Only a few days to go: We’re raising £25,000 to keep TheyWorkForYou running and make sure people across the UK can hold their elected representatives to account.Donate to our crowdfunder
With this, it will be convenient to consider new clause 16—Review of Bulk Powers—
“Saving this section, Part 6 shall not come into force until—
(a) the Secretary of State has established an independent review of the operational case for bulk powers contained in sections 119 to 173; and
(b) the review has been published and a copy laid before each House of Parliament.”
New clause 16 is in my name and those of my colleagues. We come now to part 6 of the Bill; we are examining bulk warrants for the first time, and it is important that we take some time. Different types of bulk warrant are provided for in the Bill, and chapter 1 of part 6 deals with bulk interception warrants. We need to take time with these, because they are intentionally breathtakingly wide.
I remind members of the Committee that, as is set out in the code of practice, in contrast to targeted interception warrants issued under part 2, a bulk interception warrant instrument
“need not name or describe the interception subject or a set of premises in relation to which the interception is to take place”.
Chapter 1 also does not impose a limit on the number of communications that may be intercepted. For example, if the requirements of the chapter are met
“then the interception of all communications transmitted on a particular route or cable, or carried by a particular CSP, could, in principle, be lawfully authorised.”
That is directly from paragraph 6.2 of the code of practice. It gives a sense of how wide these bulk powers in the Bill are. When one has powers of such breathtaking width, there is a requirement for a high level of justification for their use, and I will come back after making some further preliminary points.
First, despite suggestions over the years that no enormous database would come into existence through the use of what, in truth, were bulk intercept warrants, it is now pretty clear that there is an enormous database, which is growing daily. Secondly, although it is right to say that bulk interception warrants are only authorised for overseas-related communications, the comfort we get from that is much more limited than might first appear. That is because, as the Joint Committee observed,
“given the global nature of the internet, the limitation of the bulk powers to “overseas-related” communications may make little difference in practice to the data that could be gathered under these powers.”
The ISC has confirmed that the Government considers that an “external communication” occurs
“every time a UK based person accesses a website located overseas, posts on a social media site overseas such as Facebook, uses overseas cloud storage or uses an overseas email provider such as Hotmail or Gmail—” or searches on Google. Any communication that involves those external communications comes within the provisions of a bulk interception warrant. I accept that it cannot be targeted at somebody in this jurisdiction, but as I have said, the comfort that that gives is much more limited than might at first appear when one reads the legislation.
Thirdly, the sheer breadth of these warrants, if they are not carefully constrained, is capable of frustrating any meaningful review of necessity and proportionality. Those tests need to bite on something meaningful when one has a warrant as wide as these bulk warrants are potentially and in practice.
It is right to acknowledge that David Anderson, the ISC and the Royal United Services Institute panel all recommended that bulk powers should be set out in legislation, and they now are. They are avowed. The Bill sets them out and puts a framework of safeguards around them. That is welcome; it is as it should be and in accordance with those recommendations. If the Bill passes, it will increase accountability in relation to the exercise of these warrants, which until now have been exercised under implied powers without the safeguards in the Bill. But—and it is a big “but”—this is the first time that Parliament has had the chance to scrutinise those bulk powers. The argument that they already exist and are already in use is no answer to the need for close scrutiny, because until now the House has not had the chance to scrutinise them.
The first step in scrutiny is to consider the operational case, which sets out the overall need for bulk powers. An operational case was published by the Government alongside the Bill, which is welcome, but it is inadequate. It is a 47-page document and much of it is purely introductory. On average, only five pages are allocated to addressing the capabilities for each bulk power. There are four pages for bulk interception, seven pages for bulk equipment interference, six pages for bulk communications data acquisition, and five pages for bulk personal datasets. Each power is supported by a handful of one-paragraph case studies. We understand that further material has been provided to the ISC, but no formal assessment of that material and no report of the ISC has been made available to the Committee, although of course we heard the comments of the Chair of the ISC on Second Reading. Incidentally, we will be writing to him to ask him to outline the general nature of that material and what formal assessment the ISC made.
The operational case that has been published is inadequate, for the reasons that I have set out, and lacking any independent evaluation, which was a recommendation of the Joint Committee. The Labour party has been pushing for that evaluation from the start of the scrutiny of the Bill; it is why we tabled new clause 16. We say to the Government that it is not too late to carry out the evaluation that has been called for for some time. New clause 16 is not intended to delete clause 119 or to suggest that there could be no justification for bulk intercept warrants, particularly since they have been used. The intention is to put down a marker in saying that part 6 will not come into force until the Secretary of State has established an independent review of the operational case for the powers in clauses119 to 173—that is all the bulk powers, which is why it is a new clause rather than an amendment to clause 119—and the review has been published and before each House.
