Investigatory Powers Bill (Fifteenth sitting)

Robert Buckland Excerpts

Committee Debate: 15th sitting: House of Commons
Tuesday 3rd May 2016 Public Bill Committees

[The Solicitor General (Robert Buckland)]

It is a pleasure to serve again under your chairmanship, Ms Dorries. I have listened carefully to what the hon. and learned Gentleman and others have said about their concerns regarding the provisions, but may I reassure him and put to bed the notion that somehow this is a back door or a blank cheque to allow the authorities to do what they like when it comes to interference with the privacy of individuals? Far from it. I will explain as far as I can the purpose of the type of warrantry, particularly the national security notice, that we are talking about, and indeed the technical proficiency provisions as well.

An example of the type of support that might be required would be the provision of services or facilities to help the intelligence agencies in safeguarding the security of their personnel and operations. A notice might typically require a communications service provider to provide services to support secure communications by the security and intelligence agencies—for example, by arranging for a communication to travel via a particular route in order to improve security. A notice may additionally require the confidential provision of services to the security and intelligence agencies within the communications service providers, such as by maintaining a pool of trusted staff for the management and maintenance of sensitive communications services. I hope that gives the hon. and learned Gentleman some insight into what we are talking about here.

[Keir Starmer]

I am grateful for that indication, but I am not sure why that is an argument for not subjecting what could be a wide-ranging power to the double-lock mechanism, which has been the preferred safeguard for such powers in the Bill.

[The Solicitor General]

There are clear reasons for not going down that route. We are talking about the preparatory stage as opposed to the stage of interference with privacy. If the Government’s position was that there was a loophole—a gateway—to allow such interference, the hon. and learned Gentleman’s argument would have real strength, but that is far from the case. This is all about the preparatory stages—the necessary stages that need to be taken by communications service providers before we get to the application for what we all accept is an intrusion.

I am afraid I cannot share with hon. Members their analysis that we need a “now and forever” definition of national security in law. There is a good reason why national security is not defined in statute. Any attempt to define it in the Bill runs a real risk of restricting the ability of this country to respond to constantly evolving and unpredictable threats. It is vital that legislation does not, however unintentionally, constrain the ability of our security and intelligence agencies to protect this country. The examples are all around us: who would have imagined a few years ago cyber-attacks of the nature and on the scale that now threaten us? My concern is that if we try to rigidly define what we mean by national security, we run the risk of defeating the means by which we can keep this country safe.

[Joanna Cherry]

I hear what the Solicitor General says about the measure only facilitating preparatory steps, but under the terms of clause 218(8) we will never know whether the notices exist or their contents, so we will not be able to know whether we are dealing with preparatory steps or whether they could go beyond that.

[The Solicitor General]

I have gone as far as I can to explain the types of scenarios that the national security notices would be used for. In essence, they deal with the nuts and bolts rather than the intrusion. If somehow there was a gateway into intrusion, the hon. and learned Lady would be absolutely right, but I assure her that there is not, so the worries that she and other people and organisations have about a blank cheque, while understandable, are unfounded. I can assure her in Committee and I am happy to continue to make the assurance that the function of this type of notice is not intrusion.

Indeed, we have oversight because national security notices will be overseen by the Investigatory Powers Commissioner. The commissioner will have a duty to report at least once a year on what he or she has found and to make recommendations on where improvements can be made. The commissioner will also have the power to report on an ad hoc basis on any issue that he or she considers appropriate.

[Keir Starmer]

I am listening carefully to the Solicitor General. He says that the notices are not a gateway for preparatory steps to become steps that invade privacy, but where in the Bill is the provision that prevents that happening? The only restriction is subsection (4), which does not achieve that end.

[The Solicitor General]

With respect, I do not think that is necessary because any agency that sought to use this type of notice in order to get around the double-lock provisions in the Bill would soon come a cropper with the commissioner. That important oversight means that organisations are not operating in a vacuum; they will be held to account if they try to misuse these notices in the way that the hon. and learned Gentleman and others fear.

