David Anderson gave evidence.

Welcome, Mr Anderson. Before we start, do any Members wish to make a declaration of interest?

Thank you, Ms Dorries. May I make a declaration of interest in relation to this witness and a number of other witnesses generally? I know this witness and some others; I have worked with them both as a lawyer and as Director of Public Prosecutions. I therefore put that on the record—if I may make a general declaration, it applies to Mr Anderson and quite a number of the witnesses today.

Ditto. I know many of the witnesses as well.

David Anderson was my pupil master when I was a barrister.

I do not know this witness, Chair, but Mr McClure, a witnesses this afternoon, is my constituent and is known to me personally.

I was a member of some of the agencies that will attend today.

I was a Treasury counsel, representing Government Departments.

I was previously standing junior counsel to the Scottish Government, which has some tangential interest to the serious crime provisions.

Okay; that is all the interests out of the way. We will now hear oral evidence from David Anderson QC, independent reviewer of terrorism legislation. Before calling the first Member to ask a question, I remind all Members that questions should be limited to matters within the scope of the Bill, as always, and that we must stick to the timings in the programme motion that the Committee has agreed. For this session, we have until 12 noon. Could the witness please introduce himself for the record?

David Anderson: I am the independent reviewer of terrorism legislation and the author of the report “A Question of Trust”.

It is a pleasure to serve under your chairmanship, Ms Dorries. Good morning, Mr Anderson. There are obviously a lot of people around the table whom you know, going by the declarations of interest. May I go straight to one of the central issues in your report, which was the need for an operational case for the powers in the Bill, and particularly the bulk powers? Having now had the opportunity to see what has been published between the Joint Committee report and the publication of the Bill, are you satisfied with the operational cases that have been published?

David Anderson: I was pleased that the Joint Committee recommended that a detailed operational case should be served in relation to each of the bulk powers. I was a little sorry that it did not also recommend a detailed operational case in relation to the police use of targeted equipment interference. I do not think I have seen the case for why that should be necessary in addition to the powers they already have under the Police Act 1997 on property interference.

In terms of the case itself, I salute GCHQ and others for being able to produce a 47-page case in circumstances that are very much about not being fully transparent about exactly how the powers are going to be used. One needs to know what the powers are, and it seems to me that, for public consumption, they have done a pretty good job that should enable Parliament to debate whether those powers are necessary or not.

I also believe, because I have seen it, although not read it, that they produced a detailed secret annex to that operational case, which was provided to the Intelligence and Security Committee. I noticed that when Dominic Grieve, the Chair of that Committee, made his speech on Second Reading of the Bill, he said that he—and I think, by implication, the Committee—was satisfied that each of the powers sought was necessary and proportionate. If the Committee has satisfied itself of that by reference to the detailed operational case, including the secret annex, that is very reassuring for all of us. If it has not, no doubt it will wish to do as the Bill completes its passage.

May I follow up on that? First, so far as operational cases are concerned, do you think there is still a need for an operational case for the police use of equipment interference powers? Secondly, is your  view that the ISC should formally indicate whether it has considered the material and is satisfied with what it has seen, rather than implying it in a speech? Thirdly, do you think there is a need for an independent assessment of the operational case? It is one thing to publish it and to put material before the ISC; it is another to have it independently assessed. Apologies for asking three questions, but should a case be made for police use of equipment interference powers; should the ISC be called upon to formally indicate its response to what it has seen; and do we need an independent assessment of the operational cases in full?

David Anderson: On your first question, I pointed out in my written evidence of January to the Joint Committee that, so far as I could see, there had been no detailed operational case on police use of equipment interference powers. From my point of view, I would like to see it. So far as the ISC is concerned, it is not for me to say what it should and should not do, but I am mindful not only of its duty to serve Parliament, but of the fact that when the courts, and particularly the European Courts, come to look at the bulk powers, as inevitably they will, it will be of great interest to them, one imagines, to see just how much evidence was put forward in relation to the necessity for the case and who considered that evidence.

As to whether there should be, as you put it, independent review in addition, I am not persuaded of the case for that. The ISC demonstrated its independence in the most dramatic way possible in its report of early February when it declared that it thought that there was no need for one of the bulk powers—bulk equipment interference. Now, it may be that there has been some rowing back from that position, judging again from the speech of Dominic Grieve on Second Reading, but I think that it would be very difficult to say that the ISC had not had an independent look at these issues .

Can I ask you about bulk powers? From your experience, could you start by giving the Committee an indication of the scope of some of the bulk powers and warrants, perhaps by reference to the equipment and interference bulk powers?

