Policing and Crime Bill (Fifth sitting)
(8 years, 1 month ago)
Public Bill CommitteesRead Full debate Read Hansard Text Read Debate Ministerial Extracts
The Committee divided: - Ayes: 5 / Noes: 9 - Question accordingly negatived.
The Committee divided: - Ayes: 5 / Noes: 9 - Question accordingly negatived.
The Committee divided: - Ayes: 5 / Noes: 9 - Question accordingly negatived.
The Committee divided: - Ayes: 5 / Noes: 9 - Question accordingly negatived.
The Minister for Policing, Fire, Criminal Justice and Victims (Mike Penning)
I beg to move amendment 131, in clause 21, page 26, line 23, at end insert—
‘29HA Duty to keep whistle-blowers informed
(1) Where the Commission carries out an investigation under section 29E(2), it must keep the whistle-blower properly informed about the progress of the investigation and its outcome.
(2) The Secretary of State may by regulations provide for exceptions to the duty under subsection (1).
(3) The power conferred by subsection (2) may be exercised only to the extent that the Secretary of State considers necessary for any of the permitted non-disclosure purposes.
(4) “The permitted non-disclosure purposes” are—
(a) preventing the premature or inappropriate disclosure of information that is relevant to, or may be used in, any actual or prospective criminal proceedings;
(b) preventing the disclosure of information in any circumstances in which it has been determined in accordance with the regulations that its non-disclosure—
(i) is in the interests of national security,
(ii) is for the purposes of the prevention or detection of crime or the apprehension or prosecution of offenders,
(iii) is for the purposes of the investigation of an allegation of misconduct against the whistle-blower or the taking of disciplinary proceedings or other appropriate action in relation to such an allegation,
(iv) is for the purposes of an investigation under Part 2 that relates to the whistle-blower,
(v) is required on proportionality grounds, or
(vi) is otherwise necessary in the public interest.
(5) The non-disclosure of information is required on proportionality grounds if its disclosure would cause, directly or indirectly, an adverse effect which would be disproportionate to the benefits arising from its disclosure.’
This amendment inserts a new section in the new Part 2B of the Police Reform Act 2002, inserted by clause 21. The new section requires the IPCC to keep a whistle-blower informed about an investigation under section 29E(2) of his or her concern and the outcome, subject to exceptions specified in regulations. It also sets out the purposes for which the regulation-making power may be exercised.
The Chair
With this it will be convenient to discuss the following:
Government amendments 132 to 134.
Amendment 162, in clause 21, page 27, line 29, at end insert—
“(ba) representatives of relevant workforces,”
This amendment would add representatives of workforces concerned to those who must be consulted by the Secretary of State before making regulations relating to the disclosure of information to whistle-blowers or other persons specified.
Government amendment 137.
Mike Penning
I will not delay the Committee too long on this group of amendments, but I will bring joy to the shadow Police Minister in a second—something that I did not manage to do for the shadow Fire Minister on Tuesday. Clause 21 strengthens the protections for police whistleblowers by conferring powers on the Independent Police Complaints Commission to investigate concerns raised by whistleblowers without referral from a police force, to keep whistleblowers updated on the progress of the investigation’s outcomes, and to protect the identity of whistleblowers, as we would all wish.
I have looked closely at amendment 162, and there is an anomaly in it. Although I wish the shadow Minister not to press the amendment, I commit to coming back to the issue on Report, because there is a case for consulting the Police Advisory Board, on which the representative bodies—including the Police Federation, the Police Superintendents Association, police officer and staff associations and the Police Staff Council—are represented, to bring it in line with proposed new part 2B of the Police Reform Act 2002.
Mr Kevan Jones (North Durham) (Lab)
Will the Minister outline what he has in mind by “specific exceptional circumstances” in the regulations? What will be exceptional?
Mike Penning
It would have to be absolutely exceptional, such as for national security. With that in mind, I thank the shadow Minister for tabling amendment 162, and I will basically do what he is asking for on Report. So that I can formulate it correctly, I ask him not to press amendment 162 but to accept the Government amendments.
Jack Dromey (Birmingham, Erdington) (Lab)
The Minister has been helpful, so I will be brief. For clarity, we are not yet talking about amendment 155—we will get to that later.
I will not repeat what the Minister said, and I welcome his undertaking. I say for clarity that of course this is about the unions that represent 55% of the workforce, but it is also about the Police Superintendents Association and the Police Federation. In the more testing areas—such as forensics on the one hand and the interface with the criminal justice system on the other—it is about organisations such as the British Medical Association and the Law Society, for which there are sometimes tricky issues relating to client confidentiality. What he has said is welcome, but I stress that, however important it is that representatives of the workforce are included, there is a wider potential ambit for this clause.
Mike Penning
I thank the shadow Minister for that. Just to clarify, amendment 155 is in the next group. There are already specific amendments in the Bill to the legislation on the Police Advisory Board, but we will look carefully at the board’s membership, and if people need to be added to it, so be it.
Amendment 131 agreed to.
Mike Penning
On a point of order, Mr Nuttall. I am sorry if I missed it, but can we clarify whether Opposition amendment 162 has been withdrawn?
The Chair
The amendment has not been moved formally; we will come to it after these amendments.
Amendments made: 132, in clause 21, page 26, line 34, at end insert—
‘( ) The power conferred by subsection (1) may be exercised only to the extent that the Secretary of State considers necessary for any of the permitted disclosure purposes.
( ) “The permitted disclosure purposes” are—
(a) the protection of the interests of national security;
(b) the prevention or detection of crime or the apprehension of offenders;
(c) the institution or conduct of criminal proceedings;
(d) the investigation of allegations of misconduct against whistle-blowers and the taking of disciplinary proceedings or other appropriate action in relation to such allegations;
(e) investigations under Part 2 that relate to whistle-blowers;
(f) investigations under this Part;
(g) any other purpose that is for the protection of the public interest.’
The new section 29I of the Police Reform Act 2002, inserted by clause 21, allows the Secretary of State to make regulations authorising the IPCC to disclose the identity of a whistle-blower and the nature of his or her concern (without the whistle-blower’s consent). The amendment provides that the regulation-making power is exercisable only for the permitted disclosure purposes set out in the amendment.
Amendment 133, in clause 21, page 26, line 43, leave out “whistle-blowers or to other”.
This amendment is consequential on Amendment 131.
Amendment 134, in clause 21, page 26, line 47, at end insert—
‘( ) The power conferred by subsection (1) may be exercised only to the extent that the Secretary of State considers necessary for any of the permitted disclosure purposes.
( ) In this section, “the permitted disclosure purposes” has the same meaning as in section 29I.’.
The new section 29J of the Police Reform Act 2002, inserted by clause 21, allows the Secretary of State to make regulations authorising the IPCC to disclose information relating to an investigation under section 29E(2) of a whistle-blowers’ concern or its outcome. The amendment provides that the regulation-making power is exercisable only for the permitted disclosure purposes (which are those set out in amendment 132).
Amendment 135, in clause 21, page 27, line 15, at end insert—
‘“( ) section 21A (restriction on disclosure of sensitive information);
( ) section 21B (provision of sensitive information to the Commission);”’—(Mike Penning.)
This amendment is consequential on NC2.
Jack Dromey
We will not press amendment 162.
Clause 21, as amended, ordered to stand part of the Bill.
Schedule 5
Schedule to be inserted as Schedule 3A to the Police Reform Act 2002
Amendments made: 136, in schedule 5, page 178, line 34, leave out “19ZD” and insert “19ZC”.
This amendment is consequential on NC2.
Amendment 137, in schedule 5, page 179, line 37, at end insert—
‘(4) The power conferred by sub-paragraph (3) may be exercised only to the extent that the Secretary of State considers necessary for any of the permitted non-disclosure purposes.
(5) The Secretary of State may also by regulations make provision for circumstances in which (despite sub-paragraph (2)(b)) a copy of the report may be sent to the appropriate authority without the consent of the whistle-blower.
(6) The power conferred by sub-paragraph (5) may be exercised only to the extent that the Secretary of State considers necessary for any of the permitted disclosure purposes.
(7) Where the Commission would contravene section 21A by sending a copy of a report in its entirety to the whistle-blower or to the appropriate authority, the Commission may comply with its duty under sub-paragraph (2)(a) or (as the case may be) may exercise its power under sub-paragraph (2)(b) (or under regulations under sub-paragraph (5)) by sending instead a copy of the report after having removed or obscured the information which it is prohibited from disclosing by section 21A.
(8) In this paragraph—
(a) “the permitted non-disclosure purposes” has the same meaning as in section 29HA;
(b) “the permitted disclosure purposes” has the same meaning as in section 29I.’.—(Mike Penning.)
Paragraph 5 of the new Schedule 3A to the Police Reform Act 2002, inserted by Schedule 5, deals with reports following the conclusion of an investigation under section 29E. Currently, it requires the IPCC to send a copy of the report to the whistle-blower except in circumstances specified in regulations. The amendment provides that the regulation-making power is exercisable only for particular purposes (the same as those set out in amendment 131). It also gives the Secretary of State power to make regulations allowing the IPCC to send a copy of the report to the appropriate authority without the consent of the whistle-blower but, again, the regulation making power may only be exercised for particular purposes (the same as those set out in amendment 132). The amendment further allows the IPCC to send a redacted report where it would otherwise contravene section 21A (inserted by NC2).
Schedule 5, as amended, agreed to.
Clause 22
Disciplinary proceedings: former members of police forces and former special constables
The Parliamentary Under-Secretary of State for the Home Department (Karen Bradley)
I beg to move amendment 138, in clause 22, page 28, line 35, leave out from “paragraph (a)” to “, or” on line 38.
This amendment is consequential on amendment 139.
The Chair
With this it will be convenient to discuss the following:
Amendment 155, in clause 22, page 28, line 41, leave out from “(a)” to end of subsection.
This amendment would remove the time limit on disciplinary proceedings against former members of police forces and former special constables.
Government amendments 139 to 145.
Government new schedule 1—Disciplinary proceedings: former members of MoD Police, British Transport Police and Civil Nuclear Constabulary.
Government amendments 154 and 153.
Karen Bradley
The Government amendments in this group are technical amendments to ensure that the provisions of the clause work as intended.
Jack Dromey
I often say that I have seen at first hand just how far the police have come over the past 30 years. To be frank, I did not get off to the best of starts with the police service, but then I saw excellent elements in it learning painful lessons about what had gone wrong historically, including from the Scarman tribunal and from Macpherson. The police have come a long way from often having poor relationships with communities throughout the country to being one of the most popular institutions in British society. Indeed, all polling evidence shows that the police are between three and four times more popular than we are as Members of Parliament.
Even if the police have come a long way, we are still learning painful lessons from the past. The shadow Home Secretary, my right hon. Friend the Member for Leigh (Andy Burnham), recently convened a powerful seminar on historic injustices, together with Baroness Doreen Lawrence. I will never forget, in particular, the contributions by the Hillsborough families.
Hillsborough was a disaster, a human crush that caused the deaths of 96 people, and injured 766 others, at a football match between Liverpool and Nottingham Forest at Hillsborough stadium, Sheffield, on 15 April 1989. The 1990 official inquiry into the disaster, the Taylor report, concluded that the main reason for it was the failure of police control. What the families said—it was incredibly moving—on the occasion in question was that they wanted justice and closure, but also accountability from those who presided over some disastrous errors, which led to people being killed on that scale.
As we said earlier in the debate, on Tuesday, we are strongly in favour of a different, more balanced approach towards disciplinary and investigatory arrangements for the police service. For example, I have talked about moving away from a blame culture to a learning culture—a culture that does not take every mistake and every wrong through an investigation and disciplinary process. Having said that, where the police get things badly wrong, of course it is right to act to put them right, because the public interest comes first and the victims deserve nothing less.
The amendment would remove the time limit on the initiating of disciplinary proceedings after an officer leaves the force. We strongly welcome the fact that the Bill provides, for the first time, for disciplinary proceedings to be initiated against former officers in circumstances where misconduct does not come to light until after their time in office. Where the proceedings result in a finding that the officer would have been dismissed had he or she still been serving, that officer will be barred from policing and added to the police barred list.
The Government have stated thus far that matters relating to a former officer’s misconduct must come to the attention of a chief officer within 12 months of an officer leaving the force. Our concern is that the 12-month period could be unduly restrictive. We know from recent experience, such as the Hillsborough inquest, that it may take many more years for campaigners and families to uncover wrongdoing. It is our view that wrongdoing needs to be put right, whenever it occurred, and that the officers concerned should be held to account.
We had constructive discussions earlier this morning, and I hope that the Government will now reflect further on the proposal, not only because of cases such as Hillsborough but to prevent perverse outcomes that might happen when one former officer has been out of the force for 13 months and another has been out for 11. Injustices often take some years to come to public light and scrutiny. There should be accountability in those circumstances.
We have had constructive discussions with the Minister, and I hope that she will consider the clause again and return with fresh proposals. In those circumstances, we would not press the amendment to a vote today.
Karen Bradley
I did not say earlier what a pleasure it is to serve under your chairmanship, Mr Nuttall, but it truly is.
I understand much of what the shadow Minister said, but there are a few points that are important to make. First, the time limit we want to apply is for matters relating to misconduct in employment, not criminal matters. It will of course always be possible to investigate criminal matters, but the clause is intended to deal with a problem that we know has existed, when police officers have retired from forces and not been held accountable for mistakes and misconduct. By way of comparison with other forms of employment, I am a chartered accountant and I used to work for large accounting firms. If something came to light today on a piece of advice that I gave 10 or 15 years ago, there is very little that my former employers could do, because I have left. We have to put this in context. We want to make sure that mistakes that have been made are shown to be investigated properly, for public transparency and confidence in the police.
Jack Dromey
That is a helpful response. The Minister is absolutely right to draw the distinction between criminal proceedings, for which action can and should be taken, and actions that might constitute gross misconduct, for example.
Karen Bradley
I meant to make another point in my response, which is that the provision can of course be amended by regulation. Should it prove that 12 months is not the right time limit, the Government could change it in any event.
Jack Dromey
We are at one on the principle of accountability; somebody should not escape accountability as a consequence of having left the police service. Therefore a 12-month limit is not appropriate. At this stage, I would not like to arrive at a firm view on whether a time limit should be imposed, but there is flexibility on the Government’s part, which we welcome. We are happy to have discussions with the Government between now and Report, and we hope to be able to resolve the matter then.
Amendment 138 agreed to.
Amendments made: 139, in clause 22, page 28, line 45, at end insert—
“(3B) Regulations made by virtue of subsection (3A) must provide that disciplinary proceedings which are not the first disciplinary proceedings to be taken against the person in respect of the alleged misconduct, inefficiency or ineffectiveness may be taken only if they are commenced within the period specified in the regulations, which must begin with the date when the person ceased to be a member of a police force.”.
This amendment provides for the imposition of time limits on when disciplinary proceedings can be taken against a person who has ceased to be a member of a police force if they are not the first disciplinary proceedings to be taken in respect of the particular alleged misconduct, inefficiency or ineffectiveness.
Amendment 140, in clause 22, page 29, line 16, leave out from “paragraph (a)” to “, or” on line 19.
This amendment is consequential on amendment 141.
Amendment 141, in clause 22, page 29, line 26, at end insert—
“(2C) Regulations made by virtue of subsection (2B) must provide that disciplinary proceedings which are not the first disciplinary proceedings to be taken against the person in respect of the alleged misconduct, inefficiency or ineffectiveness may be taken only if they are commenced within the period specified in the regulations, which must begin with the date when the person ceased to be a special constable.”.
This amendment is the same as amendment 139 save that it relates to special constables rather than members of police forces.
Amendment 142, in clause 22, page 30, line 25, leave out “this section” and insert “subsections (2) and (3)”.
This amendment and amendment 143 are consequential on amendment 145, which inserts subsection (8) into clause 22. They allow for the possibility that subsection (8) will be commenced at a different time from the rest of the clause.
Amendment 143, in clause 22, page 30, line 30, leave out “this section” and insert “subsections (2) and (3)”.
See the explanatory statement for amendment 142.
Amendment 144, in clause 22, page 30, line 30, at end insert—
“, but only if the alleged misconduct, inefficiency or ineffectiveness is such that, if proved, there could be a finding in relation to the person in disciplinary proceedings that the person would have been dismissed if the person had still been a member of a police force or a special constable.”.
This amendment limits the extent to which regulations made in pursuance of section 50(3A) or 51(2B) of the Police Act 1996 (provisions inserted by clause 22 of the Bill) can make provision in relation to former members of police forces and former special constables who leave the police after the coming into force of clause 22 but where the alleged misconduct, inefficiency or ineffectiveness occurred before that date.
Amendment 145, in clause 22, page 30, line 30, at end insert—
“(8) Schedule (Disciplinary proceedings: former members of MoD Police, British Transport Police and Civil Nuclear Constabulary) makes amendments of the Ministry of Defence Police Act 1987, the Railways and Transport Safety Act 2003 and the Energy Act 2004 which produce an equivalent effect to the amendments made by this section.”.—(Karen Bradley.)
This amendment introduces the new Schedule NS1.
Clause 22, as amended, ordered to stand part of the Bill.
Clause 23 ordered to stand part of the Bill.
Schedule 6
Part to be inserted as Part 4A of the Police Act 1996
Amendment proposed: 199, in schedule 6, page 180, leave out lines 22 to 29 and insert—
“(c) the person ceases to be a civilian police employee by virtue of being dismissed and the reason, or one of the reasons, for the dismissal relates to conduct, efficiency or effectiveness;
(d) the person is a former civilian police employee and there is a finding in relation to the person in disciplinary proceedings that the person would have been dismissed if the person had still been such an employee.”.—(Karen Bradley.)
This amendment and amendments 200, 201, 202, 203, 204, 205, 206, 207 and 208 make provision for the inclusion in the police barred list and police advisory list of civilian employees of the City of London police force, in addition to members of the civilian staff of a police force for a police area listed in Schedule 1 to the Police Act 1996 and of the metropolitan police force.
The Chair
With this it will be convenient to discuss the following:
Amendment 197, in schedule 6, page 180, line 29, at end insert—
“(e) the person is a former police volunteer of the police force and there is a finding in relation to the person in disciplinary proceedings that the person would have been dismissed if the person had still been such a police volunteer,
(f) the person was employed by a company or individual which had entered into a contract with a local policing body or chief officer to provide services to a chief officer and there is a finding in relation to the person in disciplinary proceedings that the person would have been dismissed if the person had still been such an employee.”.
This amendment would provide for police volunteers and privately contracted staff to be placed on the barred list.
Government amendments 200 to 203.
Amendment 198, in schedule 6, page 185, line 35, at end insert—
“(c) the person was employed by a company or individual which had entered into a contract with a local policing body or chief constable to provide services to a chief officer and the person ceases to be so employed by resigning or retiring after a relevant allegation about the person comes to the attention of their employer and the relevant authority.”.
This amendment would provide for privately contracted staff to be placed on the advisory list.
Government amendments 204 to 209.
Amendment 161, in clause 25, page 32, line 35, at end insert—
“(f) community support volunteers and policing support volunteers.”.
This amendment would require guidance concerning disciplinary proceedings issued by the Secretary of State to apply to police volunteers.
Government amendments 210 to 213.
Jack Dromey
My apologies, Mr Nuttall; I, too, should have said that it is a pleasure to serve under your chairmanship.
Amendment 197 would provide the ability to place police volunteers and privately contracted staff on the barred list. Under the Bill, where police offers and special constables have been dismissed following disciplinary proceedings, their details will be added to the barred list held by the College of Policing. Chief officers will be barred from appointing anyone on the list as an officer, member of police staff, special constable or police volunteer. That is welcome, subject to the reservations that I am about to raise.
The Bill does not provide for volunteers dismissed for misconduct to be added to the barred list. Such volunteers are therefore not barred from taking up positions with other forces. We understand that police volunteers can be added only to the advisory list, although the legislation could make that clearer. That does not bar them from being appointed, but the advisory list is made available for vetting purposes.
The advisory list is intended to be used in the interim to record information about individuals who are under investigation or subject to proceedings. If the person is dismissed or would have been dismissed, they are effectively transferred to the barred list; however, if the matter is not proven or does not amount to gross misconduct, they are simply removed from the list. Do volunteers wrongly accused of misconduct have an opportunity to be investigated and removed from the advisory list? It is equally troubling that those who have committed gross misconduct cannot be placed on the barred list to ensure that they cannot serve with any force again.
Amendment 197 addresses the issue that the Bill does not provide for private sector staff to be added to the barred list. We find that extremely concerning, given that private sector staff can hold certain policing powers as detention and custody officers. Perhaps the Minister will therefore explain what mechanisms are in place to ensure that privately contracted staff who abuse their policing powers cannot serve again.
In 2012, Deborah Glass, the deputy chair of the Independent Police Complaints Commission, told The Observer:
“We believe it is vital for public confidence that all those who perform police-like functions and powers are subject to independent oversight.”
We wholeheartedly agree. In that spirit, the purpose of amendment 197 is to ensure that anyone with warranted powers can properly be held to account and, in instances of gross misconduct, can be prevented from being appointed to a police force.
Amendment 198 is closely linked to amendment 197 and would provide for privately contracted staff to be placed on the advisory list. It is therefore a tidying-up amendment, in line with the thrust of amendment 197, to provide for private sector staff to be added to the advisory list.
Karen Bradley
The creation of a statutory police barred list and police advisory list will bring greater accountability to the police disciplinary system and ensure that those who are employed by the police but dismissed as a result of serious wrongdoing are prevented from joining another force—something that I think we all agree on. The Bill will also ensure that officers and staff who leave by resigning or retiring before disciplinary proceedings have concluded are not able to evade sanction. The Bill will achieve greater accountability and strengthen public protection in a manner that we consider to be proportionate and workable.
As the shadow Minister has explained, amendments 197 and 198 seek to include police volunteers and those in a contractual relationship with police forces in the provisions for the police barred list and police advisory list. I have concerns about the approach that he suggests in relation to both categories.
I will start with volunteers. We recognise the importance of ensuring that volunteers carry out their functions appropriately and with adequate safeguards to ensure that they are held to account when they fall short of the standards expected. To achieve that, we have introduced measures to ensure that volunteers can be disciplined if wrongdoing occurs. The Bill contains measures to ensure that volunteers are captured in the provisions for the police advisory list. That will ensure that where a volunteer’s designated status is withdrawn as a result of serious misconduct, it will be recorded on the advisory list. That is a proportionate approach that reflects the fact that we are dealing with individuals who are not paid employees and who do not hold full contracts of employment. Amendment 197 would take those protections beyond what we regard as reasonable and proportionate for a volunteering role in policing.
Turning to police contractors, the amendments fail to address the complexities associated with the role and status of contractors who are not directly employed by police forces. Those contracted individuals cannot be treated like police staff or officers for the purposes of disciplinary proceedings. As a result of that legal and practical distinction, the responsibilities for employment matters rest ultimately with the companies that employ the contractors, and are governed by employment law.
The provisions of the police barred list, with all its effects and consequences, cannot simply be added to the end of other organisations’ disciplinary processes and procedures, because the full safeguards and protections that have been developed and built into the police staff and police officer disciplinary systems that sit within the police service would be lacking. For example, there would be no guarantee of a fair process for a hearing to consider the sanction or a subsequent appeal, in line with the policies and regulated procedures followed for police officers and police staff.
To bolt amendments 197 and 198 on to the Bill would risk undermining the principles of consistency, fairness and transparency that are at the core of what we are trying to achieve on accountability.
Jack Dromey
If specials can be barred, why not volunteers and private contractors?
Karen Bradley
It is because of the contractual relationship. A volunteer is unpaid and is doing the job of their own free will. There is not the same relationship. A contractor’s employer is the company, not the police. There are issues about the contractual relationship between the employer and the police, but those are not about the individual.
Jack Dromey
I remain unconvinced. First, the fact that private contractors have their own employment and disciplinary arrangements does not mean that the police service, or the policing Minister, cannot discharge the obligations of the Government to the contractor. In a hypothetical but possible circumstance in which there was wrongdoing by a special, a volunteer and a contractor alongside one another, the special could end up barred, whereas the volunteer and the contractor would escape being barred. That is an anomaly that I do not understand.
Karen Bradley
Another anomaly is that the special is warranted, while the volunteer and the contractor are not; they do not have the ability to arrest in the same way. We are looking at how to ensure that there is trust and accountability for police and warranted officers. The volunteers are not warranted and neither are the contractors. To try to undo this, and to try to bolt on an additional disciplinary process for an individual who is employed by a third-party company, which has its own disciplinary processes—
Jack Dromey
I am grateful to the Minister; she is being very generous with her time. Can she understand why specials would feel hard done by because they are held to certain standards, while volunteers and private contractors are not?
Karen Bradley
I do not think this is a case of anyone being held to different standards. We are talking about warranted officers as opposed to those who are not warranted. There is a difference in what they can do; there is a difference in their position; there is a difference in the duties that they carry out. While I fully appreciate and understand what the hon. Gentleman seeks to achieve—full accountability and public trust in these arrangements—I think that trying to bolt on an additional disciplinary process for volunteers or individuals employed by a third party, who have no warranted powers, simply confuses the matter. I am afraid that I therefore cannot accept amendments 197 and 198.
Turning to amendment 161, I agree with the hon. Member for Birmingham Erdington that as police forces modernise, including by taking advantage of the greater flexibility to confer policing powers on volunteers, adequate safeguards and arrangements are needed to hold designated volunteers to account when wrongdoing occurs. That issue was raised in the public consultation, which is why we have included appropriate provisions in the Bill, including in respect of guidance. Clause 30 will, for the first time, mean that if a member of the public makes a complaint against a designated volunteer, or if an internal allegation comes to the attention of the force, action can be taken to respond to that matter.
Jack Dromey
We have aired the concerns on amendment 197. An anomaly is left in the Bill, and it is rough justice, but we have aired the issue. On amendment 161, I make one point, and one point alone. The Minister has spoken about the capacity for guidance to be issued, and she indicates that such guidance will be issued. In those circumstances, we are content not to press our amendments.
Amendment 199 agreed to.
Amendments made: 200, in schedule 6, page 181, leave out lines 11 to 15 and insert—
“(e) in relation to a person falling within subsection (1)(c), the chief officer of police under whose direction and control the person was immediately before being dismissed;
(f) in relation to a person falling within subsection (1)(d), the chief officer of police under whose direction and control the person was immediately before ceasing to be a civilian police employee.”.
See the explanatory statement for amendment 199.
Amendment 201, in schedule 6, page 181, line 20, leave out “member of the civilian staff of a police force” and insert “civilian police employee”.
See the explanatory statement for amendment 199.
Amendment 202, in schedule 6, page 181, leave out lines 24 to 28 and insert—
“(5) For the purposes of this section, a person is a civilian police employee if the person is—
(a) a member of the civilian staff of a police force, including the metropolitan police force (within the meaning of Part 1 of the Police Reform and Social Responsibility Act 2011), or
(b) a person employed by the Common Council of the City of London in its capacity as police authority who is under the direction and control of the Commissioner of Police for the City of London.”.
See the explanatory statement for amendment 199.
Amendment 203, in schedule 6, page 181, line 30, leave out “member of the civilian staff of a police force” and insert “civilian police employee”.
See the explanatory statement for amendment 199.
Amendment 204, in schedule 6, page 186, leave out lines 14 to 16 and insert—
“(d) in relation to a person who was a civilian police employee immediately before resigning or retiring, the chief officer of police under whose direction and control the person was at that time.”.
