Alan Wardle and Ray McClure gave evidence.

Welcome to the afternoon session. We will now hear oral evidence from the National Society for the Prevention of Cruelty to Children and Mr Ray McClure. We have half an hour for this session. Could the witnesses briefly introduce themselves?

Alan Wardle: I am Alan Wardle. I am head of policy and public affairs at the NSPCC.

Ray McClure: I am Ray McClure. I am the uncle of Lee Rigby, the fusilier who was brutally murdered on the streets of London. I am the eldest brother of his father.

Thank you both for appearing today; it is good to see you.

Mr McClure, could I start with you? We have been talking about the prevention of terrorism to date, but from your perspective this is about crime prevention. Perhaps you could say a few words about that and the measures in the Bill that would benefit crime prevention from your perspective.

Ray McClure: The forces of law and order and security need information in order to prevent crime. Surveillance is a necessary part of crime prevention. You go down the high street or go into shops and you are on CCTV cameras all the time. That is surveillance. The public know what it is for: to prevent crime and to gather information in order to prosecute those who are guilty of committing crime.

This whole thing to date is also about making sure that the forces of law and order—the police and the security forces—have the means of gathering the information that they need in order to prevent crime, be it on the internet or terrorism, as well as being able to gather the evidence in order to prosecute people who are guilty of crime.

Modern society works by having rules that are understood and agreed, and by having those rules policed and enforced. Without those rules and laws in place, we are living in anarchy.

Thank you. Mr Wardle, do you want to give the NSPCC’s position?

Alan Wardle: I am happy to. As you would expect, our interest is less to do with the counter-terrorism aspects and more to do with the investigation and prosecution of specific crimes against children. We know, and the Committee will know as well, that the police’s ability to  investigate and prosecute some of the high-profile crimes we have seen in recent years—online grooming of children and the number of people who are viewing illegal images of children online, which has grown exponentially— is increasingly dependent on communications data. I think it is vital that this Bill ensures that the police have the powers and capabilities to continue to do that.

So from your perspective—and this is from reading the evidence from the NSPCC—this is not just about collecting data; it is about sharing data and intelligence in a joined-up way between the services. Is that correct?

Alan Wardle: It is about collecting data so that, as and when the police need to investigate, there is a dataset that they can specifically and forensically look into to investigate. So data sharing is part of it, but not all of it. Say a child is being groomed online and you are trying to establish where that child was met by someone who has groomed them. Did they actually meet in real life for contact abuse? In the case of a child being trafficked across the country, was a hotel booked? Was a car booked? It is about being able to piece that information together. So traditional policing methods—being able to use the internet and the data that are available from people’s online activities to identify people and prosecute them—is the main concern, but the sharing of data, where relevant, is also relevant.

We have seen delays of sometimes 12 months in gathering and processing evidence, insufficient training in the collection of digital evidence—all things you have cited in your evidence—and a lack of awareness of the legal processes to access communications data. Bearing those things in mind, the new powers, even if we had them, could not really be used effectively unless there was the right training in the first place.

Alan Wardle: Absolutely. This is not a silver bullet; it is another tool that the police need in their armoury to help them deal with these kinds of crimes. Equally important is that local police forces particularly have the forensic capability to analyse a mobile phone or computer, and the technical tools and skilled officers to be able to do that.

Being able to access the data is one part of it, but not all of it. The kind of tools that we see at the National Crime Agency and the Child Exploitation and Online Protection Centre are very helpful, but the issue is the extent to which that expertise and those technical tools are disseminated throughout the entire police force across the UK. I would argue that communications data was only ever going to be part of the answer—an important part, obviously.

We clearly have two excellent witnesses here, and I am sure that many colleagues will want to ask questions. Who is trying to catch my eye? Would Mr Matheson like to ask a question?

I remind the Committee that Mr McClure is known to me, as he is my constituent.

Good afternoon, Mr McClure. The case of your nephew obviously involved a criminal offence and was clearly terrorist-related. There have been suggestions, and we have heard evidence as a Committee, that the  failure was not necessarily one of electronic intelligence, but of human intelligence and a lack of resources, because the security services were already aware of the then suspects—the people convicted of your nephew’s murder. How do you react to that ?

Ray McClure: It is a bit of both, to be honest. The report by the Government into Lee’s murder, “Report on the intelligence relating to the murder of Fusilier Lee Rigby”, highlighted failings in the intelligence services and their processes. I do not know personally whether the recommendations have all been implemented, but I have got to assume that they have been, because they were taken very seriously.

Also, the report highlighted other major failings. The ones that caused me the greatest concern were those where the warrants issued by the UK Government were not complied with by American internet companies. [Interruption.] Sorry, I am going to pick up my notes. The report made it absolutely clear that the attack by the two murderers of Lee was planned on the internet; they made contact with people on the internet. Yes, opportunities were missed, but internet service providers failed to review any suspicious contacts and they did not obey UK warrants—they went out of their way to obstruct UK warrant providers.

