Warrants: notification by Judicial Commissioner

Investigatory Powers Bill – in a Public Bill Committee am 7:15 pm ar 3 Mai 2016.

Danfonwch hysbysiad imi am ddadleuon fel hyn

“(1) Upon completion of conduct authorised by a warrant under this Part, or the cancellation of a warrant issued under this Part, a Judicial Commissioner must notify the affected party, in writing, of—

(a) the conduct that has taken place, and

(b) the provisions under which the conduct has taken place.

(2) The notification under subsection (1) must be sent within thirty days of the completion of the conduct or cancellation of the warrant.

(3) A Judicial Commissioner may postpone the notification under subsection (1) beyond the time limit under subsection (2) if the Judicial Commissioner assesses that notification may defeat the purposes of an ongoing serious crime or national security investigation relating to the affected party.

(4) A Judicial Commissioner must consult with the person to whom the warrant is addressed in order to fulfil an assessment under subsection (3).”.—

This amendment would introduce a requirement that all equipment interference produces a verifiable audit trail. This will be particularly vital to the success and legitimacy of prosecutions. It is recommended that further provision for the independent verification of audit trails is included in Part 8 (Oversight Arrangements).

Brought up, and read the First time.

Photo of Joanna Cherry Joanna Cherry Shadow SNP Westminster Group Leader (Justice and Home Affairs)

I beg to move, That the clause be read a Second time.

With this it will be convenient to discuss the following:

New clause 13—Audit trail of equipment interference—

“Any conduct authorised under a warrant issued under this Part must be conducted in a verifiable manner, so as to produce a chronological record of documentary evidence detailing the sequence of activities (referred to hereafter as ‘the audit trail’).”.

New clause 18—Notification by Intelligence and Surveillance Commissioner—

“(1) The Intelligence and Surveillance Commissioner is to notify the subject or subjects of investigative or surveillance conduct relating to the statutory functions identified in section 196, subsections (1), (2) and (3), including—

(a) the interception or examination of communications,

(b) the retention, accessing or examination of communications data or secondary data,

(c) equipment interference,

(d) access or examination of data retrieved from a bulk personal dataset,

(e) covert human intelligence sources,

(f) entry or interference with property.

(2) The Intelligence and Surveillance Commissioner must only notify subjects of surveillance under subsection (1) upon completion of the relevant conduct or the cancellation of the authorisation or warrant.

(3) The notification under subsection (1) must be sent by writing within 30 days of the completion of the relevant conduct or cancellation of the authorisation or warrant.

(4) The Intelligence and Surveillance Commissioner must issue the notification under subsection (1) in writing, including details of—

(a) the conduct that has taken place, and

(b) the provisions under which the conduct has taken place, and

(c) any known errors that took place within the course of the conduct.

(5) The Intelligence and Surveillance Commissioner may postpone the notification under subsection (1) beyond the time limit under subsection (3) if the Commissioner assesses that notification may defeat the purposes of an on-going serious crime or national security investigation relating to the subject of surveillance.

(6) The Intelligence and Surveillance Commissioner must consult with the person to whom the warrant is addressed in order to fulfil an assessment under subsection (5).”.

Photo of Joanna Cherry Joanna Cherry Shadow SNP Westminster Group Leader (Justice and Home Affairs)

The new clause relates to part 5 of the Bill, which deals with equipment interference—more colloquially known as “hacking”. The effect of the new clause would be to require that the targets of hacking, or the targets of equipment interference, are notified after the fact, as long as that does not compromise any ongoing investigation. The effect of the new clause would mean that the judicial commissioners were under a mandatory statutory duty to notify those subject to surveillance once a particular operation or investigation had ended. At present, unlawful surveillance only comes to light as the result of a chance leak, whistleblowing or public interest litigation of the sort brought by Liberty and other non-governmental organisations and concerned citizens. That is deeply unsatisfactory and is also potentially contrary to our obligations under the European convention on human rights. If a person’s article 8 and other Human Rights Act-protected rights have been infringed, in order to have access to an effective remedy, as required under human rights law, the person must first be made aware of a possible breach. This was stated by the Court in Strasbourg in Klass v. Federal Republic of Germany back in 1978 and reiterated more recently in Weber and Saravia v. Germany in 2006. In both cases, the European Court of Human Rights reiterated

“that the question of subsequent notification of surveillance measures is inextricably linked to the effectiveness of remedies before the courts and hence to the existence of effective safeguards against the abuse of monitoring powers, since there is in principle little scope for recourse to the courts by the individual concerned unless the latter is advised of the measures taken without his or her knowledge and thus able to challenge their legality retrospectively.”