See the explanatory statement for amendment 199.
Amendment 205, in schedule 6, page 186, line 21, leave out “member of the civilian staff of a police force” and insert “civilian police employee”.
See the explanatory statement for amendment 199.
Amendment 206, in schedule 6, page 188, line 35, leave out “member of the civilian staff of a police force” and insert “civilian police employee”.
See the explanatory statement for amendment 199.
Amendment 207, in schedule 6, page 188, line 40, at end insert—
“‘civilian police employee’ has the same meaning as in section 88A;”.
See the explanatory statement for amendment 199.
Amendment 208, in schedule 6, page 188, leave out lines 43 and 44.—(Karen Bradley.)
See the explanatory statement for amendment 199.
Schedule 6, as amended, agreed to.
Clause 24
Appeals to Police Appeals Tribunals
Amendment made: 146, in clause 24, page 32, line 17, leave out subsection (7) and insert—
“( ) In section 4A of the Ministry of Defence Police Act 1987 (appeals against dismissal etc), in subsection (1)(b), for the words from ‘by any provision’ to the end of the paragraph substitute ‘—
(i) by rules under section 85(1A) of the Police Act 1996 or by any provision of Schedule 6 to that Act, or
(ii) by any provision of Schedule 3 to the Police and Fire Reform (Scotland) Act 2012.’”.—(Karen Bradley.)
This amendment replaces the amendment of section 4A of the Ministry of Defence Police Act 1987 with one that ensures that the provision made concerning the constitution of appeal tribunals will continue to be equivalent to that made in relation to corresponding tribunals under the Police Act 1996 or the Police and Fire Reform (Scotland) Act 2012.
Clause 24, as amended, ordered to stand part of the Bill.
Clause 25
Guidance concerning disciplinary proceedings and conduct etc
Amendments made: 209, in clause 25, page 32, leave out lines 32 to 34 and insert—
“(d) civilian police employees, and”.
This amendment and amendments 210, 211, 212 and 213 make provision for the giving of guidance to, and about, civilian employees of the City of London police force, in addition to members of the civilian staff of a police force or a police area listed in Schedule 1 to the Police Act 1996 and of the metropolitan police force.
Amendment 210, in clause 25, page 33, leave out lines 6 to 9 and insert—
“(iii) civilian police employees;”.
See the explanatory statement for amendment 209.
Amendment 211, in clause 25, page 33, line 14, after “section” insert “—
‘civilian police employee’ means—
(a) a member of the civilian staff of a police force, including the metropolitan police force (within the meaning of Part 1 of the Police Reform and Social Responsibility Act 2011), or
(b) a person employed by the Common Council of the City of London in its capacity as police authority who is under the direction and control of the Commissioner of Police for the City of London;”.
See the explanatory statement for amendment 209.
Amendment 212, in clause 25, page 33, leave out lines 33 to 35 and insert—
“(c) civilian police employees.”.
See the explanatory statement for amendment 209.
Amendment 213, in clause 25, page 33, line 44, after “section” insert “‘civilian police employees’ and”.—(Karen Bradley.)
See the explanatory statement for amendment 209.
Clause 25, as amended, ordered to stand part of the Bill.
Clause 26
Powers of inspectors to obtain information, access to police premises etc
Amendment made: 147, in clause 26, page 38, line 20, at end insert—
“Provision of sensitive information to inspectors
6F (1) A person who provides information that is intelligence service information or intercept information to an inspector (whether under a provision of this Schedule or otherwise) must—
(a) make the inspector aware that the information is intelligence service information or (as the case may be) intercept information, and
(b) provide the inspector with such additional information as will enable the inspector to identify the relevant authority in relation to the information.
(2) In this paragraph, ‘inspector’, ‘intelligence service information’, ‘intercept information’ and ‘relevant authority’ have the same meaning as in paragraph 6E.””. —(Karen Bradley.)
This amendment supplements new paragraph 6E of Schedule 4A to the Police Act 1996 as inserted by clause 26 of the Bill. Paragraph 6E imposes restrictions on the disclosure of certain sensitive information by Her Majesty’s Inspectors of Constabulary. The new paragraph 6F inserted by this amendment is intended to assist inspectors in complying with paragraph 6E.
Clause 26, as amended, ordered to stand part of the Bill.
Clause 27 ordered to stand part of the Bill.
Clause 28
Powers of police civilian staff and police volunteers
Jack Dromey
I beg to move amendment 190, in clause 28, page 40, line 14, at end insert—
‘(1A) A relevant employee, in their capacity as a member of police civilian staff, must not be a member of a private sector company.”
This amendment would ensure that employees of the staff of private sector companies who are police contractors cannot be designated with additional powers under the proposals in the Bill.
The Chair
With this it will be convenient to discuss the following:
Amendment 191, in clause 28, page 40, line 18, leave out subsection (3) to subsection (11) and insert—
‘(3) An individual designated as a community support volunteer or a policing support volunteer may not be given any powers exercisable by—
(a) a police constable, or
(b) a police community support officer.”
This amendment would allow chief constables to use volunteers in their forces for appropriate tasks, but removes the ability for chief constables to give them powers of a Constable or Police and Community Support Officer.
Amendment 192, in clause 28, page 40, line 18, after subsection (2) insert—
“The chief officer of any police force may not bring under their direction and control the following volunteers—
(a) a community support volunteer,
(b) a policing support volunteer
where such volunteers would either—
(a) replace a police officer or member of staff, or
(b) fill a vacant police officer or member of staff role.”
This amendment would prevent volunteers being placed in roles which would normally be paid jobs.
Amendment 193, in clause 28, page 40, line 18, after subsection (2) insert—
“The chief officer of any police force may not place a volunteer in an operational role in the following areas—
(a) child sexual exploitation,
(b) serious crime,
(c) counter-terrorism,
(d) custody and detention.”
This amendment would prevent volunteers being placed into some of the most sensitive and demanding police staff roles.
Amendment 194, in clause 28, page 40, line 18, after subsection (2) insert—
“The chief officer of any police force may not place a volunteer in any role which may require the use of force or restraint.”
This amendment would prevent volunteers being placed in roles which may require the use of force or restraint and which should only be performed by officers and members of police staff.
Amendment 195, in clause 28, page 41, line 18, leave out from (6) to end of subsection
This amendment removes the provision for volunteer PCSOs to be issued with CS spray and PAVA spray.
Amendment 196, in clause 29, page 42, line 11, leave out “may” and insert “must”
This amendment would make it mandatory for the College of Policing to issue guidance to chief officers of police on training of volunteers.
New clause 15—Scrutiny of volunteer use—
‘Police and crime plans produced under Chapter 3 of Part 1 of the Police Reform and Social Responsibility Act (2011), must include an annual assessment of the use of volunteers, including the following—
(a) number of volunteers used,
(b) roles of volunteers
(c) protected characteristics.’
This new clause would make it mandatory for Police and Crime Commissioners to produce an annual assessment of the use of volunteers in police forces to allow for proper scrutiny of volunteer use.
Jack Dromey
I want to start by making a wider point. Our approach is not to say “public good, private bad”—far from it—but to draw the distinction between what should properly be done by police officers and what can be done by the private sector in one capacity or another, in support of the police service.
I will take as an example the West Midlands police service, which covers the area where I am proud to be a Member of Parliament. Four years ago, the Home Office ran a pilot, together with Surrey and the West Midlands police service, in which the radical transfer of a number of police functions to the private sector was proposed. It was strongly objected to, and was eventually dropped by Government and, indeed, the West Midlands police service which, however, then entered into an intelligent arrangement with Accenture on the 2020 modelling of the police service. That is an example of saying, “Let’s look at how we meet demand in 2020.” Accenture, with its excellent professional expertise, has been invaluable in working with the West Midlands police. That has been widely welcomed in the west midlands.
The Bill enables chief officers to designate a wider range of police powers for police staff. The amendment would prevent those provisions from allowing additional policing powers to go to employees of private sector companies, such as the G4Ss of this world. We will not support any further moves to allow private companies to carry out police activities that require warranted powers. The amendment is a probing one, designed to ensure that employees of private sector companies cannot be designated as community support officers or policing support officers. We want to get on record the Government’s assurance that the additional powers of a constable cannot be designated to be carried out by private sector staff.
The former Police Minister, the right hon. Member for Arundel and South Downs (Nick Herbert), said in 2012:
“No front-line police officers will be contracted out to the private sector.”
He went on to say:
“The Government are clear that the private sector can help the police service achieve cost savings and better services for the public.”
I agree. That is what Accenture did in the west midlands. The right hon. Gentleman continued:
“Every pound saved means more money for front-line services. Only police officers have the power of arrest and they will continue to patrol the streets, respond to 999 calls and lead investigations. There is no intention to allow private companies to carry out police activities which require warranted powers”.—[Official Report, 27 March 2012; Vol. 542, c. 1129W.]
That was clear and succinct, and we hope that the Government stand by what he said in 2012.
I do not think it is necessary to catalogue the failings of the private sector. G4S and the Olympics is the classic example, but only today on a separate but related matter comes news that four in 10 planned deportations are being cancelled as a consequence of the failure of the private sector. I stress again that it is not that the private sector should never have a role, but that it should never be allowed to discharge the functions of a police officer. Only warranted police officers should be able so to do. Will the Police Minister stand by the assurances that his predecessor gave?
I will move on to amendment 191. Winston Roddick, the impressive police and crime commissioner for North Wales, has served his community well and is standing down—we wish him all the best for the future—but he waxed lyrical in front of the Committee about the role of volunteers, and I do the same. As we said on that occasion, in the immortal words of Robert Peel,
“the police are the people and the people are the police”.
There is a long and honourable tradition of volunteering. The specials go back more than 150 years, but I have seen the tradition at first hand in my constituency. In Castle Vale, for example, there is the tasking force, the tackling of antisocial behaviour and the excellent relationship between local people, local volunteers and the police service, which are all making Castle Vale a safe place to live. In Witton Lodge, the admirable Linda Hines, like her counterpart in Castle Vale, Lynda Clinton, is the backbone of volunteering with the police and the police community watch. She sits on the police and crime panel. I remember doing a presentation recently to Maureen Meehan. She has been responsible for 29 years for the taskforce in the Stockland Green area, the community watch and the neighbourhood watch. They have been highly successful in working with the police and tackling a range of crimes and antisocial behaviour.
I stress in the strongest possible terms that the police could do not do their job without a voluntary army, but a voluntary army should not do the job of the police. The amendment would allow chief constables to use volunteers in their forces for appropriate tasks, but remove chief constables’ ability to give them the powers of a constable or a police and community support officer. The Bill enables chief officers to designate a wider range of police powers to police volunteers. The amendment leaves the option open for chief constables to use volunteers in their forces as they must, but would remove the option of giving them powers and jobs that should be those of warranted officers.
Forgive me for saying it one more time, but there is common ground across the Committee in support of that long and honourable tradition of volunteering, which goes back 150 years and more. That volunteering includes the special constables and the excellent work done by neighbourhood watches and police and crime panels. That is all true, but the public demand that police functions be discharged by police officers. We are extremely concerned that this measure may be an attempt by the Home Secretary to provide policing on the cheap. Instead of completely removing the clause, our view is that volunteer roles should be formalised in legislation to allow for proper scrutiny of volunteer use and accountability of volunteers. However, we fundamentally oppose giving policing powers to volunteers to fill the gaps left by the drastic reduction in officer and staff numbers over the past five years. If the Government do not agree, we intend to press the amendment to a vote.
Mike Penning
It would be appropriate for the shadow Minister to indicate that Winston Roddick said that in a personal capacity, not as chair of the Association of Police and Crime Commissioners. He said that quite specifically when giving evidence.
Jack Dromey
I would not for one moment downgrade his role or the significance of what he said. He is a police and crime commissioner who is highly respected throughout the police service. That is why he has been elected as chair of the Association of Police and Crime Commissioners.
Mike Penning
I was not in any way deriding the fact that he has been elected. He specifically said in evidence to the Committee that he was speaking in a private capacity, giving his personal views, and not as the chair. That is what he said.
Jack Dromey
The power of what he said speaks for itself. He is highly respected throughout the police service. I know that view is shared by other PCCs, Conservative and Labour. Winston Roddick went on to say, and it could not have been clearer:
“I think that the proposal raises points of principle about arming members of the public to do something by the use of arms, which goes further than the common law principle of acting in reasonable self-defence. You have to be very careful before you extend the right of one person to attack another by the use of any means.”––[Official Report, Policing and Crime Public Bill Committee, 15 March 2016; c. 51, Q67.]
Mike Penning
I will try to cover as many of the shadow Minister’s concerns as I can, but I feel that we will probably have a few Divisions in the next half-hour or so. I will touch quickly on some of the less controversial points—controversial to the shadow Minister, although not necessarily to Her Majesty’s Government.
Amendment 190 seeks to prevent employees of private sector companies who are police contractors from being designated additional powers in the Bill. The Bill says specifically that it cannot do that.
Incidentally, the powers for private contractors were brought in in section 39 of the Police Reform Act 2002—I do not think we were in Government in 2002—and parts 3 and 4 of schedule 4 to that Act relate to prisoner custody and escort functions, which are carried out today by private contractors in many forces. I have seen them in operation and in many cases they are exceptionally professional. There is no extension of powers whatever in the Bill, so amendment 190 is not necessary.
I think amendment 191 is about whether the powers given volunteers would go beyond a constable’s existing powers and extend them. The designated powers of a warranted officer are set by Parliament. If they were to change—they are not changing in the Bill—we would have to come back to Parliament, and there are no plans to do so. I agree with my predecessor, my right hon. Friend the Member for Arundel and South Downs, that we are 100% behind the warranted powers of a police officer and that includes specials, who I believe are volunteers.
Just to correct the shadow Minister who made what I am sure was a slip of the tongue, specials have been around for 180 years, not 150, and they have done exceptionally fantastic work.
Amendment 192 would make it very difficult for chief constables and police and crime commissioners, but particularly chief constables, to allow volunteers to do the work that we will ask them to do. Volunteers have been around for 180 years in the police force and the Government believe it is important to address some of the concerns—the shadow Minister alluded to this—in the core of the Bill. The core powers will remain, but we will need to use the skills of members of the public who want to help us but—this arises in my constituency—do not want to be a special in a uniform. They want to bring their other skills to policing, with appropriate training and scrutiny, which are vital.
This is not about taking police officers off the street and replacing them with volunteers or of saying, “You’re not good enough at your job, so we are bringing someone else in.” We are saying that we need to use all the skills we have in this great country of ours to help us with policing, particularly in respect of new technology. I am sure that there were concerns when specials were introduced 180 years ago. Perhaps they were similar to the concerns of the Opposition today. I think that they are unfounded. Having powers that help us to catch criminals and make people safer in their homes and workplaces is surely what this is all about.
Amendment 195 is interesting. Lincolnshire has already lined up and trained soon-to-be volunteer PCSOs and is just waiting for the legislation to be on the statute book. PCSOs have told me that the Herberts out there who may cause problems or attack PCSOs, particularly if they are under the influence of something, often know that PCSOs have no way of protecting themselves. They have asked me face to face, “Why won’t you let us have a pepper spray or a CS spray so we can protect ourselves?”.
Mike Penning
Yes, and now we will have volunteer PCSOs. The powers already exist for chief constables to give those weapons to PCSOs, but if we are going to have volunteer PCSOs, why would we not allow them to have the same protection? Why would we not let someone, after training, protect themselves and other members of the public in the exceptional circumstances when CS and PAVA are used? It is astonishing that we would not want to give the public and our volunteers as much protection as possible.
We may divide on this. I want to protect the public and our volunteers as much as possible, and to have the correct training that tells people what they are able to use in the circumstances.
Jack Dromey
I cannot say that this was a scientific study, but over the past three weeks, I have asked five PCSOs for their views on this matter. One said, to quote the immortal words of John McEnroe, “You cannot be serious.” I know that the Minister tours the country all the time talking to police officers and PCSOs, but has he had PCSOs and police officers on the ground saying to him, “We want volunteers and for them to be armed in this way”? I find it hard to believe he has.
Mike Penning
In which case, the shadow Minister does not believe me, and I will take that in good faith. If, when I stand up as a Minister and say something, people do not believe me, so be it. I am slightly disappointed, however, that he thinks I would say such a thing if it had not actually happened.
The principle is whether we enable—“armed” is such an emotive word, is it not? This is about giving people the protection that they might need after suitable training. It is already on the statute book for PCSOs, but we would not then give it to volunteer PCSOs—how could we in this Committee and in this House do that?
I fully understand exactly where the shadow Minister is coming from on the issue relating to the College. However, Her Majesty’s Government, who drafted the clause, have not instructed the College on anything. We have asked it, as an independent body, to issue guidance. The Bill would insert new section 53F into the Police Act 1996, which will for the first time enable the College to issue guidance on the experience and qualifications that are necessary for a person who is being designated with certain powers.
Not every chief constable in the country is going to take up these powers. For instance, powers of detention for PCSOs are on the statute book now and some chiefs decide they do not want their PCSOs to use them. Some have gone way beyond that, as we have heard. The hon. Member for North Durham is not in his place, but in North Durham, we have seen PCSOs go way beyond that in areas that we would probably not have expected—and very successfully. I am not going to instruct the College, but it will have heard what is said today and it will issue guidance, of course.
I do not think new clause 15 is required. The data will be collected through the annual data requirement process, under the responsibilities of the PCC. There is no point asking us to collect more and more data. They will be collected and they will be evaluated. It is, of course, absolutely crucial that we know what is going on and how many volunteers are being used. As the Minister introducing this legislation, I will be absolutely fascinated to make sure that enough volunteers come forward, and I will ask questions in areas if they are not coming forward. We know that we have a substantial amount of volunteers ready and waiting for this legislation. In Lincolnshire, for example, we have volunteer PCSOs trained and ready to go. They are just waiting for the Bill to receive Royal Assent.
I understand where the shadow Police Minister and the Opposition are coming from, but particularly on allowing us to protect our volunteers with the correct training and on other points that were made, I think we will beg to differ. We may have to divide the Committee, which is sad, because we agree on 99.9% of the Bill, but on this particular point, we probably will not. I hope I might have convinced the shadow Police Minister, but probably not.
Jack Dromey
The Minister is right. Actually, some of the things he has said are helpful. First, I note what he said about the College guidance. Secondly, it is welcome that a repeat of the assurances that were given by the then Police Minister, the right hon. Member for Arundel and South Downs, is now on the record. Thirdly, I note the point that was rightly made about the normal process of data collection in respect of what new clause 15 proposes.
I have to disappoint the Minister by saying that we will divide the Committee on these issues. Given the time, may I make two simple points? First, the Minister referred, quite understandably, to the 2002 Act, but a lot of water has flowed under the bridge since 2002. The problem now is that the police service has lost 18,000 police officers, including 1,300 in the last six months alone, as well as 5,000 PCSOs and thousands of members of staff at a time of mounting demand, on the one hand—I spoke earlier about child sexual exploitation and abuse, and the sheer scale and cost of it—and diminishing resources, on the other. I do not say this as a criticism, but chief constables at the sharp end are finding it increasingly difficult, and our concern is that we might end up with gaps being plugged by volunteers as more and more police officers and PCSOs go.
Mike Penning
But if we were to tell 100 people in the Dog and Duck, “By the way, a full-time, paid PCSO can have it, but a volunteer PCSO can’t. An operational, full-time police officer has it, and so does a volunteer special,” they will scratch their head and say, “Why aren’t you protecting the volunteer PCSO?”
Jack Dromey
I think they would say that volunteers should never be put into a front-line policing role where such a risk might be encountered. That is simply not appropriate. Ultimately, there are also issues about the accountability of volunteers because, by definition, there is a clear line of accountability for warranted officers or PCSOs, but there is not in quite the same way for volunteers.
I beg to ask leave to withdraw the amendment.
Amendment, by leave, withdrawn.
Amendment proposed: 191, in clause 28, page 40, line 18, leave out subsection (3) to subsection (11) and insert—
‘(3) An individual designated as a community support volunteer or a policing support volunteer may not be given any powers exercisable by—
(a) a police constable, or
(b) a police community support officer.”.—(Jack Dromey.)
This amendment would allow chief constables to use volunteers in their forces for appropriate tasks, but removes the ability for chief constables to give them powers of a Constable or Police and Community Support Officer.
Question put, That the amendment be made.
Investigatory Powers Bill (First sitting)
(8 years, 1 month ago)
Public Bill CommitteesRead Full debate Read Hansard Text Read Debate Ministerial Extracts
The Chair
Before we begin, I have a few preliminary announcements. Please switch electronic devices on to silent—thank you. Tea and coffee are not allowed during sittings.
Today, we will first consider the programme motion on the amendment paper. We will then consider a motion to allow us to deliberate in private about our questions before the oral evidence sessions, before considering a motion to enable the reporting of written evidence for publication. I hope that we may take some of those formally, without debate. I call the Whip to move the first motion.
Ordered,
That—
(1) the Committee shall (in addition to its first meeting at 11.30 am on Thursday 24 March) meet—
(a) at 2.00 pm on Thursday 24 March;
(b) at 9.25 am and 2.00 pm on Tuesday 12 April;
(c) at 11.30 am and 2.00 pm on Thursday 14 April;
(d) at 9.25 am and 2.00 pm on Tuesday 19 April;
(e) at 11.30 am and 2.00 pm on Thursday 21 April;
(f) at 9.25 am and 2.00 pm on Tuesday 26 April;
(g) at 11.30 am and 2.00 pm on Thursday 28 April;
(h) at 9.25 am and 2.00 pm on Tuesday 3 May;
(i) at 11.30 am and 2.00 pm on Thursday 5 May;
(2) the Committee shall hear oral evidence on Thursday 24 March in accordance with the following Table:
Time | Witness |
|---|---|
Until no later than 12.00 pm | David Anderson Q.C., independent reviewer of terrorism legislation |
Until no later than 12.30 pm | Don’t Spy on Us; Liberty |
Until no later than 1.00 pm | International Institute for Strategic Studies; Lord Evans of Weardale |
Until no later than 2.30 pm | NSPCC; Mr Ray McClure |
Until no later than 3.00 pm | BT |
Until no later than 3.30 pm | National Crime Agency; HM Revenue and Customs |
Until no later than 4.00 pm | National Anti-Fraud Network |
Until no later than 4.30 pm | Lord Judge, Chief Surveillance Commissioner; Interception of Communications Commissioner’s Office |
Until no later than 5.00 pm | The Rt. Hon. the Lord Reid of Cardowan; The Rt. Hon. Charles Clarke |
(3) proceedings on consideration of the Bill in Committee shall be taken in the following order: Clauses 1 to 6; Schedule 1; Clauses 7 to 10; Schedule 2; Clauses 11 to 48; Schedule 3; Clauses 49 to 61; Schedule 4; Clauses 62 to 74; Schedule 5; Clauses 75 to 96; Schedule 6; Clauses 97 to 207; Schedule 7; Clauses 208 to 212; Schedule 8; Clauses 213 to 231; Schedule 9; Clause 232; Schedule 10; Clause 233; new Clauses; new Schedules; remaining proceedings on the Bill;
(4) the proceedings shall (so far as not previously concluded) be brought to a conclusion at 5.00 pm on Thursday 5 May. —(Simon Kirby.)
The Chair
Therefore, the deadline for amendments to be considered at the first two line-by-line sittings of the Committee on 12 April is 4.30 pm on Thursday 7 April.
Resolved,
That, at this and any subsequent meeting at which oral evidence is to be heard, the Committee shall sit in private until the witnesses are admitted.—(John Hayes.)
Resolved,
That, subject to the discretion of the Chair, any written evidence received by the Committee shall be reported to the House for publication.—(John Hayes.)
The Chair
Copies of written evidence that the Committee receives will be made available in the Committee Room.
We will now move to the examination of the witnesses. We have agreed that Mr Starmer will open, but this is very informal, so anyone who wants to speak may do so at any time. Minister, you will wish to join in.
Examination of Witnesses
David Anderson gave evidence.
The Chair
Welcome, Mr Anderson. Before we start, do any Members wish to make a declaration of interest?
Keir Starmer (Holborn and St Pancras) (Lab)
Thank you, Ms Dorries. May I make a declaration of interest in relation to this witness and a number of other witnesses generally? I know this witness and some others; I have worked with them both as a lawyer and as Director of Public Prosecutions. I therefore put that on the record—if I may make a general declaration, it applies to Mr Anderson and quite a number of the witnesses today.
The Solicitor General (Robert Buckland)
Ditto. I know many of the witnesses as well.
Lucy Frazer (South East Cambridgeshire) (Con)
David Anderson was my pupil master when I was a barrister.
Christian Matheson (City of Chester) (Lab)
I do not know this witness, Chair, but Mr McClure, a witnesses this afternoon, is my constituent and is known to me personally.
Byron Davies (Gower) (Con)
I was a member of some of the agencies that will attend today.
Suella Fernandes (Fareham) (Con)
I was a Treasury counsel, representing Government Departments.
Joanna Cherry (Edinburgh South West) (SNP)
I was previously standing junior counsel to the Scottish Government, which has some tangential interest to the serious crime provisions.
The Chair
Okay; that is all the interests out of the way. We will now hear oral evidence from David Anderson QC, independent reviewer of terrorism legislation. Before calling the first Member to ask a question, I remind all Members that questions should be limited to matters within the scope of the Bill, as always, and that we must stick to the timings in the programme motion that the Committee has agreed. For this session, we have until 12 noon. Could the witness please introduce himself for the record?
David Anderson: I am the independent reviewer of terrorism legislation and the author of the report “A Question of Trust”.
Keir Starmer
Q It is a pleasure to serve under your chairmanship, Ms Dorries. Good morning, Mr Anderson. There are obviously a lot of people around the table whom you know, going by the declarations of interest. May I go straight to one of the central issues in your report, which was the need for an operational case for the powers in the Bill, and particularly the bulk powers? Having now had the opportunity to see what has been published between the Joint Committee report and the publication of the Bill, are you satisfied with the operational cases that have been published?
David Anderson: I was pleased that the Joint Committee recommended that a detailed operational case should be served in relation to each of the bulk powers. I was a little sorry that it did not also recommend a detailed operational case in relation to the police use of targeted equipment interference. I do not think I have seen the case for why that should be necessary in addition to the powers they already have under the Police Act 1997 on property interference.
In terms of the case itself, I salute GCHQ and others for being able to produce a 47-page case in circumstances that are very much about not being fully transparent about exactly how the powers are going to be used. One needs to know what the powers are, and it seems to me that, for public consumption, they have done a pretty good job that should enable Parliament to debate whether those powers are necessary or not.
I also believe, because I have seen it, although not read it, that they produced a detailed secret annex to that operational case, which was provided to the Intelligence and Security Committee. I noticed that when Dominic Grieve, the Chair of that Committee, made his speech on Second Reading of the Bill, he said that he—and I think, by implication, the Committee—was satisfied that each of the powers sought was necessary and proportionate. If the Committee has satisfied itself of that by reference to the detailed operational case, including the secret annex, that is very reassuring for all of us. If it has not, no doubt it will wish to do as the Bill completes its passage.