As I have said, we have the powers of review by the IPC. We also have the provision, pursuant to clause 220(5)(b) and (7), that the Secretary of State must consult the commissioner if a notice is reviewed, and the commissioner will then consider the proportionality of the matter before reporting conclusions to the Secretary of State. We have the checks and balances that the hon. and learned Gentleman rightly wants within the mechanism.

On amendments 853 and 854, I would say this: the role of the Secretary of State in issuing national security notices rightly reflects the responsibility of the Executive in protecting our national security; conversely, the role of the judicial commissioner in approving the issuing of warrants under the Bill reflects the particular and proper sensitivity regarding interference with private communications. We have got the double lock in place to ensure that, before the fact, a senior judge has to be satisfied that any interference with privacy is justified. The Bill explicitly prohibits—this is an important point—the issuing of national security notices for the primary purpose of obtaining private information, and the double lock then applies to the use of the most sensitive powers. We need to focus on the need for the double lock in relation to applications that result in the acquisition of private information. These types of notices do not permit the authorities to do that, so the amendments are unnecessary.

Amendments 845 and 855 deal with technical capability notices. Clause 217 builds on the current power provided for under the Regulation of Investigatory Powers Act 2000, where a company can be obliged to maintain a permanent interception capability in order to ensure that when a warrant is served, a company has the infrastructure in place to give effect to it securely and quickly. Again, any warrant served will have been reviewed by a judicial commissioner; he or she will play an important part in overseeing the operation of technical capability notices and any appeal that may be lodged against them. The commissioner will also be consulted about the making of regulations that will provide more detail about the operation of these types of notices, and those regulations will be put before Parliament for approval. Plenty of the checks and balances that the hon. and learned Member for Holborn and St Pancras, others interested in Bill and I would expect and want to see are here.

I am not persuaded of the need for amendments 852 and 859, because clause 220 already sets out the role of the IPC in the process of review and the actions that the Secretary of State must take in that process. The IPC will be integral to any review, because the Secretary of State must consult the commissioner, who will then consider whether the notice is proportionate. Inevitably, considerable weight will be afforded to the advice of the commissioner. The role of the commissioner provides an opportunity for the person on whom the notice has been served and for the Secretary of State to present evidence. The conclusions of the commissioner will be reported to the Secretary of State and to the person who has made the reference. After consideration of the conclusions, the Secretary of State may decide to confirm the effect of the notice, to change or vary it, or to withdraw it. Until that decision is made, there is no requirement for the person who has referred the notice to comply with the specific obligations under review.

In a nutshell, there are plenty of adequate safeguards to alleviate the concerns expressed by the hon. and learned Gentleman. I urge him to withdraw his amendments.

--- Later in debate ---

[Joanna Cherry]

I respectfully support everything that the hon. and learned Gentleman has said.

[The Solicitor General]

In arguing in opposition to the amendments, I first want to address the last point that the hon. and learned Member for Holborn and St Pancras made. I can come back to his point about the tests, but in a nutshell, they are inherent to the Bill. The tests of necessity and proportionality are part and parcel of the decision-making process that the authority will be enjoined to carry out.

[Keir Starmer]

It is noticeable that, for obvious reasons, necessity and proportionality have been written into relevant clauses throughout the Bill, but here, I think for the first time, we have a wide-ranging power with no such test—unless I have missed it, in which case I will happily concede the point.

[The Solicitor General]

In strict terms, the hon. and learned Gentleman is right—I am looking at clause 218 in particular. I think that subsection (3) might help him, because although we do not have the words “necessity” and “proportionality” there, the matters to be taken into account lead one to conclusions based on necessity and proportionality, and perhaps do so in a more prescribed way that is more helpful to the decision maker. Subsection (3)(a) to (e) addresses the hon. and learned Gentleman’s point, and I put it clearly on the record that the principles of necessity and proportionality are part and parcel of the tests to be applied.

I also note that necessity is required under clause 217(6), which relates to the steps specified in a technical capability notice. I do not know whether that helps the hon. and learned Gentleman. I will certainly consider the issue carefully, but on the face of it, I do not think there is a worry of the sort that he envisages.

[Joanna Cherry]

The Intelligence and Security Committee described the clause as a

“seemingly open-ended and unconstrained power”.

