Investigatory Powers Bill
Public Bill Committee, 24 March 2016.
Nadine Dorries (Conservative, Mid Bedfordshire)
Before we begin, I have a few preliminary announcements. Please switch electronic devices on to silent—thank you. Tea and coffee are not allowed during sittings.
Today, we will first consider the programme motion on the amendment paper. We will then consider a motion to allow us to deliberate in private about our questions before the oral evidence sessions, before considering a motion to enable the reporting of written evidence for publication. I hope that we may take some of those formally, without debate . I call the Whip to move the first motion.
Nadine Dorries (Conservative, Mid Bedfordshire)
Therefore, the deadline for amendments to be considered at the first two line-by-line sittings of the Committee on 12 April is 4.30 pm on Thursday 7 April.
Nadine Dorries (Conservative, Mid Bedfordshire)
Copies of written evidence that the Committee receives will be made available in the Committee Room.
We will now move to the examination of the witnesses. We have agreed that Mr Starmer will open, but this is very informal, so anyone who wants to speak may do so at any time. Minister, you will wish to join in.
Examination of Witnesses
Nadine Dorries (Conservative, Mid Bedfordshire)
Welcome, Mr Anderson. Before we start, do any Members wish to make a declaration of interest?
Keir Starmer (Labour, Holborn and St Pancras)
Thank you, Ms Dorries. May I make a declaration of interest in relation to this witness and a number of other witnesses generally? I know this witness and some others; I have worked with them both as a lawyer and as Director of Public Prosecutions. I therefore put that on the record—if I may make a general declaration, it applies to Mr Anderson and quite a number of the witnesses today.
Robert Buckland (Conservative, South Swindon)
Ditto. I know many of the witnesses as well.
Lucy Frazer (Conservative, South East Cambridgeshire)
David Anderson was my pupil master when I was a barrister.
Chris Matheson (Labour, City of Chester)
I do not know this witness, Chair, but Mr McClure, a witnesses this afternoon, is my constituent and is known to me personally.
Byron Davies (Conservative, Gower)
I was a member of some of the agencies that will attend today.
Suella Fernandes (Conservative, Fareham)
I was a Treasury counsel, representing Government Departments.
Joanna Cherry (Scottish National Party, Edinburgh South West)
I was previously standing junior counsel to the Scottish Government, which has some tangential interest to the serious crime provisions.
Nadine Dorries (Conservative, Mid Bedfordshire)
Okay; that is all the interests out of the way. We will now hear oral evidence from David Anderson QC, independent reviewer of terrorism legislation. Before calling the first Member to ask a question, I remind all Members that questions should be limited to matters within the scope of the Bill, as always, and that we must stick to the timings in the programme motion that the Committee has agreed. For this session, we have until 12 noon. Could the witness please introduce himself for the record?
Keir Starmer (Labour, Holborn and St Pancras)
It is a pleasure to serve under your chairmanship, Ms Dorries. Good morning, Mr Anderson. There are obviously a lot of people around the table whom you know, going by the declarations of interest. May I go straight to one of the central issues in your report, which was the need for an operational case for the powers in the Bill, and particularly the bulk powers? Having now had the opportunity to see what has been published between the Joint Committee report and the publication of the Bill, are you satisfied with the operational cases that have been published?
Keir Starmer (Labour, Holborn and St Pancras)
May I follow up on that? First, so far as operational cases are concerned, do you think there is still a need for an operational case for the police use of equipment interference powers? Secondly, is your view that the ISC should formally indicate whether it has considered the material and is satisfied with what it has seen, rather than implying it in a speech? Thirdly, do you think there is a need for an independent assessment of the operational case? It is one thing to publish it and to put material before the ISC; it is another to have it independently assessed. Apologies for asking three questions, but should a case be made for police use of equipment interference powers; should the ISC be called upon to formally indicate its response to what it has seen; and do we need an independent assessment of the operational cases in full?
Keir Starmer (Labour, Holborn and St Pancras)
Can I ask you about bulk powers? From your experience, could you start by giving the Committee an indication of the scope of some of the bulk powers and warrants, perhaps by reference to the equipment and interference bulk powers?
Keir Starmer (Labour, Holborn and St Pancras)
One of the safeguards is the need for necessity in relation to bulk powers. From your experience, how easy or difficult is it to demonstrate necessity in relation to bulk powers? Give us an idea of the way the test actually operates in your experience.
Keir Starmer (Labour, Holborn and St Pancras)
Can I take you from bulk to internet connection records, which you dealt with in your report? There have been comments about and criticism of the definition—or lack of definition—of internet connection record. Looking at the version in the Bill now, do you have any concerns about the definition?
Keir Starmer (Labour, Holborn and St Pancras)
ICRs are obviously new and developing in real time, but there are a number of other novel and contentious areas in the Bill. Do you see any role for greater independent authorisation in relation to some of these new techniques or powers?
Nadine Dorries (Conservative, Mid Bedfordshire)
Order. Mr Starmer, can you make that your last question, please, because it is already 11.45 am and I think other people would like to ask some questions?
Keir Starmer (Labour, Holborn and St Pancras)
I will do. Thank you.
Nadine Dorries (Conservative, Mid Bedfordshire)
Yes, but as briefly as you could, please. If not, you can provide a written answer.
Joanna Cherry (Scottish National Party, Edinburgh South West)
It is a privilege to serve under your chairpersonship, Ms Dorries.
Good morning, Mr Anderson. The first question that I want to ask you follows up on questions about the operational case for bulk powers. We heard on Second Reading of this Bill in the Chamber that in the United States of America, the bulk collection of citizens’ data has been heavily curbed, as it was considered to be
“not essential to preventing terrorist attacks”.
Most damningly, the American President’s privacy and civil liberties oversight board said that it was
“aware of no instance in which the”
National Security Agency’s bulk records programme had
“directly contributed to the discovery of a previously unknown terrorist plot or the disruption of a terrorist attack.”
