Draft Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 Draft Investigatory Powers (Technical Capability) Regulations 2018 Draft Investigatory Powers (Review of Notices and Technical Advisory Board) Regulations 2018 Draft Investigatory Powers (Codes of Practice) Regulations 2018

Ben Wallace Excerpts

Thursday 25th January 2018 General Committees

[The Minister for Security and Economic Crime (Mr Ben Wallace)]

I beg to move,

That the Committee has considered the draft Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018.

[The Chair]

With this it will be convenient to consider the draft Investigatory Powers (Technical Capability) Regulations 2018, the draft Investigatory Powers (Review of Notices and Technical Advisory Board) Regulations 2018 and the draft Investigatory Powers (Codes of Practice) Regulations 2018.

[Mr Wallace]

It is a pleasure to serve under your chairmanship, Mr Rosindell. I am pleased to be given the opportunity to debate these important regulations, which are being made under the Investigatory Powers Act 2016. The Act passed with strong support from Members on both sides of the House of Commons and received Royal Assent in November 2016, following unprecedented parliamentary scrutiny.

That legislation brings together the powers available to our law enforcement and security and intelligence agencies to obtain communications and data about communications. It ensures that those powers and the safeguards that apply to them are clear and understandable, and it radically overhauls how the powers are authorised and overseen. It introduces a double lock for the most intrusive powers so that they cannot be used until the decision to do so has been approved by a judge. It has also created a powerful new Investigatory Powers Commissioner—a post held by Lord Justice Fulford—to oversee how the powers are used.

Let me be clear: the powers in the Act are absolutely crucial to our national security and the safety of our citizens. They make sure that our law enforcement and security and intelligence agencies are equipped to carry out their critical work of protecting the public and ensuring that terrorists, paedophiles and other perpetrators of serious crimes can be brought to justice. In the light of the horrifying attacks in this country in the past year, making sure that our agencies maintain the powers that they need is more important than ever.

The regulations are all intrinsically linked to the implementation of the Act. They do not create any new powers; rather, they enable a number of the Act’s provisions to be exercised and set out further details of how certain powers will be used. Collectively, they also create additional safeguards about the use of the powers, building on those set out in the primary legislation.

We will debate four sets of regulations. First, the draft Investigatory Powers (Codes of Practice) Regulations 2018 bring into force five codes of practice covering a number of vital provisions under the Act. The codes relate to the interception of communications, equipment interference, the bulk acquisition of communications data, national security notices and the intelligence services’ retention and use of bulk personal datasets. Each of the five codes sets out processes and safeguards governing the use of the investigatory powers to which they relate. They give detail on how the relevant powers should be used, including examples of best practice. They provide additional clarity and ensure that the highest standards of professionalism and compliance with this vital legislation are adhered to.

The codes are primarily intended to guide the public authorities that can exercise powers under the Act, as well as communications service providers that might be required to provide assistance in giving effect to its provisions. The codes provide information on the process associated with applying to use each of the powers, as well as the safeguards and oversight arrangements that will ensure that the powers are used in the intended manner. The codes are detailed and comprehensive, together with more than 400 pages of guidance and best practice, ensuring that the use of these important powers is subject to the most stringent safeguards.

Secondly, the draft Investigatory Powers (Technical Capability) Regulations 2018 set out the obligation that may be imposed on a telecommunications or postal operator in a technical capability notice. The purpose of such a notice is to ensure that when a warrant or authorisation is served on or given to an operator, that company has the capability to provide assistance, giving effect to it securely and quickly.

As part of maintaining a technical capability, the Act specifies that a telecommunications operator may be required to maintain the capability to remove encryption from communications that it has applied or that has been applied on its behalf. The regulations do not change that position and simply make it clear that such an obligation could be included in a technical capability notice when necessary and proportionate.

The Act sets out robust safeguards on the use of technical capability notices. Such a notice may be given by the Secretary of State only where necessary and proportionate, having taken into account a number of factors such as technical feasibility and cost, and having consulted with the operator to which a notice is to be given. The decision of the Secretary of State to give a notice must be approved by a judicial commissioner.