Keir Starmer
Q May I follow up on that? First, so far as operational cases are concerned, do you think there is still a need for an operational case for the police use of equipment interference powers? Secondly, is your view that the ISC should formally indicate whether it has considered the material and is satisfied with what it has seen, rather than implying it in a speech? Thirdly, do you think there is a need for an independent assessment of the operational case? It is one thing to publish it and to put material before the ISC; it is another to have it independently assessed. Apologies for asking three questions, but should a case be made for police use of equipment interference powers; should the ISC be called upon to formally indicate its response to what it has seen; and do we need an independent assessment of the operational cases in full?
David Anderson: On your first question, I pointed out in my written evidence of January to the Joint Committee that, so far as I could see, there had been no detailed operational case on police use of equipment interference powers. From my point of view, I would like to see it. So far as the ISC is concerned, it is not for me to say what it should and should not do, but I am mindful not only of its duty to serve Parliament, but of the fact that when the courts, and particularly the European Courts, come to look at the bulk powers, as inevitably they will, it will be of great interest to them, one imagines, to see just how much evidence was put forward in relation to the necessity for the case and who considered that evidence.
As to whether there should be, as you put it, independent review in addition, I am not persuaded of the case for that. The ISC demonstrated its independence in the most dramatic way possible in its report of early February when it declared that it thought that there was no need for one of the bulk powers—bulk equipment interference. Now, it may be that there has been some rowing back from that position, judging again from the speech of Dominic Grieve on Second Reading, but I think that it would be very difficult to say that the ISC had not had an independent look at these issues.
Keir Starmer
Q Can I ask you about bulk powers? From your experience, could you start by giving the Committee an indication of the scope of some of the bulk powers and warrants, perhaps by reference to the equipment and interference bulk powers?
David Anderson: The bulk powers, of course, are extraordinarily broad in scope, although the practical effect of that breadth is greatly limited by what happens after the line has been tapped or the device has been accessed. That is really the stage that makes it proportionate. My concern, particularly in relation to equipment interference, is that, if one looks at the so-called targeted power and, in particular, at its potential thematic use, it is quite extraordinarily broad. We are looking, I think, at clause 90 of the Bill. A so-called targeted equipment interference can be performed—devices may be subject to equipment interference if they are concerned in an operation or an investigation, or if they are in a location not defined.
The code of practice indicates that that power is very broad indeed—so broad that the ISC said:
“The so-called targeted power appears to be very broad. We are not quite sure what, in addition, you would get from the bulk power.”
I think that matters because the safeguards on the targeted power are less than the safeguards on bulk. For a start, you do not need to be aiming only at somebody outside the UK or people outside the UK. You can quite properly target it inside the UK. Secondly, you do not have the safeguard that you have with a bulk power that, if you are going to look in detail at one individual within the UK, you need a full individual warrant as well.
The commissioners have been very cautious in the past in allowing thematic powers to be too broad. One could say, “Let’s put it all on the commissioners. Let’s rely on them to make sure that the thematic power is not too broadly used.” I would feel a little more comfortable if there were more constriction in the statute.
Keir Starmer
Q One of the safeguards is the need for necessity in relation to bulk powers. From your experience, how easy or difficult is it to demonstrate necessity in relation to bulk powers? Give us an idea of the way the test actually operates in your experience.
David Anderson: I have seen the detailed warrant applications that currently go usually to the Foreign Secretary in relation to a bulk power. They currently have an extremely broad range of purposes that the bulk power is said to serve. I am sure that it is all very carefully considered by the warrant granting department at the Foreign Office and then by the Foreign Secretary. There will certainly be much stronger safeguards under the new Bill, and I welcome that.
Keir Starmer
Q Can I take you from bulk to internet connection records, which you dealt with in your report? There have been comments about and criticism of the definition—or lack of definition—of internet connection record. Looking at the version in the Bill now, do you have any concerns about the definition?
David Anderson: I last looked in detail at internet connection records almost a year ago now, and even an operational case had not been made. There certainly had not been the dialogue with communication service providers that would have been necessary to make it work. I am afraid that I have not followed in the same technical detail as the Joint Committee on the Draft Investigatory Powers Bill and the Select Committee on Science and Technology the arguments on the extent to which they have been properly defined, the extent to which it will be feasible to produce these records or, indeed, how much it would cost. Therefore, I cannot, I am afraid, raise any alarms on that or give you any reassurance, save to say that these would appear to remain live issues.
Keir Starmer
Q ICRs are obviously new and developing in real time, but there are a number of other novel and contentious areas in the Bill. Do you see any role for greater independent authorisation in relation to some of these new techniques or powers?
The Chair
Order. Mr Starmer, can you make that your last question, please, because it is already 11.45 am and I think other people would like to ask some questions?
Keir Starmer
I will do. Thank you.
David Anderson: Do I answer that question, Chair?
The Chair
Yes, but as briefly as you could, please. If not, you can provide a written answer.
David Anderson: Internet connection records are a form of communications data. I said rather conservatively in my report that there were some forms of communications data that should be independently authorised, including novel and contentious ones. One of the respects in which the Bill did not really follow my report—I should add that in most respects it did—was in not providing for that outside the protected categories of journalists, lawyers and so on. I could well understand it if members of the Committee or others were to take the view that ICRs were of such a nature that to allow self-authorisation by the police might not be a sufficient safeguard.
Joanna Cherry
Q It is a privilege to serve under your chairpersonship, Ms Dorries.
Good morning, Mr Anderson. The first question that I want to ask you follows up on questions about the operational case for bulk powers. We heard on Second Reading of this Bill in the Chamber that in the United States of America, the bulk collection of citizens’ data has been heavily curbed, as it was considered to be
“not essential to preventing terrorist attacks”.
Most damningly, the American President’s privacy and civil liberties oversight board said that it was
“aware of no instance in which the”
National Security Agency’s bulk records programme had
“directly contributed to the discovery of a previously unknown terrorist plot or the disruption of a terrorist attack.”
Bearing that in mind, do you agree that a proper independent assessment of the utility and effectiveness of bulk powers would need to look at the experience of their use in other jurisdictions?
David Anderson: What you are referring to is one type of bulk power that I myself looked at the necessity for in a great deal of detail. It is difficult, of course, to read across from section 215 in the US to what we have here, which is rather different. What we have here is service providers being required to keep phone logs, details of when emails were sent and so on.
If you look at my report, “A Question of Trust”, you will see that there are several annexes there and quite a bit of text in which I set out just how useful the police find that power to be. I also found when I was in Germany, where at the time they did not have the power because Germany’s constitutional court had removed it, that the police and the internal security service were crying out for something along those lines. So, that is one aspect.
I cannot speak for the US position—different power, different circumstances—but particularly in dealing with paedophile crime, I was satisfied that this, if you like, plain vanilla element of bulk collection communications data was something for which there was an operational need.
Joanna Cherry
Q So, in your investigations for your report, you looked at the experience of at least some other jurisdictions. Is that correct?
David Anderson: I did, yes.
Joanna Cherry
Q So would you agree that a proper independent operational case for the support of this Bill should look at the experience of other jurisdictions?
David Anderson: Well, we have had three detailed reports. We have had the pre-scrutiny reports, as well. Evidence was heard by some of those Committees from people from other jurisdictions. It is always nice to think one is fully informed about what goes on in the rest of the world. Incidentally, that is very difficult in this field, because very few countries have been as up front as this Bill is about exactly what powers are used and how they are used.
For example, you mentioned the US and section 215, but of course there are other bulk powers that have not been curbed in the way you suggest. There is section 702, which was given a clean bill of health by the privacy and civil liberties oversight board. There is also executive order 12333, about which very little is known, but which seems to give very intrusive and extensive powers outside the US. So I am hesitant about drawing these country comparisons, although I accept that evidence from other countries is always useful.
Joanna Cherry
Q Bearing in mind the pressures of time, may I move on to my next heading, which is the scope of bulk powers? On Second Reading, the Home Secretary said that
“certain bulk powers are predominantly those for foreign usage, rather than in relation to the United Kingdom.”—[Official Report, 15 March 2016; Vol. 607, c. 823.]
Would I be correct in understanding that most of the bulk powers proposed in the Bill could, in fact, apply to the data of UK citizens?
David Anderson: The way it works, as I understand it, is that the use of the bulk powers must be motivated by a desire to retrieve data relating to people outside the UK. Of course, there will be what fishermen call a “bycatch” of people in the UK whose data are unavoidably retrieved during that process. The safeguard for people inside the UK is that if anyone wants to look at the content of that stuff, they need an individual warrant relating to that person.
Joanna Cherry
Q But would we be correct in understanding that, for example, bulk personal datasets will comprise the personal data of United Kingdom citizens?
David Anderson: That is certainly true.
Joanna Cherry
Q Would we also be correct in understanding that bulk communications data will comprise data relating to British citizens?
David Anderson: Indeed, that is true and has been the position for, we now know, some 10 or 15 years.
Joanna Cherry
Q So if an impression were to get about that bulk powers are merely about obtaining information on people who live overseas, that would be incorrect.
David Anderson: That would be incorrect, but of course neither of the two examples you gave me was about the content of people’s communications. The first was about lists and registers, and the second was about communications data.
Joanna Cherry
Q My third heading is legalities. You will be aware that the United Nations special rapporteur on the right to privacy has expressed concern that some aspects of the Bill may not comply with either European Union law or the UK’s obligations under the European convention on human rights. He expressed particular disquiet about bulk surveillance and bulk hacking, and suggested that those powers prima facie failed the benchmark set by the European Court of Justice in the Schrems case and by the European Court of Human Rights in the Zakharov case. Have you had a chance to consider his report?
David Anderson: I have.
Joanna Cherry
Q Do you have any view on what he has said in that regard?
David Anderson: I think he is advancing one view of what European law or international law might require. I do not think that it is the only possible view, and I would apply the same comment to the letter signed by 250 very distinguished lawyers and sent to The Guardian.
May I give you an example of the latest case in Europe to deal with these issues? In Szabó and Vissy v. Hungary, which was decided in January, the European Court of Human Rights described
“the massive monitoring of communications susceptible to containing indications of impending incidents”
as “progress” and suggested only that these powers needed proper legal safeguards, with which I think any sensible person would agree.
I think that there are two views at the moment, even within the European Courts. Where I disagree with the rapporteur and the 250 lawyers is on the suggestion that the position is now clear. It may of course become clearer, perhaps as soon as this summer when the Davis and Watson case is determined in Luxembourg, but I do not think that the case law has yet solidified.
Joanna Cherry
Q So your view would be that there are potentially two competing arguments as to where the case law is heading, but we do not know ultimately what the situation is, although we may have a better indication when there is a judgment in the Davis and Watson case later this year.
David Anderson: There are also the Strasbourg cases of Big Brother Watch and Liberty. I do not know when those judgments will come, but there are two views, basically. One is that bulk access to content, even only by machines, is just wrong and that, however strong the operational case for it and however minimal the actual intrusion into people’s private lives, it cannot be justified. The other, more pragmatic view is that it is a question of proportionality and that one ought to look at the strength of the operational case, just as one ought to look at the degree of intrusion into privacy.
Joanna Cherry
Q I want to ask you briefly about bulk personal datasets. It is possible, is it not, that medical information pertaining to every single citizen of the United Kingdom could be scooped up in a bulk personal dataset?
David Anderson: I do not believe that there is any statutory exclusion. Whether there is a justification for doing such a thing would depend, first, on whether the Secretary of State signed off on it and, secondly, on whether the judge was prepared to approve it.
Joanna Cherry
Q It would also be possible for bulk personal data sets in relation to children to be scooped up under this legislation as currently drafted. Is that right?
David Anderson: Again, I do not believe that there is any statutory exclusion.
Joanna Cherry
Q Do you agree that in the investigation of threats to national security and terrorism there can really be no justification for scooping up personal data in relation to children?
David Anderson: I am going to duck that one because bulk personal datasets were outside my remit. The use of bulk personal datasets, we now know, has been subject to annual review by the Intelligence Services Commissioner for several years. Perhaps he is the appropriate person to ask about that.
The Minister for Security (Mr John Hayes)
Q Thank you for coming, David. On bulk personal datasets, I note that you say that the members of the intelligence community that you have met, and what you have seen and heard from them, have confirmed the view that was expressed by the ISC and others. Are you clear about their efficacy and utility?
David Anderson: I think what I said was that bulk personal datasets had been looked at by the Intelligence and Security Committee and by the Intelligence Services Commissioner. I have read what they have said about that, including in closed hearings, and I said that what I was shown by the agencies was consistent with that, but I was not trying to do the same exercise that they had done of deciding whether these things were necessary or proportionate.
Mr Hayes
Q As a follow up on that, obviously you appreciate that your recommendations on the operational case being made have been built in to what we are doing. Further to what you said about the Chairman of the ISC’s recognition of their proportionality and necessity, I suppose you would accept that any publication of that operational case will obviously be limited, because it is an operational case and as soon as you make it public to the point where it ceases to have value, it could compromise operations.
David Anderson: Yes, the agencies’ ability to protect us relies quite heavily on people not knowing exactly what it is they can and cannot do.
Victoria Atkins (Louth and Horncastle) (Con)
Q I will ask just a couple of questions, if I may, Mr Anderson. Looking at the operational case for bulk powers, the Home Office has stated:
“There is clear evidence that these capabilities have…played a significant part in every major counter terrorism investigation of the last decade, including in each of the seven terrorist attack plots disrupted since November 2014...enabled over 90% of the UK’s targeted military operations during the campaign in the south of Afghanistan…been essential to identifying 95% of the cyber-attacks on people and businesses in the UK discovered by the security and intelligence agencies over the last six months”.
They have also been of great use in serious organised crime and paedophilia investigations, as we know. Are those factors that you and others have taken into account when assessing whether we need bulk powers, and how critical they are to national security and serious organised crime investigations?
David Anderson: I saw and heard enough to persuade myself of the necessity of bulk interception powers and bulk data retention of the type we were describing—phone logs and emails and so on. I did not look at equipment interference, for example, because that was outside my remit, and the query that I raised on that earlier was really the same query that the Intelligence and Security Committee has raised. If you define the targeted powers so broadly as to encompass almost anything, what is the additional utility of a bulk power? I am not persuaded on that simply because I did not do the exercise.
Victoria Atkins
Q By way of conclusion, you gave evidence to the Joint Committee scrutinising the draft Bill in November 2015 and at that time you said it gave effect to 90% or more of the recommendations in your report entitled “A Question of Trust”. Now that the Government have responded to the Joint Committee’s report and made further amendments, how much closer is the Bill to your report’s recommendations?
David Anderson: If I may say so, I thought that it was an excellent report and I was very pleased to see that the Government had given effect to the great majority of those recommendations.
Suella Fernandes
Q I have two questions. On the double lock and the judicial review test, concerns were expressed by witnesses to the Joint Committee about two issues. The first is the access to evidence by the judges and by the Ministers or the Home Secretary in the process of considering warrants. What would be the access to evidence by both parties involved in the double lock? Would it be the same or different?
David Anderson: I would certainly assume that the judges would have access to all the evidence that the Home Secretary or the Secretary of State had access to. I believe I have actually had a private assurance that that would be the case. I am afraid I have not checked to see whether that is in the code of practice, but plainly it ought to be, because this is not a rubber-stamp and nor is it simply a test of rationality or process. If it needs to, it should involve a proper look into these issues of necessity and proportionality. I was delighted to note that the Foreign Secretary said as much when he wound up the debate on Second Reading last week.
Suella Fernandes
You have pre-empted my second question, which is about the concerns that various witnesses have raised about the level of scrutiny involved in the judicial review test. Are we looking at a Wednesbury level of scrutiny?
The Chair
Order. I am afraid we have reached the end of the time allotted for the Committee to ask questions. On behalf of the Committee, thank you very much for your time and for giving evidence today.
Examination of witnesses
Eric King and Sara Ogilvie gave evidence.
The Chair
Q We will now hear oral evidence from Don’t Spy On Us and Liberty. For this session we have until 12.30 pm.
Welcome, and thank you for coming. Will the witnesses please introduce themselves for the record?
Eric King: I am the director of Don’t Spy On Us, a coalition of non-governmental organisations in London who are concerned about surveillance.
Sara Ogilvie: I am a policy officer at Liberty, which is a UK-based human rights organisation.
Keir Starmer
Q Because we do not have much time, I would like to ask Eric King some questions about bulk powers and then Sara Ogilvie some questions about internet connection records.
Eric King, do you have any concerns about the definitions and scope of the bulk powers in the Bill?
Eric King: It is important to understand the level of interception that takes place by our agencies and that will continue to take place under the warrants. My view is that bulk interception as it is currently practised by GCHQ is not a proportionate act and is not strictly necessary. The reason why is that, at the moment, we know from the ISC that there are just 10 warrants, which are authorised every six months, that permit the interception of 50 billion pieces of communication every single day. As a lawyer looking at that, I struggle to be imaginative enough to understand how you could craft a warrant that would appropriately assess the proportionality equation at that moment, given the scope of what is taking place.
The reality of how our signals intelligence agencies work is that, once those 50 billion communications are intercepted, the vast majority of GCHQ’s expertise is in automatically processing that and analysing it into what it calls query-focused datasets. We do not necessarily need to understand all that, but it suffices to know that GCHQ touches it in such a way that it results in significant intrusion on those communications.
Keir Starmer
Q Can I press you on that? To some extent, we are proceeding on the basis that there are two exercises involved when it comes to bulk powers. The first is the acquisition or holding of the data, and the second is, at some subsequent time, the accessing of those data, subject to different thresholds. Is it as simple as two distinct exercises, or is there more to it than that?
Eric King: There is considerably more to it than that. The intermediary stage—the point at which you have collected the material—is really just the first assessment. From that point, GCHQ’s computers begin processing the material and providing analytics on it—for example, voice transcription or keyword analysis, or they might be doing facial recognition on certain imagery.
There is one programme that we know about called Optic Nerve that resulted in GCHQ intercepting 50 million pieces of webcam traffic, which included 3% to 11% of material that was undesirable nudity. Once that was collected, GCHQ deployed facial recognition on it. There is no warrantry stage at that point. It has already been collected under those 10 warrants. All the processing is done without any authorisation. It is only at that final bit that you highlighted, when an analyst may wish to look at it, that we have an additional safeguard.
Keir Starmer
Q Given your concerns, do you have alternatives that you think would serve the same purpose as some of the bulk powers?
Eric King: My starting point is that there needs to be formidable intrusive powers for our agencies to operate, but they must be targeted. When you are targeting it can be difficult and you can have some additional collateral around the targets you are seeking to obtain communications about, but it has to be proportionate collateral. At the moment, I just do not see how we can put our hands on our hearts and say that we are doing that properly.
I think there are a number of different models we could be looking at. In the US they have judicial authorisation of selectors that are put in place, all of which focuses on warrants being targeted at individuals, rather than on infrastructure or cables, which I think is not proportionate.
Keir Starmer
Q When you refer to selectors, I think you are referring to what happens in that middle period, between initial acquisition and later access.
Eric King: That is exactly right. We know that GCHQ has 50 billion targeting identifiers—these are the selectors. A simple one would be an email address or a phone number; a more complicated one might be an email signature or something like that. That is the reality of how the systems are genuinely processed, and those are the sort of places our law should be constructed around. It should be constructed around the technical and operational reality of how our agencies work, to ensure that our law is constraining how our agencies operate, rather than the technical ingenuity of the engineers at that point.
Keir Starmer
Q Your evidence is that much of this happens before the final access thresholds apply.
Eric King: Absolutely. GCHQ analysts do not wish to look at most material themselves. The main reason for that is that it is time consuming. If you can programme a computer to do the heavy lifting, to do the intrusion, the processing and the analysis, that is to their advantage, and that is where they have put that. The problem with that is that our legal framework does not recognise that shift in massive computing power intruding on those communications in a very sophisticated way.
Keir Starmer
Q Can I turn to you, Sara Ogilvie, on internet connection records, in particular? I know that Liberty has got a number of concerns about the powers in the Bill in relation to internet connection records. Could you give us a brief summary of the main headline issues from your point of view?
Sara Ogilvie: The problem with internet connection records, from what we have seen, is that they do both more than they are supposed to and less than they are supposed to.
In terms of doing more, it is clear that they will create a database of the internet connections that take place day in, day out of every person across the country. That is a terrifying amount of information to store either in one place or across a number of different databases. It creates a clear impression of what you are doing, with whom you are communicating, what issues you have in your life. That can involve some very confidential and private information. I have real concerns about that.
In terms of doing less, I am not as technologically minded as Eric but it has been made clear to me that what these powers are supposed to do is deliver certain information that can be used by law enforcement or the security services, perhaps to deal with paedophiles and undercover unlawful internet site usages. It seems clear that, given the bulk nature of these powers, they will not deliver that kind of information in a helpful manner. If anything, it seems more likely to drive criminals to use bits of the internet that will not be captured by the service. On the one hand, we have clear evidence of the things that law-abiding citizens are doing, but on the other hand, we do not have evidence on what criminals are likely to be doing.
Joanna Cherry
Q To be clear, Mr King, is your evidence in relation to bulk interception and collection of data that there is intrusion and analysis of them by computer programs prior to any warrant being applied for?
Eric King: No. There will be warrants at the collection stage but at the moment it is simply 10. Those 10 warrants that are authorised every six months permit the agencies to intercept at an extraordinarily large scale: 50 billion connections every single day, and growing. We know that, in the past five years, that has increased by 7,000%. I say that those 10 warrants do not appropriately assess the proportionality requirements, and I do not think they are necessary in the current climate.
Joanna Cherry
Q Once the intercept has been collected, there is a stage of the process at which it is analysed by a computer, and that stage is not currently the subject of any legal regulation.
Eric King: That is right. It is internal authorisation by the agencies. We have no visibility on that. There has been no published material about that. In various court cases, disclosure has been sought better to understand those points, but we have not got it. The best I can gather, the internal authorisations inside GCHQ are at a very low level, mostly analyst by analyst even rather than going up to senior directors inside the agency.
Joanna Cherry
Q Just so we can be clear, does anything in the Bill involve legal regulation of that stage of the process?
Eric King: No, not at all. Our model is the same as it was 15 years ago. It is a very simplistic model that applies interception at one stage and then, when a human looks at it, an additional safeguard. However, that does not match the reality and, as a result, our warrantry, in my view, does not allow you to assess proportionality and necessity to an adequate level.
Joanna Cherry
Q We know now, because it has been avowed, that previous Administrations had unacknowledged arrangements for bulk interception of the internet in the United Kingdom. Can you tell us whether those resulted in the collection and analysis of ordinary British citizens’ communications?
Eric King: In the Bill and previous practice, there was a lot of focus on the fact that this would be foreign-focused—that the goal is to collect material outside the United Kingdom. The practical reality is that you cannot do that any more. All our communications slush around through the exact same undersea fibre optic cables as foreigners’. In terms of GCHQ’s collection programme, we do not know the exact percentage. I would encourage the Committee to try and seek out how many British communications are collected into this, but there is no way for them to distinguish between them at this point. When there is a foreign-focused power, at least for interception, the reality is that it is a massive amount of British communications. Your communications are not exempt from that and neither are mine, no matter quite what we might try.
Joanna Cherry
I would like to ask Ms Ogilvie a couple of questions if I may, Madam Chairman.
The Chair
Order. Time is very short now, because we have seven more people waiting to speak.
Joanna Cherry
Q I will ask one question briefly then. Liberty looked at the investigation by the Intelligence and Security Committee into the brutal murder of Fusilier Lee Rigby in May 2013. Did those inquiries suggest that if the security services had had more resources to cover lower priority level targets, the outcome could or would have been different?
Sara Ogilvie: The Intelligence and Security Committee report found that there were a number of failings that may or may not have led to the murder, but basically, the two suspects had both been known to the security services at various points. It had been decided not to treat them as priorities. When that decision was later changed and a warrant was sought to place one of the individuals under surveillance, delays meant that that warrant was not granted in enough time for that individual to be under surveillance at the appropriate moment. Those are absolutely not the powers in this Bill, or the use of powers in this Bill, that we have any exception with at all. That seems to us to be absolutely the right way to use powers. It was not a lack of information or a lack of target in this case; it was the fact that there was perhaps too much information to be used.
Simon Hoare (North Dorset) (Con)
Q Mr King, I am not a lawyer, so forgive me. Are you a parent?
Eric King: Pardon?
Simon Hoare
Q I am—I have three daughters. I just wonder where the balance is between the sort of purity test, for want of a better phrase, and what law enforcement have told us—that, without ICRs, they would be unable to identify at least 600 child abusers in the UK alone. What weight should we attach to that?
Eric King: The police definitely have capability gaps at the moment, particularly around the resolution of IP addresses. I think that is really what the statement goes to: when they obtain these IP addresses, they are seeking to resolve them. There are lots of different ways you can do that, however, and I am not convinced that ICRs are the answer to that problem. This was not a proposal by the police for ICRs; it was a Home Office answer to the problem. Last year, we had the Counter-Terrorism and Security Act 2015 that put in place new powers for IP resolution—they have not yet been put into use. My starting point would be that we should use them. They should be deployed. We should see how well they work and from there look at what the other options are. It seems to me that that important issue does need to be addressed and has been addressed, but we have not given it time to see whether or not it works.
Simon Hoare
Q You are right that there are a number of clubs in the golf bag of the law enforcement team and the agencies, but given that we live in an incredibly fast-moving, technological world, where international boundaries are not recognised and so on, would you agree that the more facilities that the agencies have available to them, the better—that is, the wider that the net can be cast, the more ne’er-do-wells one is going to identify and hopefully apprehend?
Eric King: Respectfully, as you acknowledge, there are different ways to solve a problem. Casting a very wide net is not always the right thing to do. IP resolution is certainly a very narrow technical issue that you need to resolve. Collecting all sorts of additional information in additional areas would not help resolve that narrow issue. I think you have to look at it on a case-by-case basis.
That is part of the reason why we need to scrutinise properly the operational cases for the variety of these powers, to understand which bits of them they help solve and which bits they do not. Certainly, intrusive powers need to be available to our law enforcement and agencies, but we need to understand which bits work and which bits do not.
Suella Fernandes
Q This is a question for Sara. In evidence to the Joint Committee, Shami Chakrabarti criticised the Bill on behalf of Liberty, saying that judges would not have the same access to evidence as Ministers in the warrant process. We have just heard evidence from the independent assessor of the terrorism legislation, David Anderson QC, that that is not the case. The Home Secretary has said on the record that that is not the case, and that they would have the same access. Do you withdraw that criticism of the legislation?
Sara Ogilvie: No. This is one of the areas where there has been a lot of discussion and to-ing and fro-ing. If the Home Secretary wishes to satisfy our concerns, those are the kinds of provision that should be dealt with on the face of the legislation. It seems to us that judicial review remains an inherently limited jurisdiction. That is quite a legal term to say that there are only so many things that it can do. We think that a much broader power needs to be granted to the judicial commissioners in order to satisfy public concerns that the powers be used appropriately and to match human rights standards. This is an area on which the Home Secretary has sought to give lots of reassurance, in which case I think it would be best if she put that reassurance in legislation.
Suella Fernandes
Q Evidence was given to the Joint Committee by Sir Stanley Burnton, the Interception of Communications Commissioner, and Lord Judge, the Chief Surveillance Commissioner. Both said that the double lock involves an intensive analysis including analyses of necessity and proportionality. It is not simply rubber-stamping. Again, do you maintain your disagreement with those senior judges?