Bearing that in mind, do you agree that a proper independent assessment of the utility and effectiveness of bulk powers would need to look at the experience of their use in other jurisdictions?
Joanna Cherry (Scottish National Party, Edinburgh South West)
So, in your investigations for your report, you looked at the experience of at least some other jurisdictions. Is that correct?
Joanna Cherry (Scottish National Party, Edinburgh South West)
So would you agree that a proper independent operational case for the support of this Bill should look at the experience of other jurisdictions?
Joanna Cherry (Scottish National Party, Edinburgh South West)
Bearing in mind the pressures of time, may I move on to my next heading, which is the scope of bulk powers? On Second Reading, the Home Secretary said that
“certain bulk powers are predominantly those for foreign usage, rather than in relation to the United Kingdom.”—[Official Report, 15 March 2016; Vol. 607, c. 823.]
Would I be correct in understanding that most of the bulk powers proposed in the Bill could, in fact, apply to the data of UK citizens?
Joanna Cherry (Scottish National Party, Edinburgh South West)
But would we be correct in understanding that, for example, bulk personal datasets will comprise the personal data of United Kingdom citizens?
Joanna Cherry (Scottish National Party, Edinburgh South West)
Would we also be correct in understanding that bulk communications data will comprise data relating to British citizens?
Joanna Cherry (Scottish National Party, Edinburgh South West)
So if an impression were to get about that bulk powers are merely about obtaining information on people who live overseas, that would be incorrect.
Joanna Cherry (Scottish National Party, Edinburgh South West)
My third heading is legalities. You will be aware that the United Nations special rapporteur on the right to privacy has expressed concern that some aspects of the Bill may not comply with either European Union law or the UK’s obligations under the European convention on human rights. He expressed particular disquiet about bulk surveillance and bulk hacking, and suggested that those powers prima facie failed the benchmark set by the European Court of Justice in the Schrems case and by the European Court of Human Rights in the Zakharov case. Have you had a chance to consider his report?
Joanna Cherry (Scottish National Party, Edinburgh South West)
Do you have any view on what he has said in that regard?
Joanna Cherry (Scottish National Party, Edinburgh South West)
So your view would be that there are potentially two competing arguments as to where the case law is heading, but we do not know ultimately what the situation is, although we may have a better indication when there is a judgment in the Davis and Watson case later this year.
Joanna Cherry (Scottish National Party, Edinburgh South West)
I want to ask you briefly about bulk personal datasets. It is possible, is it not, that medical information pertaining to every single citizen of the United Kingdom could be scooped up in a bulk personal dataset?
Joanna Cherry (Scottish National Party, Edinburgh South West)
It would also be possible for bulk personal data sets in relation to children to be scooped up under this legislation as currently drafted. Is that right?
Joanna Cherry (Scottish National Party, Edinburgh South West)
Do you agree that in the investigation of threats to national security and terrorism there can really be no justification for scooping up personal data in relation to children?
John Hayes (Conservative, South Holland and The Deepings)
Thank you for coming, David. On bulk personal datasets, I note that you say that the members of the intelligence community that you have met, and what you have seen and heard from them, have confirmed the view that was expressed by the ISC and others. Are you clear about their efficacy and utility?
John Hayes (Conservative, South Holland and The Deepings)
As a follow up on that, obviously you appreciate that your recommendations on the operational case being made have been built in to what we are doing. Further to what you said about the Chairman of the ISC’s recognition of their proportionality and necessity, I suppose you would accept that any publication of that operational case will obviously be limited, because it is an operational case and as soon as you make it public to the point where it ceases to have value, it could compromise operations.
Victoria Atkins (Conservative, Louth and Horncastle)
I will ask just a couple of questions, if I may, Mr Anderson. Looking at the operational case for bulk powers, the Home Office has stated:
“There is clear evidence that these capabilities have…played a significant part in every major counter terrorism investigation of the last decade, including in each of the seven terrorist attack plots disrupted since November 2014...enabled over 90% of the UK’s targeted military operations during the campaign in the south of Afghanistan…been essential to identifying 95% of the cyber-attacks on people and businesses in the UK discovered by the security and intelligence agencies over the last six months”.
They have also been of great use in serious organised crime and paedophilia investigations, as we know. Are those factors that you and others have taken into account when assessing whether we need bulk powers, and how critical they are to national security and serious organised crime investigations?
Victoria Atkins (Conservative, Louth and Horncastle)
By way of conclusion, you gave evidence to the Joint Committee scrutinising the draft Bill in November 2015 and at that time you said it gave effect to 90% or more of the recommendations in your report entitled “A Question of Trust”. Now that the Government have responded to the Joint Committee’s report and made further amendments, how much closer is the Bill to your report’s recommendations?
Suella Fernandes (Conservative, Fareham)
I have two questions. On the double lock and the judicial review test, concerns were expressed by witnesses to the Joint Committee about two issues. The first is the access to evidence by the judges and by the Ministers or the Home Secretary in the process of considering warrants. What would be the access to evidence by both parties involved in the double lock? Would it be the same or different?
Suella Fernandes (Conservative, Fareham)
You have pre-empted my second question, which is about the concerns that various witnesses have raised about the level of scrutiny involved in the judicial review test. Are we looking at a Wednesbury level of scrutiny?
Nadine Dorries (Conservative, Mid Bedfordshire)
Order. I am afraid we have reached the end of the time allotted for the Committee to ask questions. On behalf of the Committee, thank you very much for your time and for giving evidence today.
Examination of witnesses
Nadine Dorries (Conservative, Mid Bedfordshire)
We will now hear oral evidence from Don’t Spy On Us and Liberty. For this session we have until 12.30 pm.
Welcome, and thank you for coming. Will the witnesses please introduce themselves for the record?
