent the loss of £100 million. ICRs can only help us in that regard.

Richard Berry: From a local policing point of view, it is not just about serious crime; it is also about—if I can use this phrase—policing the digital high street. So ICRs could be just as relevant for cases such as domestic abuse, stalking and harassment, to prove a particular case, or to help us deal with what might seem, in isolation, to be a minor issue, but can often be on a path of escalation to homicide or very serious assault.

[The Solicitor General]

Q You were just asked about anonymity and the perceived danger to anonymity—for example, in the Crimestoppers scenario—but that would apply if I telephoned Crimestoppers now, wouldn’t it?

Chris Farrimond: It would.

[The Solicitor General]

Q Theoretically, you would be able to get access to the phone number that I have used and work out who that number was linked to and, presumably, link that to me now.

Chris Farrimond: Yes.

[The Solicitor General]

Q As I understand it, these internet connection records will be held by CSPs—communications service providers—not by the authorities.

Chris Farrimond: Correct.

[The Solicitor General]

Q In order to access those records, you have to apply to a SPOC, or via that procedure, and then a filtering process will apply.

Chris Farrimond: Yes, it does.

[The Solicitor General]

Q So the scenario of the authorities holding this information and being able, at a whim, to breach anonymity is nonsense, isn’t it?

Richard Berry: We certainly very much follow the procedure of looking at each application and testing it for its necessity against its purpose, the proportionality, the levels of collateral intrusion and things like the timescales involved. If you look at the annual reports of the Interception of Communications Commissioner’s Office in 2015, you will see that they even go to the extent—I think it was done on about 100,000 applications— of looking at the amount of time a decision maker, a designated person or, under the new legislation, a designated senior officer, actually takes to consider all the tests that are required to ensure that the parameters are tight and that justification is in place.

[Byron Davies (Gower) (Con)]

In my experience, the UK is regarded as a world leader in intelligence-led law enforcement and I am sure that you agree that the Bill will enhance your capability. Can you tell me how important to your work it is that this legislation applies extraterritorially?

Chris Farrimond: It is rare for serious crime to be investigated and to have no international aspect to it at all. Certainly in the case of the National Crime Agency, almost every single case that we investigate has got an international aspect to it, but I suspect that that is the same for both my colleagues as well. That means that communications data will almost certainly be held in a third country at some point, because we have been communicating with people in other countries. The extraterritoriality will at least give us the ability to ask for those data. I do not doubt that there will be some complications when it gets compared with the host nation legislation along the way, but, nevertheless, at the moment we have a very lengthy process to get material back from other countries, so if this can help in any way, shape or form in speeding that up, that will be a good thing.

Richard Berry: It certainly is a strategic priority for law-enforcement policing to look at how we can ensure, as Chris said, this fragmentation of data across server farms, in clouds and across several countries is increasingly a challenge for us, so any legislation that can help with that process will be particularly useful.

The other point that I would make, building on what you said in your introduction, is also quoted by the commissioner in the 2015 report. Communications service providers, certainly in the US, very much favour the British SPOC system, because there is a dedicated, rigorous system, whereas they could perhaps be approached individually by—I think, to quote them—one of “10,000 FBI agents”, all adopting a slightly different process. So we have got the right systems in place; I think it is really the relationships and the access that is critically important.

Simon Grunwell: I will just add that the internet obviously provides mobility and anonymity. We could have an attack from anywhere in the world, online, so we need to keep pace effectively with digital changes. Sometimes the only clue that we have as to who is criminally attacking us is a digital one. The ability to go extraterritorial to pursue that one clue could be vital.

--- Later in debate ---

[Christian Matheson]

Q You could still handle those investigations and deal with them, but when it was apparent that they are of a sufficiently serious nature you can involve the police, who are then able to make the applications on your behalf, so you would not need access under the terms of the Bill.

Mark Astley: It is a valid point, but I believe that the powers are there for the trading standards, who do a really good job, and they have done an excellent job so far in dealing with high-level crime.