More recently, in the case of Zakharov v. Russia in December 2015, the Grand Chamber of the European Court of Human Rights found that judicial remedies for those subjected to interception in Russia were generally ineffective, particularly in light of the total absence of any notification requirement with regard to the interception subject, which meant that there was no meaningful ability to mount retrospective challenges to surveillance measures, and therefore such provision as there was in Russia was ineffective. Do we want to be passing legislation that is as ineffective in the protection of our constituents’ rights as that in Russia?

The Bill, as it stands, provides a new power for the Investigatory Powers Commissioner to inform someone subjected to a surveillance error by a public authority, but not by a communications service provider, if the commissioner is made aware of it and considers it sufficiently serious, in the public interest, not prejudicial to national security, and so on. We debated that at some length last week. For an error to be serious, it must have caused significant prejudice or harm to the person concerned.

As we also discussed last week, the Bill states that a breach of the Human Rights Act is not, in itself, sufficient for an error to be considered serious, which is a serious shortcoming of the Bill. When notifying someone of an error, before making a decision the Investigatory Powers Commissioner must ask the public authority responsible for the error to make submissions to the commissioner about the matter concerned. That is a narrow, arbitrary and highly discretionary power that will relate only to the most serious errors that judicial commissioners discover during their very limited audit of the use of surveillance powers, which highlights the conflicted position in which judicial commissioners may find themselves, and it does not discharge the Government’s human rights obligations to provide post-notification by default unless they can justify continued secrecy. That is very significant because the security repercussions of hacking into a device or network create an even greater imperative for post-notification, as we discussed at length when we debated amendments and clauses under part 5.

When we debated part 5, it was noted by me and others that a hack, once it has been carried out, may compromise the security of the hacked device, leaving it open to further exploitation by criminals or even other Governments. It is the equivalent of the state breaking into a house, conducting a search and then leaving without locking the doors and without the resident realising that all that has happened. It is one thing for the state to hack into a device where it is strictly necessary and proportionate, but it is quite another for the state to leave the scene, leaving individuals vulnerable to criminal attacks with no way of protecting themselves. If the Government wish their security and law enforcement agencies to have this significant power, they must accept the concomitant responsibility. The purpose of new clause 12, put briefly, is to put the judicial commissioners under a mandatory statutory duty to notify persons after the fact, once an operation or investigation has ended, unless there are very good reasons not to do so.

New clause 13 also addresses equipment interference, or hacking, under part 5. The purpose of the new clause is to introduce a requirement that all equipment interference must be accompanied by a verifiable audit trail. The reason for the new clause is that hacking or equipment interference can include any number of methods, many of which empower the hacker to add, delete and alter files and software, changing the content of the hacked device. Unlike traditional searches, the practice of equipment interference necessitates interference with items that may later be used as evidence, and the new clause would protect the integrity of such potential evidence and the success of prosecutions. It is essential that we do that, because otherwise potential evidence could be compromised in such a way that it was not able to be used and prosecutions could be undermined. With an independently verifiable audit trail, however, that risk ought to be avoided.

Another benefit of an audit trail is that it provides a helpful way of seeing that the conduct has taken place in accordance with good practice. Similarly, the police have to keep a log of activity undertaken when conducting traditional property searches, and those of us who have experience of the criminal courts will know how useful those logs are. A verifiable audit trail would be particularly vital should certain practices be conducted by telecommunications operators; if tasks were outsourced to private contractors it would ensure that they were carried out in accordance with the law. The new clause, therefore, is in the public interest and it strengthens the power in the Bill, in the sense that it tries to protect the integrity of evidence and the success of subsequent prosecutions.

New clause 18 relates to part 8 of the Bill. It would introduce a new duty of general notification and create the presumption that subjects of surveillance had been notified after the end of a period of surveillance, subject to a public interest in preserving the integrity of police investigations and national security inquiries. What underlies the new clause is the key safeguard identified by the European Court of Human Rights that individuals be notified of surveillance as soon as is reasonably possible.