Keir Starmer (Labour, Holborn and St Pancras)
Because we do not have much time, I would like to ask Eric King some questions about bulk powers and then Sara Ogilvie some questions about internet connection records.
Eric King, do you have any concerns about the definitions and scope of the bulk powers in the Bill?
Keir Starmer (Labour, Holborn and St Pancras)
Can I press you on that? To some extent, we are proceeding on the basis that there are two exercises involved when it comes to bulk powers. The first is the acquisition or holding of the data, and the second is, at some subsequent time, the accessing of those data, subject to different thresholds. Is it as simple as two distinct exercises, or is there more to it than that?
Keir Starmer (Labour, Holborn and St Pancras)
Given your concerns, do you have alternatives that you think would serve the same purpose as some of the bulk powers?
Keir Starmer (Labour, Holborn and St Pancras)
When you refer to selectors, I think you are referring to what happens in that middle period, between initial acquisition and later access.
Keir Starmer (Labour, Holborn and St Pancras)
Your evidence is that much of this happens before the final access thresholds apply.
Keir Starmer (Labour, Holborn and St Pancras)
Can I turn to you, Sara Ogilvie, on internet connection records, in particular? I know that Liberty has got a number of concerns about the powers in the Bill in relation to internet connection records. Could you give us a brief summary of the main headline issues from your point of view?
Keir Starmer (Labour, Holborn and St Pancras)
I can see other hands going up, so I will end there.
Joanna Cherry (Scottish National Party, Edinburgh South West)
To be clear, Mr King, is your evidence in relation to bulk interception and collection of data that there is intrusion and analysis of them by computer programs prior to any warrant being applied for?
Joanna Cherry (Scottish National Party, Edinburgh South West)
Once the intercept has been collected, there is a stage of the process at which it is analysed by a computer, and that stage is not currently the subject of any legal regulation.
Joanna Cherry (Scottish National Party, Edinburgh South West)
Just so we can be clear, does anything in the Bill involve legal regulation of that stage of the process?
Joanna Cherry (Scottish National Party, Edinburgh South West)
We know now, because it has been avowed, that previous Administrations had unacknowledged arrangements for bulk interception of the internet in the United Kingdom. Can you tell us whether those resulted in the collection and analysis of ordinary British citizens’ communications?
Joanna Cherry (Scottish National Party, Edinburgh South West)
I would like to ask Ms Ogilvie a couple of questions if I may, Madam Chairman.
Nadine Dorries (Conservative, Mid Bedfordshire)
Order. Time is very short now, because we have seven more people waiting to speak.
Joanna Cherry (Scottish National Party, Edinburgh South West)
I will ask one question briefly then. Liberty looked at the investigation by the Intelligence and Security Committee into the brutal murder of Fusilier Lee Rigby in May 2013. Did those inquiries suggest that if the security services had had more resources to cover lower priority level targets, the outcome could or would have been different?
Simon Hoare (Conservative, North Dorset)
Mr King, I am not a lawyer, so forgive me. Are you a parent?
Simon Hoare (Conservative, North Dorset)
Are you a parent?
Simon Hoare (Conservative, North Dorset)
I am—I have three daughters. I just wonder where the balance is between the sort of purity test, for want of a better phrase, and what law enforcement have told us—that, without ICRs, they would be unable to identify at least 600 child abusers in the UK alone. What weight should we attach to that?
Simon Hoare (Conservative, North Dorset)
You are right that there are a number of clubs in the golf bag of the law enforcement team and the agencies, but given that we live in an incredibly fast-moving, technological world, where international boundaries are not recognised and so on, would you agree that the more facilities that the agencies have available to them, the better—that is, the wider that the net can be cast, the more ne’er-do-wells one is going to identify and hopefully apprehend?
Suella Fernandes (Conservative, Fareham)
This is a question for Sara. In evidence to the Joint Committee, Shami Chakrabarti criticised the Bill on behalf of Liberty, saying that judges would not have the same access to evidence as Ministers in the warrant process. We have just heard evidence from the independent assessor of the terrorism legislation, David Anderson QC, that that is not the case. The Home Secretary has said on the record that that is not the case, and that they would have the same access. Do you withdraw that criticism of the legislation?
Suella Fernandes (Conservative, Fareham)
Evidence was given to the Joint Committee by Sir Stanley Burnton, the Interception of Communications Commissioner, and Lord Judge, the Chief Surveillance Commissioner. Both said that the double lock involves an intensive analysis including analyses of necessity and proportionality. It is not simply rubber-stamping. Again, do you maintain your disagreement with those senior judges?
Chris Matheson (Labour, City of Chester)
I will ask only one question. Mr King, you talked about the astonishing amount and huge volumes of data that are collected. Can you both comment on the statement that the sheer volume of information means that there is less of a threat to personal privacy, simply because individuals’ personal data are almost swamped within the mass of data collected?
Nadine Dorries (Conservative, Mid Bedfordshire)
Can we keep questions and answers as brief as possible to get everybody in, please?
Peter Kyle (Labour, Hove)
I, too, am not a lawyer but, unlike Mr Hoare, I do not apologise for it. Mr King, it was quite striking when you gave a flavour of the quantity of data that is being harnessed. Do you know whether that has ever led to an unlawful arrest, or a wrongful arrest?
Victoria Atkins (Conservative, Louth and Horncastle)
Mr King, there was a phrase you used quite a few times during your evidence. That is, “We don’t know.” How long have you worked for the security services?
Victoria Atkins (Conservative, Louth and Horncastle)
What security clearance do you have?
Victoria Atkins (Conservative, Louth and Horncastle)
How many intercept warrants have you prepared or reviewed?
Victoria Atkins (Conservative, Louth and Horncastle)
So, it would be fair to say that there is a great deal about the workings of GCHQ and other security services that you simply do not know about.
Victoria Atkins (Conservative, Louth and Horncastle)
I am driven to ask, Mr King, against your evidence that you do not know much about how security services work, how many lives you are willing to sacrifice for your very pure plan of privacy?
