Oral evidence: Draft Investigatory Powers Bill, HC 651Monday 30 November 2015

Oral evidence, 30 November 2015.

Witnesses

Paul Lincoln, Director, National Security, OSCT, Home Office, Richard Alcock, Director, Communications Capability Development Programme, OSCT, Home Office, and Lewis Neal, Director, Intelligence Policy, Foreign and Commonwealth Office, gave evidence.

The Chairman

I apologise for the fact that we are two minutes late. Welcome to our witnesses. We have, of course, seen Mr Lincoln in another capacity. We have until between now and about 5.30 pm. As is normal with these arrangements, all members of the Committee will ask questions. I will kick off in a second, but I remind Members of the House of Lords that they should declare any interests when they ask the question. Perhaps I could ask the three of you a very general question to begin with. Could you give a few brief remarks on what the draft Bill proposes and why it is necessary?

Paul Lincoln

The draft Bill responds to the three reports that were commissioned in this area: the recommendations from the Independent Reviewer of Terrorism Legislation, David Anderson QC; the review that was done by the Royal United Services Institute at the behest of the then Deputy Prime Minister; and the report by the Intelligence and Security Committee of Parliament. All three reviews agreed that the powers associated with communications and the data associated with communications should be brought together in one place to make them more clear and transparent. This draft Bill attempts to do three things. First, it brings together, as requested, the powers already available to law enforcement in this area. It makes them clearer and more understandable than they have been in the past. Secondly, the draft Bill overhauls the oversight arrangements. In particular, you will have noticed that we have proposed a double-lock authorisation for the most intrusive powers, which consists of a Secretary of State authorisation as well as a judicial commissioner authorisation. Thirdly, the Bill ensures that the powers are fit for the digital age, so restoring capabilities that law enforcement would previously have had in relation to communications data by bringing in powers for internet connection records.

The Chairman

Thank you very much. I do not know whether your colleagues wish to make any additional points. If not, arising from that and to make it clear to the Committee, which of the proposed powers are brand new, and which of them are being rewritten in new legislation?

Paul Lincoln

This Bill is very much about transparency and oversight, which the three reviews all said needed to be improved, as this is about powers. The Bill brings the existing powers together. The only new capability that is provided for relates to internet connection records.

The Chairman

Yes, but what does that mean for oversight?

Paul Lincoln

It not only brings the double-lock system that I talked about for the most intrusive powers, involving Secretary of State and judicial commissioner authorisation, but it establishes a new Investigatory Powers Commissioner, bringing together the existing three commissioner bodies and providing additional resources and additional technical and legal expertise.

The Chairman

Thank you very much. Other than the expiry at the end of 2016 of the provisions of DRIPA, what would the impact be if we did not have this Bill?

Paul Lincoln

If we did not have this Bill, we would lose a once-in-a-generation opportunity to provide some of the additional oversight mechanisms that I talked about a moment ago. In terms of the powers and capabilities, a new capability is provided for that in effect restores powers that used to exist around internet connection records. We have provided data as part of the associated documentation with the Bill, which sets out the operational case for that.

The Chairman

Just one more question from me before I hand over to my colleagues. What has been the impact of the Digital Rights Ireland case and the Court of Appeal decision in the Davis case on the powers and the wording of the Bill before the Committee?

Paul Lincoln

The Government responded to the Digital Rights Ireland case by passing some fast-track legislation in 2014, the Data Retention and Investigatory Powers Act, which took account of the ruling on Digital Rights Ireland. However, on the back of that, a judicial review was brought against those powers, which Parliament had voted for. That judicial review, in the Divisional Court, found two reasons for which the powers were incompatible with European legislation. Since then, a Court of Appeal ruling has said provisionally that it did not think that Digital Rights Ireland set out a minimum set of standards for Governments to comply with, and on the back of that the Court of Appeal has remitted this to the court in the European Union. Therefore, we have considered that position and the powers and the associated processes for which Parliament voted in 2014.