Thirdly, the draft Investigatory Powers (Review of Notices and Technical Advisory Board) Regulations 2018 are fundamentally linked to the technical capability regulations. The Act provides for the important safeguard that a telecommunications operator in receipt of a technical capability notice, a national security notice or a data retention notice may seek a review of that notice by the Secretary of State. In conducting such a review, the Secretary of State must consult the Technical Advisory Board—a non-departmental public body—as to the technical feasibility and cost of the notice. These regulations set out the circumstances in which a review may take place and how the board must be constituted.

The final set of regulations is the draft Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018. The Act provides that it is a criminal offence to intercept communications in the absence of lawful authority. It also makes clear that lawful authority includes interception by businesses or other bodies where it is legitimate practice. The regulations set out what conduct that includes, and simply ensure that companies can undertake routine activities without falling foul of the offence of unlawful interception. Such activities might include, for example, call centres recording telephone calls for training purposes or companies scanning their computer networks to detect cyber-attacks.

In summary, the regulations give effect to provisions already set out in primary legislation that is fundamental to our national security. The regulations make clear how a number of provisions in that Act will operate, and establish additional safeguards to the already rigorous controls set out in the primary legislation.

--- Later in debate ---

[Mr Wallace]

May I first thank the official Opposition for their position and considered view on the regulations? The passing of the Investigatory Powers Act 2016 through the House was a significant process, with many Government concessions and lots of working across party lines to ensure that we struck the balance between freedoms and security, while trying to allow our law enforcement agencies and intelligence services to stay one step ahead of paedophiles and terrorists who often exploit technology to outwit or to remain undetected.

It is not easy in my job to listen to the intercepted communication of paedophiles plotting to kidnap a child. Sometimes that is behind encrypted communication. They do that knowing that they are hard to detect because some of the data they use is hard for us to analyse or capture. That is why the 2016 Act was so important. I do not think any Government like to change a piece of legislation at any stage, but it has allowed us to detect, prosecute and convict some of the people in society who pose a real danger to us.

The codes of practice are user-friendly, believe it or not. Often the statutory instruments we debate are slightly gobbledegook and we have to refer to the explanatory notes and go back to the original debate to understand what they are about. The codes of practice are designed for the superintendent or the official sitting at their desk doing an investigation to ensure that they comply with the law. The codes are user-friendly and accessible.

In the drafting of the codes of practice, I was determined to ensure that the protections we promised to the House in primary legislation are reflected strongly. In terms of the protected professions, I ensured that journalism, about which people expressed concern during the passage of the Bill, was given the due prominence required in the codes so that when people are considering using the powers, they understand that we have to give extra consideration to a number of protected provisions. For that reason, I am content with the regulations.

I am grateful for the official Opposition’s support. The regulations contain all sorts of ways to ensure that the agencies are held to account. Lord Justice Fulford is a formidable individual and a highly respected judge. The independence of the interception commissioners will be without question. One or two are from Scotland and some are from jurisdictions across the United Kingdom to ensure that it is not just the usual suspects, but a broad base of judiciary, and our decisions and the technical notices will be subject to that scrutiny. Judges will not do it with favour; they will do it in compliance with the law. When I look across the oversight that we now have, both independent and in this House, of our intelligence agencies, I see that we have the Intelligence and Security Committee, the varying roles of the tribunals, including the Investigatory Powers Tribunal—some of those roles will be folded into the commissioners’ jobs—and Parliament and the review of terrorism. We have many more layers of oversight than some of our contemporary countries across Europe and the United States, and we should be proud of that.

When I visit our intelligence services, I am always struck by how determined they are to abide by the law. Sometimes I am tempted to say, “Why are we not doing more of this?” and more and more they reflect back to me, “Minister, we have to do what is proportionate, necessary and no more.” Those professionals in those organisations take that duty incredibly seriously. The secondary legislation will ensure that they have that capability. I genuinely believe that by having it, they will help us and our children stay safe from predatory paedophiles, terrorists and organised crime. The hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East will know that only recently one of the major serious organised crime kingpins was arrested. He had military-scale weapons on him, including military-grade communication encryption. That is the enemy we can be up against, and that is why we need the powers. I urge him to reconsider his opposition.

The legislation has had lots of airing, and I am incredibly grateful to all parties that have supported it. The people who use it do so in a measured, proportionate and necessary manner.

Question put and agreed to.

Draft Investigatory Powers (Technical Capability) Regulations 2018

Motion made, and Question put,

That the Committee has considered the draft Investigatory Powers (Technical Capability) Regulations 2018.—(Mr Ben Wallace.)