Oral evidence: Investigatory Powers Bill: technology issues, HC 573Tuesday 10 November 2015

Oral evidence, 10 November 2015.

Witnesses

Professor Ross Anderson, Professor of Security Engineering, University of Cambridge, Professor Mike Jackson, formerly of Birmingham City Business School, Dr Joss Wright, Research Fellow, Oxford Internet Institute, and Professor Sir David Omand GCB, Visiting Professor, Department of War Studies, King’s College London, gave evidence.

Chair

Can I welcome all of you to our session today? I think you all sat in on our first panel and heard the views that we were receiving. We heard concerns about the amount of data involved in bulk retention, the costs implied for businesses, meeting the stated goals of the Bill and the implications for encryption. Could we start with you, Professor Anderson? Do you share those concerns, or do you think that they are overstated?

Professor Anderson

I agree with much of what the previous panel said. There are significant concerns about the increase of powers that has come with the Bill. The Home Office may technically be correct in saying that the Bill extends existing powers only slightly, but, as Valerie Vaz pointed out, they simultaneously published a number of regulations that extended existing powers in various ways. What we see is an enormous extension of the overt reach of the state. What has happened here, in effect, is that, in response to the revelations by Edward Snowden, we have seen America pull back on what the NSA is permitted to do. On the other hand, things that GCHQ has been doing and that nobody knew about are here being legalised. That may put the two countries on slightly different tracks.

Chair

I remind everybody that we are talking about the technical aspects of the Bill and how deliverable they are. We have other Committees in this place that are looking at the ethics. Professor Omand, do you think that it is, in fact, the legislation that has changed, or is it the technology that has meant that the volume of the data makes this such a different proposition?

Professor Omand

First, I have to register strong disagreement with almost everything that my friend Ross Anderson has just said. Having heard the previous session, it is very important to realise that most of the questions being addressed are not policy questions or ethical questions, but empirical questions. The question of data and whether the authorities can deal with the volume of data is an empirical matter. The Bill provides for the exception where “reasonably practical”, so the Government have given themselves a let-out if it turns out that in some areas this is just too expensive or too difficult. Basically, does the fact that we cannot do everything all at once mean that we should do nothing and not make a start? Those empirical questions need to be addressed, but they are not ethical questions. We will not find ourselves in a very different position from the United States. The volumes of data on the internet are enormous, but if there is one thing that the unfortunate Snowden revelations have shown, it is that the authorities nowadays are quite good at managing extremely large volumes of data. I would have high confidence that they would be able to derive benefit from the provisions in the Bill, but none of this is a magic bullet. If you are trying to defend the security and safety of the citizens of the United Kingdom, it is done by managing the risk, not eliminating it. This Bill will not eliminate the difficulties of encryption and of large quantities of data—people hiding their evil communications among a variety of different applications—but it will help the authorities to manage down the level of risk. You cannot ask for more than that.

Chair

How do you respond to the concerns raised by the previous panel about the fuzziness, in their words, of a lot of the definitions in the Bill, which were causing concern about the efficacy of the Bill as a result?

Professor Omand

The main fuzziness they referred to was between content and communication data. The significance of that lies simply in the level of authorisation that Parliament gives for accessing either content or communication data. On the one hand, you are into warrants signed by a Secretary of State and personally looked at by a senior judge. In another part of the Bill, for communication data, you are talking about authorisations by independent senior officers, not in the line of command of the operation but none the less below that threshold. That is where the significance matters. For most communications, there is a very clear distinction between content, which is the meaning, and the communication data—which device is connecting, in which way, in order to convey that meaning. There may well be some cases, and you could easily think of them, where it gets a little fuzzy. Again, is that a reason for not trying to make a sensible, pragmatic distinction for the very large number of cases where the police service needs access to who called whom to try to track down a missing person, deal with a potential suicide or solve a rape case? It seems to me very evident that the Bill has it right in continuing to make that distinction. Is it perfect? You are never going to get a perfect world, but I would commend that pragmatism to the Committee.

Chair

Professor Jackson, Professor Omand said that the Bill may not be perfect and that you are never going to get a perfect Bill. Do you have some recommendations for perfecting it?

Professor Jackson

To go back to the discussion that we had, I would be concerned about the amounts of data that were required to be stored. We are talking about this being empirical and whatever. Yes, the data can be stored, but the cost that is eventually put on to people, either through taxes or as they pay for their broadband, might be prohibitive, as our commercial colleagues said, in that it might actually prevent us from exploiting the advantages of broadband. I am also concerned, as our commercial colleagues were, that the Bill contains the possibility that companies who offer end-to-end encryption would be prevented at certain times from providing that facility to their customers.