Paragraph 401 says

“some overseas CSPs do not comply with UK RIPA warrants, as they do not consider themselves bound by UK legislation.”

That is a failure not of the security services, but of those other people—the internet service providers. Paragraph 457 says:

“The number of different forms of communication now available presents the Agencies with significant challenges in terms of their ability to detect and prevent terrorist threats”.

If the internet companies are not co-operating with the intelligence services, there is a big hole there—a big gap that needs to be plugged.

“CSPs based in the US have, for the most part, refused to recognise UK legislation requiring them to provide the content of communications on their networks: they do not consider themselves to be bound by the legal obligations set out in RIPA”—

warrants, etc.

To me, this is a big hole—a big issue. Being somebody from an IT background, I was horrified at some of the stuff I was reading. These companies—Apple, Facebook, Google, Microsoft, Twitter, etc.—are companies that we grew to respect, but the actions that they are undertaking now in not supporting the security and intelligence services, the forces of law and order, to prevent crimes like what happened to Lee, leave a big hole that has to be plugged.

You talk about the lack of co-operation from some of these large corporations based outside the UK. When considering your own investigations and inquiries surrounding the murder of your nephew, have you seen any evidence that that is quite a common trait?

Ray McClure: That is a good question. Yes, I have. I can give two very clear examples. One example is Microsoft, which has been fighting a warrant issued by the US Government to gain access to a drug dealer’s emails. It claims that, because the emails are not held on US territory, the US Government cannot have access to them. The emails are actually held in the cloud, and  their physical location is in Ireland. Microsoft claims that the emails are a customer’s personal documents and that, because they are outside the US’s jurisdiction, the US Government and US law-enforcement agencies cannot access them.

That raises a big question mark. Today, when you send an email, you do not know where the physical data will be held—it is held somewhere in the cloud, but you do not know where. That creates a problem for all security and law-enforcement forces. Where does the jurisdiction lie for gaining access to that data? It is a black hole. It is wrong. Microsoft’s actions are protecting the drug dealer, not helping law enforcement.

The biggest concern right now—it is a very hot topic—is Apple’s stance over the San Bernardino terrorist. He killed 14 people, yet Apple refuses to co-operate with the FBI and allow it to access the data on his iPhone, which might help the police identify his accomplices. That is protecting terrorists, not helping law and order. Quite frankly, I am at a loss as to why the IT companies are so opposed and why they are fighting law and order as they are doing. It is wrong.

Looking at the specific provisions in the Bill, as far as you have been able to check them, are you satisfied that your concerns have been addressed, or was there something else that you were specifically looking for?

Ray McClure: I do not believe that this Bill is adding new powers to the police and the security forces; I think that it is clarifying the existing powers and bringing them together. It makes it a lot clearer where responsibility lies in obtaining warrants and what the powers are. I think that bringing that clarity is a major step forward. Yes, I am happy, and I urge you all to support the Bill. My only concern—it is a personal concern—is that, frankly, I would prefer warrants to be authorised by the judiciary, not by politicians, such as the Home Secretary, but that is my personal opinion; it is down to you guys to make the laws.

Can I make one other point about Apple and Microsoft? These companies are building solutions that we use every day. Let us be honest: these phones that we use today are brilliant, with the address book and everything else. But to make that a no-go area for law enforcement is wrong. There should be no such thing as a no-go area for law enforcement. If you cannot enforce the law, you have a situation in which you are protecting evil, and when you protect evil, evil will thrive, and that is wrong.

Thank you, Mr McClure. We have so many colleagues who want to ask you questions.

Ray McClure: Sorry, Sir.

No, you are a very strong witness. Mr Buckland.

Thank you, Mr Walker; it is a pleasure to serve under your chairmanship. Mr McClure, you have made some powerful points, so thank you very much indeed for giving your perspective on the IT, and as a bereaved relative. We all share your grief and anger about the atrocity.

Mr Wardle, I want to ask you about internet connection records, the new potential powers within the Bill and the purposes for which those records could be retained by an internet service provider. We know now that, as a result of the Joint Committee’s recommendations, there are four purposes for which those records could be retained for potential examination by the authorities. I think that they are very clearly set out: for the purposes of identifying who sent a communication; to establish what services either a suspect or a potential victim has been using; to establish whether or not a known suspect has been indulging in online criminality; and finally—the additional one—to identify services that a suspect has accessed, which could assist an investigation. If there was a narrowing of those purposes, what effect do you think that would have upon the authorities’ ability to investigate child abuse and related offences?

Alan Wardle: As I understand it, the previous draft Bill had a narrowing in the fourth one, and I appeared before the Joint Committee before Christmas to argue against that narrowing. I cannot remember the exact wording, but it was essentially where illegal activity was happening.

