Clause 17 — Retention of relevant data

Funeral Services – in the House of Commons at 2:00 pm on 9 December 2014.

Alert me about debates like this

Photo of Diana R. Johnson Diana R. Johnson Shadow Minister (Home Affairs) 2:00, 9 December 2014

I beg to move amendment 5, page 11, line 3, at end insert—

(iii) is beyond that which is necessary to allow the identification of the user from the public Internet Protocol address.”

This amendment would make it explicit that the extra data retention provided for in Clause 17 does not extend beyond that which is necessary for the purpose of identifying a user from the

IP address. This amendment is not intended to impact on the rest of the Data Retention and Investigatory Powers Act, only the extra retention requirements created by Clause 17.

Photo of John Bercow John Bercow Chair, Speaker's Committee for the Independent Parliamentary Standards Authority, Chair, Speaker's Committee on the Electoral Commission, Speaker of the House of Commons, Speaker of the House of Commons, Chair, Speaker's Committee for the Independent Parliamentary Standards Authority, Chair, Speaker's Committee on the Electoral Commission

With this it will be convenient to discuss the following:

Clause 17 stand part.

New clause 1—“Access to retained data; judicial oversight—

(1) The Regulation of Investigatory Powers Act 2000 is amended as follows.

(2) After section 22 insert—

“22A Access to retained communications data: judicial oversight

(1) This section applies where a person designated for the purposes of this Chapter believes that it is necessary on grounds falling within section 22 to obtain relevant communications data retained under section 1 of the Data Retention and Investigatory Powers Act 2014 relating to professional activities covered by a duty of confidentiality.

(2) Before granting an authorisation or issuing a notice under section 22 the designated person must have obtained the permission of the court.

(3) In determining whether to grant permission under subsection (2) the court shall in particular balance the reasons why the designated person believes it is necessary to obtain the data against the public interest in upholding the duty of confidentiality.

(4) The Secretary of State may by regulations specify—

(a) the court or courts that shall determine applications for permission under this section;

(b) the process for the court or courts to determine whether to grant permission;

(c) the period for which permission shall apply before being renewed by the court; and

(d) the process for a person or persons to appeal against a decision to grant permission.

(5) Regulations under this section may not be made until they have been laid in draft before and approved by both Houses of Parliament.

(6) In this section “professional activities covered by a duty of confidentiality” shall include, but not be limited to, the professional activities of journalists, legal advisers, medical professions and Members of Parliament.”

New clause 2—“Review of timing for disclosure of Relevant Internet Data

‘(1) The Secretary of State must instigate a review of the time taken for communications service providers to comply with a request for subscriber information made under Part 1, Chapter 2 of the Regulation of Investigatory Powers Act 2000.

(2) In this section “subscriber information” means relevant internet data as defined in section 17 of this Act in so far as it relates to information required to link a public internet protocol address to an individual user.”

This New Clause would require the Home Secretary to instigate a review regarding the time taken by communications service providers to disclose information which links an individual to an IP address.

Amendment 11, in clause 42, page 25, line 5, at end insert—

‘(3A) The Secretary of State shall not make regulations under subsection (3)(a) until a report by the Interception of Communications Commissioner on the use of powers under the Regulation of Investigatory Powers Act 2000 to access the records of journalists has been laid before both Houses of Parliament.”

Photo of Diana R. Johnson Diana R. Johnson Shadow Minister (Home Affairs)

I shall speak to new clause 2 standing in my name and those of my right hon. and hon. Friends. It would be helpful to start by providing some background to clause 17, although I do not wish to pre-empt the Minister’s comments. I must say at the outset that clause 17 is not the easiest clause to follow, and reference was made to that on Second Reading.

Clause 17 amends the definition of “relevant communications data” as found within the Data Retention and Investigatory Powers Act 2014. Some of clause 17 appears to tidy up drafting issues, such as the definition of communication, from the DRIP Act. However, the clause also expands the definition of relevant communications data to include an extra category of data described as “relevant internet data” in section 2 of DRIP in order to allow the Home Secretary to use powers under section 1 of DRIP to bring in regulations to ensure that this relevant internet data is retained by communications service providers.

Essentially, the Government are using this fast-tracked primary legislation in early December to amend emergency primary legislation from July to enable the Home Secretary to bring in secondary legislation, but it is important to remember that while DRIP maintained the status quo in respect of data retention, clause 17 extends the current provision. That is why I think it important to pay close attention to the clause.

The use of the term “relevant internet data” to define the extra data being provided for in clause 17 is, I think, problematic. The use of such a broad term suggests a wide new category of data retention, while the Bill’s explanatory notes suggest, it seems to me, a much narrower category of data—namely, the data necessary to allow relevant authorities to link the unique attributes of public internet protocol, or IP addresses, to the person or device using it.

Amendment 5 is designed to ensure that the text of clause 17 matches the claims made in the explanatory notes. I understand that the change in the rules on data retention is a response to the increasing use of floating IP addresses by communications service providers, whereby one IP address is allocated to numerous devices. This is particularly common for mobile devices, which may connect to the internet only a second at a time, so numerous IP addresses may be allocated. The extra data retention, as provided for in clause 17, is to ensure that the data required to allow the relevant authorities to see who is the recipient of a communication such as an e-mail or a bit torrent, is retained by the CSP.

While there is considerable and fully understandable public concern about the extent of data storage, the Opposition broadly accept the need for this extra category of data. It has always been the case that phone companies have kept records of phone calls made. People understand and generally accept that their phone company keeps a record of these calls and that they may be used by the police. We feel that the same principle should apply to electronic communication, and that this amendment is broadly in line with this principle.

Photo of Julian Smith Julian Smith Conservative, Skipton and Ripon 2:15, 9 December 2014

Will the shadow Minister explain a bit more of her party’s thoughts on making further changes in communications data and retention, because as she knows we need to do much more in this area and this is only the start?

Photo of Diana R. Johnson Diana R. Johnson Shadow Minister (Home Affairs)

If the hon. Gentleman will be little patient, I shall move on to that subject in a few moments.

As I was saying, the Opposition accept that this extra category of data will be a vital tool for law enforcement—not just in protecting national security, but in combating a whole range of online crimes, including online child abuse, on which I shall speak in greater detail when we come on to new clause 2. The provisions for this extra category of data were first proposed in the Government’s ill-fated draft Communications Data Bill—I think that might help the hon. Gentleman in respect of his intervention. Although initially reluctant to provide any public evidence for why these extra data were needed, the Government did then provide the evidence that convinced the Joint Committee on the draft Bill of the necessity of this extra retention. The draft Communications Data Bill has been subject to much coalition grandstanding over the past few years, with the Home Secretary proposing a Bill of unprecedented, and in our view unnecessary, scope, while the Deputy Prime Minister refuses to accept the need for any legislation at all. Of course there was room for compromise and the Opposition have always supported this compromise. Some additional data retention is required, but not on the scale the Home Secretary proposed.

Photo of Alan Beith Alan Beith Chair, Justice Committee, Chair, Liaison Committee (Commons), Chair, Liaison Committee (Commons), Chair, National Policy Statements Sub-Committee, Chair, Justice Committee

How can the hon. Lady say that my right hon. Friend the Deputy Prime Minister did not see the need for any legislation at all when we are sitting here in this Committee this afternoon considering the legislation which we think properly balances the privacy issues with the need for public safety?

Photo of Diana R. Johnson Diana R. Johnson Shadow Minister (Home Affairs)

The right hon. Gentleman has made his point, and we will obviously disagree on what I have just said.

Our view, agreed with by most of the Joint Committee on the draft Bill, is that the data required to link an IP address to a device is one such category of data that is required and therefore we welcome what in principle clause 17 seeks to achieve. I say “in principle” because we do have some concerns about the drafting of clause 17, which is why we have tabled amendment 5.