Lord Strasburger

Could you tell us in which Acts there would still be surveillance, data acquisition or equipment interference powers after the passage of this Bill?

Paul Lincoln

We have taken the opportunity to bring those into this, when it comes to the primary purposes relating to accessing communications data or content, but the Police Act, for example, would still allow equipment interference for other purposes.

Lord Strasburger

Are those the only ones?

Paul Lincoln

Those would be a good example. Similarly, the Intelligence Services Act would allow that for the intelligence agencies.

Lord Strasburger

Will you be able to give us a list in writing?

Paul Lincoln

We can write to the Committee.

Lord Strasburger

Secondly, you indicated that all the powers except one already exist. I think that we need a bit more clarity on that, particularly about whether all the existing powers have been recently authorised by Parliament. Given that CNE was not avowed by the Government until February 2015, bulk interception was first mentioned in the ISC report in March 2015, and the collection of bulk communications data was not avowed until the Home Secretary did so this month, it would have been impossible for any of those, as well as several other powers in the Bill, to have been specifically debated and authorised by Parliament. Do you agree that it is high time that many of those existing powers were debated by this Committee and by Parliament?

Paul Lincoln

The powers exist already. As David Anderson said, this Bill is an opportunity to bring that more clearly into focus and to allow Parliament, as we take this forward, to take an explicit view on all the powers in the Bill.

Lord Strasburger

I think you missed my point, which was that the three powers that I mentioned and others have never been specifically debated in Parliament. Do you not think that it is time that Parliament did debate them?

Paul Lincoln

Parliament now has the opportunity to debate these powers as this Bill is passed.

Suella Fernandes

What is it about the character and scale of the threat that makes this legislation necessary?

Paul Lincoln

If people look at the products in the public domain, the Joint Terrorism Analysis Centre has independently set the level of threat to this country at severe, which means that an attack is highly likely. You have also heard that the Home Secretary, the Prime Minister and the intelligence agencies have said that seven plots against this country have been disrupted this year that otherwise would have ended up probably in some form of fatality. Equally, figures published worldwide indicate 12,000 terrorist attacks in 91 countries in 2013, the last year for which figures were publicly available.

Shabana Mahmood

How confident are you that the powers in the draft Bill are effectively future-proofed?

Paul Lincoln

By bringing the powers together we have looked at the question of future-proofing. The critical thing is internet connection records and restoring capabilities that law enforcement have traditionally had as part of that. Richard no doubt will talk later about some of the processes that we have been through in talking to communication service providers and other technology companies about the specifics of the technology.

The Chairman

Let us move now to Mr Hanson, who I know has a number of questions.

Mr David Hanson

As regards the old system versus the new system of judicial authorisation, I am interested in whether there is any likelihood of additional time pressures on decision-making.

Paul Lincoln

Each authorisation is currently considered on a case-by-case basis, and that takes a certain amount of time. There is no set time for looking at the authorisation. It needs to be done on the merits and the complexity of the case. Additional time may be needed for physically having two people involved in that decision-making process. The system that was put in as part of the draft Bill allows for urgency procedures. If there is a time-critical situation, a judicial commissioner can sign off under that procedure up to five days afterwards.

Mr David Hanson

Could we expect that, for example, in the Christmas period, the new year period or Easter period? Is that feasible and doable? In an urgent circumstance, would that be acceptable?

Paul Lincoln

In urgent circumstances, we have systems now in place where we deal with Secretaries of State. We have rota systems in place and we can access Secretaries of State out of hours to work through those systems.

Mr David Hanson

In the event that the judicial commissioner disagrees with a recommendation from a Secretary of State, what is the mechanism for that to be examined? Is that it?

Paul Lincoln

If that happened, the judicial commissioner would have to set out in writing the reasons for that refusal. The Secretary of State can have a discussion with that judicial commissioner to work through the issues. For example, it might be that collateral intrusion into a particular subject was too great when looking at necessity and proportionality. That is the kind of discussion that we have now. If you got to a position where, having gone through that process, the judicial commissioner still disagreed, the Secretary of State can ask the investigatory powers commissioner to look at this. If the investigatory powers commissioner disagrees, that is as far as that will go and the warrant will not come into force if they disagree.

