Clause 31 - Tampering with the Register etc.
Identity Cards Bill
9:15 am
Nick Palmer (Broxtowe, Labour)
I beg to move amendment No. 196, in clause 31, page 26, line 41, after “unauthorised”, insert “access to or”.
Roger Gale (North Thanet, Conservative)
With this it will be convenient to discuss the following amendments: No. 197, in clause 31, page 27, line 1, after “cause”, insert “access to or”.
No. 198, in clause 31, page 27, line 3, after “such”, insert “an access to or”.
No. 199, in clause 31, page 27, line 5, after “causes”, insert “an access to or”.
No. 200, in clause 31, page 27, line 7, after “to”, insert “an access or”.
No. 201, in clause 31, page 27, line 17, after “section”, insert “an access or”.
No. 202, in clause 31, page 27, line 19, after “the”, insert “access or”.
No. 203, in clause 31, page 27, line 21, after “the”, insert “access or”.
No. 204, in clause 31, page 27, line 24, after “causing”, insert “an access to or”.
No. 205, in clause 31, page 27, line 29, after “the”, insert “access or”.
Nick Palmer (Broxtowe, Labour)
I had intended to speak for several hours, but cross-party representations have persuaded me otherwise.
Roger Gale (North Thanet, Conservative)
Order. So far as I am concerned, the hon. Gentleman may speak for as long as he likes, as long as he is in order.
Nick Palmer (Broxtowe, Labour)
I am grateful, Mr. Gale, but I fear that you alone in this Room hold that view.
The purpose of the amendments, which are probing, is to ask the Government what they will do to discourage hacking into the database. Hacking worries my constituents more than tampering. It is reasonably unlikely that someone will try to get into a database and, say, enter a different address, but my constituents are concerned about unauthorised access. All of us who have worked in IT will know about the more familiar type of electronic intrusion.
The amendments are, in essence, identical and they were tabled merely for the sake of completeness. It is sufficient to discuss amendment No. 196, which would, by way of modification—the favourite word of the hon. and learned Member for Harborough (Mr. Garnier)—add the words “access to or”. This seems to be the more serious issue, and I would be grateful if the Minister addressed it.
Tony McNulty (Minister of State (Immigration, Citizenship and Nationality), Home Office; Harrow East, Labour)
As my hon. Friend has clearly outlined, his amendments have the single purpose of adding unauthorised access to the register to the modification offence created under clause 31.
I am grateful to my hon. Friend for tabling the amendments, which endeavour to ensure that those who seek to threaten the security of the register may be prosecuted, but I hope to reassure him that they are unnecessary and that the clause already provides that protection.
The clause contains the specific and serious offence, which is punishable by 10 years’ imprisonment, of unauthorised tampering with the information on the register. Someone who gains unauthorised access to information on the register remotely but who does not cause a modification or does not have the intention required by subsection (2) will nevertheless be covered by the Computer Misuse Act 1990 and will be dealt with appropriately.
Section 1 of the 1990 Act contains the offence of unauthorised access to computer material, with a maximum penalty of six months. Section 2 contains the offence of unauthorised access with the intent to commit or facilitate further offences, with a maximum penalty of five years. My hon. Friend’s substantial and fair point about access as well as modification is therefore covered by that Act.
I also reassure my hon. Friend that the fact that someone has accessed information will automatically be recorded in the technical data on the register, so there will be an audit trail of any unauthorised as well as authorised access. In that context, I ask him to withdraw his amendment, however well put and eloquently made.
Nick Palmer (Broxtowe, Labour)
I am overcome by the Minister’s kind words and flattered into doing as he suggests. I beg to ask leave to withdraw the amendment.
Patrick Mercer (Shadow Minister (Homeland Security), (Assisted By Shadow Law Officers); Newark, Conservative)
I beg to move amendment No. 107, in clause 31, page 27, line 12, leave out subsection (4).
Amendment No. 107 complements the amendments we have just discussed, as it would remove subsection (4) of clause 31. We tabled it to probe the Government on how hackers or crackers will be dealt with if interference with the identity register comes from abroad. I would be most grateful if the Minister enlightened us on such matters.
Tony McNulty (Minister of State (Immigration, Citizenship and Nationality), Home Office; Harrow East, Labour)
I thank the hon. Gentleman for explaining the amendment. As he said, it would remove subsection (4), which provides for extra-territorial effect in relation to the offence of tampering with the register. Furthermore, when authorised modifications took place abroad, it would be immaterial under the amendment whether the conduct was that of a British citizen. To protect the register from unauthorised modification, we must ensure that any offences applied also apply to unauthorised modifications effected from abroad, no matter what the nationality of the computer hacker, cracker or whatever else people want to call him or her.
The register will be located in the United Kingdom. A computer located outside the United Kingdom could effect an unauthorised modification from there, but an offence would be committed in the United Kingdom under clause 31. It could be argued that United Kingdom courts would therefore have jurisdiction over any such extra-territorial offence, regardless of an express statutory reference. As the register concerns people resident in the UK, Parliament could also be understood to intend that the United Kingdom courts should have jurisdiction over all unauthorised modifications of the register.
However, I took the view that the matter should be put beyond doubt under the Bill, as the general principle of the common law of England is that the exercise of criminal jurisdiction does not extend to cover acts committed on land abroad. Furthermore, when a statute expressly provides for extra-territorial jurisdiction, it will, in the absence of further clear provision, be regarded as covering such acts only when they are committed by British subjects. Therefore, express provision has been made under subsection (4) for the offence to apply regardless of nationality.