Photo of Diana R. Johnson Diana R. Johnson Shadow Minister (Home Affairs)

I will give way, but, as I have said, I do want to get on to the substantive issues.

Photo of Julian Smith Julian Smith Conservative, Skipton and Ripon

I am grateful to the shadow Minister for giving way. Will she just clarify briefly the further categories that she sees becoming more important, and where the Government and coalition can expect Labour’s support as they seek to put more of these areas on to the statute book?

Photo of Diana R. Johnson Diana R. Johnson Shadow Minister (Home Affairs)

What I will come on to say about some of the concerns we have might help the hon. Gentleman, but his question obviously leads into a debate that goes wider than this particular grouping, which is specifically on clause 17, and in the Committee stage of the Bill. I will therefore continue with my points on this grouping, because I am sure I would be in trouble if I did not do that.

To repeat, although in principle we support clause 17, we have some concerns about its drafting, which is why we have tabled amendment 5. Because of the broad label “relevant internet data”, we want to put it beyond doubt that the category of data to be retained under clause 17 does not extend beyond what is strictly necessary to link an IP address to a user.

In the Bill, the definition of “relevant internet data” is data which

“relates to an internet access service or an internet communications service” and

“may be used to identify, or assist in identifying, which internet protocol address…belongs to the sender or recipient of a communication”.

While this appears to include a whole host of other traffic data, including web logs, clause 17 also states that “relevant internet data” is not “communications data” as defined by the schedule to the Data Retention Regulations 2014 or information as defined in clause 17(3)(c), which is supposed to exclude web logs from this provision. We have concerns about the accuracy with which subsection (3)(c) captures the nature of web logs, which is why we have tabled amendment 5. I hope the regulations this clause will enable will be clearer than this primary clause in the legislation. It is disappointing that, unlike with the DRIP Bill, the draft regulations have not yet been published alongside the Bill. This has caused problems for Parliament’s ability to provide proper scrutiny of this clause.

As well as accepting our amendment 5, which I hope the Minister will be able to do, I urge him to go back and look again at the drafting of clause 17 before Report. In order to increase public confidence in the use of retained communications data we need to be clear about what is retained and I believe clause 17 and the accompanying explanatory notes could be better in this regard.

Photo of Julian Smith Julian Smith Conservative, Skipton and Ripon

The hon. Lady talks about web logs. Will she clarify the Opposition’s long-term position on that issue, and what she sees will happen in the future, when on many sides of the security spectrum there seems to be a consensus that there is a need to bring these areas in eventually?

Photo of Diana R. Johnson Diana R. Johnson Shadow Minister (Home Affairs)

I will just reiterate that we are dealing with clause 17, and we are very mindful that we want to ensure that web logs are not included under this clause. My focus is on getting clarity on that from the Minister. What might happen in the long term is perhaps a debate for another time. I am concerned that we get the drafting of this clause as accurate as we can.

I was talking about making sure the public are confident about what we are trying to do through clause 17, and what is included and what is not included. The data at the heart of clause 17 appear to be what is commonly referred to as “IP resolution data”, but this term does not appear in the text of the explanatory notes, and I hope the Minister will be able to explain whether they do refer to the same thing, as there is some confusion here.

As I explained, clause 17 is meant to plug a gap within the current framework for data retention, but when we compare the language of the Bill with the text of the current regulations, the gap is not immediately obvious. Clause 17 refers to data which

“relates to an internet access service or an internet communications service” and

“may be used to identify, or assist in identifying, which internet protocol address…belongs to the sender or recipient of a communication”.

However, part 3, paragraph 11 of the schedule to the existing regulations refers to the subscriber information

“to whom an Internet Protocol (IP) address, user ID or telephone number was allocated at the time of the communication.”

I ask the Minister to look at this and see whether he cannot amend the language to make clear on the face of the Bill the exact data category that will be provided for in the regulations.

I am also concerned about the degree to which clause 17 relies on definitions provided from the Regulation of Investigatory Powers Act 2000. I am sure the Minister is aware of the findings of the Joint Committee on the Draft Communications Data Bill that the definitions used in RIPA were out of date and needed to be replaced. Given this, it is surprising to see both the definition of “communication” and section (3)(c) of the clause rely so heavily on RIPA definitions.

I would also like the Minister look again at the definition of “identifier.” According to clause 17

“‘identifier’ means an identifier used to facilitate the transmission of a communication”.

This is at least partly circular, and again adds to the confusion around this clause. Finally, in subsection (2)(b) will the Minister confirm that he does indeed mean “paragraph (a)” rather than subsection (a)?

In addition to the five questions above regarding the drafting, I have 10 questions about the implementation that I hope the Minister will be able to address in his comments. First, will he tell the House whether he expects to introduce new retention regulations under DRIPA section 1, or will the Government be seeking to amend the Data Retention Regulations 2014? Secondly, and on a similar note, will he update the House on when he expects to publish these draft regulations and when he hopes they will be in force? Thirdly, when the data covered under clause 17 is traffic data, while the relevant authority wants to reveal the subscriber information behind this, will this be covered under a single request under RIPA, or could clause 17 data simply lead to a disclosure which requires a further RIPA request to be made? Fourthly—this is particularly relevant to amendment 5—will he assure the House that the retention by the Crown Prosecution Service of this relevant internet data can be done in such a way that does not require deep package inspections of the type that would be considered intrusive surveillance? Fifthly—and again relating to amendment 5—will the Minister explain in practice how the regulations will separate out communications going to a device, which could be a web log, such as access to an app, which would be considered a website, and communications going to a device which enables a communication, such as an app which facilitates web e-mail storage?

Sixthly, will the Minister confirm that the extra reporting requirements imposed on the interception of communications commissioner by the DRIP Act will extend to the data retained and subsequently requested under clause 17? Will the Minister be providing additional resources to the commissioner to meet those additional requirements?

Seventhly, will the Minister tell the House how roaming services are dealt with, both international SIM cards temporarily hosted on UK networks and UK-based SIMs use data roaming abroad?

Eighthly, will the Minister tell the House what he would expect the costs to be on a relevant authority making a request for data provided for under clause 17?

Ninthly, can the Minister tell the House what discussions have been undertaken with industry? In particular, can he respond to the comment from the secretary-general of the Internet Services Providers Association that he was “disappointed” that the Home Office had not consulted with industry before announcing these proposals? How did the Minister reach the £98 million estimate of compensation required by the industry if he has not consulted with it?

Finally, will the Minister assure the House that the Government have obtained independent legal advice to ensure that this measure is compatible with the decision of the European Court of Justice to quash the data retention directive? In that judgment, the ECJ suggested that any form of blanket retention was disproportionate, and also called for additional safeguards on when the data can be disclosed. Is the Minister still confident that the measures contained within DRIP are sufficient to meet those demands?

Photo of Alan Beith Alan Beith Chair, Justice Committee, Chair, Liaison Committee (Commons), Chair, Liaison Committee (Commons), Chair, National Policy Statements Sub-Committee, Chair, Justice Committee 2:30, 9 December 2014

The hon. Lady has produced a formidable list of questions, but I only have one for her, on amendment 5. It seems to me that the process we are describing does not enable people to discover who the user of an instrument was; it locates or identifies only the instrument from which the communication was made. Therefore, amendment 5 would be inoperative, because it could never be demonstrated that it was being used to establish who the user was as it cannot be guaranteed to do that.

Photo of Diana R. Johnson Diana R. Johnson Shadow Minister (Home Affairs)

I am grateful for the right hon. Gentleman’s observations on amendment 5. As with the previous grouping, the amendment was tabled to give us the opportunity to look at the specifics of clause 17 and to understand fully the thinking behind the Minister’s approach. I take on board what the right hon. Gentleman has said, which may be correct, but the amendment allows us to debate what would be disclosed and what information would be available.