David Anderson: The bulk powers, of course, are extraordinarily broad in scope, although the practical effect of that breadth is greatly limited by what happens after the line has been tapped or the device has been accessed. That is really the stage that makes it proportionate. My concern, particularly in relation to equipment interference, is that, if one looks at the so-called targeted power and, in particular, at its potential thematic use, it is quite extraordinarily broad. We are looking, I think, at clause 90 of the Bill. A so-called targeted equipment interference can be performed—devices may be subject to equipment interference if they are concerned in an operation or an investigation, or if they are in a location not defined.

The code of practice indicates that that power is very broad indeed—so broad that the ISC said:

“The so-called targeted power appears to be very broad. We are not quite sure what, in addition, you would get from the bulk power.”

I think that matters because the safeguards on the targeted power are less than the safeguards on bulk. For a start, you do not need to be aiming only at somebody outside the UK or people outside the UK. You can quite properly target it inside the UK. Secondly, you do  not have the safeguard that you have with a bulk power that, if you are going to look in detail at one individual within the UK, you need a full individual warrant as well.

The commissioners have been very cautious in the past in allowing thematic powers to be too broad. One could say, “Let’s put it all on the commissioners. Let’s rely on them to make sure that the thematic power is not too broadly used.” I would feel a little more comfortable if there were more constriction in the statute.

One of the safeguards is the need for necessity in relation to bulk powers. From your experience, how easy or difficult is it to demonstrate necessity in relation to bulk powers? Give us an idea of the way the test actually operates in your experience.

David Anderson: I have seen the detailed warrant applications that currently go usually to the Foreign Secretary in relation to a bulk power. They currently have an extremely broad range of purposes that the bulk power is said to serve. I am sure that it is all very carefully considered by the warrant granting department at the Foreign Office and then by the Foreign Secretary. There will certainly be much stronger safeguards under the new Bill, and I welcome that.

Can I take you from bulk to internet connection records, which you dealt with in your report? There have been comments about and criticism of the definition—or lack of definition—of internet connection record. Looking at the version in the Bill now, do you have any concerns about the definition?

David Anderson: I last looked in detail at internet connection records almost a year ago now, and even an operational case had not been made. There certainly had not been the dialogue with communication service providers that would have been necessary to make it work. I am afraid that I have not followed in the same technical detail as the Joint Committee on the Draft Investigatory Powers Bill and the Select Committee on Science and Technology the arguments on the extent to which they have been properly defined, the extent to which it will be feasible to produce these records or, indeed, how much it would cost. Therefore, I cannot, I am afraid, raise any alarms on that or give you any reassurance, save to say that these would appear to remain live issues.

ICRs are obviously new and developing in real time, but there are a number of other novel and contentious areas in the Bill. Do you see any role for greater independent authorisation in relation to some of these new techniques or powers?

Order. Mr Starmer, can you make that your last question, please, because it is already 11.45 am and I think other people would like to ask some questions?

I will do. Thank you.

David Anderson: Do I answer that question, Chair?

Yes, but as briefly as you could, please. If not, you can provide a written answer.

David Anderson: Internet connection records are a form of communications data. I said rather conservatively in my report that there were some forms of communications data that should be independently authorised, including novel and contentious ones. One of the respects in which the Bill did not really follow my report—I should add that in most respects it did—was in not providing for that outside the protected categories of journalists, lawyers and so on. I could well understand it if members of the Committee or others were to take the view that ICRs were of such a nature that to allow self-authorisation by the police might not be a sufficient safeguard.

It is a privilege to serve under your chairpersonship, Ms Dorries.

Good morning, Mr Anderson. The first question that I want to ask you follows up on questions about the operational case for bulk powers. We heard on Second Reading of this Bill in the Chamber that in the United States of America, the bulk collection of citizens’ data has been heavily curbed, as it was considered to be

“not essential to preventing terrorist attacks”.

Most damningly, the American President’s privacy and civil liberties oversight board said that it was

“aware of no instance in which the”

National Security Agency’s bulk records programme had

“directly contributed to the discovery of a previously unknown terrorist plot or the disruption of a terrorist attack.”

Bearing that in mind, do you agree that a proper independent assessment of the utility and effectiveness of bulk powers would need to look at the experience of their use in other jurisdictions?

David Anderson: What you are referring to is one type of bulk power that I myself looked at the necessity for in a great deal of detail. It is difficult, of course, to read across from section 215 in the US to what we have here, which is rather different. What we have here is service providers being required to keep phone logs, details of when emails were sent and so on.