The House of Lords Constitution Committee previously recommended that

“individuals who have been made the subject of surveillance be informed of that surveillance, when completed, where no investigation might be prejudiced as a result”,

and provision for mandatory notice would allow individuals to pursue a claim before the tribunal in their own right, even in circumstances where the investigatory powers commissioner had not identified an error. That model operates in other countries without difficulty, and although notification in sensitive cases might be less likely, the potential for disclosure could create an additional impetus towards lawful decision making by agencies and other bodies that were exercising the compulsory powers.

I will give some examples of what happens in other countries. For instances of intersection and law enforcement matters in the United States of America, notification is, by default, within 90 days of the termination of the relevant surveillance, unless the authorities can show that there is good cause to withhold the information. A similar model operates in Canada, where the subject of an intersection warrant for the purposes of law enforcement must be given notice within 90 days of a warrant expiring, but the period can be extended by up to three years in terrorism claims, subject to judicial oversight if it is in the interests of justice. I understand also that similar notification provisions apply in Germany and the Netherlands, with similar exemptions to protect the integrity of ongoing inquiries.

I am anxious to know, therefore, what Ministers have to say about the proposed new clauses. I have been careful in my arguments to emphasise that adding the new clauses to the Bill need not compromise the integrity of surveillance and investigations. Other countries do it. They have time lapses and exceptions to extend a time lapse, as in Canada, from 90 days to up to three years for a terrorism claim, again subject to judicial oversight and the question whether it is in the interests of justice.

The thrust of my argument is necessity. The amendments are necessary for us to comply with our duties under the European convention on human rights, and it appears that they operate without problem in other jurisdictions, not just on the continent of Europe but in the United States of America and in Canada.

Photo of Robert Buckland Robert Buckland The Solicitor-General 7:30, 3 Mai 2016

I have listened with great care to the arguments of the hon. and learned Lady. I absolutely agree that, where a serious error has occurred in the use of investigatory powers, the commissioner should be able to inform those affected. We have clause 198(1) to deal with that. However, I do not agree with the principle that as a matter of course, everyone or anyone subject to the use of a lawful investigatory power should be notified of the use of those powers, even with the caveat “unless it would damage an ongoing serious crime or national security investigation”. Such a principle would mean that we could not exclude the possibility of having to notify suspected criminals and terrorists that powers had been used against them, just because a specific ongoing investigation had stalled or indeed ended with evidence of wrongdoing, but without sufficient evidence to meet the prosecution test.

As hon. Members will know, suspected criminals and terrorists will often appear on the radar of the police and security services at different times and in different contexts. Clearly, it would not be at all appropriate to inform them that investigatory powers had been used in one case, as that could prompt them to change how they behave or communicate and hamper subsequent investigation.

National security is particularly important in relation to this matter, because the amendment would require the commissioner to make the subject of interest aware of the conduct that had taken place. That would not only run contrary to the long-standing policy of successive Governments of neither confirming nor denying any specific activity by the security and intelligence agencies; it would essentially require the techniques that they use in specific cases to be made public. That cannot be in the public interest. It would assist terrorists and criminals in their operations, which I am sure cannot be the intention behind the amendment.

Furthermore, the commissioner can delay notification only on the basis of serious crime rather than of crime generally, meaning that the amendment would require the commissioner to inform suspects in active criminal investigations that their communications data had been acquired. One example is an investigation into stalking. It may well not meet the serious crime threshold, but as we have discussed in another context, communications data could be essential, because they could show contact between two parties. My worry about the amendment is that it would require the stalker to be informed that his communications data had been requested, which surely cannot be the intent.

Photo of Joanna Cherry Joanna Cherry Shadow SNP Westminster Group Leader (Justice and Home Affairs)

Does the Solicitor General agree that new clause 12(3) deals with the very problem that he has just identified? It says:

“A Judicial Commissioner may postpone the notification under subsection (1) beyond the time limit under subsection (2) if the Judicial Commissioner assesses that notification may defeat the purposes of an ongoing serious crime or national security investigation relating to the affected party.”

Photo of Robert Buckland Robert Buckland The Solicitor-General

I am afraid that it does not, because it uses the words “serious crime”. I have given an example that might not be seen as a serious crime, although as we all know, stalking is absolutely no joke to the victims and can lead to extremely serious consequences for them. I know that the hon. and learned Lady agrees with me about all that.

