Clause 15 - Internet connection records

Investigatory Powers (Amendment) Bill [Lords] – in a Public Bill Committee at 2:15 pm on 7 March 2024.

Alert me about debates like this

Question proposed, That the clause stand part of the Bill.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

The changes made by clause 15 should transform the intelligence services and the National Crime Agency’s ability to detect serious criminals and those seeking to undermine national security. Current internet connection record conditions only enable identification of individuals involved in known events. That means an investigator must know the date, time and service being used, preventing identification of offenders where they cannot be linked to a specific time of access. For example, where analysis of a seized device identifies a site serving images of child sexual exploitation, it would not currently be possible to search ICRs for subjects accessing that site beyond a specific known event. New condition D would help to identify other subjects accessing those sites. This will not be a fishing exercise. As with all investigatory powers, the case for requesting ICR data must be necessary, proportionate and intelligence-led. As Committee members will have heard this week, the benefit to the agencies is in being more, not less, specific.

The new condition will be subject to robust safeguards, including limiting the statutory purposes available, stringent necessity and proportionality requirements and independent oversight, including regular inspections by the Investigatory Powers Commissioner’s Office. Where internal authorisation takes place for urgent and national security-related applications, authorising officers must be independent of the operation and not in the line management chain of the applicant. If an investigator knowingly or recklessly obtained ICRs—for example, if the request was clearly not proportionate—they would be at risk of having committed a section 11 offence of unlawfully obtaining communications data, which can result in a fine or imprisonment.

Photo of Stuart McDonald Stuart McDonald Scottish National Party, Cumbernauld, Kilsyth and Kirkintilloch East 2:30, 7 March 2024

We are now looking at internet connection records. Whether we are for or against the provisions, the requirement in 2016 for companies to generate and provide internet connection records was a radical departure and makes the UK something of an outlier: as I understand it, there is no other European or Five Eyes country that allows the same sort of requirements to be made, certainly in relation to its own citizens.

As the Minister explained, there are various conditions on who can access the records. At present, the investigating bodies need to know which personal device they are looking for ICRs in relation to or know a specific time when a website was accessed to identify who was responsible for the events of interest to them. There is some judicial oversight, but not always. We are being asked to move a little further from that already fairly radical starting point and remove the need for a particular time to be identified, so as to have a general look at who uses certain internet sites and services over broader grades of time. That risks moving us step by step away from suspicion-based surveillance towards broader mass surveillance. People become targets of surveillance because of websites they have visited that are not only of questionable ethics, but potentially in breach of article 18 of the European convention on human rights. Various examples of how that might work are given in the explanatory notes, particularly in paragraph 120.

The Minister also gave some examples in relation to access to sites that are clearly illegal. I was quite surprised to learn that there are not already other powers that can be used to investigate who is engaging with such sites. If that is not the case, why not confine the power to sites that are clearly illegal in and of themselves, rather than enabling a trawling of data in relation to other sites that are not? I am not a tech geek, as will become more and more apparent the more that we debate the Bill, but the explanatory notes themselves confirm that there is a danger of and huge susceptibility to error here. Paragraph 123 says:

“Whilst clearly having the potential to provide significant operational utility it is recognised that such queries are highly susceptible to imprecise construction. As a result, additional safeguards are proposed in this Bill with the intention of managing access to this new Condition and mitigating public concerns.”

I am not absolutely convinced by the additional safeguards that follow in paragraph 124, which seem to revolve around training and various other requirements.

At the very least, I would prefer to see us go for independent judicial oversight in all cases, including authorisations under condition D2. As I understand it, under condition D1 a judicial commissioner would need to authorise what has been sought, but under condition D2 it could be internal. If the Minister wants us to expand the powers without the need for judicial authorisation in all cases, he needs to explain how often he expects the powers to be used and why judicial commissioner involvement in all such cases would not be realistic. Are there not other ways in which we can make this work while still retaining judicial oversight in all cases under the new provisions? I understand what the goals are here, but this is an example where it could be framed more narrowly and oversight could be strengthened.

