Power to issue bulk acquisition warrants

Investigatory Powers Bill – in a Public Bill Committee am 9:25 am ar 26 Ebrill 2016.

Danfonwch hysbysiad imi am ddadleuon fel hyn

Photo of Keir Starmer Keir Starmer Shadow Minister (Home Office) 9:25, 26 Ebrill 2016

I beg to move amendment 673, in clause 138, page 109, line 30, leave out paragraph (c) and insert—

“(c) the Secretary of State considers the requirements of section 141 are met by the warrant,”.

With this it will be convenient to discuss amendment 688, in clause 156, page 122, line 17, leave out paragraph (d) and insert—

“(d) the Secretary of State considers the requirements of section 161 are met by the warrant,”.

Photo of Keir Starmer Keir Starmer Shadow Minister (Home Office)

It is a pleasure to continue to serve under your chairmanship, Ms Dorries. I, too, welcome the right hon. Member for Chelmsford and thank him for helping the Committee with its work. We turn to clause 138, which deals with the second of the bulk warrants that we are discussing, the bulk acquisition warrants. I will start where I started with the last bulk power, by observing the breathtakingly broad nature of this one. The communications data that can be subject to a bulk warrant are the what, where and how of a communication without disclosure of the content, as well as a person’s location, the type of equipment used and the duration of its use. The data can therefore paint a detailed picture of somebody’s life, so accessing it is a significant interference with privacy.

Clause 138 involves the bulk acquisition power that was first avowed in November last year, only about six months ago, making it one of the more recent avowals. At the time, David Anderson told the BBC that

“the law was so broad and the information was so slight that nobody knew it was happening”,

adding that it was

“so vague that anything could be done under it”.

David Anderson and others are concerned about the breadth of the power. For that reason among others, I repeat the call for more work on the operational case. I will not go over the points I made last Thursday in your absence, Ms Dorries, but where a newly avowed power is as broad as this one, the need for an operational case is heightened.

The power is not limited to those overseas, which is a material difference from the bulk power that we considered at the tail end of last week. If there is to be such a bulk power, the safeguards are extremely important, but here we run straight into the same problem as we did with the last bulk power: although clause 138 includes a necessity and proportionality test, it bites on very broad objectives. In clause 138(1)(a), we see that the Secretary of State can issue a bulk warrant if she

“considers that the warrant is necessary—

(i) in the interests of national security, or”,

under subsection (2),

“(a) for the purpose of preventing or detecting serious crime, or

(b) in the interests of the economic well-being of the United Kingdom”.

The same very broad powers apply to the issuing of a very wide bulk warrant.

Last time we considered bulk powers, I was able to go to the code of practice, which gave more detail about the necessity and proportionality test. In this case, paragraph 4.5 of the code of practice does not add much to what is on the face of the Bill. The Government might want to consider whether necessity and proportionality are dealt with consistently in the codes for each of the bulk powers. There is more detail in paragraphs 9.3 and 9.7, the latter of which is telling:

“More than one operational purpose may be specified on a single bulk warrant; this may, where the necessity and proportionality test is satisfied, include all operational purposes currently in use. In the case of bulk acquisition, BCD relevant to a number of operational purposes may be acquired on a single warrant. In the majority of cases, it will therefore be necessary for bulk acquisition warrants to specify the full list of operational purposes.”

This is another case where, in truth, few warrants will cover many operational purposes, yet the constraints of clause 138 are simply by reference to the interests of national security, to preventing or detecting serious crime and to the interests of economic wellbeing so far as they touch on the interests of national security.

I repeat and reassert the points made on the previous bulk warrant measure. Lifting some of the more detailed analysis of the safeguard and test from the code into the Bill is required to make clause 138 meaningful. That is made good in clause 141, which states:

“In specifying any operational purposes, it is not sufficient simply to use the descriptions contained in section 138(1)(a) or (2), but the purposes may still be general purposes.”

The other point made about this warrant is that it applies not only to the retention or obtaining of data but to the examination of those data. I repeat the point I made last week about the Tom Watson and David Davis case, which is currently being heard. The question in that case is whether there are specific safeguards for access when data are retained, and the proposition accepted by the divisional court is that the safeguard should be for serious crime and that there should be a degree of judicial oversight. The Court of Appeal will now form its own view on that, but the Bill’s safeguard for examination is without any teeth, because the test for examination is the test of necessity, as set out in clause 138, coupled with the test of clause 141, which says that simply citing the national interest, preventing crime, et cetera, is not enough, but that general purposes may be sufficient.

Clause 151—I am skipping beyond clause 138, but one has to see these three things together—is shorter than clauses in other parts of the Bill that address bulk powers, and it simply sets out:

“For the purposes of section 150 the requirements of this section are met in relation to the communications…obtained under a warrant if any selection…is carried out…for the specified purposes…and the selection…is necessary and proportionate in all the circumstances.”

Those purposes relate back to clause 141, which says that, although someone seeking a warrant cannot get away with simply citing national security and serious crime, they do not have to go much further. On analysis, the test for examining for selection data that have been obtained under this wide bulk power is, in fact, a necessity and proportionality test that is no different from the test applied to the holding of the data in the first place. In other words, there is no differentiation between the test for holding, retaining or acquiring the data and the test for examining it at some later stage. I made that point last week, and it arises again in relation to this very wide bulk power.

The only other thing I will say at this preliminary stage is that I think I am right in saying that, in relation to this bulk warrant, there are no specific provisions for legal professional privilege, for the correspondence of MPs or for journalistic material. That has cropped up in our previous discussions and I think the Solicitor General is giving further consideration as to whether, in some circumstances, the fact that there is a communication with a lawyer, even though the content is not there, may need at least some reconsideration in terms of how it is dealt with in the Bill.