I want to pick up on some of the specifics of the clause. In clause 119(4)(c) and (d) it is clear that a bulk intercept warrant authorises not just interception but examination within the interception. That is extremely important, because one of the arguments that I have sought to make consistently is that the wider the power to gather, harvest or hoover up communications or data, the greater the need for thresholds and careful safeguards when that material is accessed. Under (4)(c) and (d) the bulk intercept warrant provides not only for the interception of communications but for selection for examination—in other words, it deals with part 2 at the same stage as part 1, so it is important to pay careful regard to the safeguards in place. I will make the argument about safeguards when I get to clause 121, which sets out the necessity of the proportionality test; at this stage I am merely flagging up that we are talking about both the wider power and the access power and reminding the Committee that although there are some protections for the communications of those in the British islands, the protection does not extend to secondary data.
The only other point that I wanted to make at this stage relates to the code of practice, paragraph 6.12:
“Where a bulk interception warrant results in the acquisition of large volumes of communications, the intercepting agency will usually apply a filtering process to discard automatically communications that are unlikely to be of intelligence value.”
We saw last week express provisions for filtering arrangements in other parts of the Bill. As far as I can ascertain, there are no express filtering provisions in relation to bulk intercept warrants. For the record, what does the Minister say the power is for that middle exercise of filtering between the acquisition of the information and accessing it?
To be clear about how I think it is intended that that should work, the code of practice suggests later that what will happen in general, accepting that a huge volume of communications is likely to be affected by a bulk warrant, is that automated systems will be in place. On the scope of what we are talking about, paragraph 6.57 of the code of practice makes it clear:
“More than one operational purpose may be specified on a single bulk warrant; this may, where the necessity and proportionality test is satisfied, include all operational purposes currently in use. In the case of bulk interception, overseas-related communications relevant to multiple operational purposes will necessarily be transmitted and intercepted together under the authority of a bulk interception warrant. In the majority of cases, it will therefore be necessary for bulk interception warrants to specify the full range of operational purposes.”
That makes it clear that under one warrant, there are likely to be numerous operational purposes and a huge amount of data gathered. The idea that there will be one warrant for each operational purpose would be a misunderstanding of how the powers have been and undoubtedly will be used if the Bill is passed. It appears, from paragraph 6.59, that what will then happen is that
“automated systems must, where technically possible, be used to effect the selection in accordance with section 134 of the Act.”
There will be an automated filtering process.
These are very wide powers requiring close scrutiny and high levels of justification. Until there is independent evaluation of an operational case, the clauses should not come into force.
The Scottish National party has tabled leave-out amendments to the entirety of part 6. I sought the assistance of the Committee Clerks, to whom I wish to record my sincere and grateful thanks for their help over the last couple of weeks, on how to approach the amendments. It was suggested that I might press the question on stand part for the first clause of an objectionable part. For example, in chapter 1 of part 6, I could press the question on clause 119 and make my position abundantly clear, which might be a proxy for my objections to the whole part. Are you content for me to proceed in that way, Mr Owen?
To deal with clause 119, I must outline why the Scottish National party wishes the entirety of part 6 to be removed from the Bill until such time as a convincing case has been made for the use of bulk powers and the legality of bulk powers has been determined. In our view, it is important not to pre-empt the terms of court judgments in cases currently considering bulk powers, as they will have a significant impact on the lawfulness of the approach set out in the Bill, which at present must, at the very least, be open to question.
The Government have produced an operational case in response to remarks made by a number of witnesses before the Joint Committee on the Draft Investigatory Powers Bill, who were concerned about the lack of such a case, and to the Joint Committee’s recommendation 23. The Home Office published a 47-page operational case for bulk powers alongside the Bill. That document was produced within three weeks, and the first half of it is introductory, covering topics such as how the internet works and what the dark net is. Only the second half of the document, characterised as an operational case, addresses the capabilities with which we are concerned.
Going goes through the operational case, we can see that each power—bulk interception, bulk equipment interference, bulk communications data acquisition and bulk personal data sets—has an average of about five pages devoted to it. Bulk interception has only about four. Most of the material dealt with is already public in other explanatory documents. It seems that, despite the opportunity to provide concrete, solid examples of how bulk powers bring unique value, most of the material in each section is kept at a high and general level.
For example, the first three pages of the four-page case justifying bulk interception cover an introduction to the power, the current legal position and new safeguards in the Bill. The fourth and final page provides three one-paragraph case studies, which members of the Committee will all have had the opportunity to read. One in particular deals with counter-terrorism, giving an example of where the security and intelligence agencies’ analysis of bulk data uncovered a previously unknown individual in 2014 who was in contact with a Daesh-affiliated extremist in Syria suspected of involvement in attack planning against the west.
The case study says:
“As this individual was based overseas, it is very unlikely that any other intelligence capabilities would have discovered him. Despite his attempts to conceal his activities, the agencies were able to use bulk data to identify that he had recently travelled to a European country. Meanwhile, separate intelligence”— that is, separated from the bulk-generated intelligence—
“suggested he was progressing with attack planning. The information was then passed by the agencies to the relevant national authorities. They disrupted the terrorists’ plans and several improvised explosive devices were seized.”