Photo of Kevan Jones Kevan Jones Labour, North Durham

I agree with the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East, and the ISC feels strongly on this issue. We are clearly speaking English and the Minister is speaking Japanese, because this is about understanding what is actually being given to the agencies without any judicial oversight, which is being dismissed as if these powers are no greater or more intrusive.

As the Committee will know, under the IPA an internet connection record is a form of communications data. It contains data on who has accessed something: it does not actually provide the content of what they have seen or been in contact with. However, under the IPA information can be sought to develop knowledge of who is speaking to who. I think the ISC see the value of this for not only security services but issues around child protection and organised crime, as has already been argued. We are giving the security services and agencies a degree of authorisation here, which I would argue they have not had up until now.

We then come to the argument made by the Minister and the Government that these regulations are not any more intrusive than what we have at the moment. I would argue differently because the power is broad. Previously, targeted discovery condition A, under section 62 of the IPA, required that the agency and officer know the service and precise time of use to discover the identity of an individual, so that they actually know what they are targeting. The Minister used the words “fishing expedition”—this regulation will be a fishing expedition. By default, it will bring in a broader range of individuals who have nothing to do with the target the agencies are looking at the time and connection records for, and are of no interest to the agencies or anybody else.

The Government are arguing that this regulation is no more intrusive—but it is, if we are dragging in a large number of people in that way. Actually, by not having any judicial oversight, they are allowing the agencies to agree that internally. Although the intrusion is not deeper, it is certainly a lot broader than what we have at the moment. The Bill says that the new powers can only be used for “national security” and the catch-all phrase

“economic well-being of the United Kingdom”.

I am still yet to be convinced of that terminology, but I understand that the Minister and the civil service like consistency across Bills, and that is why it is in this Bill.

Under sections 60A and 61 of the IPA, requests to obtain an ICR are like requests to obtain other communication data: they have to be “necessary and proportionate”, which runs through all of this. Again, the Government are allowing the agencies to decide what is necessary and proportionate. I am not suggesting for one minute that they are going to go on a fishing expedition, but again there is a problem with the Government’s approach to the Bill, and certainly with the agencies’ approach. They want these powers, and I do not personally have an objection, but we have to look at how other people, who are not drowned in the detail of this Bill, will perceive them. Some opponents would say, “Why should I be dragged into this?” It is really about giving public confidence; as the right hon. Member for South Holland and The Deepings said this morning, when the IPA was passed, it was about trying to reassure people.

It would be very simple to ensure that this regulation has independent judicial oversight, as the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East has just said. I know the catch-all phrase that the Minister will come back with, because I am a quick learner: he will say, “The IPC has the ability to look back at anything.” Again, that is the haystack—where is the needle? It would be better and more reassuring if they were to have some judicial approval in advance. I will give the Committee one example. Let us suppose that we are looking at train records and patterns of behaviour on WhatsApp or a train-ticketing website. There is possibly a valid reason to do that—to see someone’s patterns of travel, and so on—but it will scoop up a lot of innocent internet users. The assurance here is that they will not be of interest and therefore they will not be part of it, but their information is being dragged into the system. Then a decision has to be made as to which ones people are interested in and which ones they are not.

That is a big change. I accept that it would not be the exact content that somebody accessed, but the connections would be there. It does not sit comfortably with me to leave such a big change to the security services. Knowing them as well as I do, I do not suspect that they will use the provision illegally or for alternative motives, but we have to reassure the public, and I do not think this does that. Would that be onerous? I am not sure that it would be. This comes back to the point that we have made about the ISC all the way through. If we are giving the security services extra powers, we need the counterbalance of a safeguard.

As the right hon. Member for South Holland and The Deepings said this morning, that was exactly how the IPA was approached. Clearly, he was a very good Minister, because he accepted amendments and suggestions, whereas only one has been accepted for this Bill so far. The Minister spoke this morning about working with the ISC. The Minister speaks to us, but he does not necessarily listen to what we say or take a great deal of interest in what we propose. This is an important point. It comes back to the fundamental point that if extra powers are going to be given, it is only right that they come with responsibilities and safeguards.