Therefore, I will not go into long submissions on legal professional privilege, but it is essentially the same point, namely the assumption that if it is not pure content no privilege attaches and no concerns arise may be misplaced. I have asked the Solicitor General and the Government Minister, to take this point under the umbrella of consideration when he looks again at legal professional privilege.

Against that background, the amendments really speak for themselves. They are tightening amendments intended to sharpen the test in clause 138, which, as I say, at the moment is breathtakingly wide.

Photo of John Hayes John Hayes Minister of State (Home Office) (Security)

I again welcome you to the Chair, Ms Dorries.

I will start by saying that it is vital that the whole Committee understands two points—I think it does, but I will amplify them for the sake of the record. The first is that access to communications data is vital to securing our safety. Communications data play a critical role in almost all the major investigations in respect of terrorism and a very large part in the work of the law enforcement, security and intelligence services. That much is a given.

The second point is that the powers in the clause are not new; they are routinely used for the purposes that I have described. When you were last in the Chair, Ms Dorries, the shadow Minister said:

“As the Minister has said, it is a good thing that the powers that had previously been exercised by the security and intelligence services are now avowed on the face of the Bill.”––[Official Report, Investigatory Powers Public Bill Committee, 12 April 2016; c. 92.]

He is right: it is important that, for the first time, these powers are brought together in a single piece of legislation, making them more understandable, more transparent and more comprehensible.

As the hon. and learned Gentleman also said, it is vital that there are appropriate safeguards in place. Consideration of the clause and the amendments this morning enables us to explore the adequacy of the safeguards and, as we have discussed in previous debates, whether what is already in the Bill is sufficient. In that context, he is right to draw attention to the code of practice. Paragraphs 9.7 and 9.8 describe the particular circumstances that might apply in respect of a bulk acquisition. The code of practice emphasises that a test of necessity and proportionality must be applied to all these matters, but also makes it clear that the operational purposes of the warrant are salient, too.

Ms Dorries, we had a debate in your absence about whether the operational case should be explored in more detail at the outset. Like the hon. and learned Gentleman, I will not reprise that debate, but for your benefit I will say that, in essence, the case he made was that there should be some independent means by which we test the validity of that operational case. The hon. and learned Member for Edinburgh South West, who speaks for the Scottish National party, made essentially the same case. My hon. and learned Friend the Solicitor General and I, having listened to what they said last week, reflected upon it and discussed it, can see that there is some merit in that argument. I will not say more than that today, but I thought their case was reasonable and we might want to look at it.

Of course these matters are sensitive, because as soon as we start to explore operational matters related to the security and intelligence services, we get into that area of what we can and cannot put in the public domain. That is a challenging tightrope—I suppose all tightropes are challenging by definition, but to walk the one between protecting the public interest and protecting the capacity and effectiveness of our security services is particularly challenging. Nevertheless, the case that the hon. and learned Gentleman made about the need for greater scrutiny is interesting.

When it comes to the work we are considering today, it will be beneficial for the Committee to look again at the operational case for bulk powers, which sets out how bulk data are used. Not only does paragraph 5.1 clearly make the case that

“The power to acquire and analyse bulk data is crucial to the security and intelligence agencies’ effectiveness”,

but it also says that those powers are used alongside others, and where others are more appropriate, bulk is not used as a default position—an important point to make, because I think there is a misassumption that that may not be the case. It also says that the capabilities are used to deal with

“high-priority and…emerging threats from individuals not previously known to the security and intelligence agencies” and that they are vital to disrupting threats of that kind. Fundamentally, it says that they are

“often the only means to acquire intelligence about overseas and online threats to the UK.”

The code of practice then sets out the essential character of those powers, which I will sum up by saying that often in dealing with those threats and deciding how best to counter them, the intelligence and security agencies will have mere fragments of information; they will need to search widely to piece together from those fragments sufficient information to clarify the nature of the threat and to put into place the measures to deal with it; and the collection of data in that respect is fundamental to the work of GCHQ in particular. The idea that that is done without specificity, in a capricious way, is completely at odds with the mission of those organisations, with the safeguards in place here and with common sense. It is not in the interests of anyone to collect data beyond the purpose that I have described, to piece together information, to facilitate better investigation of threats to our national security.

Photo of Keir Starmer Keir Starmer Shadow Minister (Home Office)

I am grateful to the Minister for laying out the background and the way in which the warrants will operate. He makes a powerful case for putting some of that detail in the Bill, because if that is the actual operation, nothing could impede its effectiveness if something more specific is put in the Bill—obviously not the specifics of every operation, but something better than the very general test in the Bill. That would not cut across the operation of the warrants and would be consistent with their use as the Minister describes it.

Photo of John Hayes John Hayes Minister of State (Home Office) (Security)

That is the essence of the case the hon. and learned Gentleman makes in his amendments, but before I come to that I want to take this opportunity to set out some of the broader arguments. I am sure that members of the Committee do not need to be disabused of this, because they are extremely well informed and have read the Bill with a scrupulous diligence that is quite impressive, but the wider public may have a misconception about the nature of the powers and what they are there for. I have already dealt with the misconception that these powers are new; they certainly are not, but let me put that into even sharper focus.

In 2010, a group of terrorists were plotting attacks on the UK, including on the London stock exchange. The use of bulk communications data played a key role in the MI5 investigation, allowing investigators to uncover the terrorists’ network and to understand their plans. That led to the disruption of their activities and successful convictions against all the group’s members. This is not an academic debate; it is not a common room discussion among civilised people who take due care of these matters. This is about the day-to-day threats we face and how we counter them. These powers have been and are used to disrupt threats precisely as I have described.