Does the Solicitor General not agree that it is therefore essential that the tests of necessity and proportionality are spelled out in the clause, as they are in other parts of the Bill?

[The Solicitor General]

I hear the hon. and learned Lady, but I am not convinced that the basis of her argument is right given the breadth of the power. As I said in the context of national security notices, the technical capability notice is only a preliminary step. It will allow the subsequent implementation of a warrant, which will then be subject to the tests of necessity and proportionality. I would not want the Committee to operate under a misapprehension. It is my strong, and I hope clear, assertion that we are dealing with an earlier stage of the process, so we should not be driven to the conclusions that I know critics of the Bill want us to reach.

May I deal with encryption, which, as the hon. and learned Gentleman rightly characterised, is at the heart of the matter? I put it on the record that the Government recognise the vital importance of encryption. It has become part of our daily lives. It keeps our personal data and intellectual property secure and ensures safe online commerce, and the Government work closely with industry and business to improve their cyber-security. I can reassure the Committee that in the preparation of the code of practice, there has been close consultation with the interested parties in the industry to ensure that it comprehensively reflects the realities and needs of those who operate in this sphere. Not only does the code of practice replicate the provisions of RIPA, but it goes further, with a degree of specificity that is not possible in primary legislation. It will be a flexible, living instrument that will form a clear prospectus within which everyone can work. I make no apology for the measure being in a code practice, which is where it should be, rather than in primary legislation. With the best will in the world, we all know that it is difficult to amend primary legislation and ensure that it keeps pace with the somewhat breathtaking changes that occur in this particular field of operation.

I also want to talk about the role of GCHQ, which plays a vital information assurance role and provides advice and guidance to allow the Government, industry and the general public to protect their IT systems and use the internet safely. As the director of GCHQ, Robert Hannigan, made clear in his speech on 8 March:

“I am accountable to our Prime Minister just as much, if not more, for the state of cyber security in the UK as I am for intelligence collection.”

In the past two years the security and intelligence agencies have disclosed vulnerabilities in every major mobile and desktop platform, including some of the big names that underpin business here in the UK. In September 2015, Apple publicly credited CESG, the information assurance arm of GCHQ, with detecting a vulnerability in its operating system for iPhones and iPads, and we all know where that vulnerability could have led. The vulnerability was fixed as a result of that intervention, so the suggestion, which I know has not been advanced in this Committee—and I hope will not be—that the Government are opposed to encryption, or would legislate to undermine it, is wholly wrong.

We have to ensure that we have the necessary capabilities to keep our systems safe. Encryption is now, in effect, the default setting for most of our IT products and online services, and although it can be a power for good in keeping the law-abiding safe and secure, sadly it is used easily and all too cheaply by terrorists, paedophiles and other criminals. Therefore it can only be right that we retain the ability to require telecommunications operators to remove encryption in strictly limited circumstances, with strong controls and safeguards, so that we can address the increasing technical sophistication of those who would seek to do us harm. If we do not do that, we must simply accept that there are areas online that are beyond the reach of the law, where criminals can go about their business unimpeded and without the risk of detection. I do not accept that, and I know the general public do not accept it either. That is our starting principle.

[Joanna Cherry]

Clause 218(8) and (9) provides that the recipient of a notice must comply with it but must not disclose either its existence or its contents. Does that mean that if an Apple against the FBI scenario were to occur in the UK, Apple would not be able to disclose even the fact that it had been served with a notice, let alone challenge it in court? That is how I read it.

[The Solicitor General]

Not without the permission of the Secretary of State. I will return to the mechanism in question, but I am grateful to the hon. and learned Lady for raising that point. I am sure I will be able to provide her with clarity as I develop my remarks.

The starting principle is shared by David Anderson, who in his important review said:

“My first principle is that no-go areas for law enforcement should be minimised as far as possible, whether in the physical or the digital world.”

That view was shared by the Joint Committee on the draft Bill and is shared by the Select Committee on Science and Technology, both of which recognise that, in tightly prescribed circumstances, it should remain possible for our law enforcement and security and intelligence agencies to be able to access decrypted communications or data. That is what clauses 217 and 218 are all about: strong safeguards to ensure that obligations to remove encryption can be imposed only in limited circumstances, subject to rigorous controls.