New condition D removes the existing requirement for the exact service and the precise time of use to be known. Basically, it will now be possible to do a sweep, which will mean dragging people in. Therefore, I cannot see the problem in having some oversight of these powers. I would like to know why the Minister thinks that condition D is not more intrusive. It is more intrusive, because a lot more people will be affected by it. I think the Government are hiding behind the idea that because it is not possible to identify what the individuals have actually seen, it is not really interesting. If that is the case, why have it in the first place? I know the reason for that, but it would be interesting to know what thought has gone into this and how many people will be dragged in. It obviously depends on how the provision would be used in practice. If we went down the street and said to people that we are giving these powers without any judicial oversight—the Minister will say that IPCO can always look at it, and I understand all that—I think that most people would be quite worried. We would give reassurance by providing that important oversight.

This provision certainly needs to be looked at. Is it of benefit and am I convinced that this is a new power that the agencies need? I am, and I think it is right, but coming back to the previous point, we have to ensure that we do not do anything that undermines what is done or that gives ammunition to those people who want to cast aspersions on what is actually done.

I think I know the arguments that the Minister will put forward. We will no doubt come back to this matter on Report, when there will, I think, be amendments from members of the Committee; and if we have an election wash-up, this is one proposal that I think will be pressed by the Opposition.

Photo of John Hayes John Hayes Conservative, South Holland and The Deepings

To supplement what the right hon. Gentleman has said, this was part of the original legislation and it is and always has been a controversial aspect of it. There are two things that I would emphasise here. First, it is really important to understand that the kinds of inquiries that would necessitate the use of this power are exceptional. When we considered the original Bill in Committee, one of the arguments was around a criminal threshold: in what circumstances would the public bodies that we are talking about need to avail themselves of the powers? I am on the record as saying at that time that I entirely agreed with the then shadow Minister’s argument that it should not be permitted for minor crimes. In other words, the bodies that the Minister listed earlier would not be using the powers on a routine, daily basis for all kinds of things that they are lawfully entitled to do; they would take advantage of the powers in exceptional cases in which very serious matters were at hand. That would be a helpful way of assuaging some of the doubts raised by the right hon. Member for North Durham.

Secondly, we need greater clarity about the character of oversight. I am inclined to the right hon. Gentleman’s view that having judicial oversight would be helpful. At the very least, we need real clarity about the procedures in the relevant bodies, so that we can be sure they are robust.

Photo of Kevan Jones Kevan Jones Labour, North Durham 2:45, 7 March 2024

Or we could have what was suggested earlier: when the power is used, that is reported to the Investigatory Powers Commissioner, so that it is aware of what is going on and can do something if it has concerns. At the moment, it is presented with a haystack and has to look for the needle.

Photo of John Hayes John Hayes Conservative, South Holland and The Deepings

Exactly. That point was made when we debated the original Act, and I think that I committed at the time to those kinds of things being detailed in the annual report. To clarify a point that was made earlier, David Anderson was clear at the time, and has been since, that we cannot detail the operational purposes of the agencies if doing so would compromise them. The techniques and approaches that they necessarily use in the performance of their duties could be compromised if we were to talk in detailed terms about the character of their operational activities. However, we can speak in broader terms about the kinds of circumstances in which powers might be used—and all the more so for the other public bodies, in a sense, because even if a serious criminal investigation is taking place, those investigations are not typically as secret as they might necessarily be in respect of the security and intelligence community.

Perhaps those two grounds—greater sight of the processes in those bodies and clarity about the circumstances in which the powers can be used; in other words, exceptionally and for very serious matters—would be helpful ways of dealing with some of the points raised by my colleague on the ISC, the right hon. Member for North Durham.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

As usual, right hon. and hon. Members have raised some excellent points. Let me be clear: it is not true to say that there is no judicial oversight. To say that there is no judicial oversight would be correct if the IPC were not in place. I know what the right hon. Member for North Durham is going to say, but that is a form of judicial oversight.

