Investigatory Powers Bill

Stephen McPartland Excerpts

Report: 1st sitting: House of Commons
Monday 6th June 2016 Commons Chamber

[Mr Howarth]

I have to say to the hon. Gentleman that that is not my experience. The right hon. and learned Member for Beaconsfield, who chairs our Committee, gave a specific example of where someone was unwilling not only to explain themselves but even to engage with the Committee. That is why I support new clause 2, which gives the Intelligence and Security Committee the ability to refer a matter to the commissioner and to at least give them a nudge in the right direction in terms of concerns that need to be looked at.

I do not share the complete pessimism of the hon. and learned Member for Edinburgh South West. The Bill has moved an incredibly long distance since the original draft Bill. There is some way to go, but we may hear further concessions today or tomorrow. However, I would be grateful if the issues I have raised could be addressed by the Minister when he replies.

[Stephen McPartland (Stevenage) (Con)]

I will keep my remarks short, Mr Deputy Speaker, as I appreciate that you want them to be short. I want to speak to new clause 16 and to amendments 189 to 195, but I will group them together.

I welcome new clause 5 because it puts privacy at the heart of the Bill. Although I found the draft Investigatory Powers Bill to be some kind of absolutely Orwellian nightmare that I would never have been able to support, this Bill goes some way towards being something that I would be able to support. It is horrible that we live in a society where this House, as a cross-party organisation, will have to legalise mass surveillance of every man, woman and child in the United Kingdom who has an electronic device, but sadly that is the society we live in, and we have to have a trade-off between what keeps us free from terrorism and what keeps us free in terms of privacy. I appreciate the Government’s efforts in trying to put privacy at the heart of the Bill.

On my new clause and my amendments, I want to look at possibly introducing into the Bill notification of surveillance against innocent people. I have tabled 63 amendments because I know there will be a review before the Bill gets to the upper House. The Government have been incredibly conciliatory and have provided concessions all the way through. I consider both the Ministers on the Front Bench friends, and I have been speaking to them about the Bill for many months—for well over a year, in fact. I have tried to be constructive in my disagreements with them; my amendments are probing amendments—they are there not to cause difficulty but to try to tease out more information.

The Bill fails to provide a viable system of notification of surveillance, particularly for those who have been wrongly surveilled. The current drafting covers only error reporting, and it places a higher importance on public interest—I understand that that is the source of the dispute about whether we should have new clause 5 or new clause 21, in terms of privacy and what is in the public interest. The concepts of public interest and serious error are difficult to define, and that leads to the problem of the judicial commissioners and others having to decide what those concepts are, and whether there are varying degrees of them. I want the Bill to state very clearly what we want them to be, so that we do not have that mission creep.

Adding notification to the Bill through a new clause would go some way towards ensuring that privacy is further enhanced as the backbone of the Bill. To put the issue into context, the countries that permit notification of surveillance include America, Canada, New Zealand, Germany, Belgium, the Netherlands, Austria, Ireland, Switzerland, Slovenia, Montenegro and Hungary, so this is not something that will be specific to the United Kingdom, and we will not be leading the way; we will be trying to catch up with our partners. I appreciate that each of those countries offers a different threshold in terms of how people will be surveilled, but there is no possibility of notification in the Bill at the moment. The Ministers have been very conciliatory, and if they want to intervene on me to say that they will accept my new clause 16, I will happily sit down. No, I didn’t think so. Never mind—we will keep trying.

[Mr John Hayes]

I am not going to surprise my hon. Friend or the House, but he will have noted that the changes we have brought forward to the Bill mean that if a serious error has been identified by the commissioner, the individual concerned will be notified. That is a significant and new provision, which goes some way towards satisfying his desire. Perhaps he can meet me halfway.

--- Later in debate ---

[Stephen McPartland]

I will certainly meet the Minister halfway, because I will not call a vote on my provisions, or vote against him on this aspect of the Bill. Obviously, I would like to get my own way, but I appreciate that this is about compromise, and both Ministers have been very good at compromising over the course of the Bill.