Sara Ogilvie: I respect and agree with the fact that an extent of necessity and proportionality analysis will be done, but there is still very limited capacity for judges and judicial commissioners to undertake this exercise. We have seen, and judicial review case law tells us, what level of scrutiny can be applied to different kinds of decision, and we know that where a decision does not involve a restriction on the physical liberty of an individual, a lesser scale of judicial review scrutiny will be applied.
We also know that where cases involve national security, judges must apply a lesser level of review. Although I recognise that there is a difference of views, I think it needs to be much clearer in the legislation. Judicial review should be avoided as a standard in this circumstance.
Christian Matheson
Q I will ask only one question. Mr King, you talked about the astonishing amount and huge volumes of data that are collected. Can you both comment on the statement that the sheer volume of information means that there is less of a threat to personal privacy, simply because individuals’ personal data are almost swamped within the mass of data collected?
Eric King: It is an interesting idea, isn’t it, that the more widespread the intrusion, the less potentially bad it is. That is not a view that I can understand myself, particularly now. Computer analytics of such material is going to increase. It is going to get better and faster. The more data being collected, the more intrusion will be applied year on year as GCHQ engineers find cheaper, better and faster ways to process it. Perhaps five years ago, swamping agencies with material might have resulted in people passing through, but every day, that becomes less likely and less real.
We have seen in the last five years a 7,000% increase inside GCHQ of the analytical capability on material. That means that 7,000% more material is being touched, analysed and scrutinised by those agencies. Perhaps it was an idea that could be comprehended 20 years ago, when it involved physical piles of paper that no one ever looked at, but now it is all being automated, and I am not sure that the notion stands up today.
Sara Ogilvie: I clearly agree with what Eric has said. The only thing I would add is that I ask you to consider the fact that we are not just concerned about the state having this information. All this information that is stored somewhere can be accessed by other individuals for nefarious purposes. We have seen the TalkTalk hacks this year. We have seen the VTech hacks. There are real and legitimate concerns about the way this vast amount of personal information can be used, not just by the state but by other people who really do wish to do us harm.
The Chair
Can we keep questions and answers as brief as possible to get everybody in, please?
Peter Kyle (Hove) (Lab)
Q I, too, am not a lawyer but, unlike Mr Hoare, I do not apologise for it. Mr King, it was quite striking when you gave a flavour of the quantity of data that is being harnessed. Do you know whether that has ever led to an unlawful arrest, or a wrongful arrest?
Eric King: No. At the moment we have almost no visibility on how our security and intelligence agencies work on a day-to-day basis with our National Crime Agency. We know that they co-operate very regularly and we know there is a lot of material that is shared around, particularly for organised crime circumstances. I imagine that lots of the relevant material is passed to the NCA and others, and that will lead to arrests and occasionally presumably also unlawful arrests. But no, that is not material that is in the public domain.
Victoria Atkins
Q Mr King, there was a phrase you used quite a few times during your evidence. That is, “We don’t know.” How long have you worked for the security services?
Eric King: I don’t work for the security services.
Victoria Atkins
Q How many intercept warrants have you prepared or reviewed?
Eric King: None.
Victoria Atkins
Q So, it would be fair to say that there is a great deal about the workings of GCHQ and other security services that you simply do not know about.
Eric King: Yes. In my evidence that I wrote to the Joint Committee I set out my frustration at my inability to be able to probe at the heart of the issues on this. We are in a much stronger position now democratically, I believe, with so much more material that is available. That has led to court cases and the Investigatory Powers Tribunal that has found unlawful actions by GCHQ. Without that material being published, we would not have been successful in those cases. I wish there were more but I do not have it all, I am afraid.
Victoria Atkins
Q I am driven to ask, Mr King, against your evidence that you do not know much about how security services work, how many lives you are willing to sacrifice for your very pure plan of privacy?
Eric King: None. I do not think that any lives should be sacrificed for a pure view of privacy. We need both; we need security and privacy. Both are values that we hold in this society and are values that we should be ensuring that we get right in the Bill. That is why it is so important that we have long scrutiny on this because we should not simply provide an unlimited set of powers to our security and intelligence agencies. They must have some, and they must be formidable powers, but they need to be checked.
They need to be provided for by Parliament. We need to have proper authorisation and oversight for that. That has been my work for the past five years. So, no, while I do not hold a security clearance, it does allow me to come before you and talk about all the things that I do know. Regrettably, if I did hold a security clearance, I would not be able to be in that position.
Matt Warman (Boston and Skegness) (Con)
Q Building on that, the Joint Committee did ask for an operational case for bulk powers to be published, and that has been seen and assessed by the ISC who do have the security clearance that you do not have, who do have visibility on all of the things that you are not able to see. The ISC says that they are happy with that operational case. It seems to me that the more people know about this, the more comfortable they are with that operational case. I wonder whether you are questioning their judgment or simply saying that you disagree.
Eric King: No. It is certainly true that the more you see about some aspects of agency practice, you do get more reassured. Certainly, in the process of Investigatory Powers Tribunal cases that have taken place, I was pleased that there were areas that had safeguards when I did not originally think there were.
I have also been fantastically disappointed in other areas, where I thought there should have been very obvious safeguards, such as areas of legal professional privilege that were found wanting and unlawful by the IPT. I am afraid I have become a terrible judge on which bits I think the agencies have got right and which bits they have got wrong. I seem to be very poorly predicting it. On the operational case, I think the issue here is that we need a whole range of experts outside the ISC to be looking at this. I am not sure that it is the perfectly placed organisation or body to be looking at this. It has known about these powers and approved of them right the way through. I think that at this time, now that they are being put before Parliament plainly for the very first time, we should be looking to do what they have done in the US, which is to have an independent scrutiny of many of those cases, so that you can test them.
It is not enough simply to provide a list of cases where this worked. They need to be really looked at, because, as we found in the US, some powers that many thought would work, like the bulk acquisition of communications data, turned out not to be terribly effective. The 64 cases that the agencies in the US put forward, to say that these were powers that were needed, turned out to be false. Only one was of relevance, and it was not a terrorism case. So it is vitally important that we scrutinise them and have the time to do so.
Lucy Frazer
Q I would like to pick up on something that you said in your evidence was about internet connection records. I would just like to ask you first of all, do you respect the work of David Anderson?
Sara Ogilvie: Absolutely.
Lucy Frazer
Q Have you had the opportunity to read his report?
Sara Ogilvie: I have.
Lucy Frazer
Q Are you familiar with paragraph 7.51 where he talks about Operation Notarise?
Sara Ogilvie: You will have to tell me what it says.
Lucy Frazer
Q Are you familiar with Operation Notarise?
Sara Ogilvie: I am not sure that—
Lucy Frazer
Q In that operation 600 suspected paedophiles were arrested, and 92% of the communications data requested proved helpful in tracking down suspects. That what he says in the report. Do you accept therefore that he has found evidence that the ICRs are helpful?
Sara Ogilvie: Those were not evidence for ICRs, as far as I am aware. I think that is to do with different communications data.
Lucy Frazer
Q I am just reading from the report, and that is what it says. It gives the figure of 92% of communications data and says the questions provided were helpful.
Sara Ogilvie: Communications data are quite different from internet connection records. A significant amount of the powers that we have in the current Bill are ones that are replicating powers in RIPA, and I think the comms data ones you talk about are those. Internet connection records are actually something quite new, and something that David Anderson—
Lucy Frazer
Q Do you accept that, if some communications data in an old form of technology is helpful, then in a modern form of technology exactly the same powers will also be useful?
Sara Ogilvie: I agree that there are powers that are absolutely necessary and helpful. I do not think that there is a direct comparator between old and new powers in this case. I completely agree that the security services and law enforcement need targeted powers to gather communications data, so maybe they can use those to target particular websites where we know that paedophile information is provided. They can be used to target suspected criminals. That is all completely adequate use of powers; but what we have is this broad power in the Bill that targets absolutely everyone and is not focused on those individuals, and that is what I have the problem with.
Byron Davies
Q Mr King, you have mentioned a couple of times now, in the first part of your evidence, you talked about formidable intrusive powers. You quite agree that the agencies should have these powers. So in view of what has happened recently in Paris and in Brussels, I am really somewhat confused as to what you are trying to tell us in your evidence as to what the agencies should have. Do you know? Are you clear in your own mind what these powers should be?
Eric King: Yes. The Bill’s structure—some of the core powers there—you do not disagree with. The question is often about the scale of the powers—how they are used and the safeguards that are put in place around them. To my mind, the mass collection of material in a generalised form for analysis is not a proportionate activity, and I think this is something that particularly the European Court are confirming. I heard David Anderson say that there was a split view on that. It will be important to hear the judgments later this year, but they have to have very strong powers; but it is how they are used, and the scale of them, and the targets of them, which are so vital to get right. I am afraid that for me this is the bit in the Bill that is not in the right place at the moment, I suppose.
Byron Davies
Q But criminals and terrorists would not regard it in that respect.
Eric King: They would not—
Byron Davies
Q They would not see it the way you see it, obviously.
Eric King: I do not know what criminals and terrorists would think about this Bill.
The Chair
If there are no further questions for Members, I thank the witnesses for their evidence, and we will move on to the next panel.
Joanna Cherry
On a point of order, Ms Dorries. In any forum that I have appeared in where the witness is being asked a question about a document, particularly a lengthy document, it is customary to afford them the courtesy of having a copy of the document in front of them. Might I suggest that if we are going to ask further witnesses about documents, we afford them that dignity?
Simon Hoare
Further to that point of order, Ms Dorries. To put the contra view to that expressed by the hon. and learned Lady, should not the Committee expect witnesses who are giving evidence to be properly briefed and to have in front of them documents on which they are likely to be cross-examined?
The Chair
I shall answer the substantive point of order. The information that the witnesses bring with them is their responsibility. It is not the normal procedure for them to have documentation in front of them or for the panel to know what information they have with them. As we decided at the start, they can always follow up in writing if they feel they did not have the right information.
Joanna Cherry
I am very grateful to you, Ms Dorries, for clarifying that questions and answers can be followed up in writing.
Examination of witnesses
Nigel Inkster and Lord Evans gave evidence.
The Chair
Q We will now hear evidence from the International Institute for Strategic Studies and Lord Evans of Weardale. For this session we have until 1 pm. Will the witnesses please introduce themselves for the record?
Nigel Inkster: Good afternoon. I am the director for future conflict and cyber-security at the International Institute for Strategic Studies. I retired from the Secret Intelligence Service at the end of 2006 as the assistant chief and director of operations.
Lord Evans: I am a former director general of the Security Service, MI5, between 2007 and 2013. I was also a member of the Royal United Services Institute independent panel on surveillance. By way of context, I have not had as much time to prepare as I might have done as a result of the fact that I was formally invited to attend only yesterday. I apologise if there are any gaps in my knowledge.
Keir Starmer
Q Lord Evans, I think this one is for you. The bulk powers in the Bill are used differently by different agencies. Some are relied on by the security and intelligence agencies more than others. There is a notion that the bulk powers operate in the sense that there is a power to acquire or hold a great deal of data and then, at some later stage, there is targeted access on a different threshold, and that those are different safeguards. The reality is that quite a lot happens between those two stages, whether one calls it analytics or anything else. Can you tell us from your experience what happens in practice in that middle bit between first hold and later access?
Lord Evans: This is not a real example, but it might exemplify how one might use the power, certainly from a counter-terrorism point of view and from MI5’s point of view. If you look at the current situation, we are obviously very concerned about what has happened in Belgium and we are very concerned that there might be other IS active units in the UK. We do not want any of them to attack here, but we may not know who they are. In a sense, we are therefore trying to find individuals who might be members of IS and who might threaten us, but we do not necessarily have much information about who they are in specific terms.
For instance, although this is not a real example, using bulk access you might say, “Let’s have a look at all individuals from the UK who are known to have travelled into or out of the middle east and the area around Syria over the past six months. Let’s look at everybody who has a mobile telephone and has been in Syria or northern Iraq, and it’s pinged so we know that there is a telephone in that area.” We might say, “Let’s look for data on individuals who have been in Molenbeek,” because it looks as though quite a lot of the problems have emerged from that particular part of Brussels.
Put all those elements of data together and you will end up with perhaps a few dozen, some scores or one or two hundred individuals or, at least, telephones or something that might be relevant. You might then say, “Let’s take all those phones and see which of those telephones has been in first or second-order contact with known extremists.” Either they have been in touch directly with someone known to be a violent extremist, or they have been in touch with somebody who in turn is in touch with violent extremists. That might refine it down from 150 to half a dozen. Then you might start to think, “Actually, there’s quite a high likelihood, although one cannot be certain, that these half a dozen might be people of security interest in their own right.”
At that point, having gone through those various layers of putting different sorts of data together, comparing, contrasting and seeing what comes out, you might say, “Perhaps for those half a dozen, some more targeted form of surveillance is justified, so we can see who they are.” Once you have done that, if you get the appropriate authorisations, you might then find that some of them are self-evidently not, because they are BBC journalists who have been following the story or similar, so you can put them aside. But you might find that you have one or two who look as though they might be IS activists who have been in touch with the relevant people, so you put some resource into establishing what they are doing and who they are associating with.
That sort of process is very much the way in which MI5 has used these sorts of capability over the last 10 years or so, and it has been an absolutely central part of how we have identified individuals who have been involved in terrorist planning. That is then fed through into more intensive investigations, enabling us with the police to prevent attacks from taking place.
Keir Starmer
Q In a sense, what you have described is a stripping away of the bits you do not want to look at so that you can focus on the bits you do want to look at, in the particular context that you gave.
Lord Evans: Correct.
Keir Starmer
Q Is there any general analysis done to data in order to assist that? All data must be put through a level of analysis to make it easier to carry out the sort of exercise you have just described.
Lord Evans: I cannot think that there is that sort of general analysis. You could imagine starting from lots and lots of data and trying to work your way through a general process to identifying unknown terrorists. That is something that books and so on have talked about, and we have looked at it, but in general, in a non-specific sense, trying to identify patterns that in themselves indicate that somebody is a national security threat is very difficult, because you will have so many false positives. It tends to be used to answer specific operational questions rather than a wholesale review of data ab initio, because if you do that, the chances of finding somebody that you are really concerned about are very low.
In terms of operational reality, the problem for MI5—it certainly was during my time as director general, and I suspect it is still the case—is not finding people with no known connections who have ill intentions; it is finding out more about people who are already associated in some way with violent extremism. It tends to be in support of particular operational requirements and particular investigations, rather than a much more generalised process.
Keir Starmer
Q Can I turn briefly to equipment interference bulk powers? I do not think you were here when David Anderson gave his evidence—this may apply to you as well, Mr Inkster—but he raised a concern about the breadth of those powers. In particular, I think he said that what is called targeted is in fact so wide that it does not really fit with the notion of targeting. That chimes with the suggestion that it is very difficult to define necessity and proportionality in relation to those particular bulk powers. Can you assist the Committee with why, with those bulk powers, there is that problem of definition that David Anderson is concerned about?
Nigel Inkster: I will do my best to assist the Committee, but I should emphasise that I do not have a signals intelligence background and we are talking about capabilities that were in their infancy when I was still part of the intelligence community, so I am looking at this more from an academic perspective and with no privileged access—I no longer have any security clearances.
The issue is that the technologies are evolving so fast and in so many different directions that it can be very difficult to start from a clear perspective of what represents a proportional approach in certain cases. It seems to me that, in this particular set of circumstances, we have to make some allowance for a degree of trial and error—to see whether certain things actually deliver the kind of outcomes that were hoped for, but to be ready to cease using them and move elsewhere if they do not deliver the sort of results that would justify the kind of level of intrusion that we are talking about.
It is very context-specific. For example, if you are looking to try to thwart the attempts by a particular regime to illicitly acquire nuclear weapons capability, your target set defines itself relatively more easily than in certain other cases—transnational terrorism would be one of those where it is much more difficult.
Keir Starmer
Q I have one final question for either or both of you. Am I right in thinking that, as far as internet connection records are concerned, although the security and intelligence services would not say, “There are no circumstances in which we’d really need them,” in reality, they are relied on much less by the security and intelligence agencies than by law enforcement, as a separate component?
Lord Evans: It is not impossible that they could be of value in an intelligence sense, but I think the principal driver for using them or for obtaining them is for evidential purposes, and that is made clear publicly. It is principally a law enforcement and evidential issue to inform cases coming before the courts more often than it is an intelligence issue. You could construct a scenario in which it might be of value, but the purpose of putting them in the Bill, as I understand it, is law enforcement and providing criminal evidence.
Joanna Cherry
Q Lord Evans, I want to ask you about the savage murder of Fusilier Lee Rigby and the Intelligence and Security Committee investigation into that. It reported to Parliament that his killers had previously come to the attention of the Security Service on multiple occasions and that, in its view, intelligence reports were mishandled. I think I am right in saying that its inquiry suggested that, if the Security Service had more resources to cover more and lower-priority level targets, the outcome could or would have been different. Would you like to comment on that?
Lord Evans: The Lee Rigby murder took place after my time as director general—not that there is any connection between those two—so I am not very close to the actual facts. In general, one of the critical decisions—certainly for MI5, but it applies by logic to other people on counter-terrorism—is what you do not do. We have more leads which might connect to possible terrorist attack or to violent extremism than we can thoroughly investigate at any one time, so the service has created a quite rigorous triage process that ranks the seriousness of the available information, which is updated on a regular basis, and that drives therefore the allocation of resources.
The difficulty here is self-evident: obviously, sometimes you are working on the basis of fragmentary intelligence or unclear intelligence, so you have to make the judgment as to whether you put resources in to pursuing that or whether you put the resources in to something else. The fact is that sometimes you make a judgment on the available best evidence and then find out later that, actually, the situation was more serious than was apparent. That appears to have been the case with Lee Rigby.
Exactly the same issue came out after the 7 July bombings in London. Mohammad Sidique Khan had appeared in the context of Security Service investigations and police investigations a couple of years before. At that stage, he was assessed to be not a very serious threat and therefore he was put aside so that we could come back to him later while we did other things that were more immediately pressing, but in the interim his activities developed.
It is a problem. The question of course is: how do you get around that problem? The first thing is to use the best quality information available. The second is that the more resources you have, the more yesses you can give as to whether we investigate any one individual, but then you get into a judgment about how many people we think it is proportionate and necessary to investigate. If you doubled the resources of the Security Service again, there would still be cases where you might say, “We don’t have the resources to pursue that.” You ultimately get into a political judgment as to how much resource you want put into this and how much intrusion you have into the activities of people who might not be quite as threatening as others. That is a judgment that has to be made.
Joanna Cherry
Q If the Government had given you more resources for more boots on the ground, would it have been possible for the security services perhaps to have had targeted surveillance on lower priority targets prior to this particular dreadful murder?
Lord Evans: There is no doubt that to some extent intelligence activity in counter-terrorism is scalable. What has happened since 9/11 is that the resources available to the Security Service and the other agencies have increased very considerably under both Governments—or all three Governments, if you want to put it in those terms. We have therefore probably got within the Security Service three or four times as much resource as we had previously.
There has been a very considerable uplift, but it is not just a question of people. Importantly, it is also a question of powers. Your capability to cover and monitor threats is not very often, although it sometimes is, a matter of boots on the ground; it is a matter of the overall toolbox available. One of the attractions of digital intelligence and the sort of powers that are outlined in the Bill is that it enables considerable coverage of threats without having to deploy lots and lots of people following people around and so on, which in some ways would be more intrusive.
Victoria Atkins
Q We talk about the security services and the other agencies as block organisations, but of course the quality and effectiveness of an organisation depend on the people who make up that organisation. Could you give us, as far as you are able, an assessment of the qualities and character of the people who work for the agencies that you have led?
Nigel Inkster: In the United Kingdom, we like to maintain the position that intelligence and security work is a high-status profession. We look for quality people who might otherwise go into areas such as the law, merchant banking and that sort of thing. That is the level that we are pitching for, and that is not always the case around the world. In that regard, the United Kingdom distinguishes itself in the right way, in my view. We have very well educated and well motivated people. In my service, for example, we had people joining us in the wake of 9/11 who had taken very significant salary cuts and left high-paid jobs in the City to come and do this work precisely because they were motivated by and committed for what we regarded as the right reasons.
During my time in SIS, I was responsible inter alia for compliance with all the different oversight mechanisms to which we were subject. I had extremely long conversations with the various commissioners responsible for overseeing those activities. In all cases, their judgment was that the people we employed were highly motivated, took their responsibilities seriously and understood the powers that they had, the need to act lawfully and the need to use those powers in a wise, measured and proportionate manner. I think we are very fortunate as a country.
Lord Evans: I would agree with that. I think we have employed people who are intellectually able, are motivated by public service and are ethically sensitive. It might be useful to the Committee to invite the Clerk to find comments made by Lord Brown of Eaton-under-Heywood, a former Supreme Court judge and former intelligence commissioner, when the 2015 Counter-Terrorism and Security Bill was being discussed in the House of Lords. He gave a very, very strong endorsement of his experience of the quality and integrity of the members of the intelligence services that he had seen. If you want an independent voice, rather than a voice from inside the agencies, that might be worth finding.
Victoria Atkins
Q In the nightmare scenario that there was a wrong ’un in the agencies, how would they be able to find that person and prevent them from misusing their powers?
Lord Evans: It is inevitably the case that you cannot ensure that everybody in the service is brilliant and saintly, because it’s human nature. As a result, we maintain a strong, continuing vetting procedure. Your vetting is reviewed on a regular basis and it is built into the way we do our appraisal to raise security-related issues. Also, particularly in the management of access to sensitive information, there are arrangements to ensure independent oversight of what is being done on the systems that the service has in place. In the same way that, if you were running a trading system in a bank or something, you would monitor the activities of the traders to try to identify improper activity, something similar is applied to the systems operating within the intelligence services. We rely on good recruitment and on continuing security vetting, but we also have some wired-in ways of trying to identify misuse of official resources for personal use or whatever.
Peter Kyle
Q I would like to turn your attention from the efficacy and professionalism of your staff to that of the politicians you have had to deal with over the years. You have had to have relationships with several different Home Secretaries in your time. Have you always been able to get the time and attention you need from each of them at the moment at which you need it?
Lord Evans: I served under four Home Secretaries from both the Labour party and the Conservative party. I saw the Home Secretary without fail once a week, and quite often twice a week. All of them took a great interest in the work that the service was doing and its operations, and were regularly briefed. From that point of view, I think we were given very good airtime. In addition to that, there is the question of the time to look at warrants. They were not presented by the director general but were processed and nominally presented by the Home Secretary’s officials, so on top of that there was a lot of time spent by Home Secretaries on warrants. I can say, without going into great detail, that they did not all go through with a tick. Occasionally, warrants would come back and they would say, “Actually, the Home Secretary doesn’t want to sign this.”
Peter Kyle
Q You have answered my second question, which does great service to your profession. Does the same stand for you, Mr Inkster?
Nigel Inkster: Yes. Obviously, our service’s interaction was more with the Foreign Secretary, but our experience is comparable. I cannot think of a single case of a Foreign Secretary who did not take a serious and sustained interest in this area of work. I cannot think of a Foreign Secretary who did not take a serious and sustained interest in the kind of warrants and submissions that they were asked to approve. My experience, like Jonathan’s, is that these did not go through on the nod. There was lot of self-policing in the system, because we knew that a weak case would not stand. There was no point in putting it forward, because its fate would be clear, so one did not do that. The only other thing I would add is that my experience has been that, without fail, the senior politicians involved in this business owned the decisions that they took, stood by them and did not, as they well could have done in many cases, try to fend them off on to somebody else.
Peter Kyle
Q My final quick question is: is there much difference in the behaviour towards issuing warrants between Home Secretaries, or do you find it a consistent experience?
Lord Evans: Broadly speaking, all the Home Secretaries took a similar view on this. I have never come across a Home Secretary who was pro-terrorism, obviously. I suppose, in practice, what happened early on in the time of a Home Secretary being in post was that you tended to get more questions, which is entirely as you would expect. If a new Home Secretary came in, quite often they would say, “I don’t understand that. Bring me somebody to explain it.” So they are doing their job. Of course, that is an iterative process because if you understand that a Home Secretary has particular concerns about area x, you will put a little bit more effort into explaining it and making the case. You would tailor it to some extent to the particular concerns of any particular Home Secretary, but the overall threshold employed was roughly the same.
I would say one other thing. I do not want to name names for this purpose but I can remember at least on one occasion briefing a new Home Secretary on something we were doing that was really quite intrusive, although it was lawful. I said, “I need to tell you about this.” Their initial reaction was, “That’s fine,” and I said, “No it isn’t. You need to think about this. You cannot just say ‘This is fine.’ You need to be aware that this is potentially quite audacious. May I suggest that you look at this in a little more detail rather than go with something off the top of your head?” We did try to ensure that Ministers really were internalising this. We were not just trying to get it past them without them thinking about it, not least because if something then comes up, you do not want to be in a position where the Home Secretary says, “You never told me this could get me into trouble.”
Mr Hayes
Q On Second Reading, Mr Starmer said that you do not know that someone is a suspect until they are a suspect and that at that point you need to know who they are speaking to. The filtering process that you described in your earlier remarks is about taking very large amounts of data and, through that filter, in the end dealing with very small amounts. We have heard a lot of concerns and paranoia about bulk powers. Would it be fair to say that that filtering process is as much about excluding people as it is about including them?
Lord Evans: It is essentially about that. The purpose of the whole machinery is to put the surveillance on people who are actually a direct threat to our national security. You do not want anybody else in the system. You need to get everybody else out of the way as early as possible; otherwise you will get distracted by things that are a waste of resources. That puts you in a very vulnerable position, of course, because something will go wrong. Yes, you are quite right that we are trying to clear away all the things that are not relevant so that you can focus down on to what is relevant.
Mr Hayes
Q Another of Mr Starmer’s arguments was on equipment interference. Does equipment interference become more important as, for example, encryption makes other means by which you would get to the same destination more difficult?
Lord Evans: I am not a siginter so I would find that slightly difficult to know. The fact that we have a multiplicity of devices that any individual will be operating on at any one time means that selecting out those that are really significant becomes a more and more important process. That is certainly the case and I suspect that is part of that bulk process. Because these are overseas powers, this is fundamentally a sigint issue. Therefore I do not feel fully able to answer your question.
Keir Starmer
Q I have just a short supplementary question on bulk datasets. There is a great sensitivity about some datasets. People might not mind if their flight details are kept, but they do mind a great deal if, for example, their mental health records are collected. If there was some extra provision in the Bill for sensitive or highly sensitive data, would that cause you any concern, assuming that in any given case you can get over the threshold?
Lord Evans: Our internal processes when we were going down this path did take these issues into consideration. As you say, health records are extremely sensitive, so you would need an extraordinarily high level of justification. If you wanted to externalise that into the process—I have not talked to anybody about this so this is my feeling on it—then as long as you are really talking about very, very intrusive datasets, I would not have thought that having an additional safeguard would be a showstopper.
Keir Starmer
Q So if it was to externalise what was internal practice, which is obviously based on experience, that would not be a showstopper.
Lord Evans: I would not have thought it was a showstopper. You are going to hit definitional issues. It is a bit like journalists and politicians kind of stuff.
The Chair
I am afraid that brings us to the end of the time allotted for the Committee to ask questions. On behalf of the Committee, I thank our witnesses for their evidence.
Investigatory Powers Bill (Second sitting)
(8 years, 1 month ago)
Public Bill CommitteesRead Full debate Read Hansard Text Read Debate Ministerial Extracts
The Chair
Q77 Welcome to the afternoon session. We will now hear oral evidence from the National Society for the Prevention of Cruelty to Children and Mr Ray McClure. We have half an hour for this session. Could the witnesses briefly introduce themselves?