Beyond the principled objections to the amendment, there are numerous practical problems. It would not be practical, for example, for the commissioner to make everyone whose data were subject to a data retention notice aware of that fact. The commissioner would have to require the relevant telecommunications operator to provide them with a list of all relevant customers, and that operator would have to inform the commissioner every time a new customer joined the service. I worry that it would be pretty easy for criminals to use that process to identify services that they could use to avoid detection, and that unreasonable burdens would be put on all the public authorities covered by the Bill.

Photo of Joanna Cherry Joanna Cherry Shadow SNP Westminster Group Leader (Justice and Home Affairs)

By way of probing, if we were to delete the word “serious”, so that the subsection read, “notification may defeat the purposes of an ongoing criminal investigation or a national security investigation,” would that deal with the Solicitor General’s concerns?

Photo of Robert Buckland Robert Buckland The Solicitor-General

I am grateful to the hon. and learned Lady for the way in which she is seeking a reasonable compromise, but I worry that her proposed approach is, on that basis, unnecessary. We already have checks and balances in the framework of the Bill that allow for serious error to be properly identified and dealt with, and for those affected to be notified. As I was saying, I worry that we would end up placing unreasonable burdens on public authorities by requiring them constantly to make a case to the commissioner about whether what they were doing would hamper national security or crime investigations if suspects were told that investigatory powers were being used against them. It would be far better for the police to spend their time and money on getting on with the work of investigating criminals than on determining whether individuals should be informed about what we should not forget is perfectly lawful investigative activity, with the caveat I mentioned about serious error.

Furthermore, in the context of bulk warrants under parts 6 and 7 of the Bill, the public authority or commissioner would need to examine all the data collected under the warrant to identify those individuals whose data had been collected. That would be impracticable and would actually lead to greater intrusions into privacy, because, as we know, bulk data are not examined to that degree unless there is a specific purpose and a properly framed approach. I am sure that cannot be the intention of the amendment. These proposed new clauses are at best unnecessary and at worst frankly unhelpful, and risk undermining the work of our law enforcement and security and intelligence agencies.

On new clause 13 and the audit trail point, the draft code of practice, at paragraph 8.5, requires that

“When information obtained from equipment interference is used evidentially, the equipment interference agency should be able to demonstrate how the evidence has been recovered, showing each process through which the evidence was obtained.”

There will, however, be circumstances when equipment interference is used on an intelligence-only basis—that is, a non-evidential basis. Given those points, and given that it is in the interests of law enforcement and the intelligence agencies to ensure that where equipment interference is used to support a criminal investigation, that is done accordance with evidential standards, new clause 13 is, with respect, not necessary.

If that new clause is in fact about the enhancement of oversight, we have made it clear that while the powers of the new commissioner are being significantly increased, their resources will be greatly increased, which means that they will be able to audit, inspect and review equipment interference agencies as they see fit. In addition, the draft code of practice for equipment interference will require the relevant agencies to keep extensive records to support and enable oversight. There has been no suggestion from the current oversight commissioners in respect of property interference warrantry that a statutory requirement for an audit trail is necessary.

The hon. and learned Lady properly made reference to recent ECHR authorities, most notably Zakharov, a case that I have looked at in the context of these debates. We have to be careful about Zakharov, because it deals with the targeted interception regime—a particular aspect of the debate, as she knows—rather than the bulk regime, in relation to which it is sometimes prayed in aid. I give that caveat in the spirit of fairness, because of course the Zakharov case contained reference to Kennedy v. United Kingdom, a 2010 case in which the UK was found to be in compliance with article 8. In particular, the role of the Investigatory Powers Tribunal was seen as an important part of the checks-and-balances mechanism that allowed the Court to come to the conclusion that the article 8 requirements were satisfied.

We know that the Zakharov case was in the context of a Russian domestic law scenario, which I think we all agree is somewhat different from the scenario in which we work. I do not seek to palm it off glibly on the basis that it relates to Russia and not to the UK, but looking at the ambit of Zakharov and the domestic context in which that case was brought, it is somewhat more difficult than appears at first sight to draw direct comparisons and conclusions from that authority that undermine the carefully calibrated approach the Government are taking to investigatory powers. For all those reasons, I respectfully ask the hon. and learned Lady not to press her new clause.

Question put, That the clause be read a Second time.

The Committee divided:

Ayes 2, Noes 10.

Rhif adran 129 Christmas Tree Industry — Warrants: notification by Judicial Commissioner

Ie: 2 MPs

Na: 10 MPs

Ie: A-Z fesul cyfenw

Na: A-Z fesul cyfenw

Question accordingly negatived.

New Clause 13