On error reporting and notification, it is worth noting the views expressed in sections 613 to 622 of the report by the Joint Committee on the draft Investigatory Powers Bill. I will not read them all out—you would not like that, Mr Deputy Speaker—but I would like to pull a few highlights out. The report states:

“Clause 171 provides that the Investigatory Powers Commissioner must inform a person about any ‘serious error’ when the Investigatory Powers Tribunal agrees the error is serious”,

and when that is in the public interest. But why would it ever be in the public interest to inform somebody that the error was serious? I cannot imagine that it would ever be in the public interest to do so, so they would never be informed.

The report also noted that the Bingham Centre for the Rule of Law felt that the approach in the draft Bill to error reporting was a matter of profound concern. Similarly, the Interception of Communications Commissioner’s Office believed the provisions in the clause were weaker than the current well-established powers. The requirement that an error should cause significant prejudice or harm was also criticised for setting a very high bar. In addition, the test was criticised by the Law Society of Scotland, Privacy International, the Interception of Communications Commissioner’s Office and Amnesty International UK for being poorly defined.

[Victoria Atkins]

I will be grateful to my hon. Friend if he can answer this question; it may negate the need for me to make a speech on this point. I have looked very carefully at new clause 16 and, indeed, new clause 1, and I cannot find any reference to “error” in them. New clause 16 seems to be a general clause of notification to anyone who is subject to a warrant. Is that correct?

[Stephen McPartland]

I certainly do not take any credit for being good at drafting new clauses. New clause 16 may not mention “error”, but I think it is mentioned in amendments 189 to 195, with which it should be considered. In “A Question of Trust”, David Anderson, QC, recommended that the judicial commissioners be given the power to report errors to individuals. I appreciate that the Minister has moved towards my point of view.

In conclusion, the Joint Committee made two recommendations. The first was that referral to the Investigatory Powers Tribunal was unnecessary and cumbersome and created a brake on the notification of errors. The second was that the error-reporting threshold should be reviewed so that it was more specific and defined.

[Mr Alistair Carmichael]

New clause 1 stands in my name and is supported by Scottish National party Members. It is remarkably similar to new clause 16, to which the hon. Member for Stevenage (Stephen McPartland) has just spoken. He says that his is a probing amendment; I regard mine as more than that, but I shall wait to hear what the Minister has to say when he replies to the debate.

I will preface my remarks on new clause 1 by highlighting some more general concerns. I absolutely agree with the hon. and learned Member for Edinburgh South West (Joanna Cherry) that the way in which today’s proceedings are being conducted is highly unsatisfactory. The time allowed is clearly insufficient. The Government have done themselves no favours, because all they do by insisting on conducting proceedings in this way is throw a bone to those in the other place and allow them to justify the greater degree of scrutiny that they will inevitably give to the Bill. It has already been referred to as a constitutional Bill that countenances the most egregious interference with individual liberty by the state. Such scrutiny ought to be done by this elected Chamber.

The fact that the Government are still taking on board amendments after the draft Bill, the report by David Anderson, QC, and the debate in Committee indicates an unsatisfactory attitude on their part. It shows that they are not yet putting privacy at the heart of the Bill, and that they are being dragged kicking and screaming to that position. On new clauses 5 and 21, it is unsatisfactory that the best provision has been proposed by the hon. and learned Member for Holborn and St Pancras (Keir Starmer), who speaks for the Opposition, and that we will not get to that unless we first vote down an inferior proposal that, while adequate and an improvement, is not as good as that proposed by the official Opposition. I reiterate a point that I made in an intervention on the hon. and learned Member for Edinburgh South West: the Government will still have the opportunity, if they are minded to take it, to insist on their version in the other place at a later stage, but this House should be empowered to express a view on new clause 21, which for reasons of procedure it is not able to do at present.