I have just bombarded the Minister with a whole range of questions and I know that, as usual, he will be very thorough and go through each in turn. However, I want to turn briefly to new clause 2, which seeks to move on from the retention of data to a review of whether the form of storing the data is allowing the key authorities to access it in a timely manner. I will say, so everyone understands where I am coming from, that this proposal aims to probe the Minister’s argument, and to look at the clause to see what more can be done and whether we need to be aware of any issues for companies.

My concern arises from the police’s apparent problems in pursuing the majority of suspected paedophiles identified through Operation Notarise. My understanding is that Operation Notarise identified between 20,000 and 30,000 individuals whom the communications data suggested were taking part in online abuse. From that, only 700 people have been named, investigated and arrested, so well in excess of 20,000 IP addresses have been identified, but that information has not been translated into named users. At this point, I am not even talking about arrests, but about identifying the users to enable effective safeguarding interventions.

Once a user is identified, even if it is just an address, the police can make several key checks: first, against the police national computer to see if there is a known sex offender living at the address; secondly, against the Disclosure and Barring Service database to identify anyone who might be working with or have access to children; and thirdly, against the Department for Work and Pensions database to see if a child is registered at the property for the purpose of claiming child benefit.

At the moment, the police do not know how many of the people they have identified are known sex offenders, working with children or living with children. Most people would see that as unacceptable and would believe there should be a response. This could start with a review of the degree to which the difficulty of linking IP addresses to users is behind the police’s problems with moving this forward.

Finally, I turn to the amendments and new clauses tabled by my hon. Friends the Members for Hayes and Harlington (John McDonnell) and for Islington North (Jeremy Corbyn), and by Caroline Lucas, on the degree to which RIPA is being used to access the records of certain professionals, including journalists. They address a real concern that Members and the general public have about the use of RIPA to access the records particularly of journalists and those in the media.

As the shadow Home Secretary, my right hon. Friend Yvette Cooper, has said, this issue has to be addressed. Indeed, a key concession secured by the Opposition during the passage of the DRIP Bill was that a review of RIPA would be conducted by David Anderson QC, the independent reviewer of terrorism legislation, and that it would include the use of RIPA to look at the records of journalists. It is because we have confidence in that review that we do not feel amendment 11 is necessary.

However, that is also why the Opposition have a great deal of sympathy with the aims of new clause 1, which would require a court order before relevant authorities could access communications data that could be covered by a professional duty of confidentiality. The clause does not state whether the role of the court would be simply to ensure that due process is followed, or to apply some test of proportionality or necessity. However, the clause provides for the right of appeal for the individual. That means that an individual would have prior knowledge that their communications data were to be disclosed to law enforcement agencies. It is also important to note that the clause would apply not just to journalists but to doctors, lawyers and others, including Members of Parliament, when a professional duty of confidentiality could be construed.

Photo of Mark Field Mark Field Conservative, Cities of London and Westminster

The hon. Lady referred to journalists, but how broadly would she or her colleagues define “journalists”? We are living in a world of bloggers and of a whole range of individuals who would consider themselves to be part of the media overall, but presumably she would not necessarily want each and every one of those self-professed journalists and bloggers to be caught by these potentially restricting and constricting provisions, essentially watering down elements of RIPA?

Photo of Diana R. Johnson Diana R. Johnson Shadow Minister (Home Affairs)

I have the disadvantage of speaking first on this group of amendments, and obviously, this is not my amendment, so I am very much looking forward to hearing what the proposers feel would happen. However, the hon. Gentleman raises an important point, because we are not only talking about a limited group of people who describe themselves as journalists and who, in the past, we would have been able to identify clearly. Perhaps the proposers of the amendment would be able to address that when they speak to it.

I want to make a further point about the broad definition of professional duty that concerns me, especially when combined with the right of appeal. As I have said, a large number of professionals have some form of duty of confidentiality, and it many cases it is not clear, particularly when discussing communications data, how that potential duty of confidentiality would be separated from other investigations about which we would not allow the individual to have prior knowledge. There is a clear case for preventing a journalist from being targeted for their sources unless there is an overwhelming need to do so. However, the case is less clear in respect of other professions, particularly as we may be investigating issues involving criminal misconduct. Let me give an example for the Committee to consider: the case of Myles Bradbury, the doctor recently convicted of a string of horrendous sexual assaults of boys in his care. As a doctor, he would potentially have been covered by the new clause, especially in respect of some of his communications, and the Committee would be concerned about that. If he had been alerted to the fact that the police were investigating him, he would have had some time to delete much of the evidence which was then used to lead to his prosecution. I just give that as an example of the care we have to take in considering these matters.

I hope the Minister will respond in detail—I am sure he will—to the issues I have raised on this group, particularly the need for the drafting of clause 17 to be made much clearer so that the general public can be reassured about exactly what it is attempting to do.

Photo of Alan Beith Alan Beith Chair, Justice Committee, Chair, Liaison Committee (Commons), Chair, Liaison Committee (Commons), Chair, National Policy Statements Sub-Committee, Chair, Justice Committee

Diana Johnson is right to seek clarification to satisfy herself and her colleagues that clause 17 achieves its intended purpose and no more. Its intended purpose is reasonable: to keep up with the technological changes that lead evildoers to move from one technology to another, and become more difficult to track as they do so.

Photo of Julian Smith Julian Smith Conservative, Skipton and Ripon

Does my right hon. Friend agree that this provision does not keep up with the technology, and that much more has to happen and will happen? Will he clarify his party’s position on the changes that will have to come?

Photo of Alan Beith Alan Beith Chair, Justice Committee, Chair, Liaison Committee (Commons), Chair, Liaison Committee (Commons), Chair, National Policy Statements Sub-Committee, Chair, Justice Committee

The hon. Gentleman has a strange desire, which he has expressed during a previous speech, to extend the debate beyond the bounds of clause 17 and the amendments to it. I do not think we should be drawn into that at the moment, except to make the general point that all processes involving intrusion into people’s private communications should have high levels of justification before they are used at all, and protections should be provided by various safeguards and authorisations. Finding the right balance for different levels of communication is a difficult task, and I expect a great deal of work will need to be done. Most of us in this House, and certainly most in my party, do not want, either by design or accidental discovery, a great deal of personal information about people to get in the hands of the state and its employees without any reasonable justification. On a matter that will be raised when John McDonnell speaks, nor do we want the processes of investigation by journalists to be impaired by a fear that sources will be compromised from the beginning. There are very good reasons for extreme caution in this area, but I believe the Government have exercised that caution and sought to devise a process to deal with a particular and recognisable difficulty.

Photo of Mark Field Mark Field Conservative, Cities of London and Westminster

The right hon. Gentleman is making a perfectly valid point. In the midst of the more hyperbolic phrases that get used, such as “snooper’s charter”, does he recognise that legislation such as this—and further legislation, which will inevitably be required whoever is in government in the years to come—should also be designed to protect the individual? It is not just about the state getting more powers; it is about codifying the rules and protections for the individual. It is very important that we have that in mind when looking at any new legislation that comes into play.

Photo of Alan Beith Alan Beith Chair, Justice Committee, Chair, Liaison Committee (Commons), Chair, Liaison Committee (Commons), Chair, National Policy Statements Sub-Committee, Chair, Justice Committee

I agree with the hon. Gentleman’s observation, which points to part of the purpose of the process, of which this is only a part. The clauses we are talking about in RIPA—or DRIPA, as it has become known—are the subject of a sunset provision, because significant further review is to take place and new legislation will be required on the outcome of that review. So those who think that detailed discussion of matters that often feel technically beyond us is just an occasional thing in this House will have to recognise that we are going to be coming back to this issue. That does not apply to me, because I do not anticipate being a Member in the next Parliament, having announced that I am going to retire, but Members in the next Parliament will certainly be engaging with these issues.