Alan Wardle: I am Alan Wardle. I am head of policy and public affairs at the NSPCC.
Ray McClure: I am Ray McClure. I am the uncle of Lee Rigby, the fusilier who was brutally murdered on the streets of London. I am the eldest brother of his father.
Peter Kyle (Hove) (Lab)
Q Thank you both for appearing today; it is good to see you.
Mr McClure, could I start with you? We have been talking about the prevention of terrorism to date, but from your perspective this is about crime prevention. Perhaps you could say a few words about that and the measures in the Bill that would benefit crime prevention from your perspective.
Ray McClure: The forces of law and order and security need information in order to prevent crime. Surveillance is a necessary part of crime prevention. You go down the high street or go into shops and you are on CCTV cameras all the time. That is surveillance. The public know what it is for: to prevent crime and to gather information in order to prosecute those who are guilty of committing crime.
This whole thing to date is also about making sure that the forces of law and order—the police and the security forces—have the means of gathering the information that they need in order to prevent crime, be it on the internet or terrorism, as well as being able to gather the evidence in order to prosecute people who are guilty of crime.
Modern society works by having rules that are understood and agreed, and by having those rules policed and enforced. Without those rules and laws in place, we are living in anarchy.
Peter Kyle
Q Thank you. Mr Wardle, do you want to give the NSPCC’s position?
Alan Wardle: I am happy to. As you would expect, our interest is less to do with the counter-terrorism aspects and more to do with the investigation and prosecution of specific crimes against children. We know, and the Committee will know as well, that the police’s ability to investigate and prosecute some of the high-profile crimes we have seen in recent years—online grooming of children and the number of people who are viewing illegal images of children online, which has grown exponentially— is increasingly dependent on communications data. I think it is vital that this Bill ensures that the police have the powers and capabilities to continue to do that.
Peter Kyle
Q So from your perspective—and this is from reading the evidence from the NSPCC—this is not just about collecting data; it is about sharing data and intelligence in a joined-up way between the services. Is that correct?
Alan Wardle: It is about collecting data so that, as and when the police need to investigate, there is a dataset that they can specifically and forensically look into to investigate. So data sharing is part of it, but not all of it. Say a child is being groomed online and you are trying to establish where that child was met by someone who has groomed them. Did they actually meet in real life for contact abuse? In the case of a child being trafficked across the country, was a hotel booked? Was a car booked? It is about being able to piece that information together. So traditional policing methods—being able to use the internet and the data that are available from people’s online activities to identify people and prosecute them—is the main concern, but the sharing of data, where relevant, is also relevant.
Peter Kyle
Q We have seen delays of sometimes 12 months in gathering and processing evidence, insufficient training in the collection of digital evidence—all things you have cited in your evidence—and a lack of awareness of the legal processes to access communications data. Bearing those things in mind, the new powers, even if we had them, could not really be used effectively unless there was the right training in the first place.
Alan Wardle: Absolutely. This is not a silver bullet; it is another tool that the police need in their armoury to help them deal with these kinds of crimes. Equally important is that local police forces particularly have the forensic capability to analyse a mobile phone or computer, and the technical tools and skilled officers to be able to do that.
Being able to access the data is one part of it, but not all of it. The kind of tools that we see at the National Crime Agency and the Child Exploitation and Online Protection Centre are very helpful, but the issue is the extent to which that expertise and those technical tools are disseminated throughout the entire police force across the UK. I would argue that communications data was only ever going to be part of the answer—an important part, obviously.
The Chair
We clearly have two excellent witnesses here, and I am sure that many colleagues will want to ask questions. Who is trying to catch my eye? Would Mr Matheson like to ask a question?
Christian Matheson (City of Chester) (Lab)
Q I remind the Committee that Mr McClure is known to me, as he is my constituent.
Good afternoon, Mr McClure. The case of your nephew obviously involved a criminal offence and was clearly terrorist-related. There have been suggestions, and we have heard evidence as a Committee, that the failure was not necessarily one of electronic intelligence, but of human intelligence and a lack of resources, because the security services were already aware of the then suspects—the people convicted of your nephew’s murder. How do you react to that?
Ray McClure: It is a bit of both, to be honest. The report by the Government into Lee’s murder, “Report on the intelligence relating to the murder of Fusilier Lee Rigby”, highlighted failings in the intelligence services and their processes. I do not know personally whether the recommendations have all been implemented, but I have got to assume that they have been, because they were taken very seriously.
Also, the report highlighted other major failings. The ones that caused me the greatest concern were those where the warrants issued by the UK Government were not complied with by American internet companies. [Interruption.] Sorry, I am going to pick up my notes. The report made it absolutely clear that the attack by the two murderers of Lee was planned on the internet; they made contact with people on the internet. Yes, opportunities were missed, but internet service providers failed to review any suspicious contacts and they did not obey UK warrants—they went out of their way to obstruct UK warrant providers.
Paragraph 401 says
“some overseas CSPs do not comply with UK RIPA warrants, as they do not consider themselves bound by UK legislation.”
That is a failure not of the security services, but of those other people—the internet service providers. Paragraph 457 says:
“The number of different forms of communication now available presents the Agencies with significant challenges in terms of their ability to detect and prevent terrorist threats”.
If the internet companies are not co-operating with the intelligence services, there is a big hole there—a big gap that needs to be plugged.
“CSPs based in the US have, for the most part, refused to recognise UK legislation requiring them to provide the content of communications on their networks: they do not consider themselves to be bound by the legal obligations set out in RIPA”—
warrants, etc.
To me, this is a big hole—a big issue. Being somebody from an IT background, I was horrified at some of the stuff I was reading. These companies—Apple, Facebook, Google, Microsoft, Twitter, etc.—are companies that we grew to respect, but the actions that they are undertaking now in not supporting the security and intelligence services, the forces of law and order, to prevent crimes like what happened to Lee, leave a big hole that has to be plugged.
Christian Matheson
Q You talk about the lack of co-operation from some of these large corporations based outside the UK. When considering your own investigations and inquiries surrounding the murder of your nephew, have you seen any evidence that that is quite a common trait?
Ray McClure: That is a good question. Yes, I have. I can give two very clear examples. One example is Microsoft, which has been fighting a warrant issued by the US Government to gain access to a drug dealer’s emails. It claims that, because the emails are not held on US territory, the US Government cannot have access to them. The emails are actually held in the cloud, and their physical location is in Ireland. Microsoft claims that the emails are a customer’s personal documents and that, because they are outside the US’s jurisdiction, the US Government and US law-enforcement agencies cannot access them.
That raises a big question mark. Today, when you send an email, you do not know where the physical data will be held—it is held somewhere in the cloud, but you do not know where. That creates a problem for all security and law-enforcement forces. Where does the jurisdiction lie for gaining access to that data? It is a black hole. It is wrong. Microsoft’s actions are protecting the drug dealer, not helping law enforcement.
The biggest concern right now—it is a very hot topic—is Apple’s stance over the San Bernardino terrorist. He killed 14 people, yet Apple refuses to co-operate with the FBI and allow it to access the data on his iPhone, which might help the police identify his accomplices. That is protecting terrorists, not helping law and order. Quite frankly, I am at a loss as to why the IT companies are so opposed and why they are fighting law and order as they are doing. It is wrong.
Christian Matheson
Q Looking at the specific provisions in the Bill, as far as you have been able to check them, are you satisfied that your concerns have been addressed, or was there something else that you were specifically looking for?
Ray McClure: I do not believe that this Bill is adding new powers to the police and the security forces; I think that it is clarifying the existing powers and bringing them together. It makes it a lot clearer where responsibility lies in obtaining warrants and what the powers are. I think that bringing that clarity is a major step forward. Yes, I am happy, and I urge you all to support the Bill. My only concern—it is a personal concern—is that, frankly, I would prefer warrants to be authorised by the judiciary, not by politicians, such as the Home Secretary, but that is my personal opinion; it is down to you guys to make the laws.
Can I make one other point about Apple and Microsoft? These companies are building solutions that we use every day. Let us be honest: these phones that we use today are brilliant, with the address book and everything else. But to make that a no-go area for law enforcement is wrong. There should be no such thing as a no-go area for law enforcement. If you cannot enforce the law, you have a situation in which you are protecting evil, and when you protect evil, evil will thrive, and that is wrong.
The Chair
Thank you, Mr McClure. We have so many colleagues who want to ask you questions.
Ray McClure: Sorry, Sir.
The Solicitor General (Robert Buckland)
Q Thank you, Mr Walker; it is a pleasure to serve under your chairmanship. Mr McClure, you have made some powerful points, so thank you very much indeed for giving your perspective on the IT, and as a bereaved relative. We all share your grief and anger about the atrocity.
Mr Wardle, I want to ask you about internet connection records, the new potential powers within the Bill and the purposes for which those records could be retained by an internet service provider. We know now that, as a result of the Joint Committee’s recommendations, there are four purposes for which those records could be retained for potential examination by the authorities. I think that they are very clearly set out: for the purposes of identifying who sent a communication; to establish what services either a suspect or a potential victim has been using; to establish whether or not a known suspect has been indulging in online criminality; and finally—the additional one—to identify services that a suspect has accessed, which could assist an investigation. If there was a narrowing of those purposes, what effect do you think that would have upon the authorities’ ability to investigate child abuse and related offences?
Alan Wardle: As I understand it, the previous draft Bill had a narrowing in the fourth one, and I appeared before the Joint Committee before Christmas to argue against that narrowing. I cannot remember the exact wording, but it was essentially where illegal activity was happening.
Again, I go back to the example of the grooming case I mentioned earlier. Grooming, by its very definition, takes place over a period of time. There are certain activities that you would want to investigate that are perfectly legal. Say a child has been trafficked across the country. Someone has hired a car, taken it from A to B and dropped it off, and they have gone on to the Travelodge website to book a hotel room. All of those are perfectly legitimate activities, but those activities—as part of a wider investigation—would be able to show the police that that person trafficked that child from A to B and that those activities took place. Clearly more would be needed, but the narrowing that was there before would, we believe, have unduly restricted the police’s ability to investigate those kind of crimes.
Joanna Cherry (Edinburgh South West) (SNP)
Q May I ask you some questions about internet connection records? Can you confirm that you have read the operational case for internet connection records referring to the case of Amy?
Alan Wardle: I do not think I have read that.
Joanna Cherry
Q Would you agree with me that if a child goes missing, the first thing you want to do is to find out what social media or chat sites the child has been on?
Alan Wardle: Whether that is the first thing you want to do, it is certainly—
Joanna Cherry
It would be a priority.
Alan Wardle: That would be something that the police would want to investigate pretty quickly.
Joanna Cherry
Q Is not the easiest way to do that to ask their friends?
Alan Wardle: It could well be, depending on what has happened. In an ideal world, the child would keep all the evidence themselves and it would all be freely available in terms of the content, but things are deleted and friends are asked to keep quiet and so on, so it is not always necessarily available. If the child has been groomed, they may have been taken by someone they think is their boyfriend, away from their dreadful parents—they are running away.
Joanna Cherry
Q Sometimes the child will take their phone with them and it will be switched off and be no use to us, but other times they will leave their phone behind and we can get into the phone and see which social media sites they have been on. Is that right?
Alan Wardle: I am not a police officer, but yes, I presume so.
Joanna Cherry
Q Equally, if there is a computer at home, the police can access the computer with the parents’ permission and see what social media sites the child has been on?
Alan Wardle: Yes, but three quarters of 12 to 15-year-olds have a mobile phone or tablet, so it is rarely the computer on the dining room table any more.
Joanna Cherry
Q If we assume that the computer and the phone are not available, you could go to friends or siblings and find out what social media the child commonly uses. If, for example, the child commonly uses Facebook, the friend will be able to tell you what the child’s username is.
Alan Wardle: Well, the child’s username would be their real name because Facebook has a real name policy.
Joanna Cherry
Q Indeed, and they will know what their friends’ names are. I do not really know how Bebo works, because I am too old, but if it is not a known name on Bebo, you are still able to get the username from the child’s friends.
Alan Wardle: I would imagine so, yes.
Joanna Cherry
Q Does it not really boil down to this: wherever you get the information from—whether it is mum or dad or, more likely, mates at school—you have to go to Bebo or Facebook and ask for their help?
Alan Wardle: The social media companies clearly have a huge part to play in this as well. We challenge them regularly on all aspects of how they keep children safe online. What is important when the police are investigating such crimes is that they have every tool available to them that can legitimately be made available. Some will be traditional policing methods, such as asking their friends and knocking on doors, and some may be much more technical aspects, such as internet connection records.
Joanna Cherry
Q But would you agree with me that what is important is to have effective tools?
Alan Wardle: Absolutely. One of the things we have challenged the internet companies on is that if those tools are available, they should be widely available. A good example is what is called PhotoDNA, which basically means that illegal images of children are hashed and can be removed across the internet. That is a really positive development. That technology was developed by Microsoft, but shared across all the big companies, which is a really positive thing.
We know that there are other technologies—anti-grooming technologies, for instance—that have been created, but have not been shared in that way. I think that there is an obligation on the companies—your Apples, your Facebooks and your Microsofts—to ensure that these kind of tools, with no real commercial gain to be made from them, should be freely available across the industry.
Joanna Cherry
Q If we just go back to the example that I was pursuing, about the missing child, I think you agreed with me that it is important to have effective tools. Is it your understanding that all the internet connection record will tell you is what the missing child connected to? It will not tell you what the missing child did once they were connected.
Alan Wardle: No. That is the issue to do with content. Again, it could well be that that is part of a wider picture.
Joanna Cherry
Q An internet connection record will only tell you to which service the child was connected, not whom they spoke with, nor what the content of their speaking was—
Alan Wardle: Not necessarily.
Joanna Cherry
Q Whereas, if you go to the child’s friend and get the child’s username on the social media site, you will be able to get that information as to content.
Ray McClure: You would still need the child’s password to access the data.
Alan Wardle: That is not enough in and of itself. Yes, do you have the password? How would you get into it?
Suella Fernandes (Fareham) (Con)
Q There has been a description of Tor as a facility that allows digital abuse of anonymous online activism. It is linked to encrypted information. I want you to say a bit about what effect encryption has on some of the work that you are involved with?
Alan Wardle: A lot of the activity that we take for granted online—shopping, banking and all the rest of it—could not be done without encryption, but of course, as with all these tools, encryption can be used for bad purposes by bad people. Similarly, with services like Tor and Freenet—the dark web—in the cases that we are concerned with, you get your most highly committed and dangerous offenders, quite often, particularly sharing very explicit images or videos of children being abused. Those services enable them to hide there. The police do the best they can, but, again, for a lot of that they will be dependent on traditional undercover techniques.
I think there is a question that is—I say this respectfully —beyond this Committee’s remit and beyond many of our remits. The direction of travel generally is that we are seeing greater moves to encrypt data as a matter of course, with things like Google Chrome browsers and so on. With browsers such as that, internet service providers cannot put in place the kind of protections they have, so they do not know what is going on there. That is a direction of travel and something that is worrying. It is clearly a global issue, but the police not being able to track what is going on due to increasing levels of encryption is a worry.
Victoria Atkins (Louth and Horncastle) (Con)
Q Just to pick up on the point made by the hon. and learned Member for Edinburgh South West about the missing child, is it right that, sadly, the victims of sex grooming rings do not surround themselves with friends and parents, because one of the tools that the groomers use is to isolate the victims, so that they have no one they can turn to in their hour of need?
Alan Wardle: That can be true. They can even turn the child against their family and friends as well.
Victoria Atkins
Q So in those circumstances, as you have said, the police need every tool that they can get to help those very vulnerable young children.
Alan Wardle: Absolutely. Again, as I have said, the issue of grooming is often about a period of time and establishing patterns of behaviour. Being able to gather evidence from a range of sources is really important.
Lucy Frazer (South East Cambridgeshire) (Con)
Q Following on from that, in your work in the NSPCC, do you always see a willingness for children to open up and to tell people in a position of authority personal facts about themselves and their friends, or can it be quite difficult to coax out information about children who are friendly with the vulnerable?
Alan Wardle: It will depend. Generally, it takes quite a lot for a child to come forward and disclose. In recent years, we have seen a huge increase in the number of children who are reporting sexual abuse generally. It is going up across the UK, and was up by about a third last year. A large part of that is because of a greater willingness of children to come forward and talk about the abuse that has happened to them, but we know that it can take decades for people to come forward and talk about abuse.
What we are talking about, particularly sexual abuse, is a very personal thing, so the idea that a 15-year-old who is being groomed will just walk straight into a police station and start disclosing all these very personal things is generally not quite how it works.
Lucy Frazer
Q I was also thinking about the case of missing children. If we rely only on their friends and those friends are not willing to disclose personal details, names and the social media sites that their friend is on, do you think there might be a delay in an investigation?
Alan Wardle: There could be, and it depends on the facts of the case. I will return to the main point. As I said before, the police need a range of tools. They will need some very traditional knocking-on-door tools, and they may need a range of technical tools to help identify a child in that situation.
Lucy Frazer
Q So it is a combination of tools that will keep children most safe?
Alan Wardle: Yes.
Andrew Stephenson (Pendle) (Con)
Q I thought you made a compelling case in your evidence to the Joint Committee; I was not a member of that Committee, but I have watched it back on video. You made a compelling case for why timeliness is very important when a child is threatening to commit suicide—basically having to breach that child’s confidence to ensure that the police can intervene. The expression you used was about literally having to cut children down at times.
Could you say anything more to this Committee about that? Some members of this Committee sat on the Joint Committee, but others will not have heard that evidence. Could you say more about the need for rapid intervention to save children’s lives?
Alan Wardle: The NSPCC runs ChildLine, a service that people will know. About three quarters of children who contact us do so online, rather than through the traditional telephone service. We have a very high level of confidentiality, but in an average of 10 cases a day we have to breach a child’s confidence because their life is in imminent danger. In 60% of those cases the child is actively suicidal; on average there are six cases a day where we have to contact the emergency services to protect a child whose life is in immediate danger because they are suicidal.
On the capacity for the police to be able to find where that child is, if they are on a mobile phone, for instance, an IP address would not cut it. We have cases where children who have tried to kill themselves are literally saved because of the 24/7 service that we run, and the police’s ability to be able to rescue actively suicidal children in real time is very important.
Simon Hoare (North Dorset) (Con)
Q This question is to both of you. Is there anything that is not in the Bill that you would like to have seen, or maybe still see, in the Bill?
Ray McClure: It is not really relevant to the Bill in question, but you have to find some means of punishing companies that do not comply with warrants issued, and it has to be a heavy punishment. Right now, without having legally enforceable warrants, there is no law enforcement and no justice.
Alan Wardle: I do not think it is necessarily about what is not in the Bill, but I reiterate the point I made earlier: these internet connection records are only part of the solution. There is a whole range of things in terms of keeping children safe online, particularly on the capacity of the police to respond to that and to be able to have the right tools to investigate, prosecute and convict criminals. These tools are very important, but there is a much wider piece about how the police can use all the powers available to them to help keep children safe.
The Chair
That brings us to the end of this session. May I thank our witnesses, who gave extremely strong performances? I know that being a witness before a Committee is very nerve-wracking, but you both executed your role fantastically, so thank you very much indeed. It was very kind of you to come before us today.
Examination of Witness
Mark Hughes gave evidence.
The Chair
Q Good afternoon, Mr Hughes. Thank you for coming here before us today. For the record, I know Mr Hughes outside this place. I had no idea that I was going to be here this afternoon, but here I am and here you are. Would you like, for the benefit of my colleagues, to introduce yourself quickly? There will be lots of questions.
Simon Hoare
Just for the record, I also know Mr Hughes, though I cannot remember how—I am having a senior moment.
Mark Hughes: We will work it out afterwards. I am happy to get to know everyone else on the Committee. I am the CEO of BT security, and I have responsibility for all the matters that relate to the Investigatory Powers Bill in BT.
Keir Starmer (Holborn and St Pancras) (Lab)
Q We have a definition in the Bill, as I am sure you know, of an internet connection record. What is recorded by BT or any other service provider if I book a train ticket on my mobile phone? What comes up on your record?
Mark Hughes: I would like to answer that question looking more at the Bill itself, and then come back to your question. There are clearly quite specific provisions in the Bill on what we are there to collect.
Keir Starmer
Q We have a definition—I would have copied it to you, but you probably have it there—in clause 54(6). You probably know it backwards.
Mark Hughes: Some examples of what we are talking about—I am sorry to be technical, but it is important that I refer to some technical matters—are the customer line reference number, which we perhaps know in common parlance as the account number, and the source and destination host IP addresses. The port to and from it provides content that we have to collect. There are also mass data sets. The Bill is quite clear about what we are there to collect.
On your specific question about a service where you are booking a train journey, we retain various components of the types of data that I just spoke about. It would be things such as source and destination IP addresses and the handset you used, which you mentioned specifically. The IMEI, for example, is another piece of data that associates you to that handset.
Keir Starmer
Q If I went to the Trainline website, for example, although it would not come up as Trainline, could you work out that I had been using that website to book my ticket?
Mark Hughes: No, not at the moment. That is not how it currently works. As I understand it, there are four purposes of internet connection records in the Bill, which are to link an IP address to a person or apparatus; to identify the comms service a person is using; to identify where a person is accessing illegal material; and finally, to identify the internet services a person is using, which is pertinent to your question.
What the Bill proposes we are to collect—some of which, by the way, is drawn from data sets that we collect for normal business purposes—may be used to constitute an internet connection record, which would then satisfy those purposes. It is not something we currently retain. The Bill is clear about the ingredients of an internet connection record and its purpose. At the moment, we are still working out with the Home Office exactly how we would compile those pieces of information to create internet connection records and find out which website someone was visiting.
Keir Starmer
Q I am sure all that is right, but I am still not sure that I have an answer. If I book a ticket now on the Trainline website, would it come up on your record that I had done it?
Mark Hughes: It is not something that we currently collect and retain.
Keir Starmer
Q Not currently, but when the Bill is law.
Mark Hughes: Yes, the Bill quite clearly states the purpose about identifying the internet service that the person is using—
Keir Starmer
Q So it would come up?
Mark Hughes: One of the purposes is that we would then be under notice to retain and create that record, which we do not currently do at the moment.
Keir Starmer
Q So if the Bill becomes law and I then book a ticket on the Trainline website, you would record it?
Mark Hughes: Under the Bill, once we had been through the consultation process and notice was given, that would be one of the purposes.
Keir Starmer
Q Sorry—I probably should have said that I am not that interested in the process at the moment. I understand the process and of course all the proper processes would have to be followed. I am just interested in what you would get before the process starts.
May I try a different question? If I go through the tube using electronic means of payment, would that—if the Bill becomes law and assuming that all the processes are followed—show up on my record?
Mark Hughes: That would not be information that we had access to. It is not our information; you would have to ask TfL that.
Keir Starmer
Q What about a feature that I have on my phone called Onefootball? Unbeknown to everybody else, my phone asks for the football scores all the time. What would show up on my record if the Bill became law and assuming that all the processes were followed and all the rest of it?
Mark Hughes: Again, it depends. There is some technical detail underneath here in respect of how that particular service provided by that service provider, Onefootball, polls out and how it would use the services that underlie that—that is, the services that we provide. That would obviously then be subject to the process that would then end up with an internet connection record, if that were appropriate in that case. Or it might be that you would have to go to that service provider to gain information.
Keir Starmer
Q But if it were you, would it show that I had been asking for football results all afternoon?
Mark Hughes: If there was an internet connection record under the definition of the Bill, one of the purposes of which would be to identify which internet services you had been using, yes, we would then retain that and disclose it under the appropriate instrument.
Keir Starmer
Q And if I went to the website of The Guardian and clicked on “Brussels attack” and then clicked on “Another bomb”, what would be on your records—assuming that the Bill becomes law, that all the processes are complied with and that there is a proper purpose? I am making all those assumptions. I just want to know what would be on the record.
Mark Hughes: We have obviously been spending a lot of time in consultation with the Home Office. There are varying degrees of capability that the Home Office wants. There is a technical element to how far one goes in terms of the amount of data—there is a trade-off between the amount of data that you collect, retain and then disclose. As the Bill stands, that would also constitute an internet service that someone was using so that would be something on the Bill that we would retain.
Joanna Cherry
Q At the Joint Committee, Mr Hughes, you said that BT had never collected internet connection records before, that you would have to deploy new equipment to comply with the legislation and that that would come at a cost. That is correct, is it not?
Mark Hughes: That is correct, yes.
Joanna Cherry
Q I understand from your answers to Keir that you are still working with the Home Office to agree the precise specification of what an ICR is. Is that right?
Mark Hughes: That is right, yes.
Joanna Cherry
Q Are we to understand, then, that you have not as yet reached agreement with the Home Office about the specification of an ICR?
Mark Hughes: No. It is a work in progress. This is quite a truncated time frame, as you know. I characterise a lot of things that we are doing at the moment as “in parallel” as opposed to “in series”.
Where we are at the moment is that there has been extensive consultation with the Home Office around this. There are a number of different technical approaches to how you take those component parts that then constitute themselves as an internet connection record—for example, things like the rate of sampling that you use inside the networks. Of course, it depends on the type of service that we are talking about; there are technical differences between how those services and that information are then put together to create the internet connection record. That has a big difference in terms of the associated cost.
Joanna Cherry
Q That is what I want to come on to. The Home Office has mentioned a figure of £170 million. Can you give us any indication of how much of that money British Telecom would need to build a system?
Mark Hughes: There is a spectrum. If the Home Office wanted us to collect everything and carry out a very high rate of sampling, meaning that a lot of information would potentially be available, BT—and EE; we recently bought EE, as you may know—would take the lion’s share of that figure alone, just in terms of our services.
However, we are in very frequent dialogue. Only in the last couple of days, we have been talking to the Home Office about the technical challenges associated with the trade-off between how much it will cost and how much data will be available. Clearly, if there is a different view in terms of the amount of data required, the cost may well be appropriate for the rest of the industry. It is difficult for me to comment on other operators.
Joanna Cherry
Q We have covered potential costs of building the system. Can you give us a timescale?
Mark Hughes: Again, that is down to the detailed, technical implementation and testing to ensure that it would work properly. Some of the data sets that make up the ingredients of an internet connection record are something that we do retain for business purposes already—not necessarily for the length of time they are talking about—so depending again on the final technical solution we came at, and at what services it is targeted, it could take a few months and up to a year-plus to get a solution in place.
Joanna Cherry
Q When you say a year-plus, how much on top of a year?
Mark Hughes: Again, depending on exactly what it is that we agree on with the Home Office that it wants, I think it is reasonable to suggest that we would have a service in place in a year.
Joanna Cherry
Q Are you aware of what has happened in Denmark regarding the collection of internet connection records?
Mark Hughes: I am, yes.
Joanna Cherry
Q On 17 March, the Danish Minister of Justice informed the Danish Parliament that the plans for a new internet connection records scheme had been put on hold. The reason given for the policy change was the substantial cost of ICR collection—the economic burden would be too high for the Danish telecoms industry. Were you aware of that?
Mark Hughes: I am aware of that. Under the proposals in the Bill—the Home Secretary has made reference to it—we would recover our costs from the Home Office, as we have done under existing legislation. We would like to see clearly articulated on the face of the Bill that 100% of our costs are to be recovered. That is very different from the Denmark situation. In Denmark, that is not the case; the burden is placed on the telecoms operators.