Coming to the hon. and learned Gentleman’s central point, the Bill provides enhanced safeguards and stronger oversight. By bringing these powers into legislation in a single place, it allows for just such checks and balances. It would not be lawful for the Secretary of State to issue a warrant that does not meet a statutory requirement, and the judicial commissioner, in reviewing the Secretary of State’s decision to issue a warrant, would not approve a warrant that is not lawful. The hon. and learned Gentleman drew attention to the elements of the Bill that make clear what that lawful purpose should be. He referred to clause 138, but he also helpfully drew the Committee’s attention to clause 141, which clearly sets out the requirements that must be met by a warrant. The warrant

“must specify the operational purposes for which any communications data obtained under the warrant may be selected for examination”,

and that

“it is not sufficient simply to use the descriptions contained in section 138(1)(a) or (2)”.

Those are the general principles. Furthermore:

“The warrant may, in particular, specify all of the operational purposes which, at the time the warrant is issued, the person to whom it is addressed considers are operational purposes for which communications data obtained under bulk acquisition warrants may be selected for examination.”

The issuing of the warrant must specify in sufficient detail the purposes for which it was issued, and those purposes must go beyond the general provisions set out in the Bill. That seems to me to be quite particular in providing the reassurance that members of the Committee and the wider public may seek.

Photo of Keir Starmer Keir Starmer Shadow Minister (Home Office) 9:45, 26 Ebrill 2016

In a sense, we are on common ground here. Clause 141 adds to clause 138 and, as the Minister says, indicates that what is set out in clause 138(1)(a) and (2) is not sufficient, but if what comes after the comma—

“but the purposes may still be general purposes”— is the case, there is no indication of the specific matters that must be listed. More is given in the code, and one has to remember that it is against that operational case that the judicial commissioner then conducts his or her analysis of necessity and proportionality. That is why it is so important. The question is really whether some of what is in the code of practice should not be lifted into the provisions of clause 141.

Photo of John Hayes John Hayes Minister of State (Home Office) (Security)

Let me draw my remarks to a conclusion so that we can move on with appropriate alacrity, having set out the broad argument. There are two points. The first is whether more of what is in the code should be put in the Bill and whether that would be helpful. The judgment to be made is whether the Bill is sufficient as it stands. Is the amendment unnecessary because of the requirement that a warrant be issued lawfully and the proper constraint that that places on those who make that decision? Secondly, going back to the hon. and learned Gentleman’s case about the operational case, given that there will be a stringent internal process to ensure that any warrant presented to the Secretary of State is compliant with the statutory requirements, could we say more about the operational purposes?

A combination of those two things would entirely satisfy the hon. and learned Gentleman. The Government are sensitive to all those considerations. Of course we understand the need to balance capability against safeguards, and as I said at the outset, I am mindful of the strength of the argument used when we last met about how we could be clearer about legitimising the operational case. I will leave it at that and invite him to withdraw his amendment.

Photo of Keir Starmer Keir Starmer Shadow Minister (Home Office)

I am grateful to the Minister for the way that he has set out his case and his indication of the Government’s approach. The question of safeguards is extremely important: it is vital for the Committee and the House to get it right. Rather than press these amendments, I will wait to see what response, if any, the Government make to the general case that I have made on a number of occasions about the balance between the code and the Bill and reserve my position for later stages of the Bill. I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Photo of John Hayes John Hayes Minister of State (Home Office) (Security)

I beg to move amendment 614, in clause 138, page 110, line 8, leave out subsection (4).

This amendment leaves out provision that is not relevant in the context of bulk acquisition warrants.

This is a technical amendment and I do not intend to make a great fuss of it unless anyone wants to ask me for more detail.

Amendment 614 agreed to.

Question proposed, That the clause, as amended, stand part of the Bill.

Photo of Joanna Cherry Joanna Cherry Shadow SNP Westminster Group Leader (Justice and Home Affairs)

I wonder whether I might address the Scottish National party’s “leave out” amendments at this stage, Ms Dorries. On Friday, because the SNP had tabled “leave out” amendments to the whole of chapter 1 of part 6, I made some general comments about the overarching clause at the beginning of that chapter. With your forbearance and if it is acceptable to you, as clause 138 is the overarching clause at the beginning of chapter 2, I propose to do the same now.

indicated assent.

Photo of Joanna Cherry Joanna Cherry Shadow SNP Westminster Group Leader (Justice and Home Affairs)

I am grateful, Ms Dorries.

As I explained last week, the Scottish National party wish to have part 6 removed and set to one side until a convincing operational case has been made. I noted with some interest the Minister for Security’s comments this morning that he sees some force in the arguments that were made last week. I am pleased to hear that, because I rather had the impression from the way he responded to my arguments last week that he was not going to address any of my points. I look forward to hearing his response to my arguments regarding the United States of America’s experience in relation to bulk powers. If he is not prepared to address them, I very much hope that the Solicitor General will, as I know that he takes his duties very seriously and my points about bulk powers pertain to their legality as well as their efficacy.

The Minister commented last week that the different approach that I was advocating was perhaps indicative of the fact that my party was not and has never been in government. I would like to correct him on that: the Scottish National party has been in government in Scotland for nine years. Unfortunately at the moment we do not have responsibility for national security, but we always co-operate closely with the British Government on such matters—as when Glasgow airport was attacked by terrorists in 2007, for example. We also have a strong record in fighting crime, with the result that recorded crime is at a 41-year low in Scotland. We are not soft on crime or terrorism, and in the coming years we very much hope to devise a security policy for an independent Scotland. We have looked at the experience south of the border; we will also look to international experience. It was on that basis that I addressed in some detail the experience and the reversal of procedures and the approach in the United States of America in relation to bulk powers. It is important that we take cognisance of what happened in the United States of America as well as look at international legal norms in relation to these matters.