Matt Warman (Conservative, Boston and Skegness)
Building on that, the Joint Committee did ask for an operational case for bulk powers to be published, and that has been seen and assessed by the ISC who do have the security clearance that you do not have, who do have visibility on all of the things that you are not able to see. The ISC says that they are happy with that operational case. It seems to me that the more people know about this, the more comfortable they are with that operational case. I wonder whether you are questioning their judgment or simply saying that you disagree.
Lucy Frazer (Conservative, South East Cambridgeshire)
I would like to pick up on something that you said in your evidence was about internet connection records. I would just like to ask you first of all, do you respect the work of David Anderson?
Lucy Frazer (Conservative, South East Cambridgeshire)
Have you had the opportunity to read his report?
Lucy Frazer (Conservative, South East Cambridgeshire)
Are you familiar with paragraph 7.51 where he talks about Operation Notarise?
Lucy Frazer (Conservative, South East Cambridgeshire)
Are you familiar with Operation Notarise?
Lucy Frazer (Conservative, South East Cambridgeshire)
In that operation 600 suspected paedophiles were arrested, and 92% of the communications data requested proved helpful in tracking down suspects. That what he says in the report. Do you accept therefore that he has found evidence that the ICRs are helpful?
Lucy Frazer (Conservative, South East Cambridgeshire)
I am just reading from the report, and that is what it says. It gives the figure of 92% of communications data and says the questions provided were helpful.
Lucy Frazer (Conservative, South East Cambridgeshire)
Do you accept that, if some communications data in an old form of technology is helpful, then in a modern form of technology exactly the same powers will also be useful?
Byron Davies (Conservative, Gower)
Mr King, you have mentioned a couple of times now, in the first part of your evidence, you talked about formidable intrusive powers. You quite agree that the agencies should have these powers. So in view of what has happened recently in Paris and in Brussels, I am really somewhat confused as to what you are trying to tell us in your evidence as to what the agencies should have. Do you know? Are you clear in your own mind what these powers should be?
Byron Davies (Conservative, Gower)
But criminals and terrorists would not regard it in that respect.
Byron Davies (Conservative, Gower)
They would not see it the way you see it, obviously.
Nadine Dorries (Conservative, Mid Bedfordshire)
If there are no further questions for Members, I thank the witnesses for their evidence, and we will move on to the next panel.
Joanna Cherry (Scottish National Party, Edinburgh South West)
On a point of order, Ms Dorries. In any forum that I have appeared in where the witness is being asked a question about a document, particularly a lengthy document, it is customary to afford them the courtesy of having a copy of the document in front of them. Might I suggest that if we are going to ask further witnesses about documents, we afford them that dignity?
Simon Hoare (Conservative, North Dorset)
Further to that point of order, Ms Dorries. To put the contra view to that expressed by the hon. and learned Lady, should not the Committee expect witnesses who are giving evidence to be properly briefed and to have in front of them documents on which they are likely to be cross-examined?
Nadine Dorries (Conservative, Mid Bedfordshire)
I shall answer the substantive point of order. The information that the witnesses bring with them is their responsibility. It is not the normal procedure for them to have documentation in front of them or for the panel to know what information they have with them. As we decided at the start, they can always follow up in writing if they feel they did not have the right information.
Joanna Cherry (Scottish National Party, Edinburgh South West)
I am very grateful to you, Ms Dorries, for clarifying that questions and answers can be followed up in writing.
Nadine Dorries (Conservative, Mid Bedfordshire)
We will now hear evidence from the International Institute for Strategic Studies and Lord Evans of Weardale. For this session we have until 1 pm. Will the witnesses please introduce themselves for the record?
Nadine Dorries (Conservative, Mid Bedfordshire)
Welcome, and thank you.
Keir Starmer (Labour, Holborn and St Pancras)
Lord Evans, I think this one is for you. The bulk powers in the Bill are used differently by different agencies. Some are relied on by the security and intelligence agencies more than others. There is a notion that the bulk powers operate in the sense that there is a power to acquire or hold a great deal of data and then, at some later stage, there is targeted access on a different threshold, and that those are different safeguards. The reality is that quite a lot happens between those two stages, whether one calls it analytics or anything else. Can you tell us from your experience what happens in practice in that middle bit between first hold and later access?
Keir Starmer (Labour, Holborn and St Pancras)
In a sense, what you have described is a stripping away of the bits you do not want to look at so that you can focus on the bits you do want to look at, in the particular context that you gave.
Keir Starmer (Labour, Holborn and St Pancras)
Is there any general analysis done to data in order to assist that? All data must be put through a level of analysis to make it easier to carry out the sort of exercise you have just described.
Keir Starmer (Labour, Holborn and St Pancras)
Can I turn briefly to equipment interference bulk powers? I do not think you were here when David Anderson gave his evidence—this may apply to you as well, Mr Inkster—but he raised a concern about the breadth of those powers. In particular, I think he said that what is called targeted is in fact so wide that it does not really fit with the notion of targeting. That chimes with the suggestion that it is very difficult to define necessity and proportionality in relation to those particular bulk powers. Can you assist the Committee with why, with those bulk powers, there is that problem of definition that David Anderson is concerned about?
Keir Starmer (Labour, Holborn and St Pancras)
I have one final question for either or both of you. Am I right in thinking that, as far as internet connection records are concerned, although the security and intelligence services would not say, “There are no circumstances in which we’d really need them,” in reality, they are relied on much less by the security and intelligence agencies than by law enforcement, as a separate component?
Joanna Cherry (Scottish National Party, Edinburgh South West)
Lord Evans, I want to ask you about the savage murder of Fusilier Lee Rigby and the Intelligence and Security Committee investigation into that. It reported to Parliament that his killers had previously come to the attention of the Security Service on multiple occasions and that, in its view, intelligence reports were mishandled. I think I am right in saying that its inquiry suggested that, if the Security Service had more resources to cover more and lower-priority level targets, the outcome could or would have been different. Would you like to comment on that?