Undoubtedly, every hon. Member on the Committee and in the House would wish such activities to be intercepted and prevented by the security services. I applaud the security services for the work that they do, but what concerns me is that analysing this case study in any meaningful way is challenging, because there is inadequate information to begin to test the accuracy of the case study or to challenge its conclusions. Nevertheless, I have had some initial analysis of it carried out, which suggests that perhaps the ends could just as easily have been achieved by the use of targeted interception. I will give a couple of examples to show why.
The case study refers to a previously unknown individual who was in contact with a Daesh-affiliated individual, who presumably was known. It is possible, therefore, that targeted interception may have uncovered this previously unknown individual. Although the Daesh-affiliated individual was already being monitored, there is no clear explanation in the case study of why bulk interception was necessary. It seems likely that intercepting the Daesh-affiliated individual’s contacts in a targeted manner might have identified the previously unknown individual.
That is just one of a number of issues raised about this case study by the analysis that I have had carried out. I will not take up the Committee’s time with them all, but that is one example.
The value that this case study has is that in this case a previously unknown individual was identified. Questions as to why targeted interception would not have worked are not addressed, nor are questions as to why other targeted capabilities were not used. The case study suggests that the initial identification is the only aspect in which bulk interception played a role, with the rest of the case study a result of other capabilities and separate intelligence. No information is provided about the scale of collateral intrusion undertaken when intercepting in bulk and there is no assessment of the proportionality of bulk interception. Also, given that the attack was not in the UK, there is no explanation of the necessity of UK agencies playing a role, although that is perhaps a slightly lesser consideration.
There is no information outside this case study as to the frequency of events of this kind or whether in similar cases different methods produced different results. As such, it is impossible to analyse it and make any kind of independent assessment of the necessity or proportionality of bulk power.
This is not nit-picking. These are very wide-ranging powers. The hon. and learned Member for Holborn and St Pancras, who speaks for the Opposition, described them as breathtakingly wide powers. They have never before been debated or voted on in this Parliament, and it is crucial that we get them right. We are debating and voting on them, at a time and in a climate whereby there is quite a lot of independent evidence available from the United States of America that suggests that bulk powers are not as efficacious as is suggested in the operational case produced by the Government.
I will say a little about what happened in the States, because it is important to loop to that to understand what the Scottish National party says would be the appropriate way to approach the production of an operational case to justify bulk powers.
In the USA, the Snowden revelations revealed that the National Security Agency was running a bulk domestic telephone records programme. The US intelligence community put forward strong arguments for keeping that programme going, and to bolster its position it compiled a list of 54 counter-terrorism events in which it said that section 215 of the USA Patriot Act, which underlined that bulk collection, contributed to a success story.
In America, two independent bodies undertook reviews related to those powers to determine whether the case studies put forward by the intelligence agencies were credible and accurate. They determined that only 12 of the 54 counter-terrorism events cited by the security services had any relevance to the exercise of bulk powers under section 215 of the USA Patriot Act. With access to classified material, one of the independent groups— the President’s Review Group on Intelligence and Communications Technologies, which is a very high-powered body set up under the auspices of President Obama—concluded:
“Our review suggests that the information contributed to terrorist investigations by the use of section 215 telephony metadata was not essential to preventing attacks and could readily have been obtained in a timely manner using conventional section 215 orders”.
The other body, the Privacy and Civil Liberties Oversight Board, concluded very similarly that the programme of bulk collection under section 215 had
“shown minimal value in safeguarding the nation from terrorism. Based on the information provided to the Board, including classified briefings and documentation, we have not identified a single instance involving a threat to the United States in which the program made a concrete difference in the outcome of a counterterrorism investigation. Moreover, we are aware of no instance in which the program directly contributed to the discovery of a previously unknown terrorist plot or the disruption of a terrorist attack.”
I quote those two bodies because they are independent.
I am aware that Mr William Binney, who previously worked for the National Security Agency, gave evidence to the Joint Committee. His evidence could be summarised as “bulk powers cost lives”. He is concerned about the “needle in a haystack” argument. I am aware from previous discussions that certain members of the Committee have concerns about the evidence of Mr Binney. Even if we set his evidence to one side, we cannot set to one side the evidence of those two very high-level, independent American committees that looked at bulk collection in the USA. Their conclusions seriously question the information they were given by the security services that the bulk powers were necessary to prevent terrorist outrages. They also made suggestions on existing targeted capabilities.
We have the analysis by David Anderson of the efficiency and efficacy of bulk powers, and he talks from paragraph 7.22 onwards about the importance of bulk powers. For example, he states:
“GCHQ explained that its bulk access capabilities are the critical enabler for the cyber defence of the UK, providing the vast majority of all reporting on cyber threats and the basis for counter-activity.”
I cannot gainsay that. I am well aware that David Anderson would not go as far as I am going in these submissions. He has reached the conclusion that some bulk powers are necessary, but the passage in his report that the hon. and learned Lady quotes basically starts with a phrase along the lines of “GCHQ has assured me”. My point in drawing Members’ attention to what happened in the USA is that, although the US security services compiled a list of 54 counter-terrorism events in which they said bulk powers had contributed to a success story, one of the two committees I have quoted reached the view that it could not identify a single instance where bulk powers had contributed to a counter-terrorism success story. There is a debate to be had here.