I simply wished to place on the record that my view—and, I hope, that of my right hon. and hon. Friends—is that the Government have striven hard to find a sensible way to identify the instrument or apparatus that has been the point of communication. In many cases, that will enable them to identify the individual, but I stress that it does not guarantee that, any more than knowing a telephone number guarantees that the person who used the telephone—that instrument from that number—is the person who engaged in the criminal activity. It is more complicated than that, but this provision is a necessary aid to investigations ranging from the activities of paedophiles through to the serious threats we now face.

Photo of George Howarth George Howarth Labour, Knowsley 2:45, 9 December 2014

I wish to begin by providing some context. The Intelligence and Security Committee’s report in February 2013 referred to the Home Office’s assessment that there was a

“25% shortfall in the communications data that public authorities would wish to access and what they are currently able to access.”

That is, of course, an estimate, as it is not possible to be precise about what is unknowable, but the existence of a shortfall is a legitimate cause for concern. The report goes on to suggest that

“left unchecked, this gap will increase.”

Perhaps the Minister will be able to say whether it has increased and, if so, whether by an appreciable amount. It would be interesting to know that, and I suspect it has increased.

It is worth spending a little more time examining what we know about both the scale and the sources of interceptions that take place. In his annual report for 2013, the interception of communications commissioner, Sir Anthony May, noted that the total number of authorisations for interception of communications data under part 1 of RIPA stood at 514,608, down from 570,135 in 2012. He pointed out that these figures do not represent sole individuals, because

“public authorities often make multiple requests for communications data in the course of a single investigation but also make multiple requests for communications data in relation to the same individual.”

The figures give some indication of the scale of this, rather than the number of individuals who are covered. Under the same process, Sir Anthony notes that 87.7% of authorisations were at the request of the police and law enforcement agencies, 11.5% were from the intelligence agencies, and the rest were from local and other public bodies.

Worldwide, the scale of online communications is daunting. About 3 billion people have access to the internet, and during the time I have been speaking more than 200 million e-mails will have been sent, 2 million Google searches will have been made and there will have been 6 million Facebook views. So why is it considered important that the police, intelligence agencies and other bodies have access to some of the data records of these online communications? Overwhelmingly, internet traffic is benign; it is people using the various platforms for perfectly legitimate and legal purposes. However, a small proportion—I estimate it to be no more than a tiny fraction of 1%—is used for illegal purposes, and my hon. Friend Diana Johnson referred to some other purposes that are cause for concern.

My hon. Friend’s new clause 2 would, if agreed, require the Home Secretary to review the time taken by communications service providers to disclose information linking an individual to an internet protocol address.

That is important for two reasons. The first is that, as we tragically discovered with Fusilier Lee Rigby’s murder, CSPs will, on occasion, receive information that in some cases could crucially be the catalyst for a warrant to enable greater surveillance measures on an individual to take place. In turn that can, in some cases, prevent a terrorist attack.

IP addresses are the key to unlocking who is contacting whom, and that can be critical. But they are not straightforward. Typically, a communications service provider with, say, 10 million to 15 million customers would have allocated to it 100,000 IP addresses. For the larger commercial bodies or public bodies, a series of static IP addresses will be allocated. But for the vast majority of users, IP addresses are dynamic. In practice, a range of numbers is allocated randomly to customers, which is why the former head of GCHQ used the analogy of finding a needle in a haystack.

Secondly, the range of platforms is constantly changing, with new ones entering the market all the time. A good example of that is WhatsApp, which was recently acquired by Facebook for $22 billion. On 1 April, that platform, which is adaptable and easy to use, handled, over a 24-hour period, 64 billion messages, 20 billion of which were sent and 44 billion of which were received. In such a dynamic sphere of activity, it is vital that procedures are in place and properly monitored to ensure that, when the security and intelligence services need to locate a needle in a haystack, the haystack is still in place, and that is what this section of the Bill seeks to ensure. It means that urgent inquiries of either a historical or planned terrorist or criminal activity can be located.

Photo of Julian Smith Julian Smith Conservative, Skipton and Ripon

The right hon. Gentleman makes a powerful case for us to go further. What would he do now? He has made it clear that there are many technologies that need much more scrutiny and oversight. What would he do if he were in charge?

Photo of George Howarth George Howarth Labour, Knowsley

Had the hon. Gentleman waited a while longer, I was about to say what more could be done. It is right that we have a statutory provision, and, subject to the concerns that my hon. Friend the Member for Kingston upon Hull North highlighted being satisfied, the provisions contained in the Bill are appropriate. However, there is a problem that we cannot resolve within the context of our own domestic legislation. Many of the communications service providers are not based in the UK; they are based mostly in the United States. Increasingly, the Republic of Ireland is seen as a location of choice for some companies. Google and perhaps one other CSP have already relocated there. It is increasingly clear that whatever legislation we put in place, it will not, of itself, be enough to resolve the problem.

Photo of Mark Field Mark Field Conservative, Cities of London and Westminster

Does the right hon. Gentleman also accept that the increased knowledge of the general public and—dare I say it—of individuals who would do us harm about the techniques adopted by the security services and others have also helped to ensure that there is now much more sophisticated encryption in place, which also plays an important part in further reducing our capacity to know precisely what is happening on the internet?

Photo of George Howarth George Howarth Labour, Knowsley

The hon. Gentleman is quite right and he, like me, is a member of the Intelligence and Security Committee. We have good reason to believe that there are any number of encryption packages that can be bought quite openly on the internet. It is a matter not just of the communications service providers encrypting communications that take place but of individuals buying packages that enable them to do that themselves, which makes the situation even more difficult.

What more can we do? It is no use pretending that this problem is unique to the UK; it is a very difficult international problem. I know that the Home Secretary, the Foreign Secretary and others are in constant dialogue with their opposite numbers in the United States, but there needs to be a growing understanding between ourselves and the places where CSPs are located that there cannot be this ungoverned space within which criminal activity can take place unchecked on the basis that it is in another jurisdiction from where it is being perpetrated. That issue can only be properly resolved by states, either bilaterally or multilaterally, agreeing protocols and ways of dealing with these issues. Obviously, it is much more easy to do that with friendly states—states with which we share common values—than it is in some other areas where internet providers might decide to locate because there will not be many controls on them. Clearly, that is another matter that needs to be seriously avoided.

We need to have order in this ungoverned space. I am talking about legal compliance and there not being this free space in which crime, terrorism and other activities can illegally take place. It is also important that the CSPs take a more responsible view of what they are being used for. Like Mark Field, I have seen some CSPs washing their hands of such responsibilities, saying,” That is a matter of jurisdiction. We are not in that jurisdiction so we will comply with the laws where we are.” That might be good for their reputations with their customers, but it is a fairly cynical way of operating. I hope that, through the intervention of our own Government and Governments elsewhere, CSPs can be brought to the view that they should behave responsibly and in such a way that upholds the law right across the world—except in cases where the rule of law does not operate.

Photo of Mark Field Mark Field Conservative, Cities of London and Westminster

Is the right hon. Gentleman happy for me to put it on the record that it is also the case that many CSPs do a very good job of co-operating with the police and law enforcement agencies? Part of the difficulty has been that the revelations of the past 14 or 15 months have exposed what some would call an over-cosy relationship between those service providers and the state. I am talking about not so much here in the UK, but in mainland Europe and the United States of America, and it has been commercially damaging to many of those providers.