Joanna Cherry (Scottish National Party, Edinburgh South West)
If the Government had given you more resources for more boots on the ground, would it have been possible for the security services perhaps to have had targeted surveillance on lower priority targets prior to this particular dreadful murder?
Victoria Atkins (Conservative, Louth and Horncastle)
We talk about the security services and the other agencies as block organisations, but of course the quality and effectiveness of an organisation depend on the people who make up that organisation. Could you give us, as far as you are able, an assessment of the qualities and character of the people who work for the agencies that you have led?
Victoria Atkins (Conservative, Louth and Horncastle)
In the nightmare scenario that there was a wrong ’un in the agencies, how would they be able to find that person and prevent them from misusing their powers ?
Peter Kyle (Labour, Hove)
I would like to turn your attention from the efficacy and professionalism of your staff to that of the politicians you have had to deal with over the years. You have had to have relationships with several different Home Secretaries in your time. Have you always been able to get the time and attention you need from each of them at the moment at which you need it?
Peter Kyle (Labour, Hove)
You have answered my second question, which does great service to your profession. Does the same stand for you, Mr Inkster?
Peter Kyle (Labour, Hove)
My final quick question is: is there much difference in the behaviour towards issuing warrants between Home Secretaries, or do you find it a consistent experience?
Nadine Dorries (Conservative, Mid Bedfordshire)
Okay, we have to move on to the Minister now.
John Hayes (Conservative, South Holland and The Deepings)
On Second Reading, Mr Starmer said that you do not know that someone is a suspect until they are a suspect and that at that point you need to know who they are speaking to. The filtering process that you described in your earlier remarks is about taking very large amounts of data and, through that filter, in the end dealing with very small amounts. We have heard a lot of concerns and paranoia about bulk powers. Would it be fair to say that that filtering process is as much about excluding people as it is about including them?
John Hayes (Conservative, South Holland and The Deepings)
Another of Mr Starmer’s arguments was on equipment interference. Does equipment interference become more important as, for example, encryption makes other means by which you would get to the same destination more difficult?
Keir Starmer (Labour, Holborn and St Pancras)
I have just short supplementary question on bulk datasets. There is a great sensitivity about some datasets. People might not mind if their flight details are kept, but they do mind a great deal if, for example, their mental health records are collected. If there was some extra provision in the Bill for sensitive or highly sensitive data, would that cause you any concern, assuming that in any given case you can get over the threshold?
Keir Starmer (Labour, Holborn and St Pancras)
So if it was to externalise what was internal practice, which is obviously based on experience, that would not be a showstopper.
Nadine Dorries (Conservative, Mid Bedfordshire)
I am afraid that brings us to the end of the time allotted for the Committee to ask questions. On behalf of the Committee, I thank our witnesses for their evidence.
Examination of Witnesses
Charles Walker (Conservative, Broxbourne)
Welcome to the afternoon session. We will now hear oral evidence from the National Society for the Prevention of Cruelty to Children and Mr Ray McClure. We have half an hour for this session. Could the witnesses briefly introduce themselves?
Peter Kyle (Labour, Hove)
Thank you both for appearing today; it is good to see you.
Mr McClure, could I start with you? We have been talking about the prevention of terrorism to date, but from your perspective this is about crime prevention. Perhaps you could say a few words about that and the measures in the Bill that would benefit crime prevention from your perspective.
Peter Kyle (Labour, Hove)
Thank you. Mr Wardle, do you want to give the NSPCC’s position?
Peter Kyle (Labour, Hove)
So from your perspective—and this is from reading the evidence from the NSPCC—this is not just about collecting data; it is about sharing data and intelligence in a joined-up way between the services. Is that correct?
Peter Kyle (Labour, Hove)
We have seen delays of sometimes 12 months in gathering and processing evidence, insufficient training in the collection of digital evidence—all things you have cited in your evidence—and a lack of awareness of the legal processes to access communications data. Bearing those things in mind, the new powers, even if we had them, could not really be used effectively unless there was the right training in the first place.
Charles Walker (Conservative, Broxbourne)
We clearly have two excellent witnesses here, and I am sure that many colleagues will want to ask questions. Who is trying to catch my eye? Would Mr Matheson like to ask a question?
Chris Matheson (Labour, City of Chester)
I remind the Committee that Mr McClure is known to me, as he is my constituent.
Good afternoon, Mr McClure. The case of your nephew obviously involved a criminal offence and was clearly terrorist-related. There have been suggestions, and we have heard evidence as a Committee, that the failure was not necessarily one of electronic intelligence, but of human intelligence and a lack of resources, because the security services were already aware of the then suspects—the people convicted of your nephew’s murder. How do you react to that ?
Chris Matheson (Labour, City of Chester)
You talk about the lack of co-operation from some of these large corporations based outside the UK. When considering your own investigations and inquiries surrounding the murder of your nephew, have you seen any evidence that that is quite a common trait?
Chris Matheson (Labour, City of Chester)
Looking at the specific provisions in the Bill, as far as you have been able to check them, are you satisfied that your concerns have been addressed, or was there something else that you were specifically looking for?
Charles Walker (Conservative, Broxbourne)
Thank you, Mr McClure. We have so many colleagues who want to ask you questions.
Charles Walker (Conservative, Broxbourne)
No, you are a very strong witness. Mr Buckland.
Robert Buckland (Conservative, South Swindon)
Thank you, Mr Walker; it is a pleasure to serve under your chairmanship. Mr McClure, you have made some powerful points, so thank you very much indeed for giving your perspective on the IT, and as a bereaved relative. We all share your grief and anger about the atrocity.