--- Later in debate ---

[Keir Starmer]

I looked carefully at that subsection, but perhaps the Minister could explain why it is a limiting provision. It is a requirement provision as far as the notice is concerned, but on the face of it, encryption is not limited to protection applied by, or on behalf of, the person themselves. It tells us how that situation would be dealt with, but it is not limited to that.

[The Solicitor General]

I have been interested in the clause for a while, because there are issues about what “relevant notice” means, for example. I assure the hon. and learned Gentleman that that applies only to technical capability notices, not national security notices. I will carefully consider how we can make that absolutely clear, and in that context I will have another look at the how the clause is worded. I want to put beyond any doubt the fact that the clause relates only to a technical capability notice and does not relate to third parties. That has been an important undertaking that we have given.

[Mr Hayes]

Deliberating on the interesting discourse that has taken place between the Solicitor General and the hon. and learned Member for Holborn and St Pancras, I take the point that the hon. and learned Gentleman makes about necessity and proportionality running as a theme throughout the Bill. My hon. and learned Friend the Solicitor General is of course right that these are preliminary measures, and therefore once an outcome that has been tested for proportionality has been reached, that will not be a problem. I say to him that there is an argument for taking that into account and making it even clearer, either in the supporting documentation or in the Bill.

[The Solicitor General]

I am grateful to my right hon. Friend, and I will do that.

Before I go further, I will deal with the point that the hon. and learned Member for Edinburgh South West made about Apple. My understanding is that the process will give her some reassurance. In that scenario, Apple, as the recipient of the notice, could refer it back to the Secretary of State, who in turn must then consult the technical advisory board and the IPC before deciding whether to proceed further with the notice. If the Secretary of State proceeded, it would then be judicable in the courts, which would determine whether the notice could be enforced. It is quite similar to the scenario that we discussed in the context of national security notices. I hope that gives her some assistance.

[Keir Starmer]

I have looked at this issue in the past day or two, and I was concerned about the implication that on the face of it, one could not challenge the provision in court, because there is an absolute bar on disclosure. Am I right in assuming—if I am, it should be on the record—that the Secretary of State will give permission, where appropriate, for a legal challenge to be brought? In other words, there could be disclosure for the purposes of legal proceedings.

[The Solicitor General]

On the face of it, that has to follow. If any clarification is needed on that, I am sure I can assist as I further develop my remarks.

I was dealing with the process of consultation before the giving of a notice, and we have had the Apple example. I would like to develop the importance of the draft codes of practice, which the hon. and learned Gentleman has referred to.

[Suella Fernandes (Fareham) (Con)]

The Solicitor General is talking about the power of review in clause 220, which should be read with the power to issue notices. That is important because it obliges the Secretary of State to consult the technical advisory board and the Investigatory Powers Commissioner. That process was endorsed by EE, a communications service provider, in its evidence to the Joint Committee on this very point.

[The Solicitor General]

I am grateful to my hon. Friend, who provides an example of the sort of dialogue that will be very much part of the process. There will not be mere diktat without further discussion. I was about to develop that point in the context of the draft codes of practice, because they make it clear that should a telecoms operator have concerns about the reasonableness, cost or technical feasibility of any requirements set out in a notice, which of course would include any obligations to remove encryption, they should be raised during the consultation process. That is the dialogue that we have talked about. Also, a telecommunications operator that is given a technical capability notice may refer any aspect of it—again, I gave an example earlier—including obligations relating to removal of encryption, back to the Secretary of State for review. We have dealt with the consultation process set out in the Bill.

The Bill makes it absolutely clear that in line with current practice, obligations placed on telecommunications operators to remove encryption may relate only to encryption by or on behalf of the Government. That is the point I was making about subsection (4).

[Lucy Frazer (South East Cambridgeshire) (Con)]

I wonder whether clause 217(3) is relevant in the context of what we are discussing. It shows that the Secretary of State can impose the requirements only in so far as they are practicable. The Secretary of State will be prevented from requiring a service provider to do something that it cannot do, for example because a third party has encrypted the material and it is not physically capable of assisting.