As to the way in which the authorisations work, I hope that I have been clear—I will repeat it to ensure that I am—that an investigating officer would have to make an application to use the powers. That would have to go to a senior officer in their service who is not in their chain of command: someone who is not overseeing the operation or in their management chain—a separate element. Any abuse of that system could mean that that individual, or those individuals, are in violation of section 11. I know that the right hon. Member for North Durham takes his responsibilities on the ISC exceptionally seriously and is fully aware that sometimes there can be a pressing need for operational action at pace. That is what this is also designed to help. It is important that officers have the ability to act under a regulatory framework that means that abuses are, at worst, extremely limited due to various constraints.

Photo of Kevan Jones Kevan Jones Labour, North Durham

I accept that and I have confidence in the internal protocols—do not get me wrong on that—but the Minister does not have to convince me or members of this Committee; it is about the public perception. What is the problem? If we are not going to have judicial oversight in terms of judicial authorisation, what is to stop us having another system whereby, when it is used, the IPC is informed? We could send a simple email so that it would at least have ongoing oversight when these powers are being used.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

The right hon. Gentleman is creating his own haystack here. Although I hope as ever that this power will be used only exceptionally rarely, sadly the nature of serious and organised crime and terror in this country means that it will be used more often. There is a slight misunderstanding as to how this will be used. Targeting a train website or a single authority would not be proportionate or meet the necessity provisions within the Bill. It would be neither necessary nor proportionate. In fact, it would be unnecessary and would be vastly disproportionate, because it would be a mass collection exercise that would neither be targeted in a way that would satisfy the proportionality requirement, and nor would it give a useful answer—it would give such bulk data as to be useless—and therefore it would not be necessary.

The whole point of this is that it sets out a series of conditions in which these powers could be used—perhaps against a certain website, that is true—but on the basis of intelligence. It would have to have a particular cause and a particular time. This is not a Venn diagram with a single circle, but a Venn diagram with four or five circles; it must be in the centre of those for it to be necessary and proportionate.

Photo of Stuart McDonald Stuart McDonald Scottish National Party, Cumbernauld, Kilsyth and Kirkintilloch East

I would be reassured if there was independent advanced judicial oversight. The Minister has said a couple of times that the powers will be used “exceptionally”. What is the difficulty in making sure that there is an exception for urgent cases of advanced judicial authorisation for use of these powers?

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

“Exceptional” does not mean that there is necessarily huge amounts of time to act; exceptional means that the seriousness of the offence is extremely grave. These powers are for things such as child sexual exploitation. I wish it were not so, but even in this country, the police very often have to act extremely speedily to prevent harm to a child and sometimes, very sadly, multiple children. They have also to act extremely speedily to prevent terrorist plots or other forms of very serious organised violence or criminal activity.

That is why “exceptional” does not necessarily mean that it can be dealt with in a procedural way over a number of weeks; exceptional may mean absolutely pressing as well, and that is what this is designed for. The right hon. Member for North Durham may have been aware from briefings that I believe he has received that, in some circumstances, this Bill will reduce the time taken to interrupt serious abuse of children, from months and occasionally years down to days and weeks. That is surely an absolutely essential thing to do, but that will not work unless these powers are used according to the Act, with the important words being “proportionate” and “necessary”. The reason I repeat those words is that were the intelligence services to go on some sort of fishing expedition—and I know that the right hon. Gentleman is not suggesting that they would—that would not be legally permissible under this Act and nor would it achieve the required results, because it would turn up so much data that it would simply be an unusable, vast collection of fluff. Effectively, instead of targeting the needle, they would have merely collected another haystack.

Photo of Kevan Jones Kevan Jones Labour, North Durham

It is not about a fishing expedition, but they will get into a fishing expedition anyway. He says that train lines would not be affected, but they would. If someone wants to see an individual’s travel pattern, that is what they may do. Therefore, a lot of people’s data will be dragged in, not because it has been looked for but because it will come in anyway.

The problem is that if the argument is about speed—which I do not necessarily think is the case in some cases—the Minister has to do two things to reassure people that the powers are going to be used in the right way. First, he must provide pre-authorisation judicial oversight, and secondly, the IPC should be told, perhaps via a simple email, when the powers are used. That would at least allow it to look at the trends and uncover any concerns. I accept the protocols in place and am 100% sure that they are being followed, but it is possible that some people will not follow them and that is what we have to guard against.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

This is a somewhat odd argument, because the right hon. Gentleman and I are slightly together but also arguing at cross purposes. Both of us have a very high regard for the intelligence services and are confident in their integrity, but we are slightly at cross purposes because he believes that we are not satisfying the oversight element, but I believe we are.