Photo of George Howarth George Howarth Labour, Knowsley

As always, the hon. Gentleman makes a good point. Sometimes the difficulty is that the amount of data and communications that providers store means that they are unable to know what is there. Very often, controls are triggered electronically, and so human eyes might not necessarily see the communication that relates to a terrorist plot, organised crime or even, in a hidden corner of it all, some kind of child abuse. Quite often, no human eyes see it, and it may be that only after an event—as in the case of Fusilier Lee Rigby—do people become aware that there was a communication that indicated that someone was about to or was likely to do something, and that knowing about it could have made a difference, as we concluded in our report the other week. Perhaps I have presented too cynical a picture of communications service providers. I know that, on occasion, they do co-operate constructively, but I believe that increasingly we need the space in which they operate to be better regulated, and that requires international controls agreed between responsible allies and CSPs themselves.

I will end my speech by discussing an issue on which I know my hon. Friend John McDonnell is likely to speak next, which is privileged information and certain professions “immunity” from these provisions. I think the principle is correct: there are certain discussions and areas of information that should be privileged—for example, if somebody talks with their legal adviser or gives information to a journalist or even in the privacy of a Member of Parliament’s surgery. However, I am not sure that the amendment my hon. Friend has tabled would achieve that end without creating a gap between what is necessary and what is desirable. I simply echo what has been said by the hon. Member for Cities of London and Westminster in asking how we define a legitimate professional journalist. There are thousands and thousands of people online who would consider themselves journalists but who may well have ulterior motives or connections with a terrorist community or with people plotting terrorism.

As a matter of principle, I think my hon. Friend is right, but we need to find proper ways to make sure that exceptions to the rule are governed under the same rules as everybody else. [Interruption.] Does my hon. Friend wish to intervene?

Photo of George Howarth George Howarth Labour, Knowsley

I look forward to hearing what my hon. Friend has to say. I acknowledge that he and his supporters have a valid point to make. I just think it is a tricky area in which to legislate and there might be a better way of doing it that we have not thought of yet.

Photo of John Martin McDonnell John Martin McDonnell Labour, Hayes and Harlington

Everyone else who has spoken so far seems to have explained my amendments, and I am grateful to them. I tabled new clause 1 and amendment 11 because there is now a sense of urgency about dealing with this matter. I speak as the secretary of the National Union of Journalists group in Parliament—a group of MPs drawn from various political parties in the House. Throughout proceedings on RIPA and DRIPA and now this Bill, we have been discussing this issue. To put it simply, this House has always recognised in legislation the need to protect journalists, because we see journalism as one of the bulwarks of democracy in this country. Although we may not be enamoured of journalists or individual newspapers at times, we believe they play a vital democratic role in exposing what happens, particularly in regard to the behaviour of public authorities, governments, corporations and others. That is why over the years we have written into legislation protection for journalists, as well as for other professions where there are issues of confidentiality, and the House has accepted that in all the debates so far.

Photo of Alan Beith Alan Beith Chair, Justice Committee, Chair, Liaison Committee (Commons), Chair, Liaison Committee (Commons), Chair, National Policy Statements Sub-Committee, Chair, Justice Committee

It might be better expressed as “protection for sources”, because the primary concern is not to give a special elevated status to the journalist, but to avoid a situation in which the questions are asked, “Who told him and how can we get him?”

Photo of John Martin McDonnell John Martin McDonnell Labour, Hayes and Harlington

Exactly. I was not arguing for preferential status for journalists—God forbid that I do that here. I was coming on to that point: this is about the ability to make sure a source is protected—as we all know, sources are often whistleblowers, blowing the whistle on abuses by public authorities and others—but it is also relevant to the protection of journalists themselves. We have seen across the world how, when the confidentiality of journalists’ sources is undermined, journalists become just as much a target as their sources, and in recent years large numbers of journalists in various countries have died as a result of persecution. What I am trying to say is that it is critical that we protect the role journalists play and enable them to undertake their work.

We have legislated in accordance with that principle—in PACE, for example. I agree with my right hon. Friend Mr Howarth that it is always difficult to find the mechanism, but the mechanism under PACE was the ability of the court to determine whether a production order should be made. We gave it over to the courts to determine that. What was important about that is that the journalist was notified of the application and could contest it before the court, and a decision would then be made that commanded the confidence of all those involved. The classic case since then is when the police failed to get an order under PACE and then used RIPA to obtain an order against a journalist to get information relating to articles that were being written, including the sources of that information. I think it was generally felt in the House that that was not what we intended when we passed PACE and was not in the spirit of RIPA. We have for some time consistently tried to get Government and this House—the responsibility falls on the shoulders of us all—to do exactly as my right hon. Friend said and to find an appropriate mechanism.

I tabled new clause 1 because I cannot find an effective mechanism other than the use of the courts at some stage. My hon. Friend Diana Johnson asked whether it is a mechanism enabling the court to determine whether due process has been followed or the merits of a case. I have left that open for now because I welcome the discussion, but in my view, it is both.

Photo of John Martin McDonnell John Martin McDonnell Labour, Hayes and Harlington

I hope the hon. Gentleman is not going to ask me a detailed question about my long-term future policy.

Photo of Julian Smith Julian Smith Conservative, Skipton and Ripon

Does the hon. Gentleman not agree that a mechanism is already in place, because David Anderson is conducting a review of the rules and regulations. In tabling the amendments, the hon. Gentleman has jumped the gun. Surely we have to wait for David Anderson’s report.

Photo of John Martin McDonnell John Martin McDonnell Labour, Hayes and Harlington

That is a valid point. I tabled the amendments to say that there is a sense of urgency. Something needs to be done now; some steps need to be taken immediately—before the Anderson review, to be frank.

I have raised this matter previously and engaged in dialogue with the Minister. I have a clutch of papers here, because I wanted to be sure of the accuracy of my remarks. I raised it way back on 22 July, in the debate on regulations made under DRIPA. The Minister responded in a letter received on 28 July:

“The Government…intend to bring forward amendments to the Acquisition and Disclosure Code of Practice to make this clear”.

What he was making clear was, I think, the importance of some form of understanding of the role of journalists and their sources, and therefore sensitivity in the approach taken. That becomes even more important now that in this legislation we are extending the range of the data to be collected. I take the point that this does not identify individuals, but on the information provided by Big Brother Watch and contained in the House of Commons research paper, the definitions have been narrowed. Big Brother Watch is concerned about

“the possibility of more personal information being accessed than first implied. … This means that the identity of an individual has the potential to be fully revealed by these powers.”

There is thus some uncertainty about how the powers could be used to drill down into the information to identify an individual and therefore a source and put everyone at risk.

I do not believe that the code has yet been published. I will give way to the Minister if he wishes to tell me.

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration)

I intend to address that point specifically when I respond to the debate, which I hope will be helpful to the hon. Gentleman.

Photo of John Martin McDonnell John Martin McDonnell Labour, Hayes and Harlington

I am never sure what it means when a Minister says that he is about to be helpful. He was helpful when I led a delegation from the NUJ with its lawyer to meet the civil servants who were drafting the new code of practice. We put some suggestions to them. I note—I am sorry to scramble around with these bits of paper—that the new code of practice on covert surveillance comes into effect on 10 December, and it covers legally privileged and confidential information. It demonstrates that particular care should be taken in cases in which the subject of the investigation or operation might reasonably expect a high degree of privacy or where confidential information is involved. Confidential information consists of communications subject to legal privilege, communications between a Member of Parliament and another person—the point that my right hon. Friend the Member for Knowsley raised—on constituency matters, confidential personal information or confidential journalistic material, so there is an element of reference to privilege and the role of journalists in other codes coming into force this week.

At this stage, it is critical that the code is published and implemented as quickly as possible, as a stepping stone to what might then come out of the wider review. I tabled an amendment to ensure that the legislation should not be implemented until the review is concluded, and I can argue that case. Hon. Members can see where I am coming from. I want a sense of urgency to give at least some protection to journalists in the interim before the review is published, which I believe it will be in a period of time that has been designated. I hope that the review will contain a recommendation that there should be some process in which the courts are involved. I do not believe that there will be sufficient protection against in-house decisions by any authority, be it the police, the intelligence services or, as we have seen with RIPA, local authorities and other agencies, which have used RIPA to investigate their staff, journalists and others on some of the most trivial grounds. In one instance, it was for the protection of the council’s reputation. I do not believe that in-house procedures would satisfy the general public or Members of this House. That is why I hope that some process will come out of the review which will involve the courts. My view is that there should be not just a review of the process but in some instances a review of the merits of the case itself.