Mr David Hanson

What of that discourse would at any time eventually be public in the event of accountability for one or both of those officials being held by the House of Commons or the House of Lords?

Paul Lincoln

If something went wrong, as we have seen in the past, inquiries are often held. The Intelligence and Security Committee led an inquiry into the circumstances surrounding the murder of Fusilier Lee Rigby, for example, which took into account the way in which these things work. Similarly, the commissioners hold to account an oversight of the process that is put in place.

Mr David Hanson

One final question. How many of these do you estimate would be deemed to be urgent, given what happened historically? What is your assessment of the number that will be urgent?

Paul Lincoln

In reality, we think that this will be very few percentage points of the overall number of cases. We have not provided a specific estimate, but it will be a very small number of cases—probably the majority would be where there is an imminent threat to life.

The Chairman

What about the definition of urgency? Is it self-defining or will we have some sort of guideline? I am sure that there will be grey areas.

Paul Lincoln

We have not set out in the Bill a definition of urgent. In reality, a warrant will be considered urgent only if there is a very limited window of opportunity to act. We would expect to set out guidance in a code of practice, as is usually the way in which these things are set out.

Lord Butler of Brockwell

If a warrant has been issued—

The Chairman

I do beg your pardon. We have to adjourn for five or 10 minutes while Members of the House of Lords vote. The Committee suspended for a Division in the House of Lords.

The Chairman

We were in the middle of a sentence.

Lord Butler of Brockwell

If a warrant is issued for one purpose, can the information that it provides be used for another purpose? For example, if a warrant is taken out for someone suspected of terrorism and it throws up evidence of offences under Customs and Excise, could the information be used without taking out another warrant?

Paul Lincoln

Certain purposes are set out for the intelligence agencies where they are allowed to share information along the lines of their statutory purposes. If I take your example the other way around, if you discover in a tax evasion case that someone was involved in terrorism, the practice would be that you would take out a separate warrant to do with the terrorism and run the necessity and proportionality test for that.

Lord Butler of Brockwell

Thank you. But the information that was first obtained under the tax evasion warrant could then be used to justify a further warrant for terrorism but a further warrant would be needed.

Paul Lincoln

A further warrant would be the practice to be followed through. Yes.

Dr Andrew Murrison

I am worried about the five days, because the Five Eyes community does not put up an artificial distinction between urgent and routine, since all warrants have to be certified by a member of the judiciary rather than a politician. I wonder why we have lighted upon five days. Are we seriously saying that we may not be able to get a judge to pass a view within five days? I would find that extraordinary. Perhaps we might consider whether a lesser period of time was appropriate for matters that are deemed to be urgent.

Paul Lincoln

Among the various recommendations from the reports, the Royal United Services Institute report, for example, recommended a period of 14 days for an urgency procedure, which we considered too long. We alighted on a period of five days as a maximum that would allow for sufficient time when the system may be running at its hottest if there was a particular set of counterterrorism investigations going on. In reality, we would expect decisions to be made much more swiftly than that.

Lord Strasburger

We know that the Home Secretary signs on average six of these warrants a day. Could you tell us approximately how much time she spends on it?

Paul Lincoln

I cannot give you the precise time that she spends on each warrant. She has said to the House of Commons that she spends more time on warrantry than she does on any other topic.

The Chairman

Thank you very much. We now move on to Baroness Browning, who has a number of questions that she would like to ask.

Baroness Browning

Thank you. I have to remind the Committee of my interest in the register as chair of the Advisory Committee on Business Appointments, which gives advice to senior members of the security and intelligence community when they leave office. Could I ask you about the request filter system, which I think is new? Could you explain to us how the request filter system works for applications to access communications data? In explaining how that works, perhaps you might like to give us an idea as to the correlation between the new system and fishing expeditions and whether there is a vulnerability there.