Let me be clear. I am not being a stick in the mud about this for any political reason. I actually happen to believe that this is the right way to approach this. There is a constant balance in all forms of oversight between the ability to act quickly and the ability to be controlled from outside. I believe that this sets in place a very significant, burdensome requirement on those who are taking these responsibilities to act according to certain principles. To repeat, the principles are necessity and proportionality. I do not think anybody in here would argue against those. What this requires them to do is make sure that the principles are met by effectively targeting in advance.

The right hon. Gentleman’s comment about train line use would, I am afraid, not satisfy that proportional need. The individual would have to be specifically identified in advance. The pattern of use of the website from the single point and to the point of contact—from a phone to an internet server or whatever it might happen to be—would have to be clarified. These ICRs are Venn diagram circles that are getting narrower and narrower. The idea that this would end up with some sort of week-long or month-long trawl of a train line website is, I am afraid, not permissible under the 2016 Act. Were any intelligence officers to do it—though I do not believe that they would—they would fall foul of section 11 and would not be acting necessarily and proportionately. Therefore, it would not be permissible.

It is pretty clear that existing conditions B and C already enable public authorities to make an application for a known individual’s internet connections. New condition D only enables a request for details to identify individuals who have used one or more specified internet services in a specified time.

Photo of Owen Thompson Owen Thompson SNP Chief Whip

I think that is the point. I do not think anyone is arguing against the fact that there will sometimes be exceptional circumstances that require haste. Everybody accepts that, but the issue with condition D is that it is explicit in removing the targeted nature of the other conditions. It is where they do not know the time or person and do not have the data available that they are using condition D. There is nothing in the Bill to make clear that it can only be used in exceptional circumstances. How can we square that circle? I do not think that anyone would disagree with the fact that there needs to be an ability to move at pace at times, but there is nothing here that says that power could only be used in those sorts of circumstances. Condition D creates a situation where we are going to hoover up data on a huge number of people, but there is nothing to say how long we are going to hold on to that data for, or what would be done with it.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security) 3:00, 7 March 2024

To answer the last part of the question first, the holding on to data and what is to be done with it is the same as under the IPA generally. Information can be held or not held according to those provisions. This Bill does not change any of that, which is why that is not covered here, and I know the hon. Gentleman would not expect it to be.

It is worth pointing out that condition D is not only no more intrusive than conditions A, B or C, in terms of data—

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

Let me just finish the point; I know the hon. Member will come back to me.

Condition D is no more intrusive, and it does require the serious crime threshold, which does add an extra layer before it can be used. I hear the hon. Member’s point; the condition still requires proportionality and necessity, so it could not be simply anybody who is using Facebook, because clearly that is not proportionate. It still requires that targeting; it still requires those Venn diagrams, if he likes, to close over a target; and, even then, it requires the serious crime threshold.

Photo of John Hayes John Hayes Conservative, South Holland and The Deepings

The key thing to understand here is that the agencies have always had the ability to intercept communications data. Communications data is one’s letters. Communications data is one’s phone calls. We speak about communications data now, mindful of the way that people communicate now, and we think of the internet and telephones, but the process of intercepting communications has been a core part of the work of the agencies since the agencies began, so we need to put this in context.

The difference here is the nature of how people communicate. It is right to say that—I rise to be helpful to the Minister—the character of encryption, in particular, is making it harder, even in the kind of serious cases that have been described, for those who are missioned to keep us safe to do so by accessing the information they need. So it is right that the law needs to be updated. The critical thing for me, therefore, is this matter of the threshold, which was debated when we debated the original Act.

