Clause 4 — Extra-territoriality in Part 1 of RIPA

Bills Presented – in the House of Commons at 6:30 pm on 15 July 2014.

Alert me about debates like this

Question proposed, That the clause stand part of the Bill.

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration) 6:45, 15 July 2014

The Regulation of Investigatory Powers Act 2000 allows the Secretary of State to issue interception warrants and allows those warrants to be served on persons who can assist in giving effect to them. Anyone who is providing a public telecommunications service who is served with a warrant is obliged to give effect to it. It has always been the case that that applies to any company that offers services to customers in the United Kingdom, irrespective of where it is based.

The territorial extent of RIPA has perhaps never been as explicit as it should have been. As a result, some overseas companies have started to question whether they are obliged to comply with warrants that are served on them. Our judgment is that that situation has reached a dangerous tipping point, and that it is necessary to put it beyond doubt that RIPA applies equally to public telecommunications services that are located overseas and those that are headquartered in the UK.

The clause makes clear Parliament’s intention that RIPA should have extraterritorial jurisdiction. It does that in three ways. First, it specifies that an interception warrant may be served on a company that is located overseas, and that a company providing telecommunications services to customers within the United Kingdom, but which is located overseas, has a duty to provide assistance when served with that warrant. Secondly, it specifies that a notice that is issued under section 12 of RIPA may be given to a company that is providing telecommunications services to customers within the UK, but that is located outside the UK. Such a notice would require the company to put in place the necessary infrastructure to give effect to interception warrants. Thirdly, it specifies, as has always been the case, that a notice under section 22 of RIPA for the provision of communications data may be served on a company outside the UK.

The clause specifies the means by which the serving of a warrant or the giving of a notice may be effected. It also makes clear the obligation to comply with a warrant or notice, and the means by which that obligation may be enforced.

Photo of Julian Huppert Julian Huppert Liberal Democrat, Cambridge

Will the Minister make clear what consequences the clause might have for overseas providers? Is there any possibility that a section 12 order could require a foreign company to install surveillance equipment on its network? Does the Minister have the powers to do that?

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration)

I hope that the hon. Gentleman will understand that I cannot comment on surveillance techniques. However, I restate clearly that the Bill and, in particular, clause 4 do nothing more than is already the case in respect of the requirement to serve notices and the ability to issue warrants to overseas providers.

Photo of Jack Straw Jack Straw Labour, Blackburn

May I confirm, for the benefit of the Committee, that what the Minister has just said about the intention being that RIPA should extend extraterritorially in these respects is entirely accurate? If hon. Members look at RIPA itself, they will see that section 2(1), which provides definitions, states that

“‘telecommunication system’ means any system (including the apparatus comprised in it) which exists (whether wholly or partly in the United Kingdom or elsewhere)”.

That is but one example—there are many to which I could point—that shows that the clear intention of this

House and the other place was to make this part of the Act extraterritorial. Indeed, we thought that that would be the effect of the Act.

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration)

I am very grateful to the right hon. Gentleman for providing that clarification and for highlighting that provision in section 2 of RIPA, which gives a sense of the extent and nature of the provisions that were contemplated when it was introduced. It was thought that it would have extraterritorial effect. Given legal challenges, other court cases and the language used in the legislation, we think it right to put that beyond doubt. That has always been the intent and practice for this measure; I repeat that the Bill does not extend the position but restates and asserts what has always been the case in the legislation. Those who may be subject to notices or warrants should understand clearly that it will apply to them if they are outside the UK.

Photo of Dominic Raab Dominic Raab Conservative, Esher and Walton

I am interested in the practical application of this measure. What happens if a foreign IT provider refuses to comply, and uses encryption or another security mechanism effectively to flout the relevant order? What practical steps will the Government seek to take?

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration)

The approach we have taken is to promote co-operation, and stating as clearly as possible that the legislation has extraterritorial effect is a key part of that. Ultimately, given the clarity provided in the legislation, a company that did not comply with a warrant or notice served on it would be open to court challenge.

Photo of Julian Huppert Julian Huppert Liberal Democrat, Cambridge

Perhaps my previous question was not clear. A number of companies are concerned about the important issue of how section 12 orders would be interpreted. RIPA currently deals with powers to enable companies to make lawful intercepts. Will the Minister confirm that if a company—a webmail provider, or whoever—can provide legal intercept, he is not claiming powers to require them to put specific equipment on their networks?

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration)

Perhaps I did not explain this clearly to the hon. Gentleman, but we are not intending to add additional powers to compel. I suppose he is trying to elicit whether the measure is a means of getting more data retained outside the UK—he raised that point in the previous debate on this issue, and again I may be misunderstanding him. I reassert that the Bill contains nothing that in any way extends the existing reach of section 12 of RIPA. Other than reasserting the position on extraterritoriality, it does not in essence change section 12 at all. If that does not answer his point, he may wish to write to me on the matter.