I note that not just this review but a range of reviews are taking place. I also note that some momentum is building for involving the courts. The Deputy Prime Minister and—well, blow me—the Mayor of London have called for the law to be changed to require a judge to sign off applications involving the data of journalists. The Government would be wise, once the review is finished, to come forward with proposals that involve some form of judicial oversight of the process. That would build the confidence of professionals.

My hon. Friend the Member for Kingston upon Hull North raised the issue of other professions. I understand her particular example involving the medical profession, but that would be determined by a court. The merits of the case plus the process would be argued in such a case.

Since the revelations that a number of Members of Parliament have had our telephone calls with our constituents who are prisoners intercepted—tapped—there is now a greater sense of urgency to ensure confidence in the ability of certain professionals and others to maintain confidentiality. It is important that the Government give some serious attention to making recommendations to protect us all. Journalists can become extremely vulnerable if their sources are revealed, but so can MPs. That breakdown of confidentiality between an MP and their constituent can make us vulnerable to charges of collusion and other nefarious actions, so there is an urgency about this. We need imminent publication of an effective code of practice, and, I hope, once the review is published, imminent legislation to involve the courts in the oversight of the whole process. We have gone from RIPA to DRIPA to this Bill, which seems to be mission creep on the extension of data and communications powers.

Photo of Mark Field Mark Field Conservative, Cities of London and Westminster 3:15, 9 December 2014

I very much agree that we should be proud of the traditions of a free press in this country. The hon. Gentleman has not yet answered on the extent of journalism. I accept that new clause 1(6) is not exhaustive, but he has not mentioned religious counsellors, whom many would consider to have a similar duty of care. Does the hon. Gentleman have any thoughts on that, though I accept that he has not made an exhaustive list at this stage?


Photo of John Martin McDonnell John Martin McDonnell Labour, Hayes and Harlington

My right hon. Friend the Member for Knowsley says that my local parish priest rather optimistically describes me as a lapsed Catholic. The secrets of the confessional need to be included; otherwise, there might be an excommunication.

Mark Field makes a good point about journalism. I would like the definition to be membership of the NUJ, but there you are. These days, I would have the widest interpretation, but if it is to be contested, I would like to see a court make the decision on the basis of the evidence before it.

Photo of Alan Beith Alan Beith Chair, Justice Committee, Chair, Liaison Committee (Commons), Chair, Liaison Committee (Commons), Chair, National Policy Statements Sub-Committee, Chair, Justice Committee

It is important that we distinguish what we are talking about here—the protection of the conversations that take place between lawyers and their clients and between doctors and their patients, discovered by entirely different processes. We are looking at the identification of the person who tipped someone off or provided some information. There may be good criminal law reasons for finding out who that person is, but I agree that some kind of measure is needed to ensure that those who warn a journalist or perhaps a Member of Parliament that something serious is going wrong have protection.

Photo of John Martin McDonnell John Martin McDonnell Labour, Hayes and Harlington

Let me give one example of where RIPA was used. The case of Kirsty Green was in the evidence presented to the Home Affairs Committee by Michelle Stanistreet, the general secretary of the NUJ. Kirsty was a former regional newspaper journalist. Derby council spied on her meeting with local authority staff in 2009. Two Derby city council employees watched her when, as Derby Telegraph’s local government correspondent, she met four current and former council employees in a Starbucks coffee shop. The local authority said that RIPA was used to get surveillance authority for officials because they were protecting the council’s interests. The consequences for those individuals was a risk to their job in the local authority.

It is important that communication is protected, but names and sources also have to be protected, especially for whistleblowers, as we have seen when social workers have come forward in child abuse cases. The right hon. Gentleman makes the point well, but to me it emphasises even further the need for some judicial process in the oversight of access to the data and the way in which the legislation has been proposed.

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration)

We have had an interesting and informative debate focusing on the broader aspects of the ability of the law enforcement and intelligence agencies to do their job in a fast-moving environment where technology continues to change, and their ability to continue to protect us in those circumstances. I will argue that we have an eroding capability and although the measure will deal with one element, there is still more that we need to do. That is a point on which my hon. Friend Julian Smith has intervened on other speakers in the debate and he is right to make the point. I will come on to the possible next steps in the context of the various reviews that are taking place.

The gap was highlighted by Mr Howarth. I know that his Committee is looking carefully at the issue of privacy versus security. The need to strike a balance between them and some of the issues arising from that have rightly been played out in the context of interception, data retention and communications data. I look forward to the publication of the Committee’s report, which I expect to be extremely informative in this regard.

Photo of Mark Field Mark Field Conservative, Cities of London and Westminster

Without giving a preview of anything in the Committee report, I think it is important, for the benefit of the House and those Members who take the matter very seriously, that we should remember that privacy and security are not a zero sum game. Although my hon. Friend uses the word “balance”, as many of us do from time to time, there is also a sense that these are important safeguards individually and in their own right. One of the broader recommendations that we make from the evidence we took from a wide range of people is that the notion that there is a balance and a zero sum game should be dispelled.

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration)

I appreciate the comments of my hon. Friend. As a member of the Intelligence and Security Committee, he will recognise the challenges. He is right to underline the significance and to reiterate what I said on Second Reading—that security and liberty should be mutually reinforcing. His point about it not being a zero sum game is well made.

Diana Johnson who speaks for the Opposition identified a list of 10 points, and I will do my best to respond to some of them. John McDonnell underlined the role of sensitive categories of person and additional safeguards that may be provided in respect of them when we consider communications data and the ability of the police to request such data. As my right hon. Friend Sir Alan Beith pointed out, we are looking at metadata—who said what to whom, when and where—rather than the content.

It is clear from the contributions that we have heard that gaps in communications data capability have a serious impact on the ability of law enforcement and intelligence agencies to carry out their functions—the point that was made clearly by Mr Howarth and the shadow Minister. One such gap is internet protocol address resolution. The Data Retention and Investigatory Powers Act 2014 maintained our lawful data retention regime. It did not create any additional powers, nor did it address any of the gaps in capability. To respond to the point made by the hon. Lady, we remain confident about the manner in which it did that in seeking to address the points raised by the European Court of Justice.

Clause 17 amends that Act—DRIPA—to ensure that communications service providers can be required to retain the data necessary to link the unique attributes of an internet connection to the person or device using it at any given time. Every internet user is assigned an IP address to ensure that communications service providers know which data should go to which customer and route it accordingly. Addresses are sometimes assigned to a specific device, such as a broadband router located in a home or within the work environment, but they are usually shared between multiple users— hundreds or even thousands—and allocated automatically by the provider’s systems. Many providers currently have no business reason for keeping a log of who has used each address. It is therefore not always possible for law enforcement agencies accessing the data to identify who was using an IP address at any specific point in time.

The provision would ensure that these data are available to law enforcement. It would improve the ability of the police and other agencies to identify terror suspects who may be communicating with each other via the internet and plotting attacks. It would also help to identify and prosecute paedophiles, organised criminals, cyber bullies and computer hackers, and to protect vulnerable people. For example, it could be used to identify a child who has threatened over social media to commit suicide. The IP address has direct relevance to all these issues and it is evidence that can be brought before the court. In the context of the previous debate, it is often instrumental in bringing prosecutions. Communications data are used in about 95% of all serious crime prosecutions, so they have a direct utility.

Photo of Bob Stewart Bob Stewart Conservative, Beckenham

Just a question to the Minister—does this also apply to medical in confidence communication between, say, a doctor and a patient, and documents being intercepted, or am I totally out to lunch, as it were?