David Anderson goes on, in the same section of his report, to acknowledge that it is difficult for the public to take examples on trust. He recognises the limitations of what was shown to him, but states:
“The six outline examples at Annex 9 to this Report go a little way towards remedying that defect. They illustrate the utility of bulk data capabilities more generally”.
He recognises the limitations, but still acknowledges the efficacy of the powers.
The hon. and learned Lady makes a good point. David Anderson acknowledges the efficacy of the powers and has been privy to certain information as he has a high security clearance. Not all of us can be privy to that information. I am suggesting that there should be an independent evidence base for the bulk powers. That would involve independent assessors with high security clearance undertaking forensic examination of the necessity and effectiveness of the bulk programmes.
We know, because the Home Secretary has told us—there was an interesting article about this in The Guardian today—that the bulk powers have been running for a long time. The headline of the article is, “UK spy agencies have collected bulk personal data since 1990s, files show”.
I will come back to that article in a moment, but we know that the bulk powers are operational. Given that they have been running for a while, a full list of cases where they have been required should be easy to provide. That should not be to this Committee, but to an independent review staffed by high-level individuals with the highest security clearance—the sort that David Anderson has. I have in mind such people as retired judges and retired professionals with an interest in the area.
I do not want to paint this too simplistically—the purpose of the Bill, as I understand it, is to pull together a lot of existing things under one statute—but we all have fire insurance policies on our homes. We do not want to claim on those policies, but it is important to know that they are there in case we need them in an emergency. That is exactly what all these powers are there for. We need to ensure that the kit is there for our agents to use to keep us safe.
These powers are not being used only in emergencies. That is the point. We are told that the powers are being used daily and that those data are being sucked up and collected daily, and the Bill seeks to put that on a legal footing. I am saying that there is not sufficient independently assessed evidence to justify the continuation of such powers and that we need a proper independent review.
I am suggesting that there should be independent, security cleared assessors to consider whether such powers pass the legal tests of necessity and proportionality. They would need to conclude that the powers were strictly necessary and that the same results could not be achieved using more proportionate and less intrusive means. The two American committees I mentioned concluded that the same information could be achieved using more proportionate and less intrusive means, so we in the United Kingdom should not legislate gung-ho for the continuation of such breathtakingly intrusive surveillance powers without being certain that they are necessary and proportionate. We do not have sufficient evidence to reach that conclusion.
What does the hon. and learned Lady think the independent reviewer of terrorism legislation is for, other than to review these powers? He reviewed the powers in his report.
I do not accept that the independent reviewer has carried out the exercise that I am suggesting. He fulfils a particular function, and we are talking about setting up a panel of individuals to consider the necessity and proportionality of these powers. They could consider in detail certain information that we, as hon. Members, would not be able to see. David Anderson is one individual who fulfils an important function and whose work has greatly assisted everyone on the Committee, and all hon. Members, in trying to understand what underlies the Bill.
The hon. and learned Lady is asking the Committee to attach less weight to David Anderson’s review, as my hon. and learned Friend the Member for South East Cambridgeshire said, and inviting us to prefer the evidence of Mr Binney, a whistleblower whose evidence was clearly out of date, because the last time he was security cleared was 2001.
Forgive me, but the hon. Lady was out of the room when I said that I am not asking the Committee to look at Mr Binney’s evidence. I am asking the Committee to look at the evidence of the US President’s Review Group on Intelligence and Communications Technologies and of the Privacy and Civil Liberties Oversight Board, which led to the repeal of section 215 and its replacement with the USA Freedom Act. I am not asking the Committee to look at Mr Binney’s evidence; I am asking the Committee to consider and take into account the background of two high-level independent US reports—the USA is our closest ally—that found that similar bulk powers are not necessary or proportionate.
I will not be side tracked by a suggestion that I am criticising David Anderson, because I am not—I make that absolutely clear. His review, “A Question of Trust”, was published prior to the Joint Committee of these Houses saying that a sufficient case has not been produced for bulk powers. David Anderson’s report was taken into account by the Joint Committee. I know that some members of this Committee, including the hon. Member for Fareham, sat on the Joint Committee, and one of its conclusions, recommendation 23, was:
“We recommend that the Government should publish a fuller justification for each of the bulk powers alongside the Bill. We further recommend that the examples of the value of the bulk powers provided should be assessed by an independent body, such as the Intelligence and Security Committee or the Interception of Communications Commissioner.”
The Joint Committee said that in the full knowledge of David Anderson’s report, having read and considered it. My point is that such operational case as has been produced by the Government does not live up to the Joint Committee’s recommendation 23, and does not adequately provide an operational case for the powers.