Again, I go back to the example of the grooming case I mentioned earlier. Grooming, by its very definition, takes place over a period of time. There are certain activities that you would want to investigate that are perfectly legal. Say a child has been trafficked across the country. Someone has hired a car, taken it from A to B and dropped it off, and they have gone on to the Travelodge website to book a hotel room. All of those are perfectly legitimate activities, but those activities—as part of a wider investigation—would be able to show the police that that person trafficked that child from A to B and that those activities took place. Clearly more would be needed, but the narrowing that was there before would, we believe, have unduly restricted the police’s ability to investigate those kind of crimes.

May I ask you some questions about internet connection records? Can you confirm that you have read the operational case for internet connection records referring to the case of Amy?

Alan Wardle: I do not think I have read that.

It is about a missing child.

Alan Wardle: Oh yes, I know it.

Would you agree with me that if a child goes missing, the first thing you want to do is to find out what social media or chat sites the child has been on?

Alan Wardle: Whether that is the first thing you want to do, it is certainly—

It would be a priority.

Alan Wardle: That would be something that the police would want to investigate pretty quickly.

Is not the easiest way to do that to ask their friends?

Alan Wardle: It could well be, depending on what has happened. In an ideal world, the child would keep all the evidence themselves and it would all be freely available in terms of the content, but things are deleted and friends are asked to keep quiet and so on, so it is not always necessarily available. If the child has been groomed, they may have been taken by someone they think is their boyfriend, away from their dreadful parents—they are running away.

Sometimes the child will take their phone with them and it will be switched off and be no use to us, but other times they will leave their phone behind and we can get into the phone and see which social media sites they have been on. Is that right?

Alan Wardle: I am not a police officer, but yes, I presume so.

Equally, if there is a computer at home, the police can access the computer with the parents’ permission and see what social media sites the child has been on?

Alan Wardle: Yes, but three quarters of 12 to 15-year-olds have a mobile phone or tablet, so it is rarely the computer on the dining room table any more.

If we assume that the computer and the phone are not available, you could go to friends or siblings and find out what social media the child commonly uses. If, for example, the child commonly uses Facebook, the friend will be able to tell you what the child’s username is.

Alan Wardle: Well, the child’s username would be their real name because Facebook has a real name policy.

Indeed, and they will know what their friends’ names are. I do not really know how Bebo works, because I am too old, but if it is not a known name on Bebo, you are still able to get the username from the child’s friends.

Alan Wardle: I would imagine so, yes.

Does it not really boil down to this: wherever you get the information from—whether it is mum or dad or, more likely, mates at school—you have to go to Bebo or Facebook and ask for their help?

Alan Wardle: The social media companies clearly have a huge part to play in this as well. We challenge them regularly on all aspects of how they keep children safe online. What is important when the police are investigating such crimes is that they have every tool available to them that can legitimately be made available. Some will be traditional policing methods, such as asking their friends and knocking on doors, and some may be much more technical aspects, such as internet connection records.

But would you agree with me that what is important is to have effective tools?

Alan Wardle: Absolutely. One of the things we have challenged the internet companies on is that if those tools are available, they should be widely available. A good example is what is called PhotoDNA, which basically means that illegal images of children are hashed and can be removed across the internet. That is a really  positive development. That technology was developed by Microsoft, but shared across all the big companies, which is a really positive thing.

We know that there are other technologies—anti-grooming technologies, for instance—that have been created, but have not been shared in that way. I think that there is an obligation on the companies—your Apples, your Facebooks and your Microsofts—to ensure that these kind of tools, with no real commercial gain to be made from them, should be freely available across the industry.

If we just go back to the example that I was pursuing, about the missing child, I think you agreed with me that it is important to have effective tools. Is it your understanding that all the internet connection record will tell you is what the missing child connected to? It will not tell you what the missing child did once they were connected.

Alan Wardle: No. That is the issue to do with content. Again, it could well be that that is part of a wider picture.

An internet connection record will only tell you to which service the child was connected, not whom they spoke with, nor what the content of their speaking was—

Alan Wardle: Not necessarily.

Whereas, if you go to the child’s friend and get the child’s username on the social media site, you will be able to get that information as to content.

Ray McClure: You would still need the child’s password to access the data.

Alan Wardle: That is not enough in and of itself. Yes, do you have the password? How would you get into it?

You will not get passwords from an ICR?

Alan Wardle: No.

There has been a description of Tor as a facility that allows digital abuse of anonymous online activism. It is linked to encrypted information. I want you to say a bit about what effect encryption has on some of the work that you are involved with?