Mr Wardle, I want to ask you about internet connection records, the new potential powers within the Bill and the purposes for which those records could be retained by an internet service provider. We know now that, as a result of the Joint Committee’s recommendations, there are four purposes for which those records could be retained for potential examination by the authorities. I think that they are very clearly set out: for the purposes of identifying who sent a communication; to establish what services either a suspect or a potential victim has been using; to establish whether or not a known suspect has been indulging in online criminality; and finally—the additional one—to identify services that a suspect has accessed, which could assist an investigation. If there was a narrowing of those purposes, what effect do you think that would have upon the authorities’ ability to investigate child abuse and related offences?
Joanna Cherry (Scottish National Party, Edinburgh South West)
May I ask you some questions about internet connection records? Can you confirm that you have read the operational case for internet connection records referring to the case of Amy?
Joanna Cherry (Scottish National Party, Edinburgh South West)
It is about a missing child.
Joanna Cherry (Scottish National Party, Edinburgh South West)
Would you agree with me that if a child goes missing, the first thing you want to do is to find out what social media or chat sites the child has been on?
Joanna Cherry (Scottish National Party, Edinburgh South West)
It would be a priority.
Joanna Cherry (Scottish National Party, Edinburgh South West)
Is not the easiest way to do that to ask their friends?
Joanna Cherry (Scottish National Party, Edinburgh South West)
Sometimes the child will take their phone with them and it will be switched off and be no use to us, but other times they will leave their phone behind and we can get into the phone and see which social media sites they have been on. Is that right?
Joanna Cherry (Scottish National Party, Edinburgh South West)
Equally, if there is a computer at home, the police can access the computer with the parents’ permission and see what social media sites the child has been on?
Joanna Cherry (Scottish National Party, Edinburgh South West)
If we assume that the computer and the phone are not available, you could go to friends or siblings and find out what social media the child commonly uses. If, for example, the child commonly uses Facebook, the friend will be able to tell you what the child’s username is.
Joanna Cherry (Scottish National Party, Edinburgh South West)
Indeed, and they will know what their friends’ names are. I do not really know how Bebo works, because I am too old, but if it is not a known name on Bebo, you are still able to get the username from the child’s friends.
Joanna Cherry (Scottish National Party, Edinburgh South West)
Does it not really boil down to this: wherever you get the information from—whether it is mum or dad or, more likely, mates at school—you have to go to Bebo or Facebook and ask for their help?
Joanna Cherry (Scottish National Party, Edinburgh South West)
But would you agree with me that what is important is to have effective tools?
Joanna Cherry (Scottish National Party, Edinburgh South West)
If we just go back to the example that I was pursuing, about the missing child, I think you agreed with me that it is important to have effective tools. Is it your understanding that all the internet connection record will tell you is what the missing child connected to? It will not tell you what the missing child did once they were connected.
Joanna Cherry (Scottish National Party, Edinburgh South West)
An internet connection record will only tell you to which service the child was connected, not whom they spoke with, nor what the content of their speaking was—
Joanna Cherry (Scottish National Party, Edinburgh South West)
Whereas, if you go to the child’s friend and get the child’s username on the social media site, you will be able to get that information as to content.
Joanna Cherry (Scottish National Party, Edinburgh South West)
You will not get passwords from an ICR?
Suella Fernandes (Conservative, Fareham)
There has been a description of Tor as a facility that allows digital abuse of anonymous online activism. It is linked to encrypted information. I want you to say a bit about what effect encryption has on some of the work that you are involved with?
Victoria Atkins (Conservative, Louth and Horncastle)
Just to pick up on the point made by the hon. and learned Member for Edinburgh South West about the missing child, is it right that, sadly, the victims of sex grooming rings do not surround themselves with friends and parents, because one of the tools that the groomers use is to isolate the victims, so that they have no one they can turn to in their hour of need?
Victoria Atkins (Conservative, Louth and Horncastle)
So in those circumstances, as you have said, the police need every tool that they can get to help those very vulnerable young children.
Lucy Frazer (Conservative, South East Cambridgeshire)
Following on from that, in your work in the NSPCC, do you always see a willingness for children to open up and to tell people in a position of authority personal facts about themselves and their friends, or can it be quite difficult to coax out information about children who are friendly with the vulnerable?
Lucy Frazer (Conservative, South East Cambridgeshire)
I was also thinking about the case of missing children. If we rely only on their friends and those friends are not willing to disclose personal details, names and the social media sites that their friend is on, do you think there might be a delay in an investigation?
Lucy Frazer (Conservative, South East Cambridgeshire)
So it is a combination of tools that will keep children most safe?
Andrew Stephenson (Conservative, Pendle)
I thought you made a compelling case in your evidence to the Joint Committee; I was not a member of that Committee, but I have watched it back on video. You made a compelling case for why timeliness is very important when a child is threatening to commit suicide—basically having to breach that child’s confidence to ensure that the police can intervene. The expression you used was about literally having to cut children down at times.
Could you say anything more to this Committee about that? Some members of this Committee sat on the Joint Committee, but others will not have heard that evidence. Could you say more about the need for rapid intervention to save children’s lives?
Simon Hoare (Conservative, North Dorset)
This question is to both of you. Is there anything that is not in the Bill that you would like to have seen, or maybe still see, in the Bill?
Charles Walker (Conservative, Broxbourne)
Mr Kyle, a 10-second question and a five-second answer.
Peter Kyle (Labour, Hove)
Mr Hoare has just asked my question, so I am a happy man.
Charles Walker (Conservative, Broxbourne)
That brings us to the end of this session. May I thank our witnesses, who gave extremely strong performances? I know that being a witness before a Committee is very nerve-wracking, but you both executed your role fantastically, so thank you very much indeed. It was very kind of you to come before us today.
Examination of Witness
Charles Walker (Conservative, Broxbourne)
Good afternoon, Mr Hughes. Thank you for coming here before us today. For the record, I know Mr Hughes outside this place. I had no idea that I was going to be here this afternoon, but here I am and here you are. Would you like, for the benefit of my colleagues, to introduce yourself quickly? There will be lots of questions.