[The Solicitor General]

I am grateful to my hon. and learned Friend, who is right to pray in aid that subsection, which sets out the bones on which we flesh out the procedure in the code of practice.

[Christian Matheson]

I am getting a bit confused. My understanding was that these provisions applied only to communications service providers. I think it was the hon. and learned Member for Edinburgh South West who raised the question of Apple, which to my mind is not a communications service provider, but the Minister responded in the same terms. Will he clarify who exactly we are talking about and who the provision is intended to cover?

[The Solicitor General]

The hon. Gentleman is right to make that important point and to steer us back on to the straight and narrow. I am not criticising the Committee for trying to bring the Bill to life with some examples. We are indeed talking about communications service providers, not third parties, which is important in the context of the Bill.

[Joanna Cherry]

Are we not concerned here with the “relevant operator”, which is defined in clause 217(2) as

“a postal operator…a telecommunications operator, or…a person who is proposing to become a postal operator or a telecommunications operator.”?

That definition is the basis of the concern for companies such as Apple.

[The Solicitor General]

The hon. and learned Lady is absolutely right to bring us back to clause 217(2). The problem that hon. Members are anticipating is that the provisions will somehow catch parties that no one would regard as appropriate. I think I have given clear assurances on that third party problem.

[Sir Simon Burns (Chelmsford) (Con)]

I am very grateful to my hon. and learned Friend, and I do not want to be unhelpful, but I would like some clarification regarding Apple. As he is aware, Apple refused to do what the FBI asked. Although the case was never ultimately determined by the courts, because the FBI managed somehow to break open the machine and retrieve the information, how would the clause affect a similar situation if a provider such as Apple refused point-blank to co-operate, just as it did with the FBI?

[The Solicitor General]

In endeavouring to answer my right hon. Friend’s point, may I deal first with the question about telecommunications operators? Some assistance may be gained from clause 223(10), where a telecommunications operator is defined in a way that includes Apple. The famous Apple case—the California case—was about the use of a password, which is slightly different from the question of encryption, but it does demonstrate the important tussle between the need to balance public safety and privacy. In that case, the FBI, with an appropriate search warrant, was asking for the chance to try to guess the terrorist’s passcode without the phone essentially self-destructing—after so many tries, everything gets wiped.

We are talking about an attempt to obtain communications data within the robust legal framework that we have set out, with the double lock and all the other mechanisms that my right hon. Friend and the Committee are familiar with. I am grateful to him for raising that case, but there are important differences that it would be wrong to ignore. In a nutshell, without the powers contained in the Bill, a whole swathe of criminal communication would be removed from the reach of the authorities. That is not in the interests of the constituents he has served with distinction for well over a quarter of a century—he will forgive me for saying that—or any other of the constituents we represent.

I was going to come back to the obligations imposed under a technical capability notice, with particular regard to the removal of encryption. The obligations imposed under such a notice will require the relevant operator to maintain the capability to remove encryption when it is later served with a warrant notice or authorisation. That is different from merely requiring it to remove encryption. In other words, it must maintain the capability, but there then needs to be the next stage, which is the warrant application and the notice of authorisation, where there is of course the double lock. The company on which the warrant is served will not be required to take any steps, such as to remove encryption, that are not reasonably practicable.

In a nutshell, this measure is about not an interference with privacy but sets out the preparatory stage before a warrant can be applied for. The safeguards provide the strict controls that I assure the Committee are needed in this sphere of activity. We are maintaining and clarifying the existing legal position.

[Joanna Cherry]

I am anxious to clarify what the Solicitor General said about the justiciability of the issuing of such a technical notice. As far as I can see, the Secretary of State is the gatekeeper to justiciability, because the contents of a notice can be revealed only with his or her permission. Where does it say that that can be justiciable, because I cannot find it?

[The Solicitor General]

I think it is clause 220, but I will get some further assistance on that point for the hon. and learned Lady before I resume my seat. I am grateful for that intervention.

The Bill does not drive a coach and horses through encryption. It does not ban it or do anything to limit its use. A national security notice—we debated this matter on clause 216—cannot require the removal of encryption, which further supports my argument that there is no blank cheque in the context of these notices. On the issue of civility, rather than keep this Committee waiting, I will write to the hon. and learned Lady to clarify the point that she rightly raised.