Chair

Dr Wright, what is your current impression of the state of the Bill? Do you think that the definitions within it are too vague? Do they need to be tightened up?

Dr Wright

The definitions are too vague. From a brief reading of the Bill, one of my concerns is that previously we had legislation where there were some fuzzy definitions, and we have now learned that the specific interpretation of those terms expands the scope beyond what was believed to be the case; I am concerned that now we have another set of fuzzy definitions that embed the existing state we have got to and allow fuzziness for expansion in the future. That is a considerable concern of mine. I would have to disagree respectfully with Sir David that there is a clear line between content and metadata. That is one of the key issues coming out of the Bill, particularly when we talk about the meaning of information. Meaning is an incredibly difficult concept in itself, but when we consider the meaning that can be derived from the patterns of communication and the interaction between individuals, as opposed to simply the words that appear within an email, we start to understand that there is a higher level of sensitivity to that data. That means that, when we think about how much cost and effort must be put into protecting that data, it becomes significantly higher. That is core to what I would say are the problems with the Bill.

Chair

I have heard your analysis of the problems. What would be your recommendations for improving it?

Dr Wright

My main concerns are with mass retention—or bulk retention. I know that there were very careful attempts to remove the word “mass” from the Bill, except in its denial sense. I would certainly want to see a strong understanding of necessity and proportionality in terms of data retention. My understanding at the moment is that there is a requirement for the Secretary of State to decide on necessity and proportionality for retention of data, but, reading around the Bill, it seems that that is every major internet service provider for a period of 12 months. I question whether that necessity and proportionality matches the realities.

Chair

Matt Hancock; sorry—Matt Warman.

Matt Warman

I was promoted momentarily. Obviously we are in a perpetual arms race, aren’t we? To put it in very simplistic terms, the Government are trying to catch up with the bad guys and the bad guys have a vested interest in staying ahead. How do we frame legislation in a way that is both practical now and future-proofed, so that we do not have this debate every six months, six years or whatever? Who wants to start?

Professor Anderson

Perhaps this is an issue Parliament should return to a bit more frequently, because technology just changes too fast. You cannot expect to have a Bill that will last for 25 years unless you have lots of Henry VIII clauses in it and do everything by statutory instrument, which creates problems of its own. The thing that is about to hit us, of course, is the internet of things. The Bill makes some provision for that by talking about things as well as persons, but the true implications of what it means to allow bulk equipment interference, for example, with road vehicles will probably have to be revisited once people start using autonomous vehicles at scale.

Professor Omand

I agree with the thrust of what you have just heard. It is easy to think about equipment interference that would mean that the car of the foreign intelligence service operative was radiating back where it was. That would be quite convenient. I can imagine that as a rather useful thing, if it were technically possible to do. It does not have to mean the worst case. If we try to interpret this Bill as the worst case we end up in a very bad place, because essentially we will not have the intelligence on which police services and agencies can work. The communications data definitions are not fuzzy at all; they are actually quite precise. What is not defined in the Bill is metadata, which is a term that the Committee has used itself. The position under the existing legislation is that, if it is not who, what, where or how, it is content, so some of the fancy things that you can do with metadata require a Secretary of State’s warrant. I am very comfortable with that, as I know the intelligence agencies are. I would not run away with the idea that definitions in this area of the Bill are that fuzzy. The answer to your question has to lie in codes of practice. If you try to nail everything down absolutely in the primary legislation, you will be revisiting this in a couple of years’ time and passing another Investigatory Powers Act. The answer is to learn from the mistake that the Home Office made over the last five years, which was not to update the codes of practice, so that we, the citizens, knew how the existing legislation was being used. They could have done that, in which case the Snowden case would not have been the shock, horror that apparently it was for many people. Those codes of practice are presented to Parliament. You can insist that they are revised. You could put that in your legislation. There are ways in which the Government at any one time can be quite precise about how it is interpreting them, which will help the judges very considerably. That can then be updated. As to planning because you know in advance that you will have to re-legislate on all of this, Ross is absolutely right—the technology will keep changing.

Professor Anderson

For an example of communications data as used now and defined on the face of the Bill, consider your Google calendar, or whichever calendar you use. On the definition in the Bill, that is communications data. If GCHQ hoovers up everybody’s Gmail from the backbone, between Google’s data centres, and makes it available, presumably a police officer on a production warrant can find who met whom, when. That is extraordinarily convenient if you are an investigator for the Financial Conduct Authority and you want to know which banker had lunch with which solicitor, or whatever, on what date, but is that what the voters would expect—that their calendar is not content but communications data?

Professor Omand

If that were the case, you would be right, but, as far as I understand it, you would have to check authoritatively that it is not. In other words, the communications data are that you were in touch with the Google server, not what the content of your calendar was. That would indeed be content and would require a Secretary of State’s warrant.