I know that this will disappoint the Committee, but I shall try to reduce the length of my peroration by making two things clear by way of an intervention. First, David Anderson was clear in evidence to this Committee that further review was not necessary. Actually, I am not unpersuaded by the argument for some process, although the hon. and learned Lady is doing a good job of changing my mind. Secondly, the Joint Committee was extremely clear that we would benefit from the ISC’s conclusions, and the ISC said that the powers are necessary, so I do not understand on which journey the hon. Lady is travelling, or to which destination.
“Though I seek to place the debate in a legal context, it is not part of my role to offer a legal opinion (for example, as to whether the bulk collection of data as practised by GCHQ is proportionate). A number of such questions are currently before the courts, which have the benefit of structured and opposing legal submissions and (in the case of the IPT) the facility to examine highly secret evidence, and which are the only bodies that can authoritatively determine them.”
There we have the words of the man himself. Although David Anderson seeks to place the debate in a legal context, he does not see it as part of his role to offer a legal opinion on the proportionality of GCHQ’s bulk collection of data. At least two cases now before the courts will result in judgments on whether the powers are proportionate.
If the hon. and learned Lady reads the next paragraph, she will see that David Anderson is simply making a broad statement about the fact that he is not giving legal advice generally. He is putting forward recommendations for Parliament to consider.
Indeed; he is putting forward recommendations. I am advocating an independent review looking at the operational case for bulk powers. It would look at whether the powers are necessary and proportionate, and it would provide an opinion that could then be laid before both Houses, for us to see if the Government’s case has been made. I am concerned that the case is not sufficient at the moment. I say that against the background not of Mr Binney’s evidence, but of the findings of high-level USA investigatory bodies.
I hesitate to advise an advocate on the construction of her argument, but the hon. and learned Lady would do better not to cite David Anderson and pray him in aid, because he told this Committee on
“not persuaded of the case for” an additional independent review of bulk powers, as
The quote from David Anderson that she is using comes from the very beginning of his report, in which he sets out his general approach to his work. In an effort to make her an even more accomplished advocate than she already is, my advice would be to drop Anderson from her argument.
With all due respect, hon. Members sitting behind the Minister brought up David Anderson; I made it clear that I accepted that David Anderson had reached a different view from mine on bulk powers, but I read from his report to make the point that an early stage in it, he says that it is not his objective to give a legal opinion on the legality of the bulk collection of data.
Those of us who sat through David Anderson’s evidence in Committee on
I am not persuaded by the argument that the United Kingdom Parliament should make United Kingdom law based on what some Americans whom we have never met or spoken to have said. The first duty of Her Majesty’s Government and of parliamentarians is surely to help keep our citizens and constituents safe. If we take that as our first point of principle and duty, and if the powers that are to be enshrined in the Act can fulfil that need, either now or in future, I fail to see why the proposals would cause such offence.
I am glad to hear that the hon. Gentleman does not want the Americans to tell the British how to run their affairs. In very much the same way, I do not want the British establishment to tell Scotland how to run its affairs. We can have that argument another day—
I think the hon. Gentleman will find that the argument is alive and kicking north of the border, but we digress.
I can reassure the hon. Member for North Dorset that I have no intention of following the United States of America’s security policy. We should devise our own policy in the United Kingdom, so long as it remains the United Kingdom. I am saying that we should set up an independent review body, made up of people from the United Kingdom—not the Americans or French; let us not panic about the French or the Americans telling us what to do. I am suggesting that our own people, if I may use that phrase, should be on the body. I mentioned the American experience to show that our key ally in such matters has, as a result of two very high-level congressional committees, reached the view that bulk powers are not justified. That is my point; it is not that we should do what the Americans tell us to do. I can assure the Committee that that is far from being the position of the Scottish National party. My point is that we should look to the experience in other countries to inform our decision making.
The hon. and learned Lady is being customarily generous with her time, and robust in her argument. I do not envy her her position one jot or tittle. If she were saying—without saying it—that she had a fear that spooks out there were doing nasty and horrible things, and that it was our job to try to constrain them, I could understand some of the line of her argument, but I do not think she is saying that. I am therefore not entirely sure, in practical politics, what would be added by the creation of the body she advocates. I am confident that we have security services and others who act within the rule of the law.
I am afraid that the hon. Gentleman’s confidence is somewhat misplaced, given the revelations today in a collection of more than 100 memorandums, forms and policy papers obtained in the course of a legal challenge on the lawfulness of surveillance. An article in The Guardian today says that the papers demonstrate that the collection of bulk data in the United Kingdom
“has been going on for longer than previously disclosed while public knowledge of the process was suppressed for more than 15 years.”
According to the article, The Guardian has surveyed the paperwork, which shows that the
“frequency of warnings to intelligence agency staff about the dangers of trespassing on private records is at odds with ministers’ repeated public reassurances that only terrorists and serious criminals are having their personal details compromised…For example, a newsletter circulated in September 2011 by the Secret Intelligence Agency (SIS), better known as MI6, cautioned against staff misuse.”
That internal newsletter said:
“We’ve seen a few instances recently of individuals crossing the line with their database use…looking up addresses in order to send birthday cards, checking passport details to organise personal travel, checking details of family members for personal convenience”.