Richard Alcock

The request filter is fundamentally a safeguard, the purpose of which is to limit the amount of data that goes through to law enforcement. People access comms data right now through a system of robust oversight, with the appropriate checks and balances and with necessity and proportionality at its heart. The request filter cannot be used unless a particular case has been made that it is both necessary and proportionate. By way of example of how the request filter might be used, a criminal may have committed three crimes in three locations at three different times. A request for comms data may go in about who was at a particular location in those three instances. Without the request filter and subject, obviously, to the approval being granted for that kind of request, the full array of data would be made available to law enforcement. The request filter would filter out all the irrelevant data and just identify the individuals or entities that were in those three locations at that particular point in time, so it would reduce the amount of irrelevant information that would go through to law enforcement. It does not allow for fishing, just to address that point, because you can only make a request when that is necessary and proportionate for a specific instance, which is obviously judged by investigating officers and with the appropriate oversight.

Baroness Browning

You do not think there is any fishing risk at all in the system.

Richard Alcock

No, because the same tests apply to the existing comms data approval regime.

Paul Lincoln

It may be worth adding that the Bill provides for a new offence around the abuse of powers around communications data; it provides a criminal offence for people who abuse the powers as part of this.

Baroness Browning

The Joint Committee on the Draft Communications Data Bill, as you are probably aware, identified a risk to the request filter system. Why do you think there is a difference of opinion? What has changed to minimise that risk?

Richard Alcock

The Joint Committee concluded that it was a safeguard while acknowledging that there was a risk. The risk has been mitigated by virtue of the criminal sanction that may be imposed with inappropriate access to the information that could be accessed through the system.

Baroness Browning

Sorry, did you say “criminal sanction”?

Richard Alcock

The new offence, which Paul just outlined, of inappropriate access to comms data mitigates that risk.

Paul Lincoln

There is oversight by the Investigatory Powers Commissioner as a starting point in terms of all the powers in the Bill, but in addition to that we have greater defence in the Bill to make sure that in extremis if you are wilfully trying to abuse the system, a criminal sanction is available. There are also administrative and other sanctions available to the Government.

Lord Hart of Chilton

This is a question about judicial review principles. We know that the judge or judicial commissioner, when looking at the warrant, must apply the same principles as would be applied by a court on an application for judicial review. We have seen that there are some who say that that is not a great power because it is interested in process rather than the merits. I would like you to help the Committee by explaining what you understand to be the judicial review principles for the purposes of the Bill.

Paul Lincoln

As we said before, the Bill allows for a double-lock process. The judicial commissioner comes second in that process. The principle of judicial review is well established. Lord Pannick in particular set out that he thought that the test that was set for this Bill was the right one. In examining the data that is put in front of them as part of the request, they will see exactly the same information as the Secretary of State has and they will be able to determine whether or not the decision was lawful and rational. In doing so, they will also be able to determine whether or not the particular action was both necessary and proportionate. The necessary and proportionate test is, of course, exactly the same one that the Secretary of State is looking at.

Lord Hart of Chilton

We have seen David Pannick’s article from 12 November, but we are interested in finding out the extent to which a judge could use what is called the Wednesbury principle in deciding whether or not no reasonable Secretary of State could come to the conclusion that a warrant was justified. Does the Wednesbury principle apply in this case, as that is a judicial review principle?

Paul Lincoln

The specifics here are that two things will be critical: first, that they decide in the first place that the action is rational and lawful; and, secondly, that it is necessary and proportionate. Those are exactly the same tests as the ones the Secretary of State will be looking at.

Lord Hart of Chilton

But how far could the judge go in deciding that the Secretary of State had stepped outside the remit?

Paul Lincoln

If a judge thinks that the Secretary of State has stepped outside the remit, it is for them to decide so and to say that they do not think that the warrant should come into force. Then there is the process that we described earlier about whether we appeal after that.

Lord Butler of Brockwell

What is the difference, if any, between “rational” and “reasonable”?

Paul Lincoln

I will have to ask one of my legal colleagues and write to the Committee on that one.