Professor Anderson

No. It is related communications data, section 12.

Professor Omand

The example given in the explanatory notes, which I have just been reading, was very clear on this. You could not just go hoovering your way on the say-so of a senior police officer—you would require a warrant for that. If you were doing that, you would know that you were interested in Ross Anderson, in which case you could go for a specific warrant. You would not have any of this argument, because, as you heard from the internet companies a moment ago, they do not have a problem with specific warrants.

Matt Warman

As an example, therefore, what do we not have access to that the security services would wish we had, and does the Bill plug that gap? I can see that the calendar is a very good one, but I am not sure whether, as Sir David says, it is covered by this. There is obviously some dispute between the experts in front of us.

Professor Jackson

It is not just a dispute between the experts. If you look at the proceedings of another Select Committee, the one that dealt with the bulk collection of data by GCHQ, they identified three types of data: one that was clearly metadata, one that was clearly content and a grey area. That is not reflected in the Bill as it stands.

Carol Monaghan

I was going to ask a bit more about the blurring of communications data with communications content. Do you feel that the Bill recognises the blurring of the lines between the two? Is there still some ambiguity surrounding them in the Bill?

Professor Omand

It is probably as close to precision as you are going to get. Where you are dealing with bulk data, you are talking about a Secretary of State’s warrant. The Bill provides for different categories of Secretary of State warrant, then to be judicially reviewed by a senior judge. That already has the highest level of authorisation possible. I think we are talking about cases where communications data—who called whom, when and how—can be obtained on the authority of, for example, a senior police officer who is not in the line of command of a particular investigation. The Bill provides for points of contact—SPoCs and so on—to do that. The question then is do you feel nervous that that kind of information can be obtained on the say-so of a senior officer, subject to the commissioner examining a proportion of cases and so on? That seems to me the only real issue that this definitional question brings up. It is about the level of authorisation.

Dr Wright

Could I jump in there? There is certainly some recognition of the grey area in the middle. Entity data and event data are pulled out, separating those two terms. Fundamentally, the problem I have with this issue is that the difference between content data and communications data is a proxy for how sensitive that data is. There is a fundamental philosophy in the Bill that communications data is less sensitive. That simply does not hold. Fundamentally, we have these two different classes of access because we are saying, “This one is less sensitive and this one is more sensitive.” To give a completely trivial example, if you were to watch a film via Netflix, the content of that communication is the stream of bits that are the pictures on the image, which are not sensitive at all. Within the context of the Bill, this would be access to Netflix, but when you choose to watch a film seems to me far more sensitive. It is not highly sensitive, but it is far more sensitive than simply the content of that Netflix film, which is seen by millions of people around the world. The understanding that we do not have, and which is being hammered further into the axions of the Bill, is that communications data is not sensitive. That is a fundamental misunderstanding.

Professor Omand

I do not think that the authors of the Bill are saying that it is not sensitive. Clearly it is sensitive, but not as sensitive. There will be exceptions; you will always be able to find exceptions, but for most of the time it is a fact that the suspect’s computer was communicating with the Netflix computer. In some circumstances, it could be a significant fact. Most of the time, it will not be. That is where the practical distinction lies. The alternative is to say that the higher threshold of the Secretary of State and the judicial review applies to every one of the half million accesses to communications data that take place annually at the moment. That is a proposition I would not want to entertain.

Carol Monaghan

The draft Bill currently states that communication data does not include the content of a communication, but Professor Anderson is saying that a calendar could be considered communications data. Therefore, the content would be subject—

Professor Anderson

Yes. A calendar says who met whom and when. That falls under the definition of communications data. What is more, related communications data includes communications data that is extracted by mechanical means from contact. Let me give you an example. If I send you an e-mail saying, “See you at the pub at 9 o’clock,” and you are using a system like Google+, it will understand that and will remind you at a quarter to 9 that you are seeing Ross at the pub. That becomes communications data, even though it was in the body text of an email. The Snowden revelations show that these techniques are not used merely by Google—they are used by the NSA as well. To follow up on my friend’s comments earlier, the relative sensitivity of content and communications data is something that has come up again and again in this area over the past 20 years. When one speaks to operational police officers, they very often say that the communications data are the gold dust. If you have tapped somebody’s phone or have put a room bug in their house, the sort of thing that you get is, “Fred, see you in the usual place in 20 minutes.” Knowing who is calling whom tells you who is a member of a criminal conspiracy. The cell site location history of their mobile phone and the GPS location history, which is available, provide the real gold dust. Finally, bear in mind that the main privacy case in UK law is Campbell v. Mirror. Why? Because the Daily Mirror photographed Naomi Campbell leaving a branch of Narcotics Anonymous. A photograph taken on a public street is communications data. The High Court ruled that that was highly sensitive.