The internal memo goes on to say:
“Another area of concern is the use of the database as a ‘convenient way’ to check the personal details of colleagues when filling out service forms on their behalf. Please remember that every search has the potential to invade the privacy of individuals, including individuals who are not the main subject of your search, so please make sure you always have a business need to conduct that search and that the search is proportionate to the level of intrusion involved.”
It adds that, where possible, it is better to use “less intrusive” means.
The papers also reveal that there has been disciplinary action. The article states:
“Between 2014 and 2016, two MI5 and three MI6 officers were disciplined for mishandling bulk personal data. Last year, it was reported that a member of GCHQ’s staff had been sacked for making unauthorised searches…The papers show that data handling errors remain a problem. Government lawyers have admitted in responses to Privacy International that between
I quote that article because it shows that the security services themselves admit that there is sometimes internal breaking of the rules. We should not scoff; these are the personal data of our constituents. As parliamentarians, it is part of our duty to protect their privacy and to make sure that the powers that we vote to the security agencies do not go further than necessary and compromise our constituents’ privacy and the security of their data.
I fear that the hon. and learned Lady may be slightly over-egging this particular pudding. I read the article this morning in The Guardian. She has cited, perfectly properly, the two operatives who were found to be in breach, disciplined and then dismissed. I politely suggest to her that probably quite a lot of the figures that she quoted refer to the fact that agent X could not remember Auntie Doris’s postcode and checked it because he wanted to send her a get well card. It is hardly “Enemy of the State”.
It may not be, but it is an indication of how easy it is for people to abuse the rules, and an indication that the rules are abused. I am not seeking to impugn the security services. I am seeking to draw the attention of members of the Committee and the public to the fact that the rules are sometimes abused. If we are to afford the security services generous and intrusive powers, we have to be sure that they are proportionate and necessary. My point is that we do not have sufficient evidence that they are.
I am conscious that I have taken up quite a bit of time with that submission. I will not take it any further. I have alluded to the fact that there are outstanding legal challenges, and I will make one or two more comments on clause 119. I have already made the point that the clause seeks to put bulk interception programmes that are already in operation on a statutory footing. They were disclosed for the first time by Edward Snowden in June 2013, and their existence has now been avowed by the Government. They have never before been debated or voted on by this Parliament. That is why I am taking my time with this point.
The approach that has been held to date is maintained in the clause. The bulk interception proposed by the clause will result in billions of communications being intercepted each day, without any requirement of suspicion, or even a discernible link to a particular operation or threat. I have information from Liberty that the agencies currently handle 50 billion communications per day. To put that in context, there are only 7 billion people in the world, and only 3 billion of them have access to the internet.
The Intelligence and Security Committee reported at the end of 2014 that there were just 20 warrants in place under section 8(4) of RIPA authorising this vast volume of interception. It is clear from the wording of the clause that although it purports to collect overseas-related communications, it will, for the reasons the hon. and learned Member for Holborn and St Pancras gave, collect the communications of persons who are resident in the United Kingdom. Internet-based communications have eradicated the distinction between external and internal communications. He told us that posts on social media sites overseas, such as Facebook, use overseas cloud storage, so the material there would be covered by clause 119.
Searches on Google are counted as an external communication. I do not know about other hon. Members, but I must do at least a dozen searches on Google per day. Those are external communications, even though I am a citizen of the United Kingdom. Be in no doubt: the handful of warrants that will be issued under this clause will be scooping up billions of communications by the United Kingdom’s citizens. Those communications will then sit somewhere and certain people in the security service will have unwarranted access to them. There are some people who do not respect the rules, as we know from the disclosures in The Guardian today, so there is that concern, as well as the concern about the security of the data. The vast majority of those communications that will be scooped up will be the communications of innocent people.
Does the hon. and learned Lady not accept that the primary object of the security services is to prevent crime—serious crime—and that is exactly what this measure is doing?
Of course I do, but to give some comfort to the hon. Gentleman, who has a distinguished career in law enforcement behind him, I worked for many years as a senior prosecutor with the Crown Office and Procurator Fiscal Service in Scotland, so I am fully aware of the public duty of the security services and law enforcement agencies to prevent serious crime. However, I am also aware of the duty of parliamentarians to protect their constituents and to ensure that surveillance powers are proportionate and necessary. My point is that the Committee and this House do not have sufficient evidence at present to justify these breathtakingly wide powers, and that is why the Scottish National party wishes that part 6—
I am sorry the hon. Gentleman is not persuaded, but I think others outside this room will be. It is important that somebody voices these very serious considerations while the Government attempt to railroad this legislation through the House. This is not right, and my party will not hesitate to hold the Government to account for it, not because we are troublemakers, but because we are a constructive Opposition. Having the responsibilities of a constructive Opposition, we have looked at what is happening in other countries and at their experience, and we do not consider that this degree of surveillance of our constituents’ and British citizens’ personal communications has been justified as proportionate and necessary.