The concerns I articulated last week in relation to bulk powers are not felt only by the party for which I speak; they are widely shared by three parliamentary Committees that looked at the draft Bill, by MPs from all parties, including the party of government, NGOs, the technical sector, communication service providers and eminent legal commentators—I refer to the letter written to The Guardian at the time of Second Reading, now signed by more than 250 leading lawyers from across the United Kingdom. They took particular issue with the legality of the bulk powers against the background of a report by the UN special rapporteur on the right to privacy, Joseph Cannataci. He produced a report in March this year about privacy and digital rights generally. He did not mince his words, but said that many of the powers in the Bill are of questionable legality, having regard to recent judgments of the European Court of Justice and the European Court of Human Rights. He singled out the proposals for bulk powers as undermining the very spirit of the right to privacy and said that the benchmarks provided in European jurisprudence indicate that surveillance should be targeted, by means of warrants which are focused and specific and based on reasonable suspicion.

When the Minister had rather lost his patience with me last week, he quoted Ruskin. Let me quote Robert Burns on how the rest of the world looks at this Parliament and how the rest of the world will look at what decisions we take on the Bill:

“O wad some Power the giftie gie us

To see oursels as ithers see us!”

This country was in at the founding of the United Nations. When the United Nations special rapporteur says there is a serious issue with the legality of proposed legislation, no matter how we feel about Europe and the ECHR, we cannot just sweep that to one side.

Even David Anderson QC, the independent reviewer, has described the Bill as,

“a work in progress … laced with technical detail, some of which could usefully be clarified or improved”.

I take this opportunity, because it is very important and I know that he would want me to take this opportunity, to clarify exactly what David Anderson has and has not said about the legality of bulk powers. I shall do that using his own words. In the supplementary written evidence to this Committee, which all hon. Members will have read, dated 12 April of this year, he says at paragraph 9:

“As to the necessity of bulk powers and the extent to which I came or did not come to a conclusion on this issue, the position is as set out in my supplementary written evidence to the Joint Bill Committee of January 2016, paras 4-9”.

If we turn to that supplementary written evidence, his paragraphs 4 to 9 appear under the heading, “Need for bulk powers”:

“It was put to David Davis MP on 16 December (Q177) in relation to ‘bulk interception, bulk acquisition of the collection of communications data”—

Which we are concerned with in this chapter—

“and bulk equipment interference’”—

that is the next chapter—

“that I had looked at them and pronounced myself ‘satisfied that those powers were necessary’. While there is much truth in that comment, I should like to clarify what I did and did not conclude in relation to the need for bulk powers. The central point is that the appointed Commissioners and the IPT are best placed to judge whether each of these powers is necessary and proportionate. The Commissioners have the advantage of longer and more thorough exposure to the exercise of those powers than did I; and the IPT in a number of cases has had the additional advantage of detailed and formally presented argument from both sides”.

In paragraph 6, he says:

“My own detailed briefings however left me in no doubt as to the utility of…

a. bulk data collection”—

note the word “utility”, not “necessity and proportionality”—

“particularly in fighting terrorism in the years since the London bombings of 2005…and

b. the compulsory retention by CSPs”—

communications service providers—

“of communications data”.

He says that he has no doubt about the utility of the powers, but in paragraph 7 he goes on to say:

“Whether those powers are proportionate in law is ultimately for the courts to decide, in the light of the conditions and safeguards provided for in the Bill. The relevant decided and pending cases are set out in AQOT”—

“A Question of Trust”—

“chapter 5 and include Digital Rights Ireland, to the extent that this judgment is applicable to domestic law…See further Schrems…and the Davis/Watson case, on which I have written twice since AQOT.”

He footnotes the references. Crucially, he goes on to say in paragraph 8:

“My report however contains no independent conclusions on the necessity for or proportionality of:

a. the use of bulk personal datasets”,

which we will discuss later today or on Thursday, under chapter 7,

“where I noted simply that the conclusions of the ISC and of the Intelligence Services Commissioner—who has been reviewing their use for several years—were consistent with the information and demonstrations I was given at all three agencies”.

He says that his report

“contains no independent conclusions on the necessity for or proportionality of…

b. the newly-avowed section 94 bulk collection power”,

which we are discussing in relation to clause 138 and

“which I was not authorised to refer to in AQOT, on which IOCCO has not yet reported and of which I have remarked that I made no assessment of its necessity or proportionality and that the agencies ‘should have to defend that power in the public space, where people can evaluate the claims they make and evaluate the risks as well as the benefits’”.

David Anderson also says that his report contains no independent conclusions on the necessity for or proportionality of internet connection records or bulk equipment interference, which we will discuss in chapter 3 of part 6.

There we have it, in David Anderson’s own words: his report does not reach any independent conclusions about the necessity for or proportionality of the powers that we are discussing now in relation to chapter 2 of part 6, or in relation to bulk equipment interference in chapter 3 of part 6. It would be absolutely incorrect to say that David Anderson reached an independent conclusion on that, as he has said himself that he did not.

However, I will quote him in full to give balance. He goes on to say in paragraph 9:

“I do not intend to suggest that any of the bulk powers I have referred to are unnecessary or disproportionate in the form provided for in the Bill. Indeed I view with a degree of scepticism (because they do not square with my own observations) suggestions that such powers are persisted in despite being useless or even counterproductive in practice. My point is simply to make clear what I did and did not conclude, so that false comfort is not taken from my Report in areas where it is incumbent on the Government to justify powers that it seeks to enshrine for the first time in clear law.”