Professor Omand

From your earlier discussion on encryption, there is no doubt whatever that communications data—who called whom, where and how—is the gold dust. There is absolutely no disagreement about that. That is why the intelligence community and the police are so desperate to get the Bill passed.

Professor Jackson

In presenting the Bill, the Home Secretary stated that the data that would be made available would be the equivalent of an itemised phone bill. I do not think that the data we are talking about is the equivalent of an itemised phone bill. It has significantly more information content than an itemised phone bill gives.

Dr Wright

I want to hammer this point home more and more. The fundamental issue is that comparing it with telephony is ludicrous. In the modern world, particularly for younger people, a much closer analogy is with the real world. When did you go into your house? When did you leave your house? Which friend did you meet? What shop did you go into? What newspaper did you read? What book did you buy? If we were asking for bulk collection, retention and access to that kind of data in the real world, there would be uproar. Somehow, because this is the internet and it is slotted under “This is just telecommunications,” the Bill has got to where it is.

Carol Monaghan

Do you feel that the language has to be clearer about what is meant by communications data?

Dr Wright

The conceptualisation has to be clearer. There is a fundamental misconceptualisation of what is going on with this kind of data.

Stella Creasy

There is an issue for us as a Technology Committee, because we are looking at the technology climate, but it does throw up the ethical questions. Sir David, I am very struck by your saying that we can never get a perfect world, but we can get a better technical response, can’t we? That is at the heart of some of these questions, if it is capable of that—I accept Professor Anderson’s analogy. After all, if I send an email to Outlook about a diary meeting, then whoever it is sent to, it will be a diary update. All you would get is the contact data, but knowing that I am sending an Outlook update, you know I have a meeting with that person, so you can build a picture. It is entirely possible to do that. Some of these are questions about transparency. While all of us recognise the challenges around what Edward Snowden did, the fact is that there is now a debate about what is the right information, because we recognise that people are using these technologies. The other side is the technological capacity. What I am struggling with, and what is coming out very clearly from what you are saying, is whether the British public understand fully what is currently capable of being grabbed in this way and, therefore, where that might go. Then when we have these debates we can have them with transparency about what is capable. When you talk about worst case, there are also the everyday cases, so, when we go to robot cars, it will not just be the foreign dignitary’s car that you might be able to trace, but my car and your car. Therefore, we need to have a conversation as a society about how that data is handled.

Professor Omand

I am very comfortable with what you have said, except that I would hope the Committee sees the part of the picture that has not been mentioned at all, which is why this Bill is necessary: in other words, what the harms are. That, too, has a technical component, which is of some interest. It has already been touched on with the spread of end-to-end encryption. If you want a society in which the law is upheld, where criminals are brought to justice and terrorists are tracked down, then you cannot have a society in which you do not have some of these powers. It is a question of where you draw the line.

Stella Creasy

I understand that, but as somebody who was not able to make progress in tracking somebody who was harassing me online, because they were using the Tor network, the flipside of this is about our understanding of the technological capacities and limitations. Do you think there are elements in the technological aspects of this Bill, of the internet, and how it is progressing, that the public are unaware of, that maybe the security services are not aware of, and therefore that limits what the Bill can take us forward and do? If so, how would you address them? I would like to ask all three witnesses.

Professor Omand

This Bill only takes us a certain way forward, so there is compromise to be arrived at between the needs of keeping us safe and secure and the needs that people feel for a reasonable level of privacy, unless you are going to take an absolutist position one way or the other. As a witness I want to be somewhere neatly in the middle on that. You mentioned Tor. The problem with Tor is not necessarily the anonymity it provides its users. Facebook is now on Tor, so that it can provide an additional level of security for its users. The New York Times has a site on Tor, so that if you are a whistleblower you can provide information in confidence. The real problem with Tor is that it also hides the identity of the people running the websites on hidden services, the criminal websites, where you go to buy guns, drugs or malware. It is neither right nor wrong. Encryption is just a technology. It can be used for good and it can be used for evil.

Stella Creasy

That was not quite my question. I would be interested to hear from the other members. I would imagine that in a free society we all think whistleblowing is quite an important thing to be able to do.

Professor Omand

Yes, absolutely.

Stella Creasy

Are there other technical ways in which we could help the security services and the police—because this expands from things that the security services are doing through to the police—that would work better with technology as it is and as it is to come? One of the elements is the disjuncture between the technological capacity of, perhaps, our public services and what they are seeking to do. I do not accept that this is an either/or, this is the worst case, this is it and nothing else. Are there technical improvements that could be made? Professor Anderson is itching to come in.