Lord Butler of Brockwell

It is an important point, because, as Lord Hart said, the question is whether the Wednesbury test—that no reasonable Minister could have taken the decision—should be applied. If I may say so, I do not think that you answered that. You used the word “rational”, but what we really want to know is whether the Wednesbury principle applies.

Paul Lincoln

Okay. We will come back on the specifics of the principle.

Dr Andrew Murrison

On the subject of targeted interception warrants, if I had applied for and had been granted such a warrant but I wanted to change it in some way, how would I go about doing it?

Paul Lincoln

A process is set out as part of the draft Bill stating how modifications can be made to a targeted interception warrant.

Dr Andrew Murrison

Presumably those would be of a minor nature, or would they be fundamental?

Paul Lincoln

As for making a change to a warrant, if I was a criminal or a terrorist, let us say, and a decision had already been made by a Secretary of State and a judicial commissioner to put my communications under interception, then the decision had been made that it was both necessary and proportionate to intercept Paul Lincoln’s communications in that manner. The example in that situation might be that I decide that I am going to buy a new mobile phone and, in doing so, I now have a new telephone number. Rather than necessarily going back and testing again that I am somebody who needs to have my communications intercepted, a senior official could make the change to say that that new telephone number could be added to that warrant.

Dr Andrew Murrison

At what point would you need to have the involvement of, first, the Secretary of State and, secondly, a judicial person?

Paul Lincoln

If you were to have situation where you then said—I do not know—a new person was coming along and a new circumstance, you would ask for a new interception warrant.

Dr Andrew Murrison

Through the whole process, so both the Minister and the judge?

Paul Lincoln

For both the Minister and the judge.

Dr Andrew Murrison

How does that differ from the situation that applies to equipment interference warrants?

Lewis Neal

It definitely needs some of the approach to modifications. Equipment interference follows the approach that we have taken to the original decision. In the case of SIA it will go through the departments of state, the Foreign Secretary and the judicial commissioner, whereas for law enforcement it will go straight to the judicial commissioner.

Dr Andrew Murrison

So why the difference?

Paul Lincoln

The approach follows the style point in how the authorising is done. In a case involving the intelligence agencies, for example, there is already someone separate from the chain of investigation who is looking at authorising that. In the case of the police, you are looking at doing this to add that additional safeguard as part of that process.

Dr Andrew Murrison

Presumably, there is also someone in the police looking at this too.

Paul Lincoln

Yes. Sorry.

Dr Andrew Murrison

You suggested that the difference was because in the intelligence agencies there is a specific person dealing with this.

Paul Lincoln

But you then have a separate department of state, which is independent from the body that is looking at it, which also considers that separately, whereas in the police you have that organisation itself looking at it rather than saying that there is a department of state, for example, separately looking at the authorisation. It is an additional safeguard.

Dr Andrew Murrison

Otherwise you just have the one.

Paul Lincoln

Otherwise you just have the one.

Dr Andrew Murrison

Do you think that is sufficient? It sounds a little odd to me.

Paul Lincoln

It effectively provides a form of a double-lock in terms of those modifications.

Dr Andrew Murrison

Why, then, should the handling of the equipment interference warrants and the targeted interception warrants be so different?

Paul Lincoln

That reflects effectively the starting point in saying who should be required to authorise that, and it follows consistently the starting point from—

Dr Andrew Murrison

It just seems to me that it unnecessarily complicates it.

Paul Lincoln

Our intention was to keep it simple.

Dr Andrew Murrison

Obviously it did not work. It has confused me. I admit that I am only a simple soul, but it seems to have established the two on different levels with different procedures. I wonder whether the matter might be simplified by simply having the same process without distinguishing it.

Paul Lincoln

That may be a judgment the Committee comes to.

Dr Andrew Murrison

Would it be a major issue in terms of workload?

Paul Lincoln

We would obviously look at what the implications might be in detail.

Lord Strasburger

Why does the phrase “judicial review” in respect of warrants appear in the draft Bill?