Those are the gentleman’s own words. He cannot be prayed in aid by the Minister or other Government Members as having reached an independent conclusion on the necessity and proportionality of the powers that we are discussing now, those in the next chapter or those in part 7 of the Bill, because he says that he has not.

In paragraph 10 of the supplementary evidence, he says of the Government’s requirement to justify powers:

“In that respect, I endorse the advice of Jim Killock (Q127) and Eric King (Q207)”—

the much maligned Eric King—

“that the Government should do more to make an operational case for the bulk powers that it seeks to preserve, as it has for the ICR power that it seeks to introduce. That course seems to me, indeed, to be very much in the Government’s own interest:

a. It is the Government that bears the burden (including the legal burden) of demonstrating that inroads into the legal protection afforded to privacy and to personal data are necessary and proportionate—particularly where (as in the case of equipment interference) those inroads are active rather than passive, and may affect the interests of companies and individuals in friendly nations who are not themselves suspected of wrongdoing.

b. Though there must by now be evidence of the utility of these powers, they have not been the subject of parliamentary debate”—

that is the newly avowed powers—

“and each may ultimately have to be defended in European courts which—because of their limited capacity to consider closed material—will need to be persuaded on the basis of evidence in the public domain.

c. If an evidence-based public defence of the powers is not attempted, the argument may yet be won at European level by those who—having never been exposed to the evidence—assert the powers to be either useless or more sinister in their operation than is in fact the case.”

David Anderson is saying that he did not, as I have repeated, reach an independent conclusion on the necessity and proportionality of these powers. It is for the Government to convince us of that and for Parliament to debate those issues. It is against the background of that statement in particular that I urge the Minister to do what he said he would do this morning and reconsider the arguments made by me and the hon. and learned Member for Holborn and St Pancras in favour of strengthening the operational case. Until such time as such a strengthened operational case is made and properly analysed by parliamentarians, the Scottish National party cannot support the inclusion of chapter 2 in the Bill.

Some hon. Members have reservations about Eric King’s evidence to the Committee on 24 March, but it is noteworthy that, in the passage I just read out, David Anderson endorses Eric King’s advice on the need to make an operational case. Eric King explained in his evidence that, although initial bulk acquisition warrants are required to authorise such bulk acquisition, there is an intermediate stage at which data analysis of what has been acquired is carried out by computers at GCHQ without any further need for authorisation or legal regulation. Members will recall that the shadow Minister and I both questioned Eric King on that point, and his concern is that a vast amount of analysis is done on the data acquired without any further warranting.

The Government have often sought to justify the powers in the Bill by the double lock that they promised us, but it is important for us to remember that, although a small number of bulk acquisition warrants will authorise the initial collection of the bulk data, there will be no warranted authority for the intermediate stage of analysing that bulk, which is a gross intrusion into the privacy of our constituents, whose data will be in the bulk data acquired under such warrants.

The Minister has talked about the powers not being new, and there has been a recent avowal that the communications data of UK citizens are already being collected in bulk under section 94 of the Telecommunications Act 1984. That section is somewhat vaguely worded and, as the right hon. Member for Haltemprice and Howden (Mr Davis) has said, nobody could have envisaged that it would be used for that purpose when the Act was passed because, as I think I am correct in saying, in 1984 the internet was just a notion in the minds of several clever individuals.

Photo of Suella Fernandes Suella Fernandes Ceidwadwyr, Fareham 10:00, 26 Ebrill 2016

Does the hon. and learned Lady agree that all three independent assessments concluded that the mass surveillance she suggests is complete fantasy? In his evidence to the Joint Committee, Professor Clarke from the Royal United Services Institute endorsed the approach. The idea that the state somehow has a huge control centre where it is watching what we do is complete fantasy. Not only is there a limit to capacity but there is no interest in carrying out such activities.

Photo of Joanna Cherry Joanna Cherry Shadow SNP Westminster Group Leader (Justice and Home Affairs)

The hon. Lady may recall that, when I spoke about this on Second Reading, I said that I was not going to use the phrase “snoopers charter” because it is counterproductive, and nor was I going to use the phrase “mass surveillance,” but that I was going to use the phrase “suspicionless surveillance.” What is happening under section 94 of the Telecommunications Act will continue to happen if we pass these powers without questioning them properly: bulk acquisition warrants will authorise the acquisition of huge amounts of communications data on everybody living in the United Kingdom, which will then be analysed by computers at GCHQ without any further need for authorisation. My argument is that that is a form of suspicionless surveillance. While it may have some utility, as David Anderson has said, I am not convinced that it is either necessary or proportionate. I made some fairly detailed arguments last Thursday about the inadequacy of the operational case and will not repeat them.

Photo of Lucy Frazer Lucy Frazer Ceidwadwyr, South East Cambridgeshire

I do not want to misquote the gentleman from BT as I do not have his exact words in front of me, but when we heard evidence from him on our first day in Committee, he said clearly that much of that information was already being collected. I would also like to point out, as I did in a speech on the Floor of the House, that it is clear that Google is already accessing this material and people seem to accept that—Google is analysing the content of our emails.

Photo of Joanna Cherry Joanna Cherry Shadow SNP Westminster Group Leader (Justice and Home Affairs)

I will deal with the hon. and learned Lady’s second point first. I accept her legitimate concerns about the extent to which private entities such as Google and others collect private data. Parliament should be looking at that, although it is not really the subject matter of this Bill. However, the crucial difference between Google’s collection of comms data and the UK Government’s, or its agencies’, is that Google does not have the coercive power of the state. It may have great corporate power—in fact, there is no “may” about it—but it does not have the state’s coercive power.