Professor Omand

I would have gone slightly further than just the internet connection records. As you have just heard, it is a burden on the company to separate that part, and having a full web log would be rather more useful. I can perfectly well see why that is not thought to be saleable at the moment, and I would not push the case, but it is just an illustration that there are things that can be done if society wills it.

Professor Anderson

The main limitation is that we live in a globalised world, and the great majority of the services of interest are not UK services. Most are American. Some are Korean and so on. Although there are technical things that could be done to improve things, such as training the police better, getting them to specialise more and so on, the fundamental problem is that when you try to bully foreign companies they react by introducing measures such as encryption. Many of these problems are of the making of Governments themselves. Let me give you an example. The biggest problem facing service companies like Google is that you get a court order from a family court in India saying, “Hand over all the Gmail of this person in Canada and keep quiet about it for ever.” If you are running Google, how do you simultaneously employ engineers in India and be honest with your customers in Canada? The answer, as chosen by more and more firms such as Apple, WhatsApp and so on, is that you encrypt the stuff end to end so that you can say to the court, “Sorry, guv’nor, I don’t have it.” The technology and the policy are inextricably intertwined, and the background that every legislature has difficulty grappling with is the fact that it is a globalised world, and the way forward is probably through treaties rather than through technology. Something like the cybercrime treaty, but a cyber-evidence treaty instead, would probably do far, far more good than many of the things that we see in the Bill, but that is hard. A Bill is easier to get through if you want a result in a single Parliament.

Dr Wright

In the previous discussion, you raised how we break encryption or how we break through Tor. My reaction, on issues such as Tor, is that it would certainly not be with the bulk retention of data. There are traditional methods to investigate the activities of individuals, and they involve targeted means. I believe that, in general, there is an increasing reliance on this gold dust, this magic bullet, of global content data through which, almost by definition, it is very difficult to detect crime. The purpose, as I understand it, of bulk retention of data, is that when you become interested in an individual you suddenly have a time machine that can take you back 12 months to watch what they did. I completely understand the desire for that kind of information. I am much more sanguine about starting to watch somebody when you suspect what they are doing; you can start to investigate them and their social networks. I certainly support provisions to achieve that within reason, and within the constraints of things like end-to-end encryption, which ultimately is what I would call a hard problem. There is a lot of focus on organisations, such as telecommunication providers, but with a lot of the software that is increasingly coming out now a user can download and install an open-source piece of software for free on their phone or computer that is not linked to an organisation or a company. I had a student last year who was looking at the use of encryption software by jihadi groups. They have their own home-grown encryption software. They are not going to mandate that al-Qaeda install a back door or provide your access to communications data. These are people using their own computers. There has to be much more focus on a more traditional approach to investigating individuals.

Professor Jackson

My view of the Bill is that it is doing something which is a blanket approach by taking everybody’s data for possibly very little gain; only a very small percentage of that data will become useful. In the way the Bill is phrased at the moment, although I perceive it as a reduction of privacy, it is not a big enough reduction to make a big change. In some ways, it is edging us down a route that goes to less personal privacy without giving us a whole load of gain. As we have just said, because of the technical aspects, there are ways of subverting what the Bill is doing, which those who are liable to be involved in terrorist activities, who are liable to be the people committing crime, will certainly make use of. Because there is now a Bill, they will be aware that they should be making use of it. The gain is not going to be very great but the cost, which we have talked about, in terms of all this data that has to be stored, will be quite high. Also the erosion of privacy, which we have begun, may effectively be the first part of a descent into an eventual solution where, okay, we have a situation where we are more able to clamp down on terrorism but we have thrown away a huge amount of privacy rights.

Valerie Vaz

Touching on what you have all said and picking up from you, Professor Jackson, could each of the panel say what you know about the extent of current bulk communications, interception and data access? I don’t normally do two-headed questions, but would you describe it as mass surveillance?

Professor Anderson

Absolutely. This is something that had been known to insiders for some years, as Sir David made clear, but the Snowden revelations brought home that, for example, all the data en route from one Google data centre to another was being hoovered up, and all your Gmails, all your Google calendar and so on were vanishing into the machine. If that isn’t mass surveillance, somebody is redefining language.

Professor Omand

I would flatly disagree with what you have just heard. In terms of the United Kingdom—we are talking about the United Kingdom and the effect of UK legislation—bulk access to internet communication is not the same as mass surveillance. These are different concepts. The senior judge, the interception of communications commissioner, in April 2014, in March 2015 the court, the IPT in December 2014, the Intelligence and Security Committee, David Anderson QC, and the panel I was on, the independent panel set up by Nick Clegg, all looked at this and all came to a unanimous conclusion that it is not mass surveillance. Mass surveillance is the persistent observation of all or a large part of the population. That does not take place in the United Kingdom.