Alan Wardle: A lot of the activity that we take for granted online—shopping, banking and all the rest of it—could not be done without encryption, but of course, as with all these tools, encryption can be used for bad purposes by bad people. Similarly, with services like Tor and Freenet—the dark web—in the cases that we are concerned with, you get your most highly committed and dangerous offenders, quite often, particularly sharing very explicit images or videos of children being abused. Those services enable them to hide there. The police do the best they can, but, again, for a lot of that they will be dependent on traditional undercover techniques.

I think there is a question that is—I say this respectfully —beyond this Committee’s remit and beyond many of our remits. The direction of travel generally is that we are seeing greater moves to encrypt data as a matter of  course, with things like Google Chrome browsers and so on. With browsers such as that, internet service providers cannot put in place the kind of protections they have, so they do not know what is going on there. That is a direction of travel and something that is worrying. It is clearly a global issue, but the police not being able to track what is going on due to increasing levels of encryption is a worry.

Just to pick up on the point made by the hon. and learned Member for Edinburgh South West about the missing child, is it right that, sadly, the victims of sex grooming rings do not surround themselves with friends and parents, because one of the tools that the groomers use is to isolate the victims, so that they have no one they can turn to in their hour of need?

Alan Wardle: That can be true. They can even turn the child against their family and friends as well.

So in those circumstances, as you have said, the police need every tool that they can get to help those very vulnerable young children.

Alan Wardle: Absolutely. Again, as I have said, the issue of grooming is often about a period of time and establishing patterns of behaviour. Being able to gather evidence from a range of sources is really important.

Following on from that, in your work in the NSPCC, do you always see a willingness for children to open up and to tell people in a position of authority personal facts about themselves and their friends, or can it be quite difficult to coax out information about children who are friendly with the vulnerable?

Alan Wardle: It will depend. Generally, it takes quite a lot for a child to come forward and disclose. In recent years, we have seen a huge increase in the number of children who are reporting sexual abuse generally. It is going up across the UK, and was up by about a third last year. A large part of that is because of a greater willingness of children to come forward and talk about the abuse that has happened to them, but we know that it can take decades for people to come forward and talk about abuse.

What we are talking about, particularly sexual abuse, is a very personal thing, so the idea that a 15-year-old who is being groomed will just walk straight into a police station and start disclosing all these very personal things is generally not quite how it works.

I was also thinking about the case of missing children. If we rely only on their friends and those friends are not willing to disclose personal details, names and the social media sites that their friend is on, do you think there might be a delay in an investigation?

Alan Wardle: There could be, and it depends on the facts of the case. I will return to the main point. As I said before, the police need a range of tools. They will need some very traditional knocking-on-door tools, and they may need a range of technical tools to help identify a child in that situation.

So it is a combination of tools that will keep children most safe?

Alan Wardle: Yes.

I thought you made a compelling case in your evidence to the Joint Committee; I was not a member of that Committee, but I have watched it back on video. You made a compelling case for why timeliness is very important when a child is threatening to commit suicide—basically having to breach that child’s confidence to ensure that the police can intervene. The expression you used was about literally having to cut children down at times.

Could you say anything more to this Committee about that? Some members of this Committee sat on the Joint Committee, but others will not have heard that evidence. Could you say more about the need for rapid intervention to save children’s lives?

Alan Wardle: The NSPCC runs ChildLine, a service that people will know. About three quarters of children who contact us do so online, rather than through the traditional telephone service. We have a very high level of confidentiality, but in an average of 10 cases a day we have to breach a child’s confidence because their life is in imminent danger. In 60% of those cases the child is actively suicidal; on average there are six cases a day where we have to contact the emergency services to protect a child whose life is in immediate danger because they are suicidal.

On the capacity for the police to be able to find where that child is, if they are on a mobile phone, for instance, an IP address would not cut it. We have cases where children who have tried to kill themselves are literally saved because of the 24/7 service that we run, and the police’s ability to be able to rescue actively suicidal children in real time is very important.

This question is to both of you. Is there anything that is not in the Bill that you would like to have seen, or maybe still see, in the Bill?

Ray McClure: It is not really relevant to the Bill in question, but you have to find some means of punishing companies that do not comply with warrants issued, and it has to be a heavy punishment. Right now, without having legally enforceable warrants, there is no law enforcement and no justice.

Alan Wardle: I do not think it is necessarily about what is not in the Bill, but I reiterate the point I made earlier: these internet connection records are only part of the solution. There is a whole range of things in terms of keeping children safe online, particularly on the capacity of the police to respond to that and to be able to have the right tools to investigate, prosecute and convict criminals. These tools are very important, but there is a much wider piece about how the police can use all the powers available to them to help keep children safe.

Mr Kyle, a 10-second question and a five-second answer.

Mr Hoare has just asked my question, so I am a happy man.

That brings us to the end of this session. May I thank our witnesses, who gave extremely strong performances? I know that being a witness before a Committee is very nerve-wracking, but you both executed your role fantastically, so thank you very much indeed. It was very kind of you to come before us today.