I beg to move amendment 293, in clause 109, page 87, line 39, leave out subsection (3).

This amendment would remove the provision which allows a targeted equipment interference warrant to be served on a person outside the UK for the purpose of requiring that person to take action outside the UK.

With this it will be convenient to discuss the following:

Amendment 645, in clause 109, page 87, line 41, at end insert—

“(3A) Subsection (3) shall not be applicable where the person outside the United Kingdom has its principal office where it is established for the provision of services in a country or territory with which the United Kingdom has entered in to an international mutual assistance agreement or is subject to an EU mutual assistance instrument.”

This excludes the extraterritorial provision in cases where any mutual assistance arrangement exists between the UK and the provider’s jurisdiction while enabling the government to seek voluntary assistance from CSPs in non-MLA countries.

Amendment 679, in clause 110, page 88, line 9, at end insert—

“(1A) Where such a warrant is to be served upon a person outside the United Kingdom the warrant shall be served at that person’s principal office outside the United Kingdom, where it is established, for the provision of services.”

Amendment 694, in clause 110, page 88, line 10, at beginning insert—

“Where service of a warrant in the manner envisaged in subsection (1A) is considered unfeasible or inappropriate in the circumstances,”

Amendment 647, in clause 110, page 88, line 10, after “Kingdom”, insert—

“the warrant shall be served at that person’s principal office outside the United Kingdom where it is established, for the provision of services. Where it is considered unfeasible or inappropriate in the circumstances,”

The Home Secretary confirmed at second reading that a UK agency would only serve a notice on an overseas entity that is capable of providing assistance under the warrant. UK agencies today routinely use secure means of communication to transmit notices directly to the main office of overseas CSPs. This would make government’s commitment clear on the face of the Bill (as it is in the relevant code of practice) and address contradictory provisions that remain in the Bill.

Amendment 648, in clause 111, page 89, line 19, after “take”, insert—

“which for a relevant operator outside the United Kingdom shall include—

(a) any steps which would cause the operator to act contrary to any laws or restrictions under the law of the country or territory where it is established, for the provision of services, or

(b) where a warrant could be served pursuant to an international mutual assistance agreement or subject to an EU mutual assistance instrument.”

This amendment clarifies the reasonableness test for overseas CSPs.

It is a pleasure to serve under your chairmanship, Mr Owen. May I add to your comments that I will miss the exchanges with the hon. Member for North Dorset? I wish his replacement well.

Clauses 109 and 110 deal with issues about compelling a third party to provide assistance in the execution of a warrant and extraterritoriality, which is the subject of amendment 293. In speaking to the amendment, and to the clause more generally, I will unavoidably stray into matters relating to clause 110, as the two are inextricably linked.

Clause 109 provides the UK Government with the power to issue warrants that in turn force third-party organisations or individuals outside the UK to assist in acquiring information for the means of equipment interference. The clause states that

“any person whom the implementing authority considers may be able to provide such assistance” can be served with a warrant to assist in carrying out a targeted hacking warrant. Under clause 110(2), this warrant may be served at a person’s principal office or specified address in the UK, or by making it available for inspection in the UK after appropriate steps have been taken to bring the contents of the warrant, and its very existence, to the attention of the person.

First, the problem here is the lack of judicial authorisation in this part of the process. Privacy International rightly points out that this compelled assistance will not be subject to judicial authorisation. Although law enforcement and security and intelligence agencies will have to seek a warrant to gain access to people’s devices and computers, it is correct that those authorities are not required to seek judicial approval to compel technology companies to assist in their investigations.

Secondly, we should be mindful of the difficulty that this places on any individuals or organisations who are forced to comply with the Government’s demands. These issues were heard by the Science and Technology Committee, where serious concerns were raised about the security implications of forcing companies to, for example, upload and install malware, as well as the fear that equipment interference could jeopardise their business model. The Science and Technology Committee took note of these issues and concluded that

“the industry case regarding public fear about ‘equipment interference’ is well founded.”

Amnesty International UK is deeply concerned about the dangerous precedent that this broad, aggressive power will set in forcing third-party companies to engage in hacking without any independent provision or scrutiny, and to do so in secret.