[The Solicitor General]

Q In the last year for which records are available, which I think is 2015, about half a million applications for access to comms data were made. About 0.4% of those were local authority applications.

Mark Astley: That is correct.

[The Solicitor General]

Q So we are talking about several thousand out of about half a million. Is that right?

Mark Astley: Well, if you look at the last two years alone, we are talking 3,300.

[The Solicitor General]

Q You were asked questions about the replication of the existing regime relating in England and Wales to magistrate authorisation, in Scotland to sheriff authorisation, and in Northern Ireland to district judge or magistrates court authorisation, for applications for access to comms data by local authorities. Those provisions are replicated in the Bill, are they not? I think it is in clause 66. But they are in the primary legislation.

Mark Astley: They are.

[The Chair]

Colleagues, I think we could do with a 12-minute break, because people have to get coffees and check with their offices.

Sitting suspended.

Examination of Witnesses

Lord Judge, Clare Ringshaw-Dowle, Sir Stanley Burnton and Jo Cavan gave evidence.

--- Later in debate ---

[The Solicitor General]

Q May I go back to the first points made about the judicial review test? I put in a plea for the poor parliamentary draftsmen and women who work very hard indeed to try to strike a balance between avoiding excessive prescription and the dangers of being unduly vague. Lord Judge, you suggested we were falling more towards the latter end of the spectrum and being somewhat unhelpful.

There are in clause 18 the necessity criteria that are applied by the Secretary of State and then by the commissioner. The difficulty I have is, what do I do? I am trying to ensure the commissioners have discretion and the ability to make a nuanced decision based upon the individual case before them. At the same time, I am being told, “Well, that isn’t good enough.” Should the draftsmen produce a non-exhaustive checklist, or is that in itself full of dangers for the commissioners when it comes to their decision making?

Lord Judge: I think it is a matter of principle that has to be decided by Parliament—of which I am a Member, in the other place. What check is appropriate for Parliament to put on the Secretary of State exercising this very important power?

[The Solicitor General]

That is there; it is in clause 18.

Lord Judge: There it is. If you leave it as judicial review, we know that judicial review depends on the context, on when you have last been in the Supreme Court and when the last case came from the European Court of Human Rights; it is a flexible concept. That is one of its strengths, but I am not sure that in the context of the public responsibility that goes with the issue of these warrants there should be a flexible concept.

The Home Secretary has to make the decision. As it happens, if there is the equivalent of Brussels here in London, she will now be there. She will be answering. She will say, “I did issue this warrant,” or “I didn’t.” Whichever way she did it, she will be responsible and answerable to you. What is the role of the judicial commissioner in such an arrangement? Does he come before you too, because he said, “I don’t agree with this warrant,” or, “I do agree; I do support it”? We need to be clear what you want the commissioner to do. Not everybody agrees with me, but I think that just saying “judicial review” is not clarifying where responsibility rests at the really crucial moment, which is when disaster strikes.

[The Solicitor General]

Q But you appreciate the problem that we have in getting this right.

Lord Judge: I do, but that is what Parliament is for. We have to decide what the law should be. I myself would like the law on this issue to be absolutely unequivocal, whatever Parliament or the House of Commons ultimately want.

Sir Stanley Burnton: We wonder what the function of clause 196(6) is. It is either telling a judge the obvious or it is a big stick to wave at the judge, to say, “You have to approve this because if you don’t, you’ll be jeopardising the success of an intelligence operation.”

[Suella Fernandes]

Q Building on the point made by the Solicitor General, clause 21 sets out the “necessary” and “proportionate” tests. We have heard a lot about those words. What questions do you ask when you are assessing proportionality? What is that analysis?

Sir Stanley Burnton: You are looking at the effect of the measure in question as against alternatives and as against the mischief that is aimed at—are we talking about saving life, or it just a matter of money? If it is money, is it a lot of money? Is it pensioners’ money or the Government’s? You weigh one up against the other, and in the end, it is a matter of assessment—looking at one and looking at the other.