As far as I understand, this Bill does not change the threshold; it reinforces the threshold. If that is the case and, as has been said, exceptionality is a measure of significance and not complexity—some cases will be complicated, but it is about significance—then the only outstanding difference, as the Minister has said, is oversight. I think the reporting in the annual report matters—the right hon. Member for North Durham made that point—and that would be a small concession to make, if I can describe it as such. I take the point about alacrity, too. What we cannot do is slow down the process by making it bureaucratic.

I think there is an easy way out of this. Being very clear about thresholds, as the Minister very helpfully has been today, is perhaps the way out of it. To clarify that in writing might be helpful.

Photo of Kevan Jones Kevan Jones Labour, North Durham

I do not think anyone could describe the right hon. Member for South Holland and The Deepings or myself as woolly liberals, but I do have a concern with this. Where we are giving an extra power—which is what this is, although the Minister disagrees about the breadth—I want to ensure somehow that, in a democracy, we have oversight of it. I do not want to make it difficult for the agencies to implement their powers, but there are simple ways of doing so. That could mean telling the IPC when it occurs.

I have faith in the internal mechanisms that the Minister refers to, but I was also on the Intelligence and Security Committee in 2017, when we did our rendition and detention inquiry. All the safeguards were in there then, and they were ignored. That led to some fundamental changes, including the Fulford principles. There are occasions when the best things in legislation are not followed through, and that can lead to some very serious consequences.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

I take the right hon. Gentleman’s point and the spirit in which it was made. I reiterate that requests for communications data must be approved by the Investigatory Powers Commissioner’s Office, as he knows, unless they are urgent or for the purposes of national security. That is where this is being focused. Condition D, which we have spoken about, will be restricted to only the intelligence services and the National Crime Agency when it is pursuing a national security element within its remit—that is a separate area, as he knows. Those organisations have the necessary expertise to raise compliant and proportionate restrictions.

Again and again, the principle in the Bill is that the least intrusive power must be used. The oversight starts internally, but very rapidly goes externally, whether it is to IPCO or a judicial commissioner. The ability to review is always there, and the penalties under section 11 of the 2016 Act, which we all hope will never be needed or used, are pretty onerous on anybody who abuses their power or in any way exploits their ability in order to conduct themselves in a way that we would all agree is unsatisfactory in a democracy. It is really important to say that.

Going back to the question raised by the hon. Member for Midlothian, the reality is that condition D applications will limit collateral intrusion as much as is reasonably practical. The returned data may only provide an indication of involvement in an investigation, and further analysis will likely be necessary to allow fuller determination. That is the nature of handling intelligence data and then conducting an analysis on the back of it. In all cases, that activity will have to be justified, and will be no more than is necessary to achieve the desired outcome.

To be absolutely clear, that has to be targeted. This is a series of circles in a Venn diagram to target as narrowly as possible. Were others to be captured in that narrowest possible target, that data could not be held, or a separate application would have to be made in order to hold it. For example, one can imagine a circumstance in which an intelligence agency is targeting a paedophile on a particular street. Using different forms of communication technique, it narrows it down from a handset to an operator, a particular website, a particular time, and so on, so the Venn diagram narrows—it is very focused. If it turns out that there is another paedophile operating in exactly the same area at that time, that would require a separate application, because it is a separate target. The data could not just be held. Nor would it be ignored—I am sure the hon. Gentleman would not suggest it should be. But the judicial oversight needs to be gone through and the application needs to be made. It is a separate warrant, and so on.

Photo of Kevan Jones Kevan Jones Labour, North Durham

In the example the Minister gives, at the same time the agency targets that individual, it will have a lot of other people who communicated with that individual. How long will that information be kept? That is the concern people have. It is not the depth, but this is broad. Most of those people would be completely innocent of anything. There is then the issue of how long that information is kept and who makes the decision about how long to keep it.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

Forgive me, but I disagree with the right hon. Member on this. It is unlikely that there would be a large number of people at a specific geographic location, using a specific cell site, from a specific handset, viewing a specific website at a specific time. Once it is narrowed down like that, the numbers are very small. That does not mean that any intrusion that is not legally authorised is acceptable—that is absolutely not what I am saying. But we are getting down to very small numbers of people, and quite deliberately so, in order to achieve an intelligence outcome.