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration)

I am not sure that my hon. Friend would ever be out to lunch, particularly at 3.26 in the afternoon. I think he is talking about interception. The clause is about the connection, the metadata—about who communicated with whom—rather than the content of the communication. The hon. Member for Hayes and Harlington spoke specifically about interception and the way in which certain protected categories of individual may be affected. My hon. Friend highlights a specific point, but I will come on to communications data, DRIPA and the codes of practice, and the status of certain individuals in respect of requests that may be made for that information.

Amendment 5, as the hon. Lady explained when she moved it, seeks to limit the scope of the provision to the retention of data that is necessary to allow the identification of a user from a public internet protocol address. I am pleased to say that there is no difference of principle between us on this issue. It is important that this provision goes no further than necessary to ensure that communications service providers can be required to retain the data necessary to link the unique attributes of an internet connection to the person or device using it at any given time.

I can confirm that the provision is already limited in the way the Opposition propose. Subsection (3) defines the data to be retained as data that

“may be used to identify, or assist in indentifying, which internet protocol address, or other identifier, belongs to the sender or recipient of a communication”.

As such, any data that cannot be used to identify, or assist in identifying, the user of an IP address are already outside the scope of the provision. A requirement to retain the data may only be imposed where it is necessary and proportionate to do so.

On the hon. Lady’s specific point about web logs, I can assure the Committee that the Bill is already tightly drafted. In particular, clause 17(3)(c) excludes so-called web logs. It provides for the retention of data relating to IP resolution, and only such data. Anything else is already beyond the scope of what the clause permits. Accordingly, although I entirely agree with the sentiment behind the amendment, I do not believe that it is necessary.

The hon. Lady sought to look at some of the broader issues on definition, so perhaps this is an appropriate point to respond to some of them. She asked about the definition of “identifier”. We have said that that might be the IP address or another identifier, such as a MAC—media access control—address, which might be needed to specify the relevant identity, which is why the clause is drafted in that way. It is also intended to ensure that the provisions are technology neutral. “IP address resolution” is not a technical or legal term; it is a phrase commonly used to describe the process of attributing an internet connection to an individual or device. That process can require a number of different pieces of communications data of different types. None the less, the Bill carefully defines what it is intended to cover. I want to reassure her in that regard.

I will try to answer the hon. Lady’s 10 specific questions with the information I have in front of me, but if I miss any I will reflect on the Hansard report of this debate and write to her with any information she is seeking. She asked for a list of the data types in the Bill. It is important that the legislation is technology neutral, and spelling out a detailed list of data types that could change over a short period would not make it future-proof. The Government made it clear during the scrutiny of the draft Communications Data Bill that any long-term replacement legislation must be technology neutral so as to keep pace with technological change in the communications industry. That remains the case.

The hon. Lady will be well aware of the review that David Anderson is conducting, which is due to report next May. She will also know that, as per the discussions we had on DRIPA, the Bill is time-limited to December 2016. Indeed, she will note that the provisions in clause 17 are time-limited to December 2016, for the very reason that the House will need to return to these matters in the next Parliament. I think that is right and proper, so that the issue can be considered in the round and in the light of the different reports, including the ISC report, David Anderson’s report and the Home Affairs Committee’s report, which was published in the past few days, in order to inform a measured, proper debate in the next Parliament on these issues, recognising the speed at which DRIPA was brought before the House and, equally, to ensure that the legislation remains in the right place.

Photo of George Howarth George Howarth Labour, Knowsley 3:30, 9 December 2014

I have a suggestion. Where a situation is changing rapidly, such issues are sometimes dealt with in legislation by adding a schedule that can then be updated by order. It is not necessarily the best way, but it is one way of dealing with that type of situation.

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration)

I recognise that in certain circumstances that might be appropriate, but the challenge in this case is the fast-paced nature of technology, which means we would always be playing catch-up. The original RIPA legislation was therefore intended to be technology neutral so that, if the technology moved on, it was still able to capture that, just as our criminal law is intended to cover all forms of communications. I think that might be a better way of seeking to achieve that. However, that is part and parcel of David Anderson’s review of RIPA, and therefore the existing legislation and a number of the themes that have been touched on by right hon. and hon. Members in this debate, and also the continuing utility of these provisions.

Photo of Julian Smith Julian Smith Conservative, Skipton and Ripon

It will be almost two years since the Liberal Democrats and one or two other Members scuppered the Communications Data Bill. What is the Minister’s assessment of the risk of waiting until next year, because my concern is that the enemy is not going away?

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration)

This issue is not going away, and we need to make further changes. I can see the eroding capability of our law enforcement and security agencies. While this plugs an element, there is still more to be done to ensure that our police and security services are able to protect us, and that there is evidence that can be presented in court. On these issues relating to communications data, we are talking about evidence, not merely intelligence. These are hard pieces of information that can be presented in court to secure prosecutions. This is really essential because of the underpinning that it provides to our prosecutorial system.

The Bill does not incorporate provisions on weblogs, but apps and weblogs can be directly instructive in this respect, and the House will need to confront that in, I hope, an informed way. The reviews that the Intelligence and Security Committee and David Anderson are undertaking will inform that debate rather than its being completely informed by belief or emotion, important as those elements are to ensure that it is properly reflective of the view of our communities and the public. We must ensure that the facts are there as we examine the picture, in order to provide the basis for a rational debate when the House considers the legislation it will need to pass before December 2016.

Photo of Mark Field Mark Field Conservative, Cities of London and Westminster

Does my hon. Friend accept that another issue, which was skilfully outlined by John McDonnell, is arbitrage, in the sense of authorities being able to choose one piece of legislation rather than another—for example, as he said, RIPA rather than PACE? Given the complications arising from there being more and more legislation in this area, is it not almost essential to move towards a consolidation to ensure that we entirely understand our rights and responsibilities?

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration)

I am sure that that issue will be presented in representations made to David Anderson as part of his examination. Clearly, none of us will wish in any way to prejudge the way in which that evidence is presented. He intends to report back by May. That is the right timing to ensure that the new Parliament after the next general election has the benefit of seeing his report, which will have examined these issues in close and careful detail.

The hon. Member for Kingston upon Hull North asked about the role of the interception of communications commissioner. He will oversee the acquisition of data retained under clause 17, just as he oversees the acquisition of all communications data retained under DRIPA. The Home Office will ensure that he has the necessary resources to discharge his function.

The hon. Lady referred to multiple requests for traffic and subscriber data. Public authorities can request communications data only when it is considered necessary and proportionate for one of the purposes set out in DRIPA. A communications service provider could disclose only data that have been requested. It is an operational matter for the public authority as to how it makes such requests for data. Where it holds limited information at the outset of the investigation, it is likely that it will need to make more than one request, which means there may be multiple requests relating to a particular criminal inquiry.

The hon. Lady highlighted the issue of costs. The totals that were put into the impact assessment published alongside the Bill were based on studies of IP resolution conducted by the industry and prior work with service providers and the industry on similar projects. This has been an informed process in which there has been consultation with individual service providers likely to be most affected by the provisions of the Bill.

I am grateful to the hon. Lady for tabling new clause 2 to highlight the oversight of the acquisition of communications data retained under these provisions. The data retention regulations passed earlier this year specifically require communications service providers, subject to a data retention notice, to retain data in such a way as to ensure that they are available without undue delay in response to requests. I assure the Committee that in the vast majority of cases, data retained under this obligation are disclosed in a timely fashion. Of course, things may not always work perfectly, but there are systems in place that seek to resolve such issues should they arise. Indeed, there are industry groups that work on precisely that. The law enforcement community works closely with the communication service providers, and the Home Office seeks to establish the best technical solutions to support that.