It is difficult for me to comment precisely on the Danish telecom operators because I am not one of them, but specifically here, as far as the UK is concerned, the proposed regime is more sensible as long as it is clear that we will recover 100% of our costs. We think it is important that that is on the face of the Bill—not just for the reason we said about Denmark, but also because more broadly in itself it provides a proportionality check, so you would not spend a huge amount of money to achieve little effect. If it is clear how much the public purse will have to bear of that, we think that in itself creates a proportionality check in terms of what activity is proposed.
Joanna Cherry
Q Do you agree that we cannot compare what is proposed in the Bill with what was proposed in Denmark until you have got an agreed specification with the Home Office?
Mark Hughes: A pamphlet has been issued and we have been in discussion with the Home Office as recently as the last couple of days about this. More clarity is required, but broadly speaking there is a definition in the Bill, there are purposes in the Bill and we understand that there are options technically around it. We have been working that through with them, but yes we would like clarity as soon as we can.
The Minister for Security (Mr John Hayes)
Q Thank you, Mr Hughes, for coming, and thank you also for acknowledging the extent of the consultation with which you have been engaged with the Home Office. As a result of that, you will know that the codes of practice published at the time of the Bill reflect some of the arguments you have advanced previously and clarify some requirements.
Today you emphasised that as we move forward there will be ongoing discussion. How important do you therefore think it is to avoid rigidity by putting more on the face of the Bill rather than including that in codes of practice and in the ongoing discussions you described?
Mark Hughes: It is very important that we have words and definitions on the face of the Bill to deal with the really substantive points as far as this type of legislation is concerned—namely the level of intrusiveness, which is clearly where definitions help. A definition is only really a way of helping to establish the level of intrusiveness of the power that is being put in place.
There are needs to have something. One need, which I have said, is about ensuring that there is clarity around 100% cost recovery, for example. There is definitely a need for that and with 268 pages there is quite a lot in there. However, we also recognise that as technology changes—our world is an ever-changing one as we know, and that is the case specifically in our industry—there is need for flexibility of a discussion point around how consultation happens and how that manifests itself in a legal instrument for us to retain and disclose either content or other types of communication data.
It is a difficult balance to be had. I think there is a lot at the moment in the Bill that is very useful. There are purpose limitations, for example, which are very useful for us, as are, as I said already, the definitions.
The other point is that there does need to be flexibility in future about understanding how the new codes of practice will be formulated based on what was required, and the Bill is clear that the correct oversight is in place. That is a difference from the extant legislation. The consultation process is different from others there have been in the past, and we welcome that.
Mr Hayes
Q Presumably you also welcome the right to review a technical capability notice and the commitment that there will be further discussion with you before you are obliged to meet obligations.
Mark Hughes: Yes, indeed, and not only that, but there is now on the face of the Bill a right of appeal to the Home Secretary if a notice is issued to us and we disagree with it. That has not existed in the past. In the past, under other legislation, we have had occasion to make representation, but it is much clearer in this Bill than it has been in the past.
Christian Matheson
Q Under the terms of the Bill, you are being asked to collect a large amount of data, some of which will be quite personal and some private. How confident are you of BT’s capability in terms of maintaining the security of those data from hacking or theft, particularly bearing in mind the fact that other communications service providers have been hacked into? When you consider the rest of the industry more broadly—without naming names—do you think BT is in a stronger position than other CSPs to maintain security against hacking or theft where there might be vulnerabilities elsewhere?
Mark Hughes: The security of any data we hold and retain is clearly a matter that we take extremely seriously. That is of the utmost seriousness for our organisation for any type of data. The type of data that the Bill refers to specifically is, though, perhaps different from other types of data that need to be interfacing the public on a bigger scale, for example. This is not that type of data; it is going to be restricted and allowed to be viewed by only very few individuals who have the correct authority to be able to get to the data when they need to.
The level of security applied to this type of data is clearly factored into the type of data that is being retained, so we have to put very significant security measures around it to ensure that the access is controlled properly and that the data are very secure when stored. That absolutely has to be factored into the cost and the way we operate. It is not something new. We are currently subject to laws and regulations under which we have to make sensitive data available, so we are used to doing it, but that clearly has to be factor in for, for example, some of the new datasets we are potentially going to be asked to retain under the Bill.
Matt Warman (Boston and Skegness) (Con)
Q On the Joint Committee on the draft Bill and on the Science and Technology Committee, we heard CSPs talking about the level of engagement they have had from the Home Office, and we have heard from the Home Office that that has increased recently. That seems to tally with what you are saying. Could you give us a sense of the scale and extent of that engagement, and some reassurance that, in this fast-moving world, you are confident that the relationship is such that that engagement would be there in future as well, rather than it just being about getting the Bill to this stage?
Mark Hughes: We have had extensive periods of consultation and meetings on a very frequent basis. The Home Secretary has invited many of us representatives of the CSP community to meetings with her on two occasions before this, as well as to many working-level meetings with various Home Office officials. We discussed the technical, legal and procedural points about the proposed legislation as well, which is markedly different from how things have been before.
On the point about the future, which is important here, the Bill itself clearly specifies and puts in place a regime whereby consultation is enshrined in the legislation through the consultation process that has to happen before a notice is issued and, indeed, because the reconstituted technical advisory board can be called to come together at any time. That power did not exist in the past. The consultation is in a better place and I think that the Bill itself will help to ensure that that continues in future, because it will be a point of law.
Peter Kyle
Q Is everything in the Bill technically deliverable?
Mark Hughes: There is nothing that we have yet come across that we think is technically not deliverable. However, I will caveat that by saying that we provide many different services. There are different service providers that do different types of things and operate their communications networks differently from us. I can only really comment on BT and our networks, both mobile and fixed, but from where we are coming from it is—
Peter Kyle
Q So through technology that is already in existence and already within your grasp as a company, everything in the Bill is within the bounds of deliverability.
Mark Hughes: What I would say is that, as I said at the beginning, the things in the Bill that we need to retain are what bits we can do technically. We have not yet gone through in detail how we constitute some of that information, because we have not yet done it. I cannot comment on something that we have not done yet, but on the face of it, it does not look unfeasible.
Peter Kyle
Q To follow up briefly on Mr Matheson’s question about security, I hear your answer, which is quite broad. I will rephrase the question in this way: would existing BT customers expect a different level of security protection for their data once the Bill is enabled and passed, compared with what they expect and what is at their disposal today?
Mark Hughes: Again, different types of data, depending on the concentration, volume and type of data, require different levels of security. We always assess the risk of that data becoming exposed in a way that it should not, and we assess the security against that clearly.
Peter Kyle
Q Are you saying that because the quantity and volume of data being stored will increase and you are storing it for longer, those are two contributing factors that could potentially lead to the weakening of security?
Mark Hughes: No. On the contrary, because that is the case, we will assess it and have to put additional security controls around those data. Again, some of those data sets do not currently exist. In assessing how we would build the storage for those data sets, we would obviously factor in security, and some of the factors would include the volume and type of data, which would lead to the solution that we put in place. That is part of some of the cost estimates that have been worked through in the pamphlet produced by the Home Office.
Gavin Newlands (Paisley and Renfrewshire North) (SNP)
Q This is a quick follow-up to a question Mr Starmer asked earlier about ICRs as they relate specifically to mobile devices. The example that he gave involved a football app, but let us use Facebook as an example, as it may be of use in investigations. Facebook and apps like it have lots of background processes that generate thousands of ICRs. Is there any way of ascertaining whether an ICR is created manually or automatically by the app?
Mark Hughes: I think there is a principle here. Again, it is enshrined in the Bill to a certain extent, but I make the point now. The organisation that holds the data closest to source is the one that should be subject to the powers. That is the one that should be retaining and having to disclose data under the Bill as it stands. For example, you mentioned Facebook. If Facebook has those data, they are the ones you would have to ask about how they would go about retaining and disclosing it.
Gavin Newlands
Q I understand that, but would it be technically possible to understand whether somebody has pressed a button to create that record or whether the app has done it?
Mark Hughes: I would have to look specifically at the details around it. If it generated an internet connection record that was a website visit, for example, that might be something that we retained, but it would be very difficult for me to comment specifically on that without knowing the exact details. It depends on the engineering of the services and networks, but in principle, if Facebook had that data, then they are the ones that should be subject to the law. We are considering whether to propose an amendment to the Home Office on the third party data question, which is the case in point here, and how that should be approached. We think that the principle is that other providers who have that data are the ones who should be subject to it, and that it should be explicit in the Bill.
Gavin Newlands
Q So at the moment the Bill is not clear enough on that aspect?
Mark Hughes: It could be clearer, and we are thinking about proposing an amendment specifically to over-the-top providers, making it clear that they are responsible for that.
Keir Starmer
Q Can I come back to the question of what constitutes an internet connection record? It is the record that you may be responsible for keeping and passing over, so it is important that you have clarity. I take it from your previous answers that you have said some of it will be data that you are already collecting for your own purposes, and some of it will be other data that you are not currently retaining but will retain as a result of the Act. What are the data you are currently retaining? What is the bit that you keep already?
Mark Hughes: I gave an account number as an example. We obviously know our customers’ account numbers, so that is something that we currently have, and we have other types of information, as I went through, which are potentially subject to other pieces of legislation on retaining data. The point about the internet connection record is that it is rather like a series of ingredients, which you have to put together to create the record.
Keir Starmer
Q I have got that. The account number is fine. That does not tell you very much; it is just the account number. When someone does something using the account, what else do you keep at the moment?
Mark Hughes: There are other records associated with other types of services that we have.
Keir Starmer
Q I am sorry; I am struggling with this. Can you give me an example?
Mark Hughes: A source-destination IP port, for example. That is something that has to be available to allow traffic to route around the internet. That is the type of data that we have.
Keir Starmer
The IP port?
Mark Hughes: The extent to which we collect and retain that at the moment is clearly going to depend on our being clearer about what an internet connection record is through the work of the consultation. That will drive how long we have to hold the source-destination IP.
Keir Starmer
Q What data that you do not currently retain or keep will you have to add as an ingredient?
Mark Hughes: As far as I am aware, nothing. At the moment, we have—
Keir Starmer
Nothing?
Mark Hughes: Well, we have information at the moment that we might not retain for a period of time, but which would be commensurate with what the internet connection record is going to be. It is less about the type of data and more about the length of time that we have to retain it. That is the thing that we need to work out through the consultation process. Does that make sense?
Keir Starmer
Q Just to clarify, I heard you say earlier that some of the data you keep and some you would have to constitute. Now, you are saying that it is all data you have got; it is just about how long you keep it for.
Mark Hughes: No. Sorry if I have not been clear on that. The ingredients are there in some shape or form. Some stuff we mainly retain for a very brief period. There are elements of the data that we would have to look at very differently if the Bill became law, in terms of the length of time, how we retain them and how we use them to produce the internet connection record. That would be different.
Keir Starmer
Q If I were your customer and this Bill were law and I accessed The Guardian through you, would you think that one of the ingredients is the page within the home page that I went to? Is that an ingredient that you anticipate that you will have to keep?
Mark Hughes: Sorry, I did not hear the question.
Keir Starmer
Q If I go on the Guardian website, I can start clicking between different parts of the website for different bits of information. You can go on a hyperlink to different pages. Do you anticipate keeping any of that data in the future if I were your customer?
Mark Hughes: As drafted, the Bill talks about identifying the internet service that a person is using. The extent to which that capability will be required on the face of it is subject, as I mentioned earlier, to some of the technical considerations. For example, for what you are describing, if every single thing you were to click on on that particular website needed to be retained, that would require a lot of information, which we would have to generate from our network. Technically speaking, it would require a lot of sampling of traffic to achieve that.
Keir Starmer
Q That is a technical issue, but legally do you think it is within the definition you are working to?
Mark Hughes: Absolutely. I think it is within the definition as it is written in the draft Bill at the moment.
Lucy Frazer
Q Following on from Keir’s questions, there is a concern about the hackability of the volume of data that we have already got. Have we just heard that you already collect this data, albeit not necessarily in the same form or for the same length of time? Is it all still there for someone who wants to access it immediately?
Mark Hughes: No. Not all of the data is collected. We retain lots of data for business purposes, which we therefore retain and secure proportionately and appropriately for that type of information. As I said, there are things in the Bill that are about us having to generate additional records, based on some of the existing information that we have and other types of information that may be necessary in the future.
Lucy Frazer
Q But based on the existing information that you have, it is already there.
Mark Hughes: Some of it is already there. Some of it might not be there in the way in which the Bill describes. Some of it is subject to what the actual code of practice determines we have to collect and for how long we have to collect it. Some of those things are unknown at the moment. Suffice it to say, we have lots of information, some of which could constitute or make up an internet connection record as it stands at the moment. We secure that data, and it is accessible if required for business purposes at the moment.
The Chair
Thank you very much, Mr Hughes. I am sorry we do not have more time.
Mark Hughes: I am happy to submit written evidence post the sitting.
The Chair
Excellent. Colleagues may follow up your evidence with written requests as well.
Examination of Witnesses
Richard Berry, Chris Farrimond and Simon Grunwell gave evidence.
The Chair
Colleagues, before we see our next panel, may I say that we need to exercise some extraordinary self-discipline with two of these panels? We have three witnesses coming forward on this occasion, before we go back to a single witness. We then have four witnesses for half an hour. Can I ask Front Benchers particularly for discipline and sharpness in questioning, so they are razor sharp?
Thank you, witnesses: do sit down. Because time is pressing, will you tell us briefly, in no more than 10 words, who you are and whom you represent?
Richard Berry: I am Richard Berry, the assistant chief constable from Gloucestershire and the national policing lead for communications data.
Chris Farrimond: I am Chris Farrimond, from the National Crime Agency. I am the deputy director for intelligence collection.
Simon Grunwell: I am Simon Grunwell from Her Majesty’s Revenue and Customs’ fraud investigation service.
Keir Starmer
Q We are trying to get to the bottom of what an internet connection record means in the Bill. We have the words on the page in front of us. From a practical point of view, should this Bill become law, what do you think is going to be made available to you when you need to get an internet connection record?
Chris Farrimond: We put law enforcement requirements into the Home Office, which we gave quite some detail around—the who, where, when and how of internet connection—and the internet connection record has been defined as a result of that. We believe that what we will get is down to the domain name, so it will give us, for example, The Guardian newspaper website, the easyJet website, or thetrainline.com. It will not give us beyond that. If we wanted to go beyond that, we would then have to go to that company with the appropriate authorisation in order to obtain any further details. What we need is to get to the front door. That is what we have been asking for.
Keir Starmer
Q Can I just make sure I have understood that? For booking a train ticket or something, I can understand that you need to go to the next level if you want to find out the particulars. If it is The Guardian website, what comes up first is a website. You can then click on it if you want to go to national news or international news, and within international news, you could go to Brussels, for example, as many people might have done in the last day or so, so you have gone through a couple of hyperlinks to a different page. Will the fact that you have done that come within what you consider to be an internet connection record? I can see for booking a rail ticket that you would have to go in to get the detail of what ticket, where to and all the rest of it, but when someone clicks through to linked sites on let us say, The Guardian, would you expect that to come within the definition of internet connection record?
Chris Farrimond: Our understanding, and what we have been asking for, is just to get us to the front door—the front door that is marked The Guardian, at which point, if we needed to go to The Guardian newspaper to ask for any further details, we would do that.
Keir Starmer
Q On internet connection records, as I have understood it, the purpose of getting the internet connection record in practically all cases is to bridge pretty swiftly into content using other lawful means.
Chris Farrimond: No, I would not agree with that.
Keir Starmer
Q What would you use them for?
Richard Berry: From our perspective, the use of the internet connection record would be very similar to that for which we use communications data anyway. That is potentially to identify further lines of inquiry—for example, that communications service that is accessed. It could be for evidence of illegal material, or the use of illicit material, whether that be child abuse imagery or counter-terrorism-related material, but also to provide a seed for further inquiry, such as thetrainline.com for us to establish, for example, where a suspect has travelled to and where they are intending to travel to. It is about an evidential line of inquiry. It could be evidence in itself, but also a seed for further investigation.
Keir Starmer
Q But in most cases it would be the seed for further investigation. Would it be rare for it to be an end in itself?
Richard Berry: Indeed, because of its high granularity.
Keir Starmer
Q No other country is going down this route to solve the problem of access, which is a growing problem. What are other countries doing if they are not doing internet connection records?
Chris Farrimond: Sorry, I am not convinced that you are correct in that last statement that no other country is going down the same route. I believe Australia has gone down a similar route. Perhaps we need further clarification on that, but my understanding is that Australia has gone down exactly the same route.
Keir Starmer
Q Yes, but I think they have backed up a bit. Which other countries, to your knowledge, have a power to access internet connection records in the way proposed in the Bill or a similar way?
Richard Berry: None at this stage. I think there is a common view within the law enforcement community globally that all eyes are very much on the UK to pave the way in this respect. We are aware of the danger of the Danish experience and the difficulty the Danes had with the type of data they collected to achieve the investigative aims, but while the Australians are making steps in that direction, as Chris has highlighted, at this stage it is very much the UK leading the way.
The Chair
Thank you.
Joanna Cherry, if I give you six minutes—I gave Keir six minutes—you will know what you are working with.
Joanna Cherry
Q Thank you, Mr Walker.
Mr Farrimond, are you aware that just last week the Danish Minister of Justice informed the Danish Parliament that plans for a new internet connection record scheme have been shelved in Denmark?
Chris Farrimond: Yes, I am.
Joanna Cherry
Q Are you aware that the reason given for that was the substantial cost and the economic burden for the Danish telecom industry?
Chris Farrimond: Yes, I am aware of that too.
Joanna Cherry
Q I want to change tack slightly and ask you about the police online Crimestoppers website. I am sure everyone agrees that it is a useful service.
Chris Farrimond: Yes.
Joanna Cherry
Q I looked at it again this morning and it says that when you fill in their form and say you want to be anonymous, you are guaranteed anonymity. That is correct, isn’t it?
Chris Farrimond: Yes, it is.
Joanna Cherry
Q But if we pass this Bill, that assurance will no longer be accurate. Isn’t that right?
Richard Berry: That is a technical observation, but I think the point is that, in terms of the collection of data and, more importantly, police access to or acquisition of that data, we are looking for stuff that is relevant and useful. So a line of inquiry or a justification for accessing the Crimestoppers website from my perspective could not be justified in terms of the necessity and proportionality tests required for giving that authority.
Joanna Cherry
Q If we could reel back a little, if this Bill is passed, the purpose of internet connection records, we have been told, is to have a record of every device’s connection to every service. If anyone goes on to the Crimestoppers website and fills out the form, there will be a record of their connection to that service, so it is correct to say that their anonymity is no longer guaranteed. Is that not absolutely right?
Chris Farrimond: Where is that different from Crimestoppers? If someone phones in, they are guaranteed anonymity, but if we wanted to we could easily find out who made that call. We don’t because we guarantee anonymity. If we didn’t, no one would phone the number any more.
Joanna Cherry
Q I am focusing on internet connection records. There may be other questions about communications data, but I want to clarify, because it may be very important to Members’ consideration of the Bill, that I am correct in saying that, if this Bill is passed as presently drafted, the assurance of anonymity on websites such as Crimestoppers will no longer be accurate because the purpose of internet connection records is to identify that A has used a particular device to connect to the internet service concerned.
Richard Berry: That is no different from the present situation with internet communications data. The fact that there is a freephone call number for Crimestoppers doesn’t mean that in technical terms that communication cannot be traced, but we just don’t do that because we guarantee anonymity. It wouldn’t be necessary and it wouldn’t be proportionate.
Joanna Cherry
Q But when you use a phone to contact Crimestoppers, there is no tick box saying, “I want to be anonymous”, is there?
Richard Berry: There is an assumption. It is well advertised that Crimestoppers—
Joanna Cherry
Q There is no tick box on a phone.
Richard Berry: Not that I am aware of. No.
Joanna Cherry
Q But there is a tick box on the internet site saying, “I wish to remain anonymous.”
Richard Berry: That can remain.
Joanna Cherry
That is there because we have discovered in police and law enforcement services, where I used to work as a Crown prosecutor, that if you guarantee people anonymity, you sometimes get more people to come forward.
Richard Berry: Absolutely.
Joanna Cherry
So it is possible that, if this Bill is passed, we will actually dissuade people from reporting crime because we can no longer guarantee their anonymity.
Chris Farrimond: I am also responsible for covert human intelligence sources for informants. Of course, we know their identity, but we guarantee their anonymity. That is precisely what we do, although their identity is known within the agency. It is difficult to predict exactly how this could possibly impact, but if we are guaranteeing anonymity, that means we will not—
Joanna Cherry
Q But we are not talking about CHIS; we are talking about ordinary members of the public, the sort of person who watches “Crimewatch UK” when it is on once a month, recognises one of the mug shots and goes on the website but is scared for their own safety and so wishes to remain anonymous. We need to be clear that that anonymity can no longer be guaranteed because all internet connection records will be collected. Is not that right?
Richard Berry: It would be guaranteed by law enforcement, because that is our operational policy. We would not access it. We do not retain the data, and nor could we access it, as a matter of policy.
Joanna Cherry
But the fact is that the connection to a particular service from a particular computer will be recorded as an internet connection record and retained.
Richard Berry: In theory, that could be the case, but it would never be accessed. Lots of internet connection records would potentially be gathered, but we are very much about targeted inquiry, rather than bulk inquiry, so it would never pass the necessity and proportionality test.
Joanna Cherry
That is an internal guarantee that you are giving us. There is nothing in the Bill to say that it would not be accessed, is there?
Richard Berry: Not that I have seen, no.
Mr Hayes
Q I will be mercifully brief. Given your very wide case experience, and the fact that an overwhelming number of serious crimes are now connected with both the technology and methods of modern media, can you envisage circumstances in which loss of life or severe injury might be prevented through equipment interference?
Chris Farrimond: Absolutely, yes.
Mr Hayes
Q That is something the Joint Committee recommended and now forms part of the Bill. On internet connection records, can you give us a flavour, also from your case experience, of the kinds of crimes and circumstances in which they might be vital to an investigation and, ultimately, to catching and convicting people involved in serious crime?
Chris Farrimond: Let us just start with the fact that internet connection records are the new comms data; they are the modern equivalent of comms data, the normal itemised billing that we have had for years and years. Criminals are using internet communications even if they do not necessarily realise it—when they send an iMessage, for instance, in an internet communication, rather than a text message. That is happening the whole time, and it is happening right across the population, whether people are law-abiding or criminal, so internet connection records now feature in every type of criminality. They are featuring more in those types of crime where the internet plays a larger part—fraud, for instance. I can talk about child sexual exploitation, where the internet makes it so much easier to share images, so internet connection records would be extremely useful for us in those circumstances.
Simon Grunwell: HMRC’s business model going forward is to put more and more services online to enable taxpayers to do more themselves, a bit like an online bank account. We already have online frauds. We are quite attractive for fraudsters, in the sense that we collect £500 billion a year and we pay out £40 billion in benefits and credits. Comms data helps us directly prevent the loss of £2 billion in revenue. On the ICR point, in particular, we have already had online attacks against us. In one case alone we were able to prevent the loss of £100 million. ICRs can only help us in that regard.
Richard Berry: From a local policing point of view, it is not just about serious crime; it is also about—if I can use this phrase—policing the digital high street. So ICRs could be just as relevant for cases such as domestic abuse, stalking and harassment, to prove a particular case, or to help us deal with what might seem, in isolation, to be a minor issue, but can often be on a path of escalation to homicide or very serious assault.
The Solicitor General
Q You were just asked about anonymity and the perceived danger to anonymity—for example, in the Crimestoppers scenario—but that would apply if I telephoned Crimestoppers now, wouldn’t it?
Chris Farrimond: It would.
The Solicitor General
Q Theoretically, you would be able to get access to the phone number that I have used and work out who that number was linked to and, presumably, link that to me now.
Chris Farrimond: Yes.
The Solicitor General
Q As I understand it, these internet connection records will be held by CSPs—communications service providers—not by the authorities.
Chris Farrimond: Correct.
The Solicitor General
Q In order to access those records, you have to apply to a SPOC, or via that procedure, and then a filtering process will apply.
Chris Farrimond: Yes, it does.
The Solicitor General
Q So the scenario of the authorities holding this information and being able, at a whim, to breach anonymity is nonsense, isn’t it?
Richard Berry: We certainly very much follow the procedure of looking at each application and testing it for its necessity against its purpose, the proportionality, the levels of collateral intrusion and things like the timescales involved. If you look at the annual reports of the Interception of Communications Commissioner’s Office in 2015, you will see that they even go to the extent—I think it was done on about 100,000 applications— of looking at the amount of time a decision maker, a designated person or, under the new legislation, a designated senior officer, actually takes to consider all the tests that are required to ensure that the parameters are tight and that justification is in place.
Byron Davies (Gower) (Con)
In my experience, the UK is regarded as a world leader in intelligence-led law enforcement and I am sure that you agree that the Bill will enhance your capability. Can you tell me how important to your work it is that this legislation applies extraterritorially?
Chris Farrimond: It is rare for serious crime to be investigated and to have no international aspect to it at all. Certainly in the case of the National Crime Agency, almost every single case that we investigate has got an international aspect to it, but I suspect that that is the same for both my colleagues as well. That means that communications data will almost certainly be held in a third country at some point, because we have been communicating with people in other countries. The extraterritoriality will at least give us the ability to ask for those data. I do not doubt that there will be some complications when it gets compared with the host nation legislation along the way, but, nevertheless, at the moment we have a very lengthy process to get material back from other countries, so if this can help in any way, shape or form in speeding that up, that will be a good thing.
Richard Berry: It certainly is a strategic priority for law-enforcement policing to look at how we can ensure, as Chris said, this fragmentation of data across server farms, in clouds and across several countries is increasingly a challenge for us, so any legislation that can help with that process will be particularly useful.
The other point that I would make, building on what you said in your introduction, is also quoted by the commissioner in the 2015 report. Communications service providers, certainly in the US, very much favour the British SPOC system, because there is a dedicated, rigorous system, whereas they could perhaps be approached individually by—I think, to quote them—one of “10,000 FBI agents”, all adopting a slightly different process. So we have got the right systems in place; I think it is really the relationships and the access that is critically important.
Simon Grunwell: I will just add that the internet obviously provides mobility and anonymity. We could have an attack from anywhere in the world, online, so we need to keep pace effectively with digital changes. Sometimes the only clue that we have as to who is criminally attacking us is a digital one. The ability to go extraterritorial to pursue that one clue could be vital.
Victoria Atkins
Q In the Government’s response to the pre-legislative scrutiny, they refer to a sample of 6,025 referrals to the Child Exploitation and Online Protection Centre—CEOP—with which, I imagine, Mr Farrimond, you are very familiar. It says that of those more than 6,000 referrals, 862 could not be progressed and would require the ICR provisions in the Bill to have any prospect of being progressed. In other words, for at least 862 paedophiles out of that sample, you can go no further because you do not have the tools. Does that accord with your day-to-day working knowledge of this field?
Chris Farrimond: Yes, we get around 1,500 referrals per month, some 14% of which we cannot resolve. We cannot take them any further. Whether it is that number of paedophiles, or whether it is a smaller number who are sharing the same images, we cannot be sure, but the bottom line—the important thing—is that we cannot protect the child because we cannot resolve the data.