Photo of Stuart McDonald Stuart McDonald Scottish National Party, Cumbernauld, Kilsyth and Kirkintilloch East

As I understand it, the Minister is describing the powers that already exist under the 2016 Act. If we are down to that level of knowledge of where, when and who, then what in the Bill goes beyond that? I do not follow.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

In the existing Act, one would have to be entirely specific about a particular time. It could not be 5.30 pm to 6.30 pm; an internet connection record could be done only at 5.30 pm exactly. The Bill extends that a bit, but it still has to be very targeted. This is a proportionate change in the law to allow the intelligence services to collect information that would enable the targeting of serious and organised crime.

Photo of Kevan Jones Kevan Jones Labour, North Durham

Let me go back to the Trainline example. Suppose it is not child exploitation—the Minister is possibly right that it is specific, and hopefully there are not many people in one street—and someone is trying to look for a person’s travel plans, so they want to know how many people in an area have contacted Trainline. It will be more than one person, so there will be a lot of other people they are not looking for in there. That is the problem, and that is all that the ISC, the hon. Members for Midlothian and for Glasgow South and the Labour Front Benchers are saying.

Earlier the Minister used the words “control from outside”. I am sorry if he sees oversight as control, but I certainly do not. It is about giving confidence to the public that there is independent oversight over these powers, whether that is informing the IPCO when they are used or having pre-authorisation, as was suggested earlier. I do not see the problem with keeping people informed. The Minister is hiding behind IPCO, but it was introduced in the first place to give the public confidence.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

I suspect we are not going to come to an agreement on this, so I will probably leave it after this point. The IPCO oversight means that IPCO can look at a request at any point. The maximum period it can go without looking at it is 12 months, but it can look at any point. We have said that requests for communications data must be approved by the Investigatory Powers Commissioner’s Office

“except where they are urgent or are for the purpose of national security”.

That interaction, which the right hon. Gentleman rightly supports, is already there, so I do not accept it is lacking.

On the question of proportionality, the amount of information that one may need to investigate a paedophile network, for example, may mean being slightly vaguer about the specific time, whereas following a known individual may require different forms of flexibility and proportionality. I am afraid I am going to be very cautious about setting out what each one means, because these principles will have to adapt and be applied as appropriate.

Photo of John Hayes John Hayes Conservative, South Holland and The Deepings

We are going to have to close this down and move on because we have other things to do. Perhaps the way through is, as was suggested a few moments ago, that this be reviewed over time. If in the annual report we have a really thorough examination of how the measure has been applied and in what circumstances—in broad terms, of course, because we do not need the details of the crimes—that would give us the assurance we need. Our Committee has made that point emphatically. That would be a terribly good way out of this and it would not be a huge step. If the Minister agrees to that, I would certainly be satisfied.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

It is not for me to tell the ISC what it should look into, but I would be surprised if it did not want to look into this in great depth.

Photo of John Hayes John Hayes Conservative, South Holland and The Deepings

I think the Minister might have misunderstood. Forgive me; I did not mean that. I meant that this could be reviewed in the IPCO annual report. That would obviously be considered by the ISC in the way he describes. I think we need a summary of how this will work in practice and a commitment that we do that now. He sort of talked about a retrospective review. Rather than debate this further now, that would be a very good way forward.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

I am entirely supportive of the idea that IPCO should update the ISC and the Secretary of State about how it is working and provide information so that a proper view can be taken. I think that is entirely appropriate.

Photo of Kevan Jones Kevan Jones Labour, North Durham

Well, that would be fine if the Government did not redact things in IPCO reports and try to stop us getting access to—[Interruption.] I am sorry, but the Government are doing that. They have done it over the past few years. That is the problem. The Government are paying lip service to the ISC. We are not trying to thwart the work of our security services; we are an important part of the democratic oversight of them. That is why we were set up under the Justice and Security Act 2013. I am sorry to say that the Government are trying to drive a coach and horses through it, including by preventing information from IPCO from being given to us.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

I think we have covered the area, and I have said all I am going to about the matter.

Question put and agreed to.

Clause 15 accordingly ordered to stand part of the Bill.