We are not saying that the security services should not have any powers. We have a nuanced approach to the Bill. Members of the Scottish National party did not sit on their hands and do nothing on Second Reading; we made a constructive contribution to the debate. However, I will not be dissuaded from holding these very serious concerns. They are not just my concerns; they are widely held, and there is strong evidence from one of our closest allies that they are well founded.
Nor should the hon. and learned Lady be doing anything other than what she is. She is fulfilling her role in an exemplary fashion, and I mean that in a sincere and heartfelt way. The one thing I would challenge her on—or ask her to substantiate—is this. We have had Joint Committees and all the other organisations having a look; we had a very thorough debate on Second Reading; we had a full day’s debate on the Anderson report back in July last year; and now we have detailed, line-by-line scrutiny of the Bill, and I think we will have two days on Report. I ask whether she used the word “railroad” in haste, and whether I could invite her to reflect on its use and perhaps recast her comment.
I will not recast it. I gave very detailed reasons on Second Reading as to why I felt that the Bill was not being given sufficient time. I am aware that hon. Members may feel that I have held the floor for too long; I have spoken at some length, but this is hugely important. Many people across these islands are very concerned about this part of the Bill—ordinary citizens, corporate entities—and we are not giving it enough time. There is not enough time to discuss its detail. I have taken up about 40 minutes giving just an overview of why I oppose part 6. I could have a go at every clause, but I will not do that, because we would be here forever and we have limited time, so I will draw my comments to a conclusion. The Scottish National party’s position is that each and every clause of part 6 should come out of the Bill until such time as there has been a proper independent review and a proper operational case has been made for these powers.
The hon. and learned Member for Holborn and St Pancras, who speaks for the official Opposition, spoke, not untypically, with welcome brevity and a palpable understanding of these issues, but the hon. and leaned Lady took us on a seemingly interminable journey to a place that is somewhere between intuitive hostility to these powers and confusion—a murky place that I do not want to spent too much time in. Some of the things she said warrant a response, because it seems to me that they were founded on a misunderstanding— I put that as generously as I can—of the use of the powers, their purpose and the safeguards that pertain in that regard.
Let me be clear: a Google search by a person in the UK is not overseas-related. Clause 119 deals with overseas-related communications. Warrants must be targeted at overseas communications. That will provide strong protections for people on these islands.
The ISC privacy and security report concluded that it is unlawful for GCHQ to conduct indiscriminate interception. It is also impractical for it to do so. The hon. and leaned Lady must understand, as most members of this Committee do, that it would be impossible, undesirable and unnecessary for GCHQ to deal with all but a fraction of internet communications. The peculiar view that somehow those missioned to keep us safe are interested in a whole range of communications that bear no relation whatever to their task is—again, I am trying to measure my words carefully—unusual. I say that because it is certainly not the view of the vast majority of people in this country, who want those so missioned to have the powers necessary to guard us against very real threats.
The hon. and leaned Lady spoke, quoting the hon. and learned Member for Holborn and St Pancras, of breathtaking powers. I shall come to that in a moment. She needs to understand that the threats we face are equally—actually, I would say far more—breathtaking. Unless we equip those in the security and intelligence services and the law enforcement agencies with what they need to do their job, we will pay a very dear price indeed. That is what bulk powers are about.
The collection of large volumes of information through bulk powers and the use of those data are essential. Of course they have to be filtered, and search criteria must be applied, so that fragments of intelligence can be gathered and pieced together during the course of an investigation. This is, in essence, about establishing patterns of behaviour and confirming networks. That is what GCHQ is about. Unless we collect those large volumes of information, we cannot move to the targeted regime that the hon. and leaned Lady seeks. Through a mix of misunderstanding and misjudgment, she is making an unhelpful case to those of us who want the safeguards to be as sure and certain as they need to be; I entirely take the point about “need”.
I will return to the hon. and learned Lady in a moment in my exciting peroration, but I want to deal with the hon. and learned Member for Holborn and St Pancras, who made a very interesting short contribution. He rightly distinguished between collection on the one hand and access and examination on the other. Much of the focus of those who are least well informed about this subject is on collection, but it is access and examination that really matter, so we should place an emphasis on ensuring that examination of data is based on the very best reasons. He argues that the existing means by which we test the operational case for doing what we do could be improved. I will not say too much more about that today, but I will say this: he is right that it is important that there is certainty about the operational case. I know that he is sensitive to the amount that can be published—we are by nature dealing with highly sensitive material—and, as he freely acknowledged, we have gone some way down this road in publishing the operational case for bulk alongside the Bill. It is, though, reasonable to pose the question whether more could be done.
The ISC plays an important role in these matters, and the hon. and learned Gentleman acknowledged that the Chairman of the ISC made it clear on Second Reading that he was convinced by the information that was made available to him in his special role that these powers were necessary and exercised proportionately. The Joint Committee on the draft Bill looked at these matters and, as my hon. Friend the Member for Fareham pointed out, also made it clear that it understood that bulk powers were important for the work of our security services, as I have said. But there is a case for looking at these matters carefully and, despite listening to the speech of the hon. and learned Lady, I am not by any means dissuaded from that case. She was taking me to that place, but fortunately from the perspective of those who want to get this right, I did not quite get there.