Simon Hoare (Conservative, North Dorset)
Just for the record, I also know Mr Hughes, though I cannot remember how—I am having a senior moment.
Charles Walker (Conservative, Broxbourne)
Excellent.
Keir Starmer (Labour, Holborn and St Pancras)
We have a definition in the Bill, as I am sure you know, of an internet connection record. What is recorded by BT or any other service provider if I book a train ticket on my mobile phone? What comes up on your record?
Keir Starmer (Labour, Holborn and St Pancras)
We have a definition—I would have copied it to you, but you probably have it there—in clause 54(6). You probably know it backwards.
Keir Starmer (Labour, Holborn and St Pancras)
If I went to the Trainline website, for example, although it would not come up as Trainline, could you work out that I had been using that website to book my ticket?
Keir Starmer (Labour, Holborn and St Pancras)
I am sure all that is right, but I am still not sure that I have an answer. If I book a ticket now on the Trainline website, would it come up on your record that I had done it?
Keir Starmer (Labour, Holborn and St Pancras)
Not currently, but when the Bill is law.
Keir Starmer (Labour, Holborn and St Pancras)
So it would come up?
Keir Starmer (Labour, Holborn and St Pancras)
So if the Bill becomes law and I then book a ticket on the Trainline website, you would record it?
Keir Starmer (Labour, Holborn and St Pancras)
Sorry—I probably should have said that I am not that interested in the process at the moment. I understand the process and of course all the proper processes would have to be followed. I am just interested in what you would get before the process starts.
May I try a different question? If I go through the tube using electronic means of payment, would that—if the Bill becomes law and assuming that all the processes are followed—show up on my record?
Keir Starmer (Labour, Holborn and St Pancras)
What about a feature that I have on my phone called Onefootball? Unbeknown to everybody else, my phone asks for the football scores all the time. What would show up on my record if the Bill became law and assuming that all the processes were followed and all the rest of it?
Keir Starmer (Labour, Holborn and St Pancras)
But if it were you, would it show that I had been asking for football results all afternoon?
Keir Starmer (Labour, Holborn and St Pancras)
And if I went to the website of The Guardian and clicked on “Brussels attack” and then clicked on “Another bomb”, what would be on your records—assuming that the Bill becomes law, that all the processes are complied with and that there is a proper purpose? I am making all those assumptions. I just want to know what would be on the record.
Keir Starmer (Labour, Holborn and St Pancras)
Thank you.
Joanna Cherry (Scottish National Party, Edinburgh South West)
At the Joint Committee, Mr Hughes, you said that BT had never collected internet connection records before, that you would have to deploy new equipment to comply with the legislation and that that would come at a cost. That is correct, is it not?
Joanna Cherry (Scottish National Party, Edinburgh South West)
I understand from your answers to Keir that you are still working with the Home Office to agree the precise specification of what an ICR is. Is that right?
Joanna Cherry (Scottish National Party, Edinburgh South West)
Are we to understand, then, that you have not as yet reached agreement with the Home Office about the specification of an ICR?
Joanna Cherry (Scottish National Party, Edinburgh South West)
That is what I want to come on to. The Home Office has mentioned a figure of £170 million. Can you give us any indication of how much of that money British Telecom would need to build a system?
Joanna Cherry (Scottish National Party, Edinburgh South West)
We have covered potential costs of building the system. Can you give us a timescale?
Joanna Cherry (Scottish National Party, Edinburgh South West)
When you say a year-plus, how much on top of a year?
Joanna Cherry (Scottish National Party, Edinburgh South West)
Are you aware of what has happened in Denmark regarding the collection of internet connection records?
Joanna Cherry (Scottish National Party, Edinburgh South West)
On 17 March, the Danish Minister of Justice informed the Danish Parliament that the plans for a new internet connection records scheme had been put on hold. The reason given for the policy change was the substantial cost of ICR collection—the economic burden would be too high for the Danish telecoms industry. Were you aware of that?
Joanna Cherry (Scottish National Party, Edinburgh South West)
Do you agree that we cannot compare what is proposed in the Bill with what was proposed in Denmark until you have got an agreed specification with the Home Office?
John Hayes (Conservative, South Holland and The Deepings)
Thank you, Mr Hughes, for coming, and thank you also for acknowledging the extent of the consultation with which you have been engaged with the Home Office. As a result of that, you will know that the codes of practice published at the time of the Bill reflect some of the arguments you have advanced previously and clarify some requirements.
Today you emphasised that as we move forward there will be ongoing discussion. How important do you therefore think it is to avoid rigidity by putting more on the face of the Bill rather than including that in codes of practice and in the ongoing discussions you described?
John Hayes (Conservative, South Holland and The Deepings)
Presumably you also welcome the right to review a technical capability notice and the commitment that there will be further discussion with you before you are obliged to meet obligations.
Chris Matheson (Labour, City of Chester)
Under the terms of the Bill, you are being asked to collect a large amount of data, some of which will be quite personal and some private. How confident are you of BT’s capability in terms of maintaining the security of those data from hacking or theft, particularly bearing in mind the fact that other communications service providers have been hacked into? When you consider the rest of the industry more broadly—without naming names—do you think BT is in a stronger position than other CSPs to maintain security against hacking or theft where there might be vulnerabilities elsewhere?
Matt Warman (Conservative, Boston and Skegness)
On the Joint Committee on the draft Bill and on the Science and Technology Committee, we heard CSPs talking about the level of engagement they have had from the Home Office, and we have heard from the Home Office that that has increased recently. That seems to tally with what you are saying. Could you give us a sense of the scale and extent of that engagement, and some reassurance that, in this fast-moving world, you are confident that the relationship is such that that engagement would be there in future as well, rather than it just being about getting the Bill to this stage?