The hon. and learned Lady’s first point was that these powers already exist. We found out only very recently, when the Home Secretary announced it on 4 November last year, the day the draft Bill was published, that the data were already being collected in bulk under section 94 of the 1984 Act. That had never previously been admitted by the Executive—apparently it was known only by a handful of Cabinet Ministers. Parliamentarians had previously been led to believe that communications data retention and acquisition took place under the Regulation of Investigatory Powers Act 2000 and the Data Retention and Investigatory Powers Act 2014, because that legislation specifically permits the agencies to require comms data on national security and serious crime grounds.

As I said earlier, when section 94 of the 1984 Act was passed, no one envisaged that those powers would be used in that way. The mere fact that the powers are already being used does not necessarily mean that they are proportionate or that we should not carefully scrutinise their necessity and proportionality now that they are being put on a proper statutory footing. In an intervention on the hon. and learned Member for Holborn and St Pancras last week, I made the point that, if we follow the course of action the Scottish National party advocate, which is to remove parts 6 and 7 from the Bill until a proper operational case has been made, and if the agencies who are already using these powers say that they are legal under existing legislation, we will not be jeopardising national security, because the powers will continue to be used—although I stress that their underlying legality is open to question.

I do not want to take up much more time, but I want to make the point that, in the digital age we live in, communications data provide a detailed and revealing picture of somebody’s life. If we look at how comms data are defined under DRIPA and RIPA, we can see that they include the date, time, duration and type of communication, the type of communication equipment used, its location and the calling and receiving telephone numbers. That sort of information can reveal personal and sensitive information about an individual’s relationships, habits, preferences, political views, medical concerns and the very streets they walk on. That point was made in the Digital Rights case by the Court of Justice of the European Union:

“Those data, taken as a whole, may allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them.”

With those sorts of data, the state is able to put together a complete and rich picture of what a person does and thinks with whom, when and where. I accept that that would be extremely useful for tracking terrorists, but it is extremely intrusive for the vast majority of the population who are innocent persons and who wish to live their personal lives in private. That is why I took some time on Thursday to address the utility of targeted surveillance, particularly in reference to the examples given in the operational case.

The shadow Minister made a point on legal professional privilege. Under comms data, the data available from a phone call from a lawyer to a witness could identify the lawyer’s name and location and the witness’s name and location. As he said, that is extremely intrusive information.

I am not going to rehearse the evidence from the United States of America I quoted last week; I will simply reiterate the points I sought to make. In America, not in reference to the evidence of the witness Mr Binney but in reference to the conclusions of the Privacy and Civil Liberties Oversight Board and the President’s Review Group on Intelligence and Communications Technologies, serious concerns were raised about the utility of this sort of bulk acquisition. The findings of both those panels refuted claims by General Keith Alexander, the former director of the National Security Agency, and by President Obama that at least 50 threats have been averted and lives have been saved as a result of bulk metadata retention. That led to the advice that bulk surveillance programmes be shut down in the United States, and the US Freedom Act considerably reduced the capacity of the National Security Agency to undertake mass collection of that sort of data in the United States.

There is concern that in chapter 2, which opens with clause 138, the Government are flying in the face of the American experience. I see a chink of light this morning, but so far the Home Office has resisted commissioning an independent review similar to those conducted in the United States of America to evaluate the efficacy of the programme. Unless and until the Government are prepared to commission such an independent review and we have had time to consider its proposals, we cannot support clause 138 or any of the other clauses in chapter 2 of part 6. That is the reason for our opposition.

Photo of Keir Starmer Keir Starmer Shadow Minister (Home Office) 10:15, 26 Ebrill 2016

The hon. and learned Lady, speaking for the SNP, made some important points and I want to pick up on one of them—a nagging concern on which clarification would be helpful. The bulk warrant process under this chapter and others presupposes two stages; first the acquisition of the data and then the examination of the data. I have already made my submission that, broadly speaking, the second stage ought to have a higher threshold than the first stage, for obvious reasons.

It is important to understand that there are actually four steps in a classic case. The first is obtaining data. The second is the first stage of the filtering or triage to deselect or not select all the data that are not needed. Jonathan Evans made a very powerful case on that stage, describing how clearing away all the data that the security and intelligence services do not need to consider, so that they can focus on what they do need to consider, is a major part of the task. The third stage is selecting the data they need to consider. The fourth stage is the examination of that selected material.

It is worrying that there is no reference at all in the Bill or in the code—I will be corrected, if I am wrong about the code, but I have looked—to the middle stage of filtering. We saw earlier that for comms data, when others had obtained them pursuant to a Secretary of State’s retention order, there were specific provisions for filtering. Here, for bulk powers, there are none—there is no mention of filtering in the Bill. Is it intended that the examination provisions serve two purposes—first, the filter purpose and secondly, the more specific access purpose? If so, what is to be specified in the warrant when it comes to operational purposes for examination? Is it the operational case for filter or the operational case for access? I suspect they would be different things. The operational case for filter would be, in the main, to move out of the way data that do not need to be looked at, and I am persuaded of the need for that. That would be one operational case, quite broad in nature; but the operational case for access would necessarily need to be more specific.

I am genuinely concerned that those steps are not apparent in the Bill. If they are implied, it would helpful to have on the record how the Minister sees that the provision covers the various steps. Without making the argument again, this point reinforces my argument that the test for examination of data ought to be higher than the test for acquisition or for filter. This is a very specific issue, but it is nagging because it is not in the Bill, whereas earlier on, there were clear provisions dealing with filter and how the filtering arrangements would work.