Victoria Atkins
Q Focusing on the point you have just made about protecting the child, a witness this morning referred to the collection of nude images and the security services apparently running facial recognition techniques on those images. Are such methods used to try to identify child victims so that law enforcement can find them?
Chris Farrimond: Yes, of course.
Victoria Atkins
Q Finally, on the extraterritoriality point, Europol is the EU’s information and intelligence-sharing agency in The Hague. What sort of data do law enforcement across Europe share, through Europol, to try to tackle serious organised crime and for counter-terrorism?
Chris Farrimond: Quite a lot, actually. We feed into the Europol databases. We also, in fairness, have bilateral relationships, particularly when it comes to specific investigations, but for criminal data on themes, trends and so on, we will feed it into Europol to see if there are any cross-matches with any other country experiencing the same criminality.
Victoria Atkins
Q So in those two areas—counter-terrorism and serious organised crime—this legislation could help not just our country, but our neighbours overseas as well.
Richard Berry: Yes, absolutely. From experience, I was involved in running a national operation on human trafficking, and we basically created a dataset from a significant amount of intelligence gained during that national operation over six months. It went straight into the analytical work files within Europol and we were able to map organised criminality right the way back to mainland China in some cases. The added value point, which is what you are making, very much comes from that sharing.
Simon Grunwell: Can I just add to that? A significant thread for us is organised tobacco smuggling, which is international by default. So it can only help.
Gavin Newlands
Q Just a follow-up to a question asked in the last panel about ICRs as they relate to mobile devices and third-party apps. You brought up easyJet earlier, and I have got an easyJet app on my phone. As far as I am aware, it creates a lot of ICRs as defined in the Bill. There is no way to differentiate between an ICR that is created manually or automatically by a third-party app. How would that limit the operational effectiveness of ICRs for you?
Chris Farrimond: To go back to my previous answer on this point, from your mobile record—the ICR from that—we would require your provider, Vodafone or whoever, to help us to understand which flight provider you were using. If they came back to us and said, “One of the domain names is easyJet”, we would say, “Thank you very much.” That is what we would expect from Vodafone. We would then go to easyJet and say—with the right authority signed off, obviously, and with the proportionality, necessity and everything that goes with that—“Can you tell us about his travel plans?” They would, hopefully, be able to do precisely that with the data that they hold on their flight details. But as for the actual app, all that we would look for from your provider would be to tell us that you have been making use of easyJet, and that would give us the next point in our investigation.
Gavin Newlands
I might not have used easyJet for several months, but the app still connects my phone to easyJet’s service provider. Likewise, I have a British Airways app. None of that limits any effectiveness for you?
Chris Farrimond: What I would expect to get is something showing you connected to easyJet for two minutes rather than for a nanosecond, or for an upgrade coming through. If we saw two minutes, we would say, “He did something with easyJet at that point.”
Richard Berry: Things like the tracking cookies you have on normal websites are not relevant information for our purposes. To offer a point of reassurance, we have a decade of experience of looking at what relevant data should be retained. ICRs are no different to that principle. Prior to any retention notice being served on a particular provider, law enforcement, the Home Office and the provider will be looking at the operational benefit, the cost and the technical feasibility of what data they hold and what data we would use. It almost takes each provider on a case-by-case basis to ensure we are gathering only relevant information. We could see those feeds back—the little connections you are talking about—being ruled out of the data we need to retain.
Keir Starmer
Q May I go back to the definition of internet connection record? To take it in stages, you are obviously concerned about your ability to deal with serious crime and the visibility of what you can do; I completely understand that. You make an ask of the Home Office, which as you said, is basically, “Who? When? Where? How?” That is where you think you need to go next, to maintain the ability you have now, because of the different ways people are communicating.
From that, you said, “Well, therefore The Guardian is enough for us, not that someone went to a page on Libya or clicked on something about Libya bombings, because that is not within our ask.” My difficulty is not to challenge why you want that, what you use it for or its utility. I just cannot see how the definition in the Bill is limited to your ask; in other words, it appears to go as far as you want to go.
Tell me if this is an unfair question, because it is about the words on the page, but which bit of the definition you understand to be the word or words that limit it to what you say you are asking for, rather than letting it go any further? At the moment, I cannot see that bit of the jigsaw. In other words, which is the trigger word in the definition of internet connection record that says The Guardian website but not “within The Guardian, the words ‘Libya’ or ‘bomb’” or whatever it may be that means we cannot go beyond what you have asked for?
Chris Farrimond: It is a bit difficult for us, because as law enforcement officials, we have no hand in writing the Bill.
Keir Starmer
Fair point.
Chris Farrimond: We simply have presented our case to the Home Office, and in quite some detail we have explained what we think we need to be able to protect the public. I am afraid I cannot speak to the actual words on the page.
Keir Starmer
Q Can I follow that question with this last one? If the definition were to be reworded in a way that reflected what you had asked for but made absolutely clear that it did not go beyond that, would that not trouble you at all? In other words, if there were a word, a phrase, a group of words or a definition that made it clear in technical, legal terms that we are talking about The Guardian but not certain clicks within The Guardian website.
Chris Farrimond: As long as it meets the requirement we have put forward, absolutely.
The Chair
Joanna Cherry, you have five seconds, and anyone who wants to answer has 10 seconds.
Joanna Cherry
Q I will try. Unilateral assertions of extraterritoriality will not help us much, will they? What we need is bilateral or multinational agreements with other countries, such as we have through Europol.
Chris Farrimond: I would say that they will help, in that they demonstrate what the UK would like to achieve. We have really good partnership relationships with a number of countries around the world. If it so happens that they are looking at a similar sort of provision in their legislation, we could quite easily find common ground. It may be that that is not possible and we need greater detail, but there is no harm at all in saying, “Look, this is what we’re asking for. It’s quite reasonable, isn’t it? These are our checks and balances around it.” That is the start point, as far as I can see, for further negotiation.
The Chair
Thank you. Well done colleagues—you were razor-like in your questioning.
Examination of Witnesses
Mark Astley gave evidence.
The Chair
Q We are down to one witness. Mr Astley, would you introduce yourself very briefly?
Mark Astley: I am the head of NAFN Data and Intelligence Services.
The Chair
Fantastic—that is an even shorter introduction than the one I have in front of me that details your distinctions.
Keir Starmer
Q From your perspective—the anti-fraud perspective—which of the powers in the Bill are most important to you and why?
Mark Astley: The powers to access communications are very important to our members. Trading standards are our main users. They are not high users but it is important for them to be able to investigate those crimes so they can support their community and the businesses that they are working for and on behalf of.
Keir Starmer
Q At the moment, you do not have access to internet connection records.
Mark Astley: Correct.
Keir Starmer
Q How does that inhibit you, if at all?
Mark Astley: At present, the impact is uncertain.
Keir Starmer
Q The impact of not having it.
Mark Astley: Of not having it—yes. There are areas, as colleagues have previously mentioned where, in the digitisation world that we are moving towards, everything is being conducted over the internet. That is something that may affect and have an impact on investigations for local authorities.
Keir Starmer
Q But at the moment you cannot say how not having it affects your ability?
Mark Astley: No.
Keir Starmer
Q And what do you think you will get when you get access to internet connection records?
Mark Astley: At the moment, I understand that we are not going to receive that access. Local authorities are not being included in having access to internet connection records.
Keir Starmer
Q No, local authorities are not.
Mark Astley: No, but some of the other public bodies may get access to that. That would give them the front door to the internet provider that they have entered.
Keir Starmer
Q But your network is not just limited to local authorities.
Mark Astley: Currently it is for communications data, as the legislation stands.
Keir Starmer
Q Within your network, what are the other bodies and agencies?
Mark Astley: Can I just elaborate a little bit more about our organisation? We provide a service to assist them in obtaining data and intelligence to assist investigations. However, from a telecommunications perspective, we are only able legally to operate on behalf of other local authorities. We are not able to represent other public agencies such as the Food Standards Agency, although the intention of the Bill is to introduce those collaboration agreements, so we could facilitate that.
Keir Starmer
Q I see, so at the moment, your function is limited in this particular field to local authorities.
Mark Astley: Correct.
Joanna Cherry
Q Your organisation has identified a range of crimes that local authorities use communications data to tackle. Do you think the Bill ought to identify the crimes more precisely to prevent data from being used in relation to, for example, rubbish collection or school places?
Mark Astley: I believe that the process is in place for identifying necessity and proportionality. The three bar process that we currently have in place will deal with that. To actually identify particular legislation could become more constraining and difficult to administer and, as more legislation comes along, more changes may be required to the Bill.
Joanna Cherry
Q Do you agree that the issues of rubbish collection or potential abuse of school places are not really serious crimes?
Mark Astley: I do, and the fact that communications data is not used for those types of investigations in respect of that should enforce that.
Joanna Cherry
Q But there is nothing on the face of the Bill to prevent it from being used for that kind of investigation, is there?
Mark Astley: No, but we have the three locks in place. They call it the double lock at present, but what the National Anti-Fraud Network provides is what we call a triple lock. We have the NAFN single points of contact that it has to go through. They are fully accredited and professional, and they are fully trained to ensure that we weed out all those types of inquiries. The next lock is the designated person, and following that you have the judicial approval process, too. There is a triple lock in place to prevent any of that from happening.
Joanna Cherry
Q But there is nothing on the face of the Bill to prevent the individuals you have mentioned from ultimately reaching the view that it might be necessary or proportionate to access communications data to deal with issues around rubbish collection or school places. It has happened, has it not?
Mark Astley: Not for communications data. The process is in place—the triple lock—from a NAFN perspective. The NAFN SPOCs are totally independent and fully trained. They will ensure that any application is appropriate, necessary, proportionate and lawful for that to process.
Joanna Cherry
Q You mentioned judicial authorisation. Can you elaborate on what you meant by that?
Mark Astley: Currently, our members have to go to a local magistrate to have any access request approved judicially.
Joanna Cherry
Q It is possible to bypass the single point of contact in an emergency, is it not?
Mark Astley: No, not for a local authority.
Joanna Cherry
Q Your organisation told the Joint Committee that five hours of an officer’s time seeking judicial approval is “slow and inefficient” and “a deterrent to councils”. Do you feel that the individual’s right to privacy might justify five hours of an official’s time?
Mark Astley: The issue around resources is more about how we can better deliver the services. The judicial approval process is there, and it is supportive. Looking at the figures for the past two years, 2% of those requests have been rejected by our own SPOCs, 0.3% have been rejected by the designated persons and only 0.2% have been rejected by judicial approval. Our belief is that the processes in place work effectively.
Joanna Cherry
Q That was not really my question. My question was on whether you agree that the individual’s right to privacy justifies the time that is sometimes taken in inputting for a judicial approval.
Mark Astley: I understand the need for respect for privacy, but the necessity and proportionality aspect of every case will be considered, and if it is appropriate to do so, we would need to intrude on that privacy.
Mr Hayes
Q Obviously, your role is an additional safeguard. There are those who think that the Home Secretary and I are preoccupied with safeguards, checks and balances and the defence of privacy, but I think we have probably got this right. Can you tell me of the number—the frequency—of requests that you would consider to be an abuse of power in respect of applications for information? How often do you come across seedy requests that you would consider to be an abuse of the powers?
Mark Astley: In 2% of inquiries in the past two years, we have had applications rejected or cancelled through the input of our accredited SPOCs.
Mr Hayes
Q Is that common?
Mark Astley: It is actually going down because of the training and the accreditation that is provided by our staff—the figure has reduced every year—so that people are fully aware, fully trained and fully focused on what is appropriate, what is necessary and what is lawful.
The Chair
Actually, on this occasion I did not ask you to be brief, but thank you for being brief in the spirit that that was offered.
Victoria Atkins
Q Just so there is no mystery—people might ask themselves, “Crikey! What on earth do local authorities need these powers for?”—what sort of offences do local authorities investigate and prosecute?
Mark Astley: Local authorities have been provided with a wide remit in legislation to assist them in investigating a wide range of high crimes and serious crimes, which can range from rogue traders to dangerous goods and fake alcohol and tobacco.
Victoria Atkins
Q In some cases, fake alcohol can be fatal.
Mark Astley: It can be fatal, yes. There was a recent case of children’s clothing that was not fire retardant. It is important for those officers to react quickly to prevent any loss of life or serious danger to life.
Victoria Atkins
Q They also prosecute housing benefit fraud, don’t they?
Mark Astley: Not any more.
Victoria Atkins
Q Do they still prosecute landlord offences?
Mark Astley: Yes. Tenancy fraud offences as well. There is also internal fraud. There was one specific case where people were setting up rent accounts and filtering thousands of pounds from within the organisation.
Victoria Atkins
Q But, just as importantly, and probably more importantly, they can also safeguard the lives of people who are renting properties from landlords who, for example, are not keeping up to date with their gas certificates.
Mark Astley: That is correct.
Victoria Atkins
Q Just to be clear, under this Bill local authorities will not be entitled to internet connection records.
Mark Astley: That is correct.
Victoria Atkins
Q I do not know whether you have already done this, but could you briefly help us with the process that exists at the moment? What will happen after the Bill in terms of your organisation getting this information?
Mark Astley: In how we deal with an inquiry?
Victoria Atkins
Yes.
Mark Astley: Inquiries come through to our organisation electronically from an applicant, and our SPOC will work with the applicant to get the application either up to standard or cancelled because it is not appropriate. Once it is up to the required standard, the application is passed over to the designated person, who will then look to authorise it for proportionality. Once that has gone through, our systems provide a court pack, which is delivered to each individual applicant, and they then have to arrange for a court attendance to get judicial approval.
Differently, in Scotland they also have a legal representative process, except they have a fourth lock in place in that their legal representatives get involved and then go on to the sheriffs for judicial approval. It is then returned to us. Once we have that approval, we then obtain the information accordingly.
Victoria Atkins
Q Of course, the Bill also introduces the further safeguard of the criminal offence of making an unauthorised disclosure. In other words, there is also safety from the perspective of the telecommunications organisation, BT or whoever it is, knowing that if they do not make sure that you have complied with all of your duties, they themselves may be criminally responsible for giving you any information that they should not be giving you.
Mark Astley: Yes, and I think there is an intention to make the SPOC—the single point of contact—responsible for any recklessness or wilfulness in that misuse. That is another safeguard in place to ensure that there is no abuse or misuse of telecommunications data.
The Chair
With the permission of the Committee, I might suspend the sitting for 10 minutes at 10 minutes to 4 to allow people to have a quick break, because this is quite a long sitting. Is that with the permission of the Committee? Brilliant.
Christian Matheson
Q I have two questions. Mr Astley, there are two opposing schools of thought relating to this Bill. There are those of us who recognise the need to update the legislation as it is to provide protection for children against sexual abuse and to provide protection against terrorism, terrorist atrocities and terrorist threats, and at the far end of the scale are those who believe that there is an absolute right to privacy and that no price is worth paying to imperil that privacy.
The job of Parliament is to find the correct balance on the scale between those two extremes. I do not think it would be too difficult to find justification, for example, for the protection of children against sexual abuse or for the defence of the realm against foreign threats and foreign terrorists. Justify to the Committee, if you will, the use of some of these powers, limited though they are in the Bill, for offences at the lower end of the scale.
Mark Astley: From a local authority perspective, they are a small user of telecommunications data. It has never been abused or misused from a local authority perspective, but they investigate some quite serious crimes. We had a particular case of advance-fee fraud, which was worth £7.5 million.
If you look at the majority of the applications that local authorities make, an extremely high percentage in the last two years—96%—was purely for subscriber data, or what is currently known as “c data”. That is the basic information about the subscriber to a telecommunication service and sometimes that is the key information that investigators need. An example would be someone who is trafficking illegal tobacco and the shopkeepers they are speaking with only have a telephone number for the delivery person. Therefore, in order for people to investigate successfully, which they have the powers to do—provided by Parliament—it is important that they have that access.
Christian Matheson
Q Let me ask you then, finally, why in that case, if a crime is sufficiently serious, can the involvement of the police not take over the requirements for access to electronic communications data, as opposed to, for example, your members?
Mark Astley: Yes. As I have previously mentioned, our members are very highly trained; they are commensurate in some respects to what the police investigate. But they deal with their local community on a more local basis and they have the powers and expert knowledge, in particular about rogue traders, about illicit tobacco and about counterfeit items. They have that experience.
Christian Matheson
Q You could still handle those investigations and deal with them, but when it was apparent that they are of a sufficiently serious nature you can involve the police, who are then able to make the applications on your behalf, so you would not need access under the terms of the Bill.
Mark Astley: It is a valid point, but I believe that the powers are there for the trading standards, who do a really good job, and they have done an excellent job so far in dealing with high-level crime.
The Solicitor General
Q In the last year for which records are available, which I think is 2015, about half a million applications for access to comms data were made. About 0.4% of those were local authority applications.
Mark Astley: That is correct.
The Solicitor General
Q So we are talking about several thousand out of about half a million. Is that right?
Mark Astley: Well, if you look at the last two years alone, we are talking 3,300.
The Solicitor General
Q You were asked questions about the replication of the existing regime relating in England and Wales to magistrate authorisation, in Scotland to sheriff authorisation, and in Northern Ireland to district judge or magistrates court authorisation, for applications for access to comms data by local authorities. Those provisions are replicated in the Bill, are they not? I think it is in clause 66. But they are in the primary legislation.
Mark Astley: They are.
The Chair
Colleagues, I think we could do with a 12-minute break, because people have to get coffees and check with their offices.
Sitting suspended.
Examination of Witnesses
Lord Judge, Clare Ringshaw-Dowle, Sir Stanley Burnton and Jo Cavan gave evidence.
The Chair
Welcome to the panel. In a matter of a few words, please introduce yourselves.
Jo Cavan: I am Joanna Cavan. I am the head of the Interception Commissioner’s Office.
Sir Stanley Burnton: I am Stanley Burnton. I am the interception of communications commissioner.
Lord Judge: I am Igor Judge, the chief surveillance commissioner.
Clare Ringshaw-Dowle: I am Clare Ringshaw-Dowle, chief surveillance inspector.
Keir Starmer
Q Thank you to our distinguished panel for their time this afternoon. I think this is a first—me asking distinguished judges a question. It has always been the other way round for my entire career. I shall try to keep it short and sweet.
Can I start on the issue of the approval of warrants by judicial commissioners under the Bill, and the proposed test? Clearly judges perform different functions every day. One function is to issue a warrant—to search a premises, for example; judges do that day in, day out. They are the decision maker. An application is made to them and they look at it and make their own decision, and they issue or do not issue the warrant as the case may be.
A different function is a reviewing function—a public law function where a judge is essentially reviewing somebody else’s decision. On my reading of the clause on approving warrants, clause 21(1) and (2)—if you do not have it in front of you, I have copies of it—it appears to be clearly a reviewing function. The judge is reviewing the decision of the Secretary of State, not actually making a decision him or herself on the warrant. Do you agree with that?
Sir Stanley Burnton: I do, certainly.
Lord Judge: I agree too, but you have a problem: what do you mean by judicial review?
Keir Starmer
Can I explore that?
Lord Judge: You asked me for a short answer, and that is a short answer. [Laughter.]
Keir Starmer
Q Judicial review covers a range of different approaches depending on subject matter, intensity of review and so on. As worded, how much deference or margin do you anticipate judges will give to the decision maker, the Secretary of State, in exercising these functions?
Sir Stanley Burnton: In theory, you have a complete spectrum. A judge can operate at one end of the spectrum when he just accepts what the authority is putting to him, and at the other end he can be quite stringent in reassuring himself that the statutory tests have been properly applied and satisfied. Frankly, it is going to be the commissioner who will decide—fairly early on, I would have thought—how stringent the test should be in this case. My own view is that it should be quite stringent, approaching the one that was applied in the case of control orders.
Keir Starmer
Q Do you agree with me that as the Bill is currently drafted, it is not clear what Parliament intends, and therefore it will fall to the judges? In other words, it is broadly enough drafted to cover a longer-arm review or a closer intense review depending on what judges decide as cases evolve. It could accommodate both approaches.
Sir Stanley Burnton: It is left to the judges, is it not, to decide what the proper approach is?
Keir Starmer
On this draft.
Sir Stanley Burnton: On this draft. It may be difficult to draft more tightly. The other thing I would say is that whether the judge is a decision maker or an approver, he necessarily has to give a lot of weight to the opinion of the person who is making the application to him.
If the secret service is saying, “Our assessment of this man is that he is a dangerous terrorist”, it may be very difficult to go behind that, and there is no reason why the judge should go behind it unless there is material before him that indicates that that is a wholly unreasonable and unsupported assessment. But you are compelled to give weight to the opinion of the people who are actually involved in whatever the subject matter is.
Lord Judge: I do not go all the way along the route with Sir Stanley about this. I think “judicial review” is a very easy phrase to use. It sounds convincing, but it means different things to different people. People say, “Wednesbury unreasonableness”—that was a case decided by the Court of Appeal in 1948 or 1947, and it has evolved. Personally, I think that when Parliament is creating structures such as these, it should define what it means by “judicial review”. What test will be applied by the judicial—I call him that—commissioner, so that he knows what his function is, the Secretary of State knows what the areas of responsibility are and the public know exactly who decides what and in what circumstances? I myself do not think that judicial review is a sufficient indication of those matters.
Keir Starmer
Q Thank you. Sticking with functions, if I may, as the Bill is drafted, the body responsible for authorising investigatory powers, as we have just described, is also the body responsible for oversight after the event. On the face of the Bill, there is no structural distinction between those functions. Is that sensible, or could it be improved?
Lord Judge: As that is the way in which the surveillance commission works, I strongly recommend it to you. There are different people exercising different functions. The pre-authorisation that goes on in our section of the system involves a commissioner being satisfied—I am sure you all know about the relevant tests—and either agreeing or not agreeing; that is a very important moment. In most cases, happily, because people make responsible applications, they are agreed to. Sometimes it is suggested that they should be amended, and very occasionally they are refused.
That process then unfolds, and whatever happens happens. My inspectors annually inspect the entire force—not just the individual who made the application in the first place, but each police force and each prosecuting authority—to see whether their systems are effective and check, and not just on the ones that have come through, to ensure that the process was brought to an end speedily or, when nothing further happened, that the authorities did not go on too long and so on. It is also to ensure that when the authorisation was originally given, it was founded on proper evidence and then correctly given.
Normally, this has all worked perfectly well, but there is a danger in underestimating the value of the inspectors; I shall come to a different point on that when I can give a longer answer. The process works very well in this way. They report to me as chief surveillance commissioner. I then digest the report and go see the chief constable of each force, or get one of my commissioners to go see them, to say, “This is where you are going wrong, and this is where you must do this and that.”
That is because the inspectors have taken the thing apart. They go to police forces for days; the whole lot of them go to the Metropolitan police for a week. They have the right to see anything they like, and they demand to see it. The commissioners would not be best able to exercise that function, because they are judges. They are not qualified.
Jo Cavan: There are a number of important points around these clauses in the Bill. First, we are really disappointed to see that although the Government are talking about creating a world-leading oversight body, the clauses as currently drafted do not actually create a commission. They simply create an investigatory powers commissioner and a number of judicial commissioners.
When we look at approval by those commissioners, the reality is that they are only going to be approving 2% of the authorisations that will actually be undertaken under the Act—arguably, the more highly intrusive authorisations. The remaining 98% of authorisations will only be overseen post facto, and the reality is that they will be overseen by staff within the commission.
If we look at some of the judgments coming out of the European Court of Human Rights and the European Court of Justice, there are some really important safeguards on post facto oversight, looking at the retention, storage and destruction of material, how it has been used and any infringements or breaches around the acquisition post-approval. We really feel that the Government need to create this body in the clauses.
Keir Starmer
Q One final swift question on thematic warrants and the breadth of the powers proposed in the Bill. Do any of the witnesses have headline concerns that the Committee can take away to work on as we consider the Bill line by line?
Sir Stanley Burnton: First, the existing formulation in RIPA is very unsatisfactory and unclear, and it does not cover many cases in which it would be sensible to have a so-called thematic warrant. However, the wording of clause 15(2) is very wide. If you just have a warrant that gives a name to a group of persons, you have not identified—certainly not in the warrant—all those persons to whom it is going to apply. There could be substantial changes in the application of the warrant without any modification. At the moment, the code of conduct envisages a requirement that names will be given so far as practicable. Our view is that the warrant should name or otherwise identify all those persons to whom the warrant will apply, as known to the applicant at that date.
The other concern is that substantial modifications can be made to a warrant under the Bill with no judicial approval or even notification. That needs to be changed.
Lord Judge: I agree with Sir Stanley. I will not say anything more on the second point he made, but on the first, a part of the process that all of us involved in supervising surveillance attach a great deal of weight to is that we are looking at individuals. There has to be evidence that X requires this, that there is a situation in which it is necessary for this to happen, that it is proportionate in this particular individual’s case and that there is no collateral interference. For example—there are many different examples—why should a women who happens to be married to or living with a man who is suspected and so on have her life entirely opened up in this way? Not having specific identified individuals leaves a very delicate situation. I suspect that the commissioners would find it very difficult to just say, “Well, we’re satisfied. There’s this gang here and they’re all pretty dangerous.” They might not be, and we have to be very alert to that.
Joanna Cherry
Q I have questions for Jo Cavan. In your organisation’s written evidence, you have picked up on earlier concerns about the draft Bill and updated them in the light of the finalised Bill. In the first point, you say that you have concerns about the “aggressive timeline” for the Bill. Can you explain what you mean by that?
Jo Cavan: It is a really complicated and significant piece of legislation. Although I broadly support the Bill, because it is a good thing to put a number of the powers used by the intelligence agencies on a clearer statutory footing and to try to improve transparency, I do think that the scrutiny process has been very hurried. That is of concern because there are some significant privacy implications to the clauses in the Bill. There is still a long way to go towards strengthening some of the safeguards. Also, a lot of the operational detail is in the codes of practice. It is really important that those are scrutinised properly, line by line.
Joanna Cherry
Q When you express concerns about the aggressive timeline for the Bill, are you talking about the Bill before us as well as the draft Bill?
Jo Cavan: Yes.
Joanna Cherry
Q So you consider the time that has been afforded for the scrutiny of the Bill before us to be aggressive.
Jo Cavan: It has been challenging to say the least.
Joanna Cherry
Q Do you think it is adequate?
Jo Cavan: You could argue that because we are waiting for a number of key judgments from either the European Court of Human Rights or the European Court of Justice, it might seem a bit premature to be legislating in some of these areas, but then when do you draw the line?
Joanna Cherry
Q At point 5 in your written evidence, you pose the question:
“Is it desirable to have the same body responsible for authorising investigatory powers and undertaking the post facto oversight of the exercise of those powers?”
You say:
“If so, the judicial authorisation and oversight elements of that body must be operationally distinct.”
You have already explored point 2 of your written evidence with us, but will you elaborate on point 5?
Jo Cavan: It is clear to us that there needs to be some operational distinction between the approval—the judges who are going to be approving some of these techniques—and the audit and oversight after the event, because if the judges approving the requests are then responsible for the post facto oversight, essentially they could be accused of marking their own homework. Again, if the commission is created, you will be able to distinguish those key elements.
It is really important for the commissioners to work very closely with the inspectors and technical engineers and so on who will carry out the post facto audits. They are obviously going to need to support each other, but it is really important that there is a distinction. I think I have spoken to a number of our international oversight counterparts, and some of those are quite surprised that we are going down a route where we are putting both elements into one body.