Peter Kyle (Labour, Hove)
Is everything in the Bill technically deliverable?
Peter Kyle (Labour, Hove)
So through technology that is already in existence and already within your grasp as a company, everything in the Bill is within the bounds of deliverability.
Peter Kyle (Labour, Hove)
To follow up briefly on Mr Matheson’s question about security, I hear your answer, which is quite broad. I will rephrase the question in this way: would existing BT customers expect a different level of security protection for their data once the Bill is enabled and passed, compared with what they expect and what is at their disposal today?
Peter Kyle (Labour, Hove)
Are you saying that because the quantity and volume of data being stored will increase and you are storing it for longer, those are two contributing factors that could potentially lead to the weakening of security?
Gavin Newlands (Scottish National Party, Paisley and Renfrewshire North)
This is a quick follow-up to a question Mr Starmer asked earlier about ICRs as they relate specifically to mobile devices. The example that he gave involved a football app, but let us use Facebook as an example, as it may be of use in investigations. Facebook and apps like it have lots of background processes that generate thousands of ICRs. Is there any way of ascertaining whether an ICR is created manually or automatically by the app?
Gavin Newlands (Scottish National Party, Paisley and Renfrewshire North)
I understand that, but would it be technically possible to understand whether somebody has pressed a button to create that record or whether the app has done it?
Gavin Newlands (Scottish National Party, Paisley and Renfrewshire North)
So at the moment the Bill is not clear enough on that aspect?
Keir Starmer (Labour, Holborn and St Pancras)
Can I come back to the question of what constitutes an internet connection record? It is the record that you may be responsible for keeping and passing over, so it is important that you have clarity. I take it from your previous answers that you have said some of it will be data that you are already collecting for your own purposes, and some of it will be other data that you are not currently retaining but will retain as a result of the Act. What are the data you are currently retaining? What is the bit that you keep already?
Keir Starmer (Labour, Holborn and St Pancras)
I have got that. The account number is fine. That does not tell you very much; it is just the account number. When someone does something using the account, what else do you keep at the moment?
Keir Starmer (Labour, Holborn and St Pancras)
I am sorry; I am struggling with this. Can you give me an example?
Keir Starmer (Labour, Holborn and St Pancras)
The IP port?
Keir Starmer (Labour, Holborn and St Pancras)
What data that you do not currently retain or keep will you have to add as an ingredient?
Keir Starmer (Labour, Holborn and St Pancras)
Nothing?
Keir Starmer (Labour, Holborn and St Pancras)
Just to clarify, I heard you say earlier that some of the data you keep and some you would have to constitute. Now, you are saying that it is all data you have got; it is just about how long you keep it for.
Keir Starmer (Labour, Holborn and St Pancras)
If I were your customer and this Bill were law and I accessed The Guardian through you, would you think that one of the ingredients is the page within the home page that I went to? Is that an ingredient that you anticipate that you will have to keep?
Keir Starmer (Labour, Holborn and St Pancras)
If I go on the Guardian website, I can start clicking between different parts of the website for different bits of information. You can go on a hyperlink to different pages. Do you anticipate keeping any of that data in the future if I were your customer?
Keir Starmer (Labour, Holborn and St Pancras)
That is a technical issue, but legally do you think it is within the definition you are working to?
Lucy Frazer (Conservative, South East Cambridgeshire)
Following on from Keir’s questions, there is a concern about the hackability of the volume of data that we have already got. Have we just heard that you already collect this data, albeit not necessarily in the same form or for the same length of time? Is it all still there for someone who wants to access it immediately?
Lucy Frazer (Conservative, South East Cambridgeshire)
But based on the existing information that you have, it is already there.
Charles Walker (Conservative, Broxbourne)
Thank you very much, Mr Hughes. I am sorry we do not have more time.
Charles Walker (Conservative, Broxbourne)
Excellent. Colleagues may follow up your evidence with written requests as well.
Examination of Witnesses
Charles Walker (Conservative, Broxbourne)
Colleagues, before we see our next panel, may I say that we need to exercise some extraordinary self-discipline with two of these panels? We have three witnesses coming forward on this occasion, before we go back to a single witness. We then have four witnesses for half an hour. Can I ask Front Benchers particularly for discipline and sharpness in questioning, so they are razor sharp?
Thank you, witnesses: do sit down. Because time is pressing, will you tell us briefly, in no more than 10 words, who you are and whom you represent?
Keir Starmer (Labour, Holborn and St Pancras)
We are trying to get to the bottom of what an internet connection record means in the Bill. We have the words on the page in front of us. From a practical point of view, should this Bill become law, what do you think is going to be made available to you when you need to get an internet connection record?
Keir Starmer (Labour, Holborn and St Pancras)
Can I just make sure I have understood that? For booking a train ticket or something, I can understand that you need to go to the next level if you want to find out the particulars. If it is The Guardian website, what comes up first is a website. You can then click on it if you want to go to national news or international news, and within international news, you could go to Brussels, for example, as many people might have done in the last day or so, so you have gone through a couple of hyperlinks to a different page. Will the fact that you have done that come within what you consider to be an internet connection record? I can see for booking a rail ticket that you would have to go in to get the detail of what ticket, where to and all the rest of it, but when someone clicks through to linked sites on let us say, The Guardian, would you expect that to come within the definition of internet connection record?
Keir Starmer (Labour, Holborn and St Pancras)
On internet connection records, as I have understood it, the purpose of getting the internet connection record in practically all cases is to bridge pretty swiftly into content using other lawful means.
Keir Starmer (Labour, Holborn and St Pancras)
What would you use them for?
Keir Starmer (Labour, Holborn and St Pancras)
But in most cases it would be the seed for further investigation. Would it be rare for it to be an end in itself?
Keir Starmer (Labour, Holborn and St Pancras)
No other country is going down this route to solve the problem of access, which is a growing problem. What are other countries doing if they are not doing internet connection records?