Photo of John Hayes John Hayes Minister of State (Home Office) (Security)

We have covered a lot of ground and rightly so, because this is an important part of the Bill and an important clause.

The hon. and learned Member for Holborn and St Pancras is right to say that there are several parts to the process. Paragraph 9.8 of the draft code of practice says:

“As well as being necessary for one of the operational purposes, any selection for examination of BCD must be necessary and proportionate.”

Paragraph 9.9 goes on to talk about the selection of those data, saying:

“In general, automated systems must, where technically possible, be used to effect the selection of BCD in accordance with section 151 of the Act.”

It talks about the filtering system and who should be authorised to be engaged in it, as well as the selection of data being categorised

“under the specified operational purposes” and that the methodology used should remain

“up to date and effective.”

It then says that that process should be in accordance with the relevant provision of the legislation—clause 138, which is the point we are at in our considerations.

It may be that the code of practice could say something more about the stages the hon. and learned Gentleman described and set out the process slightly more chronologically, as he did, where that chronology is helpful to explanation. I understand that argument, but what is absolutely clear is that the whole of the process must be lawful and reinforced by both the fundamental test of necessity and the clarity provided by the operational purposes. I think that is the assurance that he seeks. I do not want to put words in his mouth, but I suspect that he was alluding to the possibility that the middle process—as he put it—might be less rigorous in respect of its relationship to the operational purpose. Perhaps that is not what he meant—but if it is, I can assure him that that is not the case.

Photo of Keir Starmer Keir Starmer Shadow Minister (Home Office)

I am grateful for that explanation. I read into the Minister’s observations and the code that triaging or filtering is part of the examination process—it must be, by definition—and is therefore subject to the further requirements of examination. It is helpful to have how it works on the record, but it would be helpful to have that set out in the code, so that it is clear. The remaining concern is that there is a danger that for filtering purposes what is said about the operational case may be fairly general, but for access it may not be. There are two aspects to examination and there is a danger that the warrant either says too little or too much, depending on which purpose one is dealing with. I suspect that that will happen in most cases, because this is going to be a common process.

Photo of John Hayes John Hayes Minister of State (Home Office) (Security)

That is an extremely well made point, because the case made for the warrant has to be sufficient to persuade the Secretary of State that it is right to issue it. The case made out for the warrant has to be sufficiently specific to colour the rest of what occurs, to help to define the process the hon. and learned Gentleman describes. However, to return to the argument I made in the earlier debate, by its very nature the collection of bulk material is about taking fragments of information that one then pieces together through this process. The hon. and learned Gentleman is right that a balance has to be struck between that specificity and the very virtue that comes from broader examination of data. Where we might be able to reach common ground, as he put it, is on the character of the explanation in the draft code of practice. Perhaps we can set down what I have just said and what the hon. and learned Gentleman has requested in a slightly different way, which would help the first examination of the information. I hope that is of assistance.

Photo of John Hayes John Hayes Minister of State (Home Office) (Security)

The hon. and learned Member for Edinburgh South West has again added to our considerations with the thoroughness of her analysis, for which I am grateful. She quoted Burns, to which I shall return later.

Access to bulk communications will be limited to security and intelligence agencies; it must be for an operational purpose specified in the warrant and be necessary and proportionate. As the hon. and learned Gentleman said, it must be for one or more considerations of national security, serious crime or economic wellbeing where it is linked to national security. On that we agree, but the clause makes it crystal clear that the operational purposes must relate to one or more of the grounds for which the warrant is considered necessary. For example, if a bulk acquisition warrant is issued in the interests of national security and for the purposes of preventing or detecting serious crime, every specified operational purpose on that warrant must be necessary for one or both of those two broader purposes. Operational purposes must also include more detail than the statutory grounds, to ensure that the Secretary of State is provided with a granular understanding of the purposes for which the selection examination may take place. If the Secretary of State does not consider every operational purpose to be necessary, the warrant may not be issued. Therefore this is not a permissive process—far from it. It is designed to determine all that happens after the issuing of a warrant.

The hon. and learned Lady raised a number of other points and referred to David Anderson, whose perspective I want to discuss in some detail. As she will know, David Anderson said at the very outset, when the draft Bill was published, that he gave it four stars out of five. That was in November. Since then, the Bill has been improved further in the light of the parliamentary pre-legislative scrutiny and, critically, as a result of the recommendations of the Joint Committee—I am delighted that we heard from a distinguished member of that Committee in this debate. The Joint Committee said:

“We recommend that the Government should publish a fuller justification for each of the bulk powers alongside the Bill. We further recommend that the examples of the value of the bulk powers” be provided.

Catalysed by that recommendation we produced a case for bulk powers, with which the hon. and learned Lady will be familiar and in which the arguments that I have pithily made today are set out in more detail. I draw attention to just one of them, in paragraph 5.7 on page 18 of that document:

“Using information from communications service providers without the ability to conduct complex analysis of bulk data would also mean that the security and intelligence agencies would need to conduct intrusive analysis against a larger range of individuals in order to assess if they were part of the terrorist network.”

The use of bulk powers means that other, more intrusive powers are not used. To make the case still more vividly, that is precisely what happened in the investigation into the murder of Fusilier Lee Rigby, as the Intelligence and Security Committee made clear. The intelligence picture that emerged following that investigation, which led to us uncovering the full background of the case, and which was then looked at by that Committee, made it absolutely clear that access to bulk communications data and bulk personal datasets allowed the security and intelligence agencies to focus their limited resources on the most serious threats by quickly ruling out other associates and family members from the investigation. Contrary to what some think, the use of these bulk powers can obviate the need for the exercise of other capabilities, with the benefits to which the ISC drew attention.