Joanna Cherry
Q At point 6 of your written evidence you expressed concern that in the draft Bill there were
“a number of clauses which provide exceptions for national security or which exempt the intelligence agencies from key safeguards”.
What is your view of the finalised Bill in relation to that concern?
Jo Cavan: Essentially there has been progress on one of the national security exemptions, which is around the acquisition of communications data to determine journalistic sources. The Government have amended clause 68 to remove the national security intelligence agency exemption. That was because that was picked up by the Intelligence and Security Committee and the Joint Committee.
However, there are still two broad exceptions in the Bill: clauses 54 and 67. One of them is really important, because it is around the independence of designated persons. This area was strengthened as a result of the Digital Rights Ireland case, and that is an area where we still find significant compliance issues within public authorities. Communications data is approved by designated persons—it will become designated senior officers in the Bill—who are from the same public authority. In almost half of the police forces, intelligence agencies and other bodies that we inspected last year, we made recommendations around that area because we were not satisfied with the independence.
The clauses as drafted seem to drive a horse and cart through the independence requirements for designated persons by exempting very broadly national security. The same is the case in the single point of contact provision in clause 67: that appears to exempt in national security cases the SPOC being consulted, and we see the SPOC as a key safeguard in the process. So the fact that the Government have already said that the exemption relating to journalistic sources was broad, and removed it, suggests that the same needs to happen to clauses 54 and 67.
Sir Stanley Burnton: I would just like to add that it is far from obvious that the interests of national security, which is a ground for the grant of a warrant, is itself an exceptional circumstance. It is very difficult to see what the logic behind that formulation is.
Mr Hayes
Q Good. How often have you encountered a Bill that before its publication in draft had been preceded by three reports, and which was subsequently considered by three Committees of the House before embarking on the normal process of scrutiny? Can you think of another Bill in the last 10 years like that? How many can you list?
Jo Cavan: I am afraid I cannot think of any off the top of my head, but I will say the reviews—
Mr Hayes
Q You said it had been hurried; that is what I was trying to get at.
Jo Cavan: Yes, absolutely. The reviews were comprehensive in their own right. However, the three reviews that you talk about were specifically focused on certain areas. David Anderson was specifically focused around interception and communications data, so he did not look at equipment interference, for example. Some of the capabilities had not been avowed at that stage, so they are seen for the first time in the Bill. I think it is a challenging timeline, and a number of the witnesses have talked about their concerns.
Mr Hayes
Q But I just wanted to establish, just to be clear, that in my 20 years I cannot think of a Bill that has had quite such extended scrutiny. I am sure there must be some, but they do not spring to my mind and they clearly do not spring to yours, either.
Jo Cavan: No, that is right.
Mr Hayes
Q On a second point of fact, you talked about the number of cases in which judicial approval is involved. That is the double lock. The double lock applies where a Minister—the Secretary of State for Northern Ireland, the Foreign Secretary or the Home Secretary—issues a warrant. The double lock applies where one of those people is involved. That is right, is it not?
Jo Cavan: That is right.
Mr Hayes
Q You would hardly expect the second part of the lock to apply where a Minister is not involved, would you?
Jo Cavan: The figures from last year that were published by all three commissioner bodies show that only about 7,000 out of 290,000 applications actually have judicial approval.
Mr Hayes
Q On a separate point, it has been said that the judicial commissioner—this is a question for any of you, but I am thinking of the two gentlemen in the middle in particular—will not be sufficiently independent, and that they will be deferential towards the politicians involved. Is that your view? Are they likely to be deferential, or are they likely to act independently?
Lord Judge: I think you should ask the last 10 Secretaries of State whether they had an easy time when judges have had to consider whether they are acting lawfully. You will find, I suspect, that many of them feel fairly scarred by the experience. There is no danger whatever.
Mr Hayes
Q I have known a number of Home Secretaries, and none of them has suggested that the judiciary is deferential. I take your point. Finally, in terms of the appointment of the judicial commissioners, would the Judicial Appointments Commission be a better place to appoint them, or do you rather like the model we have come up with?
Lord Judge: No, I much prefer the model you have come up with. The Judicial Appointment Commission appoints judges usually from people who have not been judges. This is an appointment system that will work for people who have already been through the process, have acted as judges, have been appointed at whatever level they have eventually ended up, and are then exercising a new function. There is no point whatever in involving the Judicial Appointments Commission, ignoring the fact that it has got far too much to do anyway and not enough people to do the work.
My concern about the appointments is the speed with which all this is going to happen. We are going to have, under clause 233(3), a new investigatory powers commissioner within two months of the Bill becoming an Act. Where is this wonderful individual, male or female, going to come from within two months? The processes of appointments that I have had anything to do with take a very long time. I announced my retirement in November 2011 to be replaced by October 2013, and nobody knew who the next Lord Chief Justice was until the end of July. I am very worried about that. It is a very serious point. It is not a big point, but it is serious.
Peter Kyle
Q Sir Stanley, in response to Sir Keir’s question, you said that you felt that judges would be compelled to give weight to the person applying. Will judges, considering that it has been signed off by the Home Secretary, feel compelled to give weight to the fact that the Home Secretary has already authorised the warrant?
Sir Stanley Burnton: Well, you give weight to it, but you none the less look at the material to see whether she was entitled to come to the decision she came to.
Peter Kyle
Q There is a lot of weight already by the time it gets to the judge to make the decision, so the bar is high for you to overturn the application.
Sir Stanley Burnton: These are serious matters. To authorise or to approve a warrant is a serious matter, but equally not to may be a serious matter.
Peter Kyle
Q Thank you so much for a great answer. Joanna, following on from the Minister’s question, have you ever come across a Bill of this complexity, size and importance in your career?
Jo Cavan: No.
Peter Kyle
Q So it is unique, and therefore the conditions that lead up to it are unique as well.
Jo Cavan: That is right, although I defer to the individuals in this room who have been involved in this type of stuff for far longer than I have. Six codes of practice containing the operational detail were published on 1 March accompanying the Bill. That is a huge amount of material to examine.
The Solicitor General
Q May I go back to the first points made about the judicial review test? I put in a plea for the poor parliamentary draftsmen and women who work very hard indeed to try to strike a balance between avoiding excessive prescription and the dangers of being unduly vague. Lord Judge, you suggested we were falling more towards the latter end of the spectrum and being somewhat unhelpful.
There are in clause 18 the necessity criteria that are applied by the Secretary of State and then by the commissioner. The difficulty I have is, what do I do? I am trying to ensure the commissioners have discretion and the ability to make a nuanced decision based upon the individual case before them. At the same time, I am being told, “Well, that isn’t good enough.” Should the draftsmen produce a non-exhaustive checklist, or is that in itself full of dangers for the commissioners when it comes to their decision making?
Lord Judge: I think it is a matter of principle that has to be decided by Parliament—of which I am a Member, in the other place. What check is appropriate for Parliament to put on the Secretary of State exercising this very important power?
The Solicitor General
That is there; it is in clause 18.
Lord Judge: There it is. If you leave it as judicial review, we know that judicial review depends on the context, on when you have last been in the Supreme Court and when the last case came from the European Court of Human Rights; it is a flexible concept. That is one of its strengths, but I am not sure that in the context of the public responsibility that goes with the issue of these warrants there should be a flexible concept.
The Home Secretary has to make the decision. As it happens, if there is the equivalent of Brussels here in London, she will now be there. She will be answering. She will say, “I did issue this warrant,” or “I didn’t.” Whichever way she did it, she will be responsible and answerable to you. What is the role of the judicial commissioner in such an arrangement? Does he come before you too, because he said, “I don’t agree with this warrant,” or, “I do agree; I do support it”? We need to be clear what you want the commissioner to do. Not everybody agrees with me, but I think that just saying “judicial review” is not clarifying where responsibility rests at the really crucial moment, which is when disaster strikes.
The Solicitor General
Q But you appreciate the problem that we have in getting this right.
Lord Judge: I do, but that is what Parliament is for. We have to decide what the law should be. I myself would like the law on this issue to be absolutely unequivocal, whatever Parliament or the House of Commons ultimately want.
Sir Stanley Burnton: We wonder what the function of clause 196(6) is. It is either telling a judge the obvious or it is a big stick to wave at the judge, to say, “You have to approve this because if you don’t, you’ll be jeopardising the success of an intelligence operation.”
Suella Fernandes
Q Building on the point made by the Solicitor General, clause 21 sets out the “necessary” and “proportionate” tests. We have heard a lot about those words. What questions do you ask when you are assessing proportionality? What is that analysis?
Sir Stanley Burnton: You are looking at the effect of the measure in question as against alternatives and as against the mischief that is aimed at—are we talking about saving life, or it just a matter of money? If it is money, is it a lot of money? Is it pensioners’ money or the Government’s? You weigh one up against the other, and in the end, it is a matter of assessment—looking at one and looking at the other.
Suella Fernandes
Q So reading that meaning of proportionality, which we all agree on, with the factors listed in clause 18, is it not clear to a decision maker what factors are relevant and the level of scrutiny to be applied?
Sir Stanley Burnton: You have had my answer already. I am content with the Bill as is, but Lord Judge takes a different view.
Lord Judge: The answer surely is that those criteria are applied by the Secretary of State. The commissioner will apply the same criteria, but are you asking him or her to be a co-decision maker or a supervisor of the Minister? If a supervisor, then you have to define what his or her role should be.
The Chair
Thank you very much, panel. Have a happy Easter and enjoy your weekend reading.
Examination of Witnesses
Lord Reid and Charles Clarke gave evidence.
The Chair
Thank you, both distinguished former Home Secretaries. I will not ask you to introduce yourselves because I think that would be a little impertinent of the Chair. Let us go straight to Keir Starmer.
Keir Starmer
Q Thank you both for coming to give evidence to us this afternoon. We are really appreciative. Can I dive in with the question that I think the whole Committee is intrigued by or interested in? You have experience of carrying out authorisations and signing warrants. We know there are a number every day. Can you give us an example of the exercise you both carried out when you were looking at warrants so that everyone in the Committee can understand what the role of the Secretary of State was before, as is now proposed, it goes off to a judge or commissioner?
Charles Clarke: The submission is made by the officials and the services, and says there is a suspected threat in a certain area and that they recommend authorising a power to surveille a group of individuals. The judgment that the Secretary of State then has to make is whether he or she does or does not accept that there is a case for surveilling the individual. According to the time available—some of the issues do not give you a great deal of time to decide what is happening because things can be moving very quickly in both serious and organised crime and counter-terrorism—you might decide to seek more information about the particular circumstances and why the judgment is being made. I think that you would always—I don’t know what John’s experience was—have at least a brief discussion with the officials concerned about the particulars of the case. It would not necessarily be extensive and the longer you are Home Secretary, the more experience you gain of the circumstances in which these sort of things are requested.
I am sure all Home Secretaries take the decision very seriously and seek to come to a judgment about it. I do not know whether that sounds familiar to you, John, but that is certainly how I felt I was trying to deal with it.
Lord Reid: That is roughly the process. Obviously each individual case is somewhat different. Some are hugely different from others. Each individual case may have a different timescale. Without going into individual cases, you can imagine that, certainly on occasions, I had to deal with—I am sure Charles did, too—warrants in connection with an ongoing hostage situation, when there was an imminent threat to life. There is obviously a degree of urgency about that, and that constrains the time for consideration and, no doubt, the time for judicial review.
In Northern Ireland, lives were often plainly at risk. In those cases, you have a time constraint. In other cases, you have a pretty bulky file, sometimes on a renewal. As it happens, we had consecutive periods so, on occasions, I would have got an application to renew a warrant that perhaps had initially been okayed by Charles. Nevertheless, with duty and diligence, you would spend a bit of time going through it yourself—sometimes going through the papers that he went through. In other cases, there might be less information to be examined because it might be—for instance, in the case of an ongoing and imminent terrorist plot—that a telephone number, a name or some association had been picked up tangentially in relation to someone else that you had been looking at for some time.
The only other thing that I would say is that I suspect that, during the time that Charles and I were Home Secretary or, indeed, in any other position authorised to issue intercepts, because of the exponential rise of communication through cyber and the internet, the number of applications would be getting greater and greater.
Charles Clarke: Can I just add one point, Mr Starmer? There is an important conceptual point here, which is that modern detection of organisations which are criminal in intent—serious and organised crime, and terrorism—is basically about building up a pattern of what networks of relationships exist between different people.
You collect information, as John just implied, about particular nodes of the situation. Then the question is what forms of communication they have with others and who they are communicating with in order to try to better understand what the actual networks are and who is talking to who and, in certain circumstances, what they are actually intending to do. That is just the background that you should have in your mind when thinking about what kind of surveillance requirements are necessary to look at that.
Keir Starmer
Q I know there is no such thing as a typical case because they are all shapes and sizes but, in the main, would you have expected a signed statement from somebody setting out the case for necessity and proportionality—why it was necessary—and drawing your attention to the relevant material?
Lord Reid: Yes. That would be the top introduction, but there may well be further papers behind it. In some cases, there may be papers behind it in some depth.
Charles Clarke: If the question is whether there would normally—I am trying to think whether there is any exception to this—be a recommendation by an official based on the data that existed, the answer is yes. I am trying to think whether there are any exceptions to that. I cannot think of any offhand.
Peter Kyle
Q One of the innovations of the Bill is the double lock. When you were Home Secretaries, most warrants would have been signed just by the Home Secretary. Will the knowledge of having judicial oversight and a second authorisation before the warrant comes in change the behaviour of the Home Secretary when approaching the decision?
Charles Clarke: I tend to doubt it. Speaking for myself and, I am sure, for John—actually, for all Home Secretaries I have ever discussed this with—we have all been exceptionally aware of the severity and seriousness of what we were looking at. I do not think that the idea that there was going to be a judicial review of what we were doing would have changed our behaviour significantly. There is quite a serious, in-principle issue about the role of the judge as opposed to the role of the Executive.
I saw you taking evidence from Lord Judge just now. I bumped into him as I was coming in. The question of the relationship between the judiciary and the Executive is a key point. I gave evidence on it to the House of Lords Constitution Committee in 2007 because I think it has all been changed by the Human Rights Act 1998. I think there has been insufficient consideration of the changing nature of the relations. In response to your particular point, Mr Kyle, I do not believe that there would have been a significant change in behaviour.
Lord Reid: I do not think there will be a change in behaviour from the point of view of the person who is ultimately accountable to Parliament for the decisions, which is the elected Member and appointed Minister. Probably even before RIPA, which I think Charles took through the House of Commons, there was an awareness that there were degrees of oversight and you were working within certain constraints and certainly with oversight.
I confess that where I would worry—you would perhaps say, “Well, he would, wouldn’t he? He was the Home Secretary.”—is in case the judicial oversight became a co-decision. I think that is a recipe, in some cases, for obstacles to the efficient operation of aspects that I mentioned earlier, for instance in a hostage situation. I know that allowances are being made for that.
I guess that the additional oversight—judicial oversight—that is in the Bill is a result of a number of factors. One is the concern—I do not know whether it is public concern; I do not think it is, but it is certainly published concern—over the Snowden revelations, the general distrust of politicians and the fact that there was a Liberal-Conservative coalition. All of this is compromise, is it not?
I have no in-principle objections to it, provided that the first decision is made by the person accountable for it, through Parliament, to the public and the role of judicial oversight is the judicial element of it.
Joanna Cherry
Q On 4 November last year, when the Home Secretary introduced the draft Investigatory Powers Bill to the House of Commons, she informed us:
“the acquisition of bulk communications data, both relating to the UK and overseas…is not a new power. It will replace the power under Section 94 of the Telecommunications Act 1984”.—[Official Report, 4 November 2015; Vol. 601, c. 971.]
May I start with you, Mr Clarke? When you were Home Secretary, how many times do you recall authorising the use of
“the power under Section 94 of the Telecommunications Act 1984”
to collect the telephone records of everybody in the UK into a single national database?
Charles Clarke: I do not recall the answer to your question at all, I am afraid; I have not prepared for this meeting, or gone back to my files, so I cannot answer the question. I think what the Home Secretary will have been trying to communicate is that the purpose of this legislation is to update legislation in the light of massive technological change, even since 1999, when I took the RIPA Bill through Parliament. As you will recall, that was to make what was being done compliant with the Human Rights Act, which required us to have a basis on which all of this was understood. Previously, this had all been done without any basis, and I was very proud to take that legislation through.
I said at the time—if you go back to the records of those hearings—that it would be necessary to update that Bill as technology moved forward, and I think that is what the Home Secretary meant in what she said. However, I apologise that I cannot give you the precise answer that you are looking for.
Joanna Cherry
Q Perhaps you can help me with this question. When Parliament passed the Telecommunications Act 1984, there was no such thing as itemised phone bills. Do you remember back that far?
Charles Clarke: I was hardly born then. [Laughter.]
Lord Reid: That is before even we were in Parliament.
Charles Clarke: Sorry. Joking aside, I understand your point completely—
Joanna Cherry
Q On the hypothesis that that is correct—that there was no such thing as itemised telephone bills in 1984—then the use of itemised telephone bills to compile a national phone call database could not have been foreseen when that legislation was passed by Parliament, could it?
Lord Reid: I think these are interesting questions, but they miss the point of historical change since 1984; that is the important thing. To put it at its simplest, the principles behind interception or access have always been the same, whether it was in the days when you sent a letter to somebody, or the days when you made a telephone call to somebody. The principles, put very crudely, were that if you wanted to know whose name was on the envelope, then you had a level of authority that was necessary, and oversight. If you wanted to read the letter, you had a higher level of authority that was required, normally from a Minister. Similarly, with telephone calls, if you wanted to know who was phoning whom, then you needed a level of authority that was not necessarily the Home Secretary, because after 1984 there was such information available. If, as a result of that, you wished to go into the contents of the telephone conversation, like the contents of the letter, you required an even higher level of authority by warrant.
What has changed is that it has gone from people sending pigeons, writing letters and telephoning each other, to global communication, as you will be well aware. Instead of a phone call from Cambridge to London that can be intercepted, it goes around the world in packages. Indeed, as you probably know, that is why it was produced: the internet has its origins in the necessity of protecting the command and control structure for the launch of American nuclear weapons by the American President. It makes it much more difficult to intercept that.
To put it in grossly simple terms again, somebody used to say, “We all like rabbit pie but first you have to catch the rabbit.” We all want to get the needle in the haystack, but first you have to find the haystack. The problem we are all faced with now is that the haystack is global. It is global communication, which is why we get this tension between so-called bulk collection and targeted examination.
That is a long answer to your question, but I hope it goes to some of the central questions that your Committee will be asking about that relationship. Normally, a Secretary of State would authorise a targeted interception, but the explanation of why you are being asked to authorise that may relate to something much wider, as I hinted at earlier, because you have discovered the need to target this interception because of a bigger node and a bigger network.
Joanna Cherry
Q I was not asking about targeted interception, I was asking about the current Home Secretary’s specific avowal of that fact that for many years section 94 of the Telecommunications Act 1984 has been used to collect the phone records of everyone in Britain into a single national database. I am simply interested to know whether either of you gentlemen, as former Home Secretaries, could tell us whether you had authorised that.
Charles Clarke: No, I cannot, for the reasons I have stated.
Lord Reid: You would have to ask the Secretary of State that.
Charles Clarke: I do think that the related point is future-proofing. In an area where technological change is taking place so rapidly—where you have a state of affairs on the balance between security on the one hand and liberty on the other, and where we need to keep the capacity to surveille threats to society—how do we future-proof that? That was the issue I faced with RIPA in 1999-2000, and I think it is the issue that this Committee faces in thinking about this particular piece of legislation too.
Mr Hayes
Q I have many favourites.
The only question I really want to ask is whether you ever felt that the test of necessity and proportionality was insufficient to allow you to make a judgment of the kind you describe? You have said that you could call for more information and that you could qualify what you had on that basis, but in your judgment, did you ever, at any point, not feel confident to make a judgment on the basis of that prevailing test of necessity and proportionality?
Charles Clarke: For myself, I can recall only one case where I felt that. In that case, I decided not to authorise the warrant that I had been requested to authorise, for exactly the reason you suggested. There was an issue in my mind about whether the proportionality issues had been properly weighed up. I think that the proportionality issues were a constant theme of any of the warrants that were sent. You had to try to make a judgment.
I cannot recall whether there were specific guidelines on this, but when I first became Home Secretary I certainly had a couple of briefing meetings about the issues in general—not about particular warrants—to try to go through some of the principles that applied. I am sure other colleagues did much the same. I do not recall a written-down document that tried to explain the proportionality judgment in general, because obviously in reality you are always making the proportionality judgment in particular cases. My approach was that if I did not feel it was satisfactory, I would not agree the warrant.
Lord Reid: I take it that you are asking, “Were there occasions on which you refused a warrant because you didn’t think it was either proportionate, sufficient or necessary?”
Mr Hayes
Q Yes. Obviously you know, as you are very familiar with it, that that is the kind of baseline requirement. I presume that the case that was made to you was mindful of that requirement and that, for the most part, you felt it met the requirement. I just wanted confirmation of that.
Lord Reid: To give you a straight answer, yes. When I was Home Secretary, I refused a warrant. On other occasions, I refused to renew a warrant. I cannot remember specific cases in Northern Ireland, but I did it there as well. In the first instance, when a warrant is put to you, you are exercising a degree of judgment. And very often you are exercising a judgment based on other people’s judgment, and their judgment is often based on fragmentary evidence. That is the problem with all intelligence, as we know to our cost in some cases. You exercise a judgment, and that judgment is hopefully exercised diligently on the criteria: “Is this proportionate? Is it necessary? Is it reasonable? What is being asked here?” There were occasions on which the answer was no. Before you said no, the normal process would be to call in the various officials—the people who put the submission to you—if necessary, and to go through it orally and ask them questions. The answer to your question of whether I ever refused a warrant is yes.
Byron Davies
Q You have answered the main question I was going to ask, but this is carrying on from that. Times have moved on since your days in the Home Office in terms of technology, with smartphones, et cetera. If you were sat in the Home Office now, would you be looking at introducing this Bill?
Lord Reid: I don’t think it is entirely up to the Home Secretary to introduce it. There are two countervailing pressures. One is the development of cyber, which is something that, having stepped down from the Cabinet, I have voluntarily spent a lot of time working on. By the time you get this Bill through, in whatever form, we will no doubt be faced with artificial intelligence and a whole new era of communication. Yes, it would be necessary to take into account the changes, as I was saying to Ms Cherry earlier, in the world of cyber, and particularly the global nature of communications.
Secondly, there are undoubted pressures from the other end, not just the wish from the intelligence services and the policing side. I don’t think their motives and objectives have changed; what has changed is the world around them. Therefore, to meet the same objectives, they have to employ different methods on the old principles. However, at the same time, I am well aware that there has been widespread—“discussion” is a very light word—controversy about access to people’s information. Sometimes it is a paradox, because people are willing to supply all sorts of information to all sorts of private companies. That information is not only being put in a databank but is being mined, matched, sold and used for commercial reasons. Nevertheless, whatever the paradox, the concern is there, and I think the Bill tries to meet the needs of addressing technological change on the side of security at the same time as giving the reassurances necessary because of the public’s concerns about the new world in which we live and about intervention into it. That is against a background where, as the Committee will know, one of the constant characteristics of the world of cyber and communications is constant entrepreneurial innovation by black hats and white hats. It is literally changing every day. Therefore, the equivalent of today’s microdot, where we used to put secret messages, can be a webpage—an apparently innocent webpage that can be sending all sorts of instructions, propaganda or whatever. There are very bright people in both the black hats and the white hats who are constantly inventing things, vis-à-vis each other.
The Chair
We really are pressed for time, gentleman. Can we have shorter answers so I can get as many colleagues in as possible?
Charles Clarke: My short answer is yes, I would have been in favour of introducing such a Bill. I think the question of updating with future-proofing is very important. On the timing, I cannot comment on whether the Home Secretary was right to introduce it now as opposed to in five years, or five years before, or whatever. The only factor that I would add to John’s remarks is that the capacity of the organisations that we are trying to contest is a very important issue and they are very wealthy, very effective, very scientific and very powerful, as John said. An assessment will be being made, which I am not privy to now, of how effective those organisations are now, which undoubtedly would have informed the Home Secretary.
Victoria Atkins
Q I have one question for Mr Clarke. You were the Home Secretary during the 7/7 bombings. How important was your experience of warrantry and your relationship with the security services in the hours and days that followed that terrible event?
Charles Clarke: Critically important. I believe that one of our strengths in the UK is that we have good relations between the different security services, the police and the political establishment in these areas. Indeed, with 7/7 itself, there had been substantial rehearsals of the various co-operations that needed to take place. I think that co-operation between the various agencies charged with the security of the country is exceptionally important, and 7/7 reinforced that for me very much.
Victoria Atkins
Q When you were standing up in the House of Commons at the Dispatch Box explaining what the security services and the police were doing, how important was your personal oversight of that, as opposed to just a judge doing it by themselves?
Charles Clarke: The implication of your point I could not agree with more. My personal experience was very important. It did lead me, personally, directly to have relations with the individuals in the security services who were involved with these things, and I think that helped my whole job as Home Secretary.
Matt Warman
Q You talked about updating the legislation and the importance of that. Do you see an internet connection record or something equivalent to it as a key part of updating this legislation for the world we live in now?
Charles Clarke: I do personally, yes.
Lord Reid: I do as well. Not to test the Committee, but two years after 7/7, on 6 August 2006, there was a plot to bring down seven airliners. There would have been 2,500 victims, and intercept was absolutely essential in protecting those lives—absolutely essential—with both the internet and telephone communications.
Suella Fernandes
Q It has been raised before, but some witnesses have said that warrantry should be solely within the Executive function—
Lord Reid: What, sorry?
Suella Fernandes
Warrantry should be retained by the Executive. Other witnesses have said that it should be a judicial function. The double lock is a middle way. Where do you both sit on that spectrum, ideally?
Charles Clarke: Personally, I am in favour of the Executive responsibility. I would prefer to have that. I think the more you draw the judiciary directly into the operation of the law, as in continental systems, the more you threaten the ability of the judiciary to play its characteristic role. I understand why proposals are being made to have a double system, and I am not against it, but it is against my instincts, actually. It is a path that has been ill thought through. There is a whole section of lobbies in this country who believe, essentially, that the lawyers are better people, in whom you can have more confidence than in the politicians. I reject that assessment.
Lord Reid: I agree entirely with Charles on that. I think that there are a couple of other reasons as well. First, this judgment ultimately is not just the strict codification of a law, although it involves that; it is about political judgment—I therefore think that there is a second reason. The third reason is quite simple. If a wrong decision is made and 2,500 lives are lost, for instance, it will not be the judges who are held accountable—I do not just mean by Parliament, but by the family, the public, the community—it will be the Minister. Therefore, for those three reasons, I personally am in favour of this being the decision of the Executive. For the reasons that I explained, I am willing to accept that the Home Secretary has had to bow to other pressures and to put in judicial oversight, but only as long as that is about oversight and judicial process, and not about decision making. If it is about decision making, I think it is a recipe for ineffective operational capability.
The Chair
I thank our two witnesses for tailoring their responses in a way that allowed all colleagues to get in, including Back-Bench colleagues. Absolutely fascinating. On behalf of the Committee, I wish you a very happy Easter. Thank you so much for being so generous with your time.