[Victoria Atkins (Louth and Horncastle) (Con)]

This is a general point. Although we are examining this Bill in detail, there will of course be an ongoing debate, particularly as the technical companies tussle with the public, about what the public find acceptable. Those companies should not think that the debate ends here; they will have to justify their actions to the public in future.

[The Solicitor General]

My hon. Friend is absolutely right. The code of practice has been drafted in that real-life context. It will no doubt be amended and looked at—it will be a living document—as this technology develops and as we move forward. With this clause, we are trying—I do not like this phrase, but I have to use it—to future-proof the legislation to make it resilient so that it lasts and to ensure that this House does not have to return to it time and again to respond to the challenges that increased and enhanced IT present.

[Lucy Frazer]

My hon. and learned Friend referred to clause 220, which indeed does give the person who receives the notice the power to give it back to the Secretary of State, who then has to consult the Technical Advisory Board and the Investigatory Powers Commissioner, who will then take evidence from those people.

--- Later in debate ---

[The Solicitor General]

I am glad that my hon. and learned Friend has reminded us of that. I referred earlier to that consultation process. The next stage is when the Secretary of State decides to proceed. I will consider that issue even more carefully to ensure that the Committee is furnished with as much information as possible before Report.

Let me deal with the amendments tabled in the name of the hon. and learned Member for Holborn and St Pancras and others. On amendment 846, the Bill already makes it absolutely clear that a communications service provider will not be obligated to remove encryption where it is not reasonably practicable for them to do so. I do not think the amendment adds anything, and in many cases it would have the effect of inhibiting law enforcement agencies and the security and intelligence services from working constructively with tele- communications operators as the technology develops. I am sure that that is not the intention of the amendment. Depending on the individual company and the individual circumstances, it may be entirely sensible for the Government to work with a company to determine whether it would be reasonably practicable for it to take steps to develop and maintain the technical capability to remove the encryption it has applied to communications or data.

My worry about the amendment is that we would end up with communications services that can be used by criminals and others to communicate with each other unimpeded. We know that internet gambling sites, which have chat room provisions, are used by criminals for entirely unrelated criminal activities. I am sure that that is not the intention behind the amendment. Therefore, with respect, I urge hon. Members to reconsider it.

I will not deal in detail with amendment 847, because I do not think the hon. and learned Gentleman seeks to press it. Although I oppose it, I will move on without argument to amendments 848 and 858. We have discussed similar amendments on extraterritoriality in relation to other powers in the Bill. I pray in aid the arguments I used earlier. The provisions in the Bill allow a notice to be given in the most appropriate manner, taking into account the preferences of each company, which is an example of the adaptability of the legislation to the real world.

Amendment 848 is unnecessary because the clause is about not the acquisition but the development and maintenance of a technical capability. Conflict of law issues are much more likely to arise in respect of giving effect to a warrant, and we already have protection in the Bill for such cases. Admirable though the amendment may seem, it is therefore unnecessary.

Amendment 849 is unnecessary because it duplicates provisions in clauses 218, 216 and 217. I have discussed clause 218(3), which stipulates that the Secretary of State must consider a wide range of matters before giving a notice. That detailed assessment already speaks to the issues raised by the amendment. The Secretary of State has to be satisfied that the conduct is proportionate, justified, necessary and practicable.

[Joanna Cherry]

I am sorry to interrupt the Solicitor General’s flow, but I sense he is coming to the end of his argument. Will he clarify something? Am I right in understanding that there is nothing in the clause to prevent someone who is intent on evading surveillance from using open-source encryption software that is personally generated by the user? That would mean they could encrypt files and email communications themselves, independent of any provider, and therefore remain untouched by this legislation.

[The Solicitor General]

That question is about the definition of the provider. I am sure we will be able to provide some clarity on that before I draw my remarks to a conclusion. I am grateful to the hon. and learned Lady for raising that point.