The thinking behind new clause 1 is that sunlight is the best disinfectant. The question of whether the Government will accept the approach suggested by us and the hon. Member for Stevenage relates to the question of whether privacy is at the heart of the Bill. As things stand, an individual will be able to find out whether they have been the subject of intrusion under the Bill’s powers only through a whistleblower or public interest litigation. It is a question of happenstance. If the Government are sincere and prepared meaningfully to protect our liberties and individual rights, they should not object to a process with all the necessary safeguards, as outlined in new clause 1. There should be no objection to notifying those who have been the subject of surveillance once the surveillance has concluded. As the hon. Gentleman has pointed out, that idea is not novel. It happens in a number of jurisdictions and has already been the subject of judicial approval and, indeed, instruction from the European Court of Human Rights in two cases, namely Klass v. Germany in 1978, and Weber and Saravia v. Germany in 2006.

--- Later in debate ---

There are many more amendments that I would like to speak to, but I am not going to, in recognition of the fact that others deserve time to speak. I would simply say again that the Scottish National party considers the time afforded to debate the many amendments tabled to this serious and far-reaching Bill to be wholly inadequate, and there are many people beyond this Chamber who also take that view.

[Stephen McPartland]

I shall speak to four different sets of amendments. As I said earlier, it is a difficult Bill to support, but I acknowledge the work that Ministers and the Government have done in trying to work with Government Members and Opposition Members to produce a Bill with which we can all begin to start to feel comfortable. I am not a lawyer, but amendments 147 to 152, which stand in my name, are designed to leave out clauses that provide for the modification of warrants. In my view as a non-lawyer, these changes seem, through a major modification, to have the potential to change the key components of a warrant. I wonder at what stage a new warrant should be drafted instead. How far can the warrant be modified before it needs to become a new warrant? The warrant provisions seem to be very wide ranging and very ill defined.

The next set comprises amendments 178 to 186, which try to refine the matters to which targeted equipment interference warrants may relate by removing vague and overly broad categories, including equipment interference for training purposes. People outside this place may not be aware of it, but when we talk about “equipment interference”, we are basically talking about hacking devices that can hack into mobile phones, computers, email systems, or the apps that people use for their banking. “Equipment interference” is a nice way of saying state-authorised hacking, which is what we are talking about here. To me, this is an incredibly intrusive power, permitting real-time surveillance, as well as access to everything we store on our digital devices, from text messages to address books, calendars and emails, along with the websites people visit, which apps they use and how they use them.

The Bill also seems to me to provide for thematic hacking warrants, which amount to general warrants to hack groups or types of individuals in the UK. Hacking is not restricted in the Bill to equipment belonging to, used by or in the possession of particular persons or organisations. Even the director of GCHQ has apparently raised concerns about the breadth of the current definitions, which could apply to the equipment of a hostile foreign intelligence service. We here might say, “So what? So be it. That’s what they’re there for”, but what would we say if those warrants allowed all employees and family members of a particular company or the people who visit a particular religious venue or who live in a particular road to be hacked? Would we still say, “So what? Should we be bothered?” This may sound unlikely, but the draft equipment interference code of practice permits the targeting of people who are “not of intelligence interest”. If that is not carte blanche, I do not know what is, because it is in effect allowing hacking of the equipment of anybody anywhere in the UK or overseas, if the agencies choose to do so.

[Mr Davis Davis]

I am entirely in agreement with my hon. Friend on this. He says that it might not involve hacking a whole street, but it could easily involve hacking two layers of contacts. If I call 100 people, and then the people called by those 100 people are investigated, that would be a very typical intelligence exercise, pursuing the two rings of contacts. That could involve 100,000 people, most of whom have nothing to hide but could become under permanent surveillance by the state.

[Stephen McPartland]

I totally agree with my right hon. Friend’s point. As a Master of Science and Technology, I, of course, have never hacked anything in my life and would never dream of doing so, but it is not a particularly difficult thing to do at the moment. Many people do not appreciate that the measures in the Bill are authorising the state hacking of equipment. Combined with other measures in the Bill, this is not just about hacking the equipment of somebody who may be of particular interest as part of a terrorist organisation; we are talking about every man, woman and child with an electronic device inside the UK. That is where my concerns arise.