Professor Jackson

The evidence for this is the report of the committee that looked at GCHQ’s bulk data collection. It was clear that there is collection of bulk data, but if we accept the evidence taken by that committee, we have to say that only a very small percentage of that data is looked at and examined, and we have to do that. The reason given for that, if you read the report, is partly that there is, as yet, not the technical capability. Although we are making inroads into big data research and processing huge amounts of data, there is, as yet, not the technical capability in GCHQ—this was given as evidence—that that whole set of information can be processed. Clearly, we have been talking about technological evolution, and it is a major research area at the moment to be able to process data automatically, make conclusions and find information from processing huge amounts of data. In some ways, the supermarkets are already ahead of us with their reward cards and so on. In the future, the very fact that that data has been collected may open it up to mass surveillance in new ways. Again, there are some safeguards in the Bill about that. Going through to that mass surveillance, there are more safeguards than we previously had. One has to say that it is more possible to make use of that data looking forward than is happening at the moment or has happened in the past.

Dr Wright

I broadly agree with that, so I won’t play semantic games, which is always fun. Ultimately, this comes down to surveillance and interception. Again, it falls within some of the language in the Bill. There is a stated view that something is only surveillance when it involves a person reading or intercepting some data, or as a result of some analysis. That is a fundamental philosophical point. I would argue that, when you have the gathering of this amount of data, you are certainly falling under what is beginning to touch on what people would understand as surveillance. You may be able to make the argument, “This is not surveillance because we never looked at it.” Increasingly, as Professor Jackson just said, we are getting the capability to manage big data and to run analytics on big data, which means you can do a huge amount with data in terms of coming up with trends and patterns of activity about individuals and groups, before a human ever gets involved in the loop. I can imagine situations in which a human is never involved in the loop. If I can expand on that ever so slightly in terms of the public perception of this kind of work, a survey of 1,200 people was done about the Snowden revelations, or provisions like that, in terms of the surveillance of Government; 78% of the people involved felt that they would need to be more careful about their speech and online searches in light of the Snowden revelations. There was also an empirical study of the number of views on a number of sensitive topics on Wikipedia. In May 2013 there were just under 3 million views combined of those searches. In June 2013, after the Snowden revelations, there was a sudden drop of 20% in the number of people looking at those pages. People are scared when they learn about this. People stop accessing perfectly legal, legitimate and normal information because they are scared of those programs. That turns into a decreasing trend. The chilling effects that were mentioned earlier are real and empirically backed.

Valerie Vaz

I want to pick up the point I made earlier about handling arrangements for bulk personal datasets. Obviously, I could ask you all why, and you could give me a reason. Why do you think that it was passed outside the Bill? Why is it not part of the Bill, and why has it not been defined in the Bill, because it can extend to our medical records, can’t it?

Professor Anderson

There are significant public sensitivities about medical records, which are purely of interest to some agencies, if they are permitted to get their hands on them, and normally would fall under other regulations and other departments. Let me give you another example—your bank statements. How many Government Departments do you want to have access to your bank statements? Do you want a policeman to be able to access them as being, in some sense, less sensitive data? For what purposes would you want, for example, credit reference agency files to be useable? To what extent would you want an investigation to take place by running automated programs over all the bank accounts of everybody in the UK? For example, looking at missing VAT might be the sort of thing that people would start off with, and then—who knows—within five years it would be missing expense claims or duplicated expense claims. Once you start giving automated access to vast amounts of data like that, where are the checks and balances? How do you stop it going from something that most people would agree with, such as looking through foreign bank transfers to look for criminal and terrorist funding support, to something that voters would find personal and oppressive?

Valerie Vaz

But personal data is not part of the Bill, though, is it?

Professor Anderson

Yes.

Valerie Vaz

It’s already come into force, and it’s not even defined.

Professor Omand

Clauses 151, 152, 153 and 154 in the Bill all set out processes.

Valerie Vaz

Why was it brought into effect before the Bill comes into effect?

Professor Omand

Because the Intelligence and Security Committee, no doubt rightly, talked about this, and therefore the Government—

Valerie Vaz

But it is not going to be scrutinised, is it? The whole point of having a Joint Committee is to scrutinise those elements, and it is not going to be scrutinised. It has already come into force.

Professor Omand

It is going to be scrutinised. It is in the Bill.

Valerie Vaz

But it has come into force already, so it is happening now, isn’t it?

Professor Omand

The existence of bulk access for the security service, say, to the vehicle driving licence database, which seems to me a perfectly reasonable thing for them to want to have pretty quick access to for all sorts of reasons—

Valerie Vaz

Professor Jackson?