I remain open to argument about this issue. I will say no more than that at this juncture. It is important that we make a robust case for bulk powers, and the best way of doing that is to be certain about the operational case, as the hon. and learned Gentleman suggested. There is also a debate to be had about safeguards, but, as he said, they are dealt with later in the Bill. No doubt we will have a short debate about them as well. It is important that we recognise that those safeguards are fit for purpose. They are clear that information that is not pertinent to the needs of the security services must be discarded, they are clear about the limits of the criteria under which searches take place, and they are clear about the content and secondary data that are obtained accordingly and what can and cannot be used. Nevertheless, we should explore and examine those matters.
The hon. and learned Gentleman also drew attention to filtering. It is important that data are filtered before they are obtained by a public authority. No provision expressly requires the filtering of data once they are obtained, but the code of practice sets out specific provisions in respect of filtering. We can have a further discussion about that if the Committee wishes.
I was thinking of Ruskin when the hon. and learned Lady was speaking. I often think of Ruskin, as you know, Mr Owen. Ruskin said that
“endurance is nobler than strength, and patience than beauty”.
On that basis, she tested my nobility to its very limit.
There is a clear difference on this subject in the Committee, and I suspect—I do not want to assume too much—that it is the difference between those parties that are in government, have been in government or aspire to be in government in this House, and those that are not, have not been or do not aspire to be. If that is a little unkind, I hope you will forgive the unkindness, Mr Owen—
It has been a while since I have been so extensively and excessively patronised. The right hon. Gentleman says I tested his abilities to the limit—to such a limit that he has not made any effort whatever to engage with any of my points about the American experience. Will he or perhaps the Solicitor General deign to do that on a later occasion?
I will say this. The Bill has been through an exhaustive process of consideration. The draft Bill was preceded by three reports on the basis of which—the hon. and learned Member for Holborn and St Pancras drew attention to this—the Government have gone further than originally set out, in the terms I described with publication of more information, explanation of the operational case and amendments to the codes of practice. The Bill was considered by three Committees of this House and I have referred to the Joint Committee’s views on bulk powers.
This Committee is now considering the Bill following publication in its final form on Second Reading. In the Second Reading debate the Chairman of the Intelligence and Security Committee, a senior Member of this House who chairs a very important Committee, said that he was convinced that these powers were necessary. The hon. and learned Member for Holborn and St Pancras has argued for perhaps going further on the operational case.
I will just finish my sentence. I do not think anyone can say there has not been adequate debate about bulk powers. Before I give way to my hon. Friend and then the hon. Lady—I do not wish to put a further spoke in her wheel, or perhaps I do—I want to say that the US National Academy of Sciences could not identify any alternative that is appropriate to bulk powers.
I just want to put it on the record that I am sure my right hon. Friend shares my view that if the former Attorney General, our right hon. and learned Friend Mr Grieve, who chairs the Committee to which the Minister referred, had not been convinced, he would have had no problem whatever in telling the Government and anyone who wanted to listen that he was not convinced. Our right hon. Friend is not a patsy in this matter or a yea-sayer. If he disagreed, he would have told us.
Let me quote our right hon. and learned Friend. He said:
“The present Committee and its predecessor are satisfied that the Government are justified in coming to Parliament to seek in broad terms the powers that the Bill contains. None of the categories of powers in the Bill—including the principle of having powers of bulk collection of data, which has given rise to controversy in recent years—is unnecessary or disproportionate to what we need to protect ourselves.”—[Official Report,
He said that on the basis of the information provided to him, but in the knowledge that robust safeguards will govern the examination of data that have been collected in bulk and that it will be possible to select such data for examination only when it is necessary and proportionate for a specific operational purpose. What is happening in other places is, of course, of interest to us and of course we consider other jurisdictions, but my job is to listen to those who have examined the Bill with considerable diligence and in considerable detail, and to be guided by their conclusions.
In that spirit and with that purpose, I hope that we can move on to the next clause, having been persuaded, I hope, that what the Government are doing is perfectly reasonable.
That Minister said a little while ago that Google searches were not external to the UK. I think that is what he said. I am looking at a report of what Charles Farr told the Government in June 2014, which is in a report that we can all access on the BBC website. He said:
“UK intelligence service GCHQ can legally snoop on British use of Google, Facebook and web-based email without specific warrants because the firms are based abroad, the government has said. Classed as ‘external communications’, such activity can be covered by a broad warrant and intercepted without extra clearance, spy boss Charles Farr said.”
“Facebook, Twitter, YouTube and web searches on Google—“
I see now my mission; it has come to me in a flash. Part of my job is to clear the murk surrounding the hon. and learned Lady and guide her to the light. To that end, she needs to understand that there is a distinction between the position under the Regulation of Investigatory Powers Act 2000 and the definition of overseas-related warrants relating to bulk powers in the Bill. To quote what Charles Farr, with whom I worked at the Home Office, said about one does not really relate to the other. I hope we can move forward on our journey to the light.