[Suella Fernandes (Fareham) (Con)]

I am grateful to the hon. Gentleman for that explanation of his amendment, but surely there are clear limits to the powers relating to equipment interference set out in clause 91. The action needs to be necessary, proportionate and in the interests of national security, so it is really not fair to say that this is a sweeping power to which any man, woman or child could be subjected.

[Stephen McPartland]

I am grateful to my hon. Friend for her intervention, but the reality is that schedule 4 to the Bill will give a range of other organisations the ability to access this power if they choose to do so. For example, the Financial Conduct Authority could do so in circumstances relating to the stability of the markets. A whole variety of organisations will be able to use these powers, not just the intelligence services. Police services up and down the country already use equipment interference to target criminals, for example. A whole range of powers such as these is already being used. I appreciate that the Bill is trying to put them on a statutory footing, and I understand the need to keep people safe, but we have to balance this with resources. Let us remember 9/11 in the United States, when many different agencies and organisations had information but were not sharing it. I believe that we are getting ourselves into a situation in which we will have so much information on so many people that it will be of no value to us whatever. It will be like the internet: you can put anything in, and you get 3,000 pages back.

We need a stronger legal framework if we are going to authorise the state hacking of equipment in the United Kingdom. My amendments 187 and 188 simply seek to ensure that all targets of hacking are properly named or specified. We need a more specific legal framework. Amendments 173 to177 would eliminate the power of the Government to compel third parties to assist in carrying out equipment interference. As the Bill stands, this compelled assistance will not be subject to any judicial authorisation process. The relevant organisations will be able to turn up at a company and say, “We have this warrant, so you now have to help us to hack your devices.” The company will have no choice. Clause 114 contains strict non-disclosure provisions, which are effectively gagging orders that will prevent anyone from being able to say whether they have been involved in such procedures. The Science and Technology Committee documented widespread concerns regarding company compelled hacking and concluded that

“the industry case regarding public fear about ‘equipment interference’ is well founded.”

The draft equipment interference code of practice indicates that no company in the United Kingdom, no matter how small, is exempt from these obligations.

My amendments 196 to 205 are, like the rest, probing amendments to try to get these issues debated and to make people aware of them. They would provide that national security and technical capability notices be subject to a double-lock authorisation by the Secretary of State and the Investigatory Powers Commissioner. I appreciate that new clause 10 and other Government amendments are moving some way towards achieving that, which might make what I am about to say obsolete. I do not fully understand those amendments yet, as I am not a lawyer, as I have said.

My understanding of the Bill as it stood this morning was that only the Secretary of State had the power to authorise a retention notice, a national security notice and a technical capability notice. That was not in keeping with the rest of the Bill, which requires a judicial commissioner to be involved in the review and approval of those areas. Those notices in effect enable the Secretary of State to demand that private companies act as a facilitator, depository and provider of people’s communications. We need independent oversight, and as I have said, the Government have come some way towards establishing that, in new clause 10 and elsewhere. However, technical capability notices will have an impact on UK businesses with 10,000 or more users, in that they will require those companies to build systems to store user data for use by the intelligence agencies, the police and the Home Office. That is what is written into the code of practice.

Looking at the codes of practice, one thing that jumped out at me and which I found very difficult as a Conservative was the fact that the communications service providers—CSPs—will be subject to a technical capability notice. They will have to notify the Government of new products and services in advance of their launch in order to allow consideration of whether it is necessary and proportionate to require the CSP to provide technical capability information on a new service. So, in English, and from a Conservative point of view, that will effectively mean that UK-based companies launching new products will now have to get permission from the state before they can go to market, in order to identify whether or not the state will require an ability to hack those products. Why on earth would a small business launch a new service here in the United Kingdom if those conditions remain in the codes of practice?