Professor Omand

May I finish? The Bill has a whole section on bulk personal datasets. A warrant is going to be required from the Secretary of State, scrutinised by the judge, on the purposes for the dataset is needed, and there are time-expiry rules. You can go through each of those, and I hope the Committee and the Joint Committee will look at that, but we can scare ourselves witless about possible abuses. That is why it is so important that this Bill has tightened up oversight and judicial. When we took evidence from a lot of internet companies, particularly the American ones, as part of the RUSI—the Deputy Prime Minister’s—review, most of them said in private, “Look, we want to help. We do want to be able to provide this information, but we would like to see Parliament legislate. We would like to see a warrant and we’d like to see a judge’s fingerprints on it. Then we will be able to deal with our overseas customers and say ‘It’s all perfectly above board’.”

Valerie Vaz

Professor Omand, I am sure you have read, as I did when I was in the civil service, “The Judge Over Your Shoulder,” written by Roland Phillips. I am sure you know it. You will know that this is not a judge looking behind what the Home Secretary is doing. The judge is just looking at process. That is what judicial review is. They are not looking at reasons.

Professor Omand

No, no. That is quite wrong. I am sorry, it is a point of fact.

Chair

This is not the Home Affairs Select Committee, although I have fond memories of it. We are talking about the technical issues.

Valerie Vaz

But it is about access to data, isn’t it?

Professor Omand

Judicial review that involves human rights is not just process. I am sorry that is wrong.

Valerie Vaz

Professor Jackson?

Professor Jackson

I think you were asking a question about bulk data collection.

Valerie Vaz

I am partly asking why it was not part of the Bill.

Professor Jackson

The answer is that it is covered in the Bill, but it is legal because it has been legal from—I am not a legal expert on this one—an earlier Telecommunications Bill which made it legal for GCHQ to collect bulk data, and that was confirmed by the RUSI panel that Professor Omand sat on.

Dr Wright

I do not have a huge amount to add. It ties into the entire argument that the Bill is just extending existing powers—a fact that I dispute—but that is probably the reason why it is minimal, if it is there at all.

Chris Green

Dr Wright, do you have any concerns about access to data on services hosted overseas, such as cloud computing, Gmail and so on?

Dr Wright

With respect to that, it is probably most closely tied to the concerns that were raised by the previous panel about the willingness of companies abroad to do business in the United Kingdom. One of the major concerns is that we are creating an environment where companies will be pushed to avoid the United Kingdom because they are being put into a situation where they have to comply with what they would consider unreasonable demands. Beyond the concerns raised there, no.

Professor Jackson

The concern I would have is that it is part of the weakness of the Bill that there may be overseas countries that are willing to collaborate, and there will certainly be overseas countries that do not collaborate. Therefore, that will push people who are seeking to subvert what the Bill is trying to do to use overseas providers as a way of making sure that they are able to carry out whatever terrorist activities they wish to carry out without being identified by our own security services.

Chris Green

This goes on to what was discussed earlier by Professor Anderson about treaties being so important. If we develop the Bill here, we are going to have to have treaties with countries overseas, to work with them to get some kind of consistent approach.

Dr Wright

Which may turn out to be difficult. As we have seen in the US, the direction of travel may be in an opposite direction from the way the UK Government are going with this Bill. It is generally seen that the Bill is rather more stringent than any other Government seem to wish to pursue. In that case, we may be putting ourselves in a position where we are unable to collaborate with other Governments because we have produced a Bill which has stricter requirements than other Governments have.

Professor Anderson

This is really key if we are going to get a cyber-evidence convention, which is what we will probably end up with in the long run, in 10 to 20 years’ time, because other countries, such as north America and in western Europe, have a different approach to things like wire taps from us. In a great majority of those countries, wire taps can be used in evidence and are used in evidence. They are also authorised by a judicial warrant rather than a warrant from a Secretary of State. A future cyber-evidence convention will probably say that country A can get stuff, content and communications data, from country B provided, first, that an independent person, such as a judge, has accepted that there is probable cause, reasonable suspicion or whatever, according to local law; secondly, that there is transparency, which means that the people whose stuff is got at get told eventually, when they are charged or when the investigation is dropped, or after seven years otherwise; and, thirdly, that there is respect for jurisdiction. Those are the three pillars on which a cyber-evidence convention will have to be built. They are against the GCHQ culture and they are against the provisions, the spirit and the general grain of the Bill. My own feeling is that we will be back here in 10 or 15 years doing it again, so that we can fall into line with the ways that America, Europe and other OECD countries will be behaving by then.

Victoria Borwick

How can the competing demands for gaining access to encrypted communications and protecting such communications be reconciled? We touched on this slightly with the earlier panel.