If you look at my report, “A Question of Trust”, you will see that there are several annexes there and quite a bit of text in which I set out just how useful the police find that power to be. I also found when I was in Germany, where at the time they did not have the power because Germany’s constitutional court had removed it, that the police and the internal security service were crying out for something along those lines. So, that is one aspect.

I cannot speak for the US position—different power, different circumstances—but particularly in dealing with paedophile crime, I was satisfied that this, if you like, plain vanilla element of bulk collection communications data was something for which there was an operational need.

So, in your investigations for your report, you looked at the experience of at least some other jurisdictions. Is that correct?

David Anderson: I did, yes.

So would you agree that a proper independent operational case for the support of this Bill should look at the experience of other jurisdictions?

David Anderson: Well, we have had three detailed reports. We have had the pre-scrutiny reports, as well. Evidence was heard by some of those Committees from people from other jurisdictions. It is always nice to think one is fully informed about what goes on in the rest of the world. Incidentally, that is very difficult in this field, because very few countries have been as up front as this Bill is about exactly what powers are used and how they are used.

For example, you mentioned the US and section 215, but of course there are other bulk powers that have not been curbed in the way you suggest. There is section 702, which was given a clean bill of health by the privacy and civil liberties oversight board. There is also executive order 12333, about which very little is known, but which seems to give very intrusive and extensive powers outside the US. So I am hesitant about drawing these country comparisons, although I accept that evidence from other countries is always useful.

Bearing in mind the pressures of time, may I move on to my next heading, which is the scope of bulk powers? On Second Reading, the Home Secretary said that

“certain bulk powers are predominantly those for foreign usage, rather than in relation to the United Kingdom.”—[Official Report, 15 March 2016; Vol. 607, c. 823.]

Would I be correct in understanding that most of the bulk powers proposed in the Bill could, in fact, apply to the data of UK citizens?

David Anderson: The way it works, as I understand it, is that the use of the bulk powers must be motivated by a desire to retrieve data relating to people outside the UK. Of course, there will be what fishermen call a “bycatch” of people in the UK whose data are unavoidably retrieved during that process. The safeguard for people inside the UK is that if anyone wants to look at the content of that stuff, they need an individual warrant relating to that person.

But would we be correct in understanding that, for example, bulk personal datasets will comprise the personal data of United Kingdom citizens?

David Anderson: That is certainly true.

Would we also be correct in understanding that bulk communications data will comprise data relating to British citizens?

David Anderson: Indeed, that is true and has been the position for, we now know, some 10 or 15 years.

So if an impression were to get about that bulk powers are merely about obtaining information on people who live overseas, that would be incorrect.

David Anderson: That would be incorrect, but of course neither of the two examples you gave me was about the content of people’s communications. The first was about lists and registers, and the second was about communications data.

My third heading is legalities. You will be aware that the United Nations special rapporteur on the right to privacy has expressed concern  that some aspects of the Bill may not comply with either European Union law or the UK’s obligations under the European convention on human rights. He expressed particular disquiet about bulk surveillance and bulk hacking, and suggested that those powers prima facie failed the benchmark set by the European Court of Justice in the Schrems case and by the European Court of Human Rights in the Zakharov case. Have you had a chance to consider his report?

David Anderson: I have.

Do you have any view on what he has said in that regard?

David Anderson: I think he is advancing one view of what European law or international law might require. I do not think that it is the only possible view, and I would apply the same comment to the letter signed by 250 very distinguished lawyers and sent to The Guardian.

May I give you an example of the latest case in Europe to deal with these issues? In Szabó andVissy v. Hungary, which was decided in January, the European Court of Human Rights described

“the massive monitoring of communications susceptible to containing indications of impending incidents”

as “progress” and suggested only that these powers needed proper legal safeguards, with which I think any sensible person would agree.

I think that there are two views at the moment, even within the European Courts. Where I disagree with the rapporteur and the 250 lawyers is on the suggestion that the position is now clear. It may of course become clearer, perhaps as soon as this summer when the Davis and Watson case is determined in Luxembourg, but I do not think that the case law has yet solidified.

So your view would be that there are potentially two competing arguments as to where the case law is heading, but we do not know ultimately what the situation is, although we may have a better indication when there is a judgment in the Davis and Watson case later this year.

David Anderson: There are also the Strasbourg cases of Big Brother Watch and Liberty. I do not know when those judgments will come, but there are two views, basically. One is that bulk access to content, even only by machines, is just wrong and that, however strong the operational case for it and however minimal the actual intrusion into people’s private lives, it cannot be justified. The other, more pragmatic view is that it is a question of proportionality and that one ought to look at the strength of the operational case, just as one ought to look at the degree of intrusion into privacy.