For completeness in this IT age, when extra-terrestrials will perhaps be the next problem rather than extra-territorials, we need subsection (4). The offence will be extraditable; someone could be prosecuted if here or extradited from abroad for trial. The matter is very serious and it goes to the heart of the security of the register. On balance, I believe that clause 31 is better with subsection (4). I trust that the hon. Gentleman recognises the need to provide for extra-territorial jurisdiction in relation to the offence and I ask him to withdraw the amendment.
Patrick Mercer (Shadow Minister (Homeland Security), (Assisted By Shadow Law Officers); Newark, Conservative)
Tony McNulty (Minister of State (Immigration, Citizenship and Nationality), Home Office; Harrow East, Labour)
Politely.
Patrick Mercer (Shadow Minister (Homeland Security), (Assisted By Shadow Law Officers); Newark, Conservative)
Indeed, and I am most grateful to the Minister. His comments on extradition have reassured me, so I beg to ask leave to withdraw the amendment.
Roger Gale (North Thanet, Conservative)
It will also be convenient to discuss new clause 1—Prohibited uses of information—
‘(1)Subject to subsection (2), a person shall be guilty of an offence if he uses or stores any of the information set out in Schedule 1, paragraphs 4 to 9 in such a manner as to form an index to any file or data retrieval system unless—
(a)the person using or storing such information is the originator of the information; or
(b)such use or storage is undertaken as part of the operation and maintenance of the Register.
(2)The Secretary of State shall not provide any person with information from the Register if he believes that it may be used for a purpose prohibited under subsection (1).
(3)A person guilty of an offence under this section shall be liable—
(a)on conviction on indictment, to imprisonment for a term not exceeding two years or to a fine, or to both;
(b)on summary conviction in England and Wales, to imprisonment for a term not exceeding twelve months or to a fine not exceeding the statutory maximum, or to both;
(c)on summary conviction in Scotland or Northern Ireland, to imprisonment for a term not exceeding six months or to a fine not exceeding the statutory maximum, or to both.’.
Edward Garnier (Shadow Minister, (Assisted By Shadow Law Officers); Harborough, Conservative)
While speaking briefly to the new clause, I shall refer to clause 31 as a whole. The new clause is to be found on page 305 of the modification paper and it relates somewhat to the matters we discussed a moment ago, inviting us to create an offence if a person
“uses or stores any of the information set out in Schedule 1, paragraphs 4 to 9”—
members of the Committee can see for themselves what information those contain—
“in such a manner as to form an index to any file or data retrieval system unless”
the person using it is the originator of the information or is doing that work
“as part of the operation and maintenance of the Register.”
Proposed new subsection (3) sets out the penalty.
There is a lacuna that needs to be filled if the Bill is to have any integrity according to its own principles. I put it in parenthesis that I disapprove of the Bill as a matter of principle, but if we are to have it, it might as well include new clause 1.
Tony McNulty (Minister of State (Immigration, Citizenship and Nationality), Home Office; Harrow East, Labour)
As we know, clause 31 provides for an offence of tampering with the register. A person is guilty of the offence if he intentionally or recklessly makes an unauthorised modification of an entry. New clause 1 would prevent the reference numbers or histories contained in paragraphs 4 to 9 of schedule 1 from being used as index numbers on third-party databases unless those third parties were the originators of the information. A new offence would be created for those who breached the terms of the clause.
On balance, we will resist the new clause. It does not attempt to prevent the information from being held on the register—new clause 1(1)(b) ensures that—but it would restrict how third parties could use and store the information. It refers to “person”, so it covers public authorities and private organisations. The effect would be to prevent the immigration and nationality directorate, for example, from holding an individual’s foreign passport number as a reference number because it would not be the originator of that number. It would also prevent legitimate employers from being able to sort their employee databases using their national insurance numbers.
If the hon. and learned Member for Harborough had been minded to do so and if he had more time, he might have explained that the new clause is meant to probe the circumstances when a third party could hold an individual’s national identity registration number on file and the consequences of that. A third party would have the NIR number only with consent, as covered in clause 14, or in accordance with the specific circumstances that we discussed around clauses 19, 20 and 22. The number would be of no use to the third party as it would have neither the ID card nor the biometrics with which it would match.
On the provision of information, the Bill sets out clearly who, what, why and how. Beyond that, it is not appropriate or practical for the Bill to be used to restrict the manner in which information may be held by third parties or to limit how it may be used by them. In practice, those concerns relate to the fair processing of information and thus fall under the remit of the Data Protection Act 1998 and the jurisdiction of the Information Commissioner.
I understand why the hon. and learned Gentleman tabled new clause 1, but I ask hon. Members to resist it. I commend clause 31 to the Committee.
Edward Garnier (Shadow Minister, (Assisted By Shadow Law Officers); Harborough, Conservative)
I may be able to help the Minister. I will not press new clause 1, either now or at a later stage, but will he tell me why clause 31(4), which my hon. Friend the Member for Newark (Patrick Mercer) reasonably tabled an amendment to delete, cannot simply state that an offence under the provision may be committed by a British citizen anywhere in the world and by anyone within the United Kingdom? That says the same thing in fewer words.
Tony McNulty (Minister of State (Immigration, Citizenship and Nationality), Home Office; Harrow East, Labour)
Far be it from me to challenge the legalese that forms our deliberations, as I am not a member of legal fraternity. I suspect that the subsection says entirely what the hon. and learned Gentleman suggests, but in the frilly and flowery language that is our legalese. That is a shame, as I would prefer plain English, but there we have it. It says what he says, but in lawyers’ terms.
Edward Garnier (Shadow Minister, (Assisted By Shadow Law Officers); Harborough, Conservative)
If that was a bouquet, I would hate to see a hand grenade. Whatever I have to do to withdraw new clause 1, I shall do it.
Roger Gale (North Thanet, Conservative)
The answer is that the hon. and learned Gentleman has to do nothing, as it has not been moved.