Professor Omand

The starting point has to be national policy, which is, “It’s the economy, stupid.” We depend on the internet. Therefore, security of the internet is the No. 1 priority. If there is any doubt over admitting to some flaw which has been found, or over retaining it for computer interference, it gets disclosed. It seems to me that the policy on this is extremely clear. Indeed, both this Government and the previous Government made it very clear in their cyber-strategies that you need strong encryption. We need to be able to rely on the internet. Criminals don’t normally conduct their crime by breaking the encryption anyway, but do you want deliberately to remove what I would describe as the right to seek on the part of the police and the intelligence agencies—to try to find out if they can get a lead on some terrorist group, criminal group or paedophile network? We should be encouraging them to try, but there is no guarantee. I am certainly not advocating back doors being mandated, things which would weaken the integrity of the internet; there is a lot of nonsense talked about all of that. But they have to try, and some of the Bill would enable one or two tricks of the trade to be applied. Computer interference is one of those, which might give them a chance to get across some of the most dangerous people who are out there. I don’t think you can ask for more than that.

Victoria Borwick

One of the queries that my colleague raised earlier was whether encryption has got so complex that it prevents the law on surveillance and those who need to be—

Professor Omand

It clearly does.

Professor Anderson

As a general proposition, the encryption algorithms used today cannot be broken if they are properly implemented. There is evidence that certain agencies can attack algorithms with certain reduced key lengths but, in general, encryption does not get broken. It is end systems that get broken or else the keys get stolen. The right way to get round encryption is targeted equipment interference, and that is hack the laptop, the phone, the car, the Barbie doll or whatever of the gang boss you are going after, so that you get access to the microphones, to the cameras and to the stored data. The wrong way to do it is bulk equipment interference. It is tempting, if you are an intelligence agency, to say, “We don’t like North Korea, so we want to bug all the phones in North Korea, so we will put malware in all the phones in South Korea so that those that find their way across the border will have bugs in them.” This may be rational if you are running a hostile intelligence agency, but in a world in which we all depend on each other it is bad stuff. And it is seriously bad stuff when we start doing it to fellow members of the European Union, because it will get us into all sorts of trouble with the two European courts, not to mention the European Parliament.

Chair

Does anyone else wish to comment? I am conscious of time.

Professor Jackson

Encryption is vital for commerce to happen on the internet. There is a theoretical debate that it could all fall apart with one scientific discovery. If that happens, we would have a serious problem with the economy.

Matt Warman

I would like to make one quick point. One of the things Professor Anderson said was “Where are the checks and balances?” and Dr Wright talked about the so-called chilling effect of what people search for. Ultimately, the checks and balances are in Parliament. Whatever technical discussions we are having, is it ultimately down to us in Parliament to make the case that we are technologically competent to draw up some sort of legislation that we in a civilised society are comfortable with? That is not to do with technology at all. Is that fair?

Professor Omand

I agree with that. I am sure you and the Clerks have access to a lot of expertise, but you can also, in this Bill, make it clear that the judges who are going to oversee this need a lot of technical expertise at their fingertips—that is those who go in and inspect how the algorithms are being used. There is quite a lot of work to be done to raise the general level of oversight of competence. The Intelligence and Security Committee will also need technical expertise.

Professor Anderson

It is not just the experts. It is the motivation. It is what they are trying to stop and who pays them. One of my concerns about this Bill is that the Technical Advisory Board will have representatives of the police and intelligence agencies on the one hand, and of the telecom service providers on the other, but it is not going to have representatives from anybody else. It is not going to have representatives from civil society, NGOs, academia, the software industry and the many firms that are reliant on the internet and its trustworthiness for their business models, ranging from computer gaming companies to banks. In other words, the technical advice that will be available to the Home Secretary, and as part of the oversight process in the Bill, is fundamentally skewed towards only two of the many stakeholders who depend on the internet for their livelihood and their freedom.

Chair

Thank you very much. Unsurprisingly, that was one of the more heated panels we have had before the Committee so far. In closing, I do not think there is anyone on this Committee or in this House who is losing sight of the purpose of the Bill—that it is there in order to provide law enforcement and intelligence agencies with the powers that they need in order to fight crime in a digital age. The concerns that we have heard today about proportionality and clarity need to be properly scrutinised. There are questions about ensuring that the Bill delivers its intended aims without weakening encryption or exposing large volumes of personal data to security risks, and it is right that that should be properly scrutinised in this Committee and in others in the House. Thank you for the help that you have given us today. If we have further questions, we will follow up. I hope that you will be happy to help us in our endeavour to translate the technology into plain English for colleagues. Thank you very much. Oral evidence: Investigatory Powers Bill: technology issues, HC 573 2