I want to ask you briefly about bulk personal datasets. It is possible, is it not, that medical information pertaining to every single citizen of the United Kingdom could be scooped up in a bulk personal dataset?

David Anderson: I do not believe that there is any statutory exclusion. Whether there is a justification for doing such a thing would depend, first, on whether the Secretary of State signed off on it and, secondly, on whether the judge was prepared to approve it.

It would also be possible for bulk personal data sets in relation to children to be scooped up under this legislation as currently drafted. Is that right?

David Anderson: Again, I do not believe that there is any statutory exclusion.

Do you agree that in the investigation of threats to national security and terrorism there can really be no justification for scooping up personal data in relation to children?

David Anderson: I am going to duck that one because bulk personal datasets were outside my remit. The use of bulk personal datasets, we now know, has been subject to annual review by the Intelligence Services Commissioner for several years. Perhaps he is the appropriate person to ask about that.

Thank you for coming, David. On bulk personal datasets, I note that you say that the members of the intelligence community that you have met, and what you have seen and heard from them, have confirmed the view that was expressed by the ISC and others. Are you clear about their efficacy and utility?

David Anderson: I think what I said was that bulk personal datasets had been looked at by the Intelligence and Security Committee and by the Intelligence Services Commissioner. I have read what they have said about that, including in closed hearings, and I said that what I was shown by the agencies was consistent with that, but I was not trying to do the same exercise that they had done of deciding whether these things were necessary or proportionate.

As a follow up on that, obviously you appreciate that your recommendations on the operational case being made have been built in to what we are doing. Further to what you said about the Chairman of the ISC’s recognition of their proportionality and necessity, I suppose you would accept that any publication of that operational case will obviously be limited, because it is an operational case and as soon as you make it public to the point where it ceases to have value, it could compromise operations.

David Anderson: Yes, the agencies’ ability to protect us relies quite heavily on people not knowing exactly what it is they can and cannot do.

I will ask just a couple of questions, if I may, Mr Anderson. Looking at the operational case for bulk powers, the Home Office has stated:

“There is clear evidence that these capabilities have…played a significant part in every major counter terrorism investigation of the last decade, including in each of the seven terrorist attack plots disrupted since November 2014...enabled over 90% of the UK’s targeted military operations during the campaign in the south of Afghanistan…been essential to identifying 95% of the cyber-attacks on people and businesses in the UK discovered by the security and intelligence agencies over the last six months”.

They have also been of great use in serious organised crime and paedophilia investigations, as we know. Are those factors that you and others have taken into account  when assessing whether we need bulk powers, and how critical they are to national security and serious organised crime investigations?

David Anderson: I saw and heard enough to persuade myself of the necessity of bulk interception powers and bulk data retention of the type we were describing—phone logs and emails and so on. I did not look at equipment interference, for example, because that was outside my remit, and the query that I raised on that earlier was really the same query that the Intelligence and Security Committee has raised. If you define the targeted powers so broadly as to encompass almost anything, what is the additional utility of a bulk power? I am not persuaded on that simply because I did not do the exercise.

By way of conclusion, you gave evidence to the Joint Committee scrutinising the draft Bill in November 2015 and at that time you said it gave effect to 90% or more of the recommendations in your report entitled “A Question of Trust”. Now that the Government have responded to the Joint Committee’s report and made further amendments, how much closer is the Bill to your report’s recommendations?

David Anderson: If I may say so, I thought that it was an excellent report and I was very pleased to see that the Government had given effect to the great majority of those recommendations.

I have two questions. On the double lock and the judicial review test, concerns were expressed by witnesses to the Joint Committee about two issues. The first is the access to evidence by the judges and by the Ministers or the Home Secretary in the process of considering warrants. What would be the access to evidence by both parties involved in the double lock? Would it be the same or different?

David Anderson: I would certainly assume that the judges would have access to all the evidence that the Home Secretary or the Secretary of State had access to. I believe I have actually had a private assurance that that would be the case. I am afraid I have not checked to see whether that is in the code of practice, but plainly it ought to be, because this is not a rubber-stamp and nor is it simply a test of rationality or process. If it needs to, it should involve a proper look into these issues of necessity and proportionality. I was delighted to note that the Foreign Secretary said as much when he wound up the debate on Second Reading last week.

You have pre-empted my second question, which is about the concerns that various witnesses have raised about the level of scrutiny involved in the judicial review test. Are we looking at a Wednesbury level of scrutiny?

Order. I am afraid we have reached the end of the time allotted for the Committee to ask questions. On behalf of the Committee, thank you very much for your time and for giving evidence today.