Thirdly, the extraterritorial measures in clauses 109 and 110 may cause more problems than they solve. That is why amendment 293, which stands in my name and that of my hon. and learned Friend the Member for Edinburgh South West, seeks to delete subsection (3) entirely, thereby removing the extraterritorial aspect. If we serve hacking warrants on those outside the UK, what sort of message does that send to other countries? We need to be mindful that introducing this type of clause could open the floodgates for other countries to follow suit, which will ultimately have an impact on companies based in the UK. That point was articulated by Yahoo!, which said:

“Extraterritoriality encroaches on the sovereign rights of other governments and risks retaliatory action, including against UK CSPs operating overseas.”

On that point, the Government’s independent reviewer’s report suggests that, when countries seek to extend their legislation extraterritorially, those powers may come into conflict with legal requirements in the country in which companies being asked to comply with a legal request are based. Companies explained to the reviewer that they did not consider it was their role to arbitrate between conflicting legal systems. The protection of vital human rights should not be left to the goodwill and judgment of a company. The concerns of the industry were articulated in this perfect quote. The industry

“expressed concerns that unqualified cooperation with the British government would lead to expectations of similar cooperation with authoritarian governments, which would not be in their customers’, their own corporate or democratic governments’ interests.”

I shall finish with this comment from Yahoo! It states:

“The current legal framework comprises the law in the requesting country, law in the receiving country and the international agreements that connect the two.”

It is additionally possible that the requesting and receiving countries’ laws may be in conflict. For example, the receiving country’s law may outlaw the provision of content data outside their own legal process. It continues:

“Taken as a whole, this framework is fragmented, with gaps and conflicts which have gone unaddressed for many years. In this more global communications environment, this fragmentation has become more and more obvious and creates a patchwork of overlapping and conflicting laws which overseas and domestic UK CSPs must navigate in order to discharge their legal obligations to safeguard users’ privacy and to respond appropriately to valid requests for access to data… It also creates a complex environment for users to navigate and establish their privacy rights.”

This issue is global, and national laws cannot resolve global issues.

I will be brief. Members will have observed that the amendments in my name are in keeping with my previous amendments about implementation, service and extraterritoriality in relation to other warrants. I will not repeat the points I made then. The only one that is different is amendment 646, a simple proposed change to clause 109 that would add the provision:

“A warrant may be implemented only to the extent required for the purpose for which the warrant was issued.”

I think that may be implicit. If the Minister could indicate that that is his understanding, that might allay concerns and the amendment would not need to be pressed.

As the hon. and learned Gentleman says, we have been down this road before. I well recall discussing similar amendments to the targeted interception provisions in part 2. The Bill maintains the existing position in relation to extraterritorial jurisdiction and those obligations that apply to overseas companies. I am unhesitating in my view that overseas companies, because of their important role in communications, must do their bit to do the right thing, as I said previously and memorably. As a result, I will not tire the Committee by going into that argument in great detail.

Amendment 293 to clause 109 seeks to remove the ability to serve a warrant on an overseas provider and amendment 645 seeks to remove the ability to serve a warrant on an overseas provider when a mutual legal assistance agreement is in place. I draw the Committee’s attention once again to David Anderson’s comments in his report, in paragraph 11.26:

“There is little dispute that the MLAT route is currently ineffective.”

I will not quote it at length but he goes on to say that it is because it is too slow and so on. I do not think that those amendments are in line with either his view or mine.

The effect of accepting the first amendment is evident. It would mean we could serve an equipment interference warrant only on a provider based in the UK. The second amendment seeks to assert mutual legal assistance arrangements as the only route. For the reasons I have already given, that is not appropriate.

The hon. and learned Gentleman asked, in the context of his amendment, whether that matter was implicit. Yes, it is implicit and I can confirm what he thought might be the case.

The arguments have already been made and, on careful reconsideration, the hon. Member for Paisley and Renfrewshire North will realise that his amendment and argument are pseudodox and will withdraw on that basis.

I thank the Minister for that response and I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

We now come to amendment 646 to clause 109. I call Keir Starmer.

I do apologise, Mr Owen; I strayed on to amendment 646 thinking it was part of the last batch, so I have dealt with it and intend to withdraw it. My apologies.

The amendment has not been moved.

Question put, That clause 109 stand part of the Bill.

The Committee divided:

Ayes 9, Noes 2.

Question accordingly agreed to.

Clause 109 ordered to stand part of the Bill.

Clause 110