The issue that we hear about more often than that highlighted by the hon. Lady is the broader one of key categories of communications data which communication service providers do not currently retain and which are therefore unavailable to the law enforcement and security agencies that require them. The hon. Lady raised the issue of additional regulations. The provision amends the definition of “relevant communications data”. The regulations use that definition, so there is no need to amend further or to put it in other regulations, because the intention is that they will follow the change being made to this Bill.

On deep packet inspection, no solution will provide for the retention of or access to the content of a communication. Obviously, it is for the companies themselves to decide how best to implement the legal requirements that would be put upon them, but I wanted to make that point clear.

On compatibility with the European Court judgment, we are confident that the legislation passed by Parliament this summer, and this Bill, are fully compliant with all relevant legal provisions.

Although I share the Opposition’s wish to see the most efficient and timely provision of data, I do not believe that the special review proposed by new clause 2 is required. Indeed, if there are concerns they can be referred to David Anderson as part of his review. With that assurance, I hope the hon. Lady will be minded to withdraw her amendment.

In new clause 1, John McDonnell raises the specific and important issue of the position of journalists and others in relation to sensitive provision. He and I debated the issue when the Data Retention and Investigatory Powers Act 2014 made its way through Parliament this summer. Let me be clear that a free press is fundamental to a free society, and the Government are determined that nothing be done to put that at risk. Although most of the focus in the debate has been on journalists, the same issues arise equally in respect of other sensitive occupations, as Members have highlighted. Individuals should be able to speak freely and frankly to their lawyers if we are to have justice in this country. Similarly, patients must be able to speak freely to doctors, and constituents to their Members of Parliament.

I do not believe that anyone would question that those are important principles, but equally I hope that no one would take issue with the proposition that our law enforcement and intelligence agencies need the tools to carry out their vital roles. They carry out a difficult job day in, day out, protecting the public from crime and from terrorism. The Regulation of Investigatory Powers Act 2000 provides a clear legal basis for many of their critical investigative powers, including the acquisition and disclosure of communications data. The current process is clear and accountable and includes a strong and rigorous system of oversight. I have already explained what communications data are, but they do not contain the content of the communication.

I should like to point out that the interception of communications commissioner has said that communications data

“do not contain any details of what was said or written by the sender or the recipient of the communication. As such, the communications data retained by CSPs do not contain any material that may be said to be of professional or legal privilege—the fact that a communication took place does not provide what was discussed or considered or advised.”

The point that the data do not attract any form of legal or professional privilege is important. Nevertheless, the Government recognise that they are sensitive data that need to be protected accordingly.

The process of acquiring communications data requires a designated person—a senior officer of a rank stipulated by Parliament—to examine applications for such data, which can be authorised only when the officer is fully satisfied that it is both necessary and proportionate to acquire those data. The applications are facilitated by individuals known as single points of contact, who are trained in this area and can provide expert advice and support to the designated person.

During the passage of DRIPA, the Government made it clear that they would fortify the already rigorous regime, including by strengthening the requirement for the designated person’s independence from the operation for which data are needed. We have also made it clear that new requirements will deal with the very area—those in sensitive professions—covered by new clause 1. Designated persons will have to give extra consideration to a communications data request involving those in professions with duties of confidentiality, such as journalists, and records must be kept of such applications.

The changes will be made in an updated acquisition and disclosure of communications data code of practice. I can announce to the Committee this afternoon that we are launching a consultation on the draft acquisition and disclosure of communications data code of practice and on the draft retention of communications data code of practice. I will put copies of the drafts in the Library of the House. There will be a public consultation on the codes before they are finalised for approval by the House. To reassure the hon. Member for Hayes and Harlington, and to meet the commitment I made to him during the passage of DRIPA, we are now consulting on the codes to ensure that they are properly considered and assessed.

I have dealt with DRIPA and existing provisions under the Regulation of Investigatory Powers Act, but what the hon. Gentleman is suggesting goes further and therefore touches on broader issues. A system of judicial authorisation was considered in significant detail by the Joint Committee on the draft Communications Data Bill. Its view was that

“the current internal authorisation procedure is the right model.”

It went further, stating that it was

“not convinced that in reality a magistrate would provide a tougher authorisation test than the current system. Magistrates would not have access to the SPoC expertise to advise them on the necessity and proportionality of each request.”

As Members will be aware, the Home Affairs Committee examined the very issue of access, under RIPA, to the communications data of those with duties of confidentiality, and it published its report on Saturday. The report includes recommendations about those with duties of confidentiality. The changes we make to the code of practice will reflect the substance of the Select Committee’s recommendations. Notably, the Committee did not recommend the form of judicial oversight suggested in new clause 1.

David Anderson, the independent reviewer of terrorism legislation, is reviewing the powers and capabilities needed under DRIPA, including communications data, and he is due to report by 1 May. As I have already highlighted, the Intelligence and Security Committee is also considering that very point.

The hon. Member for Hayes and Harlington will be aware that the interception of communications commissioner is conducting a separate inquiry on this matter. He will report back every six months. He is in the middle of an inquiry into police access to the communications data of journalists, and we fully support that inquiry. The commissioner has said that he expects to complete it by 31 January, which may help the hon. Gentleman. We will of course consider very carefully any recommendations made by the commissioner, and I am sure his conclusions will be studied by the whole House. Indeed, the timing of his report will inform our consideration of the consultation on the codes of practice. I can certainly assure the Committee that the Government will take any recommendations very seriously and, where appropriate, we will reflect them in the new code of practice.

Photo of John Martin McDonnell John Martin McDonnell Labour, Hayes and Harlington 3:45, 9 December 2014

I am grateful to the Minister for launching the consultation on the code of practice. It is important to have a balanced view of the Home Affairs Committee report, which concluded that

“RIPA is not fit for purpose”.

Although it did go so far as to make a specific recommendation on the involvement of the courts, the Committee suggested that

“the Home Office use the current review of the RIPA Code to ensure that law enforcement agencies use their RIPA powers properly.”

What action has the Minister taken on that point, bearing in mind that a legal action is also taking place at the moment?

Photo of James Brokenshire James Brokenshire Minister of State (Home Office) (Security and Immigration)

I am constrained in what I can say because of the legal action that the hon. Gentleman highlights, but I hope he will see that the code of practice and the consultation address a number of the key recommendations of the Home Affairs Committee report that was published on Saturday, such as those on the manner in which the existing legislation is operated in practice.

The hon. Gentleman will know that David Anderson is conducting a broader examination of the legislation, including the Regulation of Investigatory Powers Act, and will report in May. That will inform consideration in the next Parliament of the provisions that are on the statute book. I assure him that it will address the issue of separation and the need for additional consideration to be given to requests that touch on protected professions.

However, I would not want an amendment that was passed today to pre-empt the interception of communications commissioner’s inquiry. We do not know what he will conclude. It is right that we should wait for him to report and then consider his recommendations, rather than make a major change now, when questions have been raised about the benefits and utility of such an approach.

Finally, I hope to deal swiftly with amendment 11, which would prevent the provisions relating to IP resolution from being brought into force until the interception of communications commissioner had completed his review of the accessing of journalists’ communications data, to which I just referred. I think I can reassure hon. Members on that point. As I have said, the commissioner intends to report by the end of January. The Bill will not complete its passage through this House until after the Christmas recess. After that, it needs to go through the House of Lords and there might have to be consideration of Lords amendments in this House. Even without that, there seems to be no way the Bill could achieve Royal Assent before the commissioner reports at the end of January. We therefore do not believe that amendment 11 is required.

In the light of what I have said, I hope that hon. Members will not press their amendments.

Photo of Diana R. Johnson Diana R. Johnson Shadow Minister (Home Affairs)

I thank the Minister for going through all the questions that I posed. On the basis of what he has said, I happily beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 17 ordered to stand part of the Bill.