Paul Lincoln

We have talked about that by saying that those are the principles under which a judicial commissioner would look at the authorisation of—

Lord Strasburger

I am just trying to understand why the judge would not look on the same basis as the Home Secretary.

Paul Lincoln

As I said, the consideration they will give follows the point about whether it is rational and lawful, and whether it is necessary and proportionate, which is the same test as the one the Home Secretary or the Foreign Secretary applies.

Lord Strasburger

So most judicial reviews are rather redundant, are they not?

Paul Lincoln

I think we said that we would write back on the specific principle. As I said, we are quoting both the report from RUSI, which said that this was an appropriate way to approach this, and some of the recommendations made by David Anderson. In this space, this seems to be the appropriate approach to take.

Suella Fernandes

Before the judge reviews a decision, how will the evidence before that judge compare to the evidence before the Minister?

Paul Lincoln

The judicial commissioner will have the same information as the Secretary of State.

Suella Fernandes

How does the test applied by the judge compare to that applied by the Minister?

Paul Lincoln

They will look at the rationality and lawfulness, and will consider the necessity as part of that decision.

Stuart C McDonald

Will the judicial commissioner be able to question members of the intelligence services, for example, when considering warrants?

Paul Lincoln

You would expect there to be potential for some conversation to go on. At the moment, conversations would happen with the agencies to try to clarify potentially the methods that people are using. If someone was trying to conduct surveillance or an intrusive activity against a particular suspect, you may question whether collateral intrusion was appropriate. Those are the kinds of conversations that happen now. You would expect similar conversations in the future.

The Chairman

To clarify that, when authorising a warrant, clearly the judicial commissioner and the Secretary of State need not be together physically. They could be in different buildings and different places, but would it be at more or less at the same time?

Paul Lincoln

When looking at the warrant itself?

The Chairman

Yes.

Paul Lincoln

Not necessarily. For more routine warrants, it may be a period of days before a judicial commissioner can do it.

The Chairman

Would that be the five days that we talked about?

Paul Lincoln

It could be a number of days.

Lord Hart of Chilton

Unlike the judicial review normally, there would be no third party representations, would there?

Paul Lincoln

The investigatory powers commissioners could look at the system and decide whether they think this is something on which they need further representation. We have not put a system in a place where we are expecting people to be making additional submissions on top of those provided. We have said that we will provide training to those who will become judicial commissioners, and we are working with the Lord Chief Justice’s office to set out what that might be.

The Chairman

Who would look at the warrant first?

Paul Lincoln

The process is that the final person who has the say is the judicial commissioner. It will have gone through a Secretary of State first.

The Chairman

The Secretary of State and then the judicial commissioner.

Shabana Mahmood

I just want to look at the issue in relation to privilege. Obviously, Clause 16 relates to Members of Parliament and the additional safeguards that will apply to communications between a constituent and an MP. I was interested in the rationale for giving those additional safeguards for Members of Parliament but not for legally privileged communications between a client and a lawyer or the protection of journalistic sources. What is the reason for the differential treatment of all three things, which are quite important to our constitutional arrangements?

Paul Lincoln

The Bill provides now for all forms of interception. The requirement of a judicial commissioner to sign off is the key difference from the situation today. All forms of interception now require the involvement of a judicial commissioner. That is a significant step that people would appreciate. The difference with Members of Parliament is that it also requires consultation with the Prime Minister, which reflects the wishes of certainly Members of the House of Commons. There was a debate about that some weeks ago on the Wilson doctrine, which went to the Investigatory Powers Tribunal. This is the result of those debates.

Shabana Mahmood

Moving on to communications data, which is about context rather than content, as a lay person I would expect content to be the most valuable bit of what you might be looking for, but the context has also been described as gold dust. It is very important. How would you describe the relative value of context as opposed to content when it comes to communications data?

Paul Lincoln

Both forms are very important but in their own different ways. For example, communications data is used in 95%[1] of all criminal prosecutions. It is an essential tool for law enforcement in particular to identify, for