The clause provides that where a warrant has been served on a company outside the UK, the law in the country where the firm is located must be taken into account when determining whether it is reasonably practicable for that company to give effect to the warrant. The clause also makes it clear that the court should consider what steps the company has taken or could take to avoid such a conflict arising. It does not extend the powers of law enforcement or security and intelligence agencies. It simply puts beyond doubt the fact that sections 11, 12 and 22 of RIPA apply to telecommunication service providers that are based outside the UK but provide services to customers in the UK.

Photo of George Howarth George Howarth Labour, Knowsley

I raised this point on Second Reading but I do not think the Minister had an opportunity to respond. In clause 4(6), proposed new subsection (3B)(a) and (b) covers the circumstances of delivering a notice to the sort of companies he has just described. Paragraph (a) states

“by delivering it to the person’s principal office within the United Kingdom or, if the person has no such office in the United Kingdom, to any place in the United Kingdom where the person carries on business or conducts activities,” and (b) states

“if the person has specified an address in the United Kingdom as one at which the person, or someone on the person’s behalf, will accept documents of the same description as a notice, by delivering it to that address.”

I am sorry to read that out, but it provides the context.

The example I used earlier was of a relatively junior member of staff in a billing office in Liverpool for Google or one of the other communications service providers, and my concern is that they could end up having a notice served on them and be put in an invidious legal position. I hope that I am wrong about that and that the Minister will be able to reassure me. The provisions seem entirely appropriate for a senior member of staff.

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration)

Provisions on a person having a specified address, such as proposed new subsection (3B)(b), refer to a situation where lawyers accept service, proceedings or notification on a person’s behalf. In essence, the Bill gives effect to such clarification.

Photo of George Howarth George Howarth Labour, Knowsley

The Minister has provided the reassurance I was looking for, so at this point I can say that I am perfectly happy with the clause as it now stands.

Photo of Julian Lewis Julian Lewis Conservative, New Forest East

My hon. Friend Mr Raab asked an important question: what will the Government do when a company does not wish to co-operate? I would like to put on the record something that I cannot attribute to a particular individual, other than to say it was a comment made by a very senior member of one of the main communications services providers in modern media. In relation to the question of his medium being abused for serious criminal or terrorist purposes, he said:

“We don’t want to frustrate the access of law enforcement agencies; only, that they should come through the front door and ask us, not sneak in by the back door.”

The companies want something that is clearly laid out in a proper legal format, so that they can fulfil that promise not at the whim of some private or backstairs approach by some unnamed Government official, but through a proper on-the-record procedure.

Photo of Dominic Raab Dominic Raab Conservative, Esher and Walton

My hon. Friend makes an extremely important point. There has been a lot of talk about privacy, but if we do not get this right and the providers are not comfortable, the risk is that the Bill will be flouted. If that happens, the use of foreign providers by every paedophile and jihadist group would drive a coach and horses through clause 4 and render it utterly useless.

Photo of Julian Lewis Julian Lewis Conservative, New Forest East

I entirely agree with my hon. Friend, who is a fierce defender of the rights of individuals. I hope he agrees that if we can build on the attitude I have described from one of the most senior providers, then, by consensus, we ought to be able to set an example of an agreed arrangement whereby providers can be satisfied that they are assisting the law enforcement authorities in a proper, open and legitimate way, with no question of their being party to underhand arrangements.

Finally, may I apologise to the House for my late entry to this important debate, and, indeed, for my attire? I spent the entire day at the Farnborough air show, where the screaming of fast jets must have excluded the noise of my telephone ringing repeatedly from Downing street, offering me an alternative way to serve the nation. [Laughter.]

Photo of Julian Huppert Julian Huppert Liberal Democrat, Cambridge

I have two questions and I would be grateful if the Minister provided a written response to them, to ensure we get a clear answer. First, may we have a written confirmation that there would be no power to force foreign companies to install surveillance equipment on their networks if they are able to provide the intercept that is needed? Secondly, will he confirm the impact of subsection (4) and make it clear that, if a foreign company is under an obligation not to provide such data—if it would, in fact, be a criminal offence for them to comply—no such requirement would be made by the Government? That would put people in the invidious position of having to face criminality on one front or the other. If the Minister wrote to me with confirmation on those points, that would be very helpful.

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration)

I will respond briefly to the points made in the debate. On the latter point, I hope that my hon. Friend Dr Huppert will have noted the reference I made to companies’ reasonable ability to comply and the consideration that would have to be given in particular to conflict of law issues, but I will see if I need to supplement that in some way.

My hon. Friend Dr Lewis highlighted the point of having proper procedures and being able to make proper requests. Putting the extraterritoriality provisions in the Bill to allow notices and warrants to be given to overseas providers strengthens that position and the ability to make requests, which would specify further details. I see this as a means of strengthening the regulatory regime, and I hope that clause 4 will stand part of the Bill.

Question put and agreed to.

Clause 4 accordingly ordered to stand part of the Bill.