Amendment 850 relates to consideration by the Secretary of State of the effect of a notice on the privacy and human rights of people both here and outside the kingdom. The amendment is unnecessary because of the point I made before, which I will reiterate: the clause is not about notices authorising an interference with privacy. A warrant provided for elsewhere in the Bill is required to do that, and we have already considered the potency of the double lock and the test to be applied. A point that is relevant to all the amendments in this group is the statutory function of the Investigatory Powers Commissioner to oversee the use of notices. I raised that in the context of national security notices, and I pray it in aid here again.

Amendment 857 seeks to narrow the category of operators to whom a technical capability notice can be given. I am worried that that would limit the effects of law enforcement. We know about the diversification of criminality and terrorism in order to find new ways to avoid protection. I am concerned that narrowing the legislation would allow loopholes to get larger. It is therefore important that the obligations relating to the technical capabilities for a range of operators can be imposed by the Government in order to ensure we keep ahead of the curve.

The hon. and learned Lady made the powerful point that the clause does not relate to personally applied encryption. However, measures in part 3 of RIPA 2000 provide for where law enforcement agencies can require an individual to remove encryption that he or she has applied themselves. We know that the Bill generally does not cover all the agencies’ powers. This is perhaps a welcome opportunity to remind ourselves of the existing provisions in part 3, so I am grateful to her.

Of course we accept that it may well be appropriate to exclude certain categories of operator from obligations under the clause—I am thinking, for example, of small businesses; we are always mindful of the burden of regulation on small businesses—but it is our intention to use secondary legislation to achieve that. It would not be appropriate in primary legislation to impose blanket exemptions on services with a communications element that are not primarily communications services. To do so would send a rather alarming and clear message to terrorists and criminals that communications over certain systems will not be monitored. That sort of carve-out recalls the point that I made about the use by criminals of seemingly unrelated or innocuous communications channels in other internet facilities or apps, in order to hide their illicit enterprises.

I know that I have taken up an inordinate amount of the Committee’s time. I am obliged to the Committee and to you, Ms Dorries, for your indulgence. I hope that I have set out the reasons why I urge hon. Members to withdraw the amendment, and I pray in aid my arguments as advancing the case that the clause should stand part of the Bill. I urge the hon. and learned Gentleman to withdraw the amendment.

[Keir Starmer]

I have only three issues to address. The first, which requires more attention from the Solicitor General—I say so with no disrespect—is the question of the extent of the prohibition on disclosure and, essentially, access to the courts or appropriate tribunals. On the face of it, clause 218(8) is a prohibition on disclosure, save with the permission of the Secretary of State. With respect to Committee members, I do not think that clause 220 provides the answer, because that deals with the consultation exercise where a notice is being reviewed.

I have no doubt that, if the Secretary of State exercised her power under clause 218(8) to prevent access to the courts, it would run straight into an article 6 access to courts argument that would succeed on judicial review. I had assumed that one could read into the clause by implication that permission would not be refused in a bona fide and proper case where access to court—or the relevant tribunal, which may be a better way of putting it—was an issue. If that were made clear for the record or by some redrafting of the clause, it would help. As I said, I think that, in practice, any court in this jurisdiction would strike down pretty quickly a Secretary of State who sought to prevent access to the court.

[The Solicitor General]

I think that the hon. and learned Gentleman is right about that. On that basis, I will have another look at clause 218(8), to get it absolutely right. I reassure him that it is not the Government’s intention to preclude access to the court.

[Keir Starmer]

I am reassured. I am sure that that would not be the case, but it might be sensible to clarify that rather than relying on clause 220, because I am not sure that that is the right way to do it. However, I will say no more about that.

I was going to press for votes on amendments 846 and 849, but I have listened carefully to what the Solicitor General said and to what the Minister said when he rose to make some observations earlier. They are by far the two most important amendments. Amendment 846 deals with encryption. I think I heard the Solicitor General say that he will look again at the wording of clause 218(4) to see whether it is possible to make clear what is clear in the code of practice, namely, that an obligation placed on a CSP to remove encryption relates only to electronic protections that the company itself has applied to intercepted communications and secondary data. That is clearly the position that the Government adopt, because it is now set out in the code. I think that the Solicitor General might accept that, at the moment, clause 218(4) does not quite achieve that objective. On the basis that he is prepared at least to look at that again, I will not press amendment 846.