As I said in my letter to the Committee, David Anderson told us on 24 March that he was “not persuaded” of the case for an additional independent reviewer of bulk powers, because

“it would be very difficult to say that the ISC had not had an independent look at these issues.”––[Official Report, Investigatory Powers Public Bill Committee, 24 March 2016; c. 6.]

He added that the ISC was qualified to do that job. The Chair of the ISC made it very clear on Second Reading that, having looked closely at these matters himself, he was persuaded of the need for these powers. He said:

“The present Committee and its predecessor are satisfied that the Government are justified in coming to Parliament to seek in broad terms the powers that the Bill contains. None of the categories of powers in the Bill—including the principle of having powers of bulk collection of data, which has given rise to controversy in recent years—is unnecessary or disproportionate to what we need to protect ourselves.”—[Official Report, 15 March 2016; Vol. 607, c. 836.]

David Anderson cited the ISC as being best qualified to make these judgments, and the Chair of the ISC has delivered a judgment.

Photo of Joanna Cherry Joanna Cherry Shadow SNP Westminster Group Leader (Justice and Home Affairs) 10:30, 26 Ebrill 2016

I read last night very carefully what the Chair of the ISC, Mr Grieve said on Second Reading. He had three concerns, which were,

“the authorisation procedures for the examination of communications data… the agencies’ use of equipment interference” and,

“the process for authorising the obtaining of bulk personal datasets”. —[Official Report, 15 March 2016; Vol. 607, c. 837-8.]

Does the Minister agree with me that a careful reading of the hon. and learned Gentleman’s remarks leads to the conclusion that he had outstanding concerns about the bulk powers?

Photo of John Hayes John Hayes Minister of State (Home Office) (Security)

In your absence, Ms Dorries, I have said that part of my mission was to take the hon. and learned Lady from the fog of doubt to the light of understanding, and earlier she herself described a chink of light. I am happy to consider what more we might do on the operational case. I do not want to go too far on that, because I have to look closely at walking the tightrope between what we can and cannot say publicly about the work of our intelligence and security services. Nonetheless, a powerful case was made on that subject and it is a matter of continuing interest to us.

The hon. and learned Lady quoted at length the evidence from America, but she will know that, in fact, the evidence from America is extremely mixed. A series of pieces of work has been done on these matters. In July 2014, the US Privacy and Civil Liberties Oversight Board said on bulk data collection that:

“Overall, the Board has found that the information the program collects has been valuable and effective in protecting the nation’s security and producing useful foreign intelligence…The program has proven valuable in the Government’s efforts to combat terrorism as well as in other areas of foreign intelligence…the program has led the Government to identify previously unknown individuals who are involved in international terrorism, and it has played a key role in discovering and disrupting specific terrorist plots”.

That builds on earlier work done in the United States to examine the powers. In 2012, the Senate looked at these matters and came to similar conclusions. It is not fair to say that international experience is at odds with what we are doing and with what we are cementing in the Bill. I know that the hon. and learned Lady, being scrupulously fair and reasonable, would want to put a balanced position on the American experience.

Photo of Joanna Cherry Joanna Cherry Shadow SNP Westminster Group Leader (Justice and Home Affairs)

I am grateful to the Minister for giving way so that I can put a balanced position. The Privacy and Civil Liberties Oversight Board’s report of January 2014 talks at page 11 specifically about the bulk telephone records programme, saying that:

“Based on the information provided to the Board, including classified briefings and documentation, we have not identified a single instance involving a threat to the United States in which the program made a concrete difference in the outcome of a counterterrorism investigation. Moreover, we are aware of no instance in which the program directly contributed to the discovery of a previously unknown terrorist plot or the disruption of a terrorist attack”.

That is what the board concluded about the bulk telephone records programme in the United States of America, which is closest to what we are discussing at present in chapter 2.

Photo of John Hayes John Hayes Minister of State (Home Office) (Security)

Ms Dorries, I am sure that you will not permit me to stray too far into a detailed consideration of how the United States has viewed these matters, but I simply say to the hon. and learned Lady that the Senate Committee that I mentioned in 2012 described the,

“ability to collect information and act quickly against important foreign intelligence targets”,

as being significant. The US National Academy of Sciences report, “Bulk Collection of Signals Intelligence: Technical Options”, said that:

“For investigations that have little or no prior targeting history, bulk collection may be the only source of useful information”.

I could go on and on, but to do so would tire the Committee and no doubt put me on the wrong side of the Chair, so I will not.

To conclude, we have had a long but important debate about this issue. The use of the powers under the Bill is subject to oversight by independent judges, the Interception of Communications Commissioner and the Intelligence and Security Committee, and none of them has raised concerns about the lawfulness of the powers. The hon. and learned Member for Holborn and St Pancras rightly said that, for the first time, we are considering these matters in a single piece of legislation and enjoying this debate. It is right that we should do so and that we should put safeguards into place, but it is just as right that we should maintain the capabilities necessary to deal with threats to our national security. I say without equivocation or hesitation that the powers are critical to that purpose and must continue to be used in our national interest.

Question put, That the clause, as amended, stand part of the Bill.

The Committee divided:

Ayes 8, Noes 2.

Rhif adran 53 Christmas Tree Industry — Power to issue bulk acquisition warrants

Ie: 8 MPs

Na: 2 MPs

Ie: A-Z fesul cyfenw

Na: A-Z fesul cyfenw

Question accordingly agreed to.

Clause 138, as amended, ordered to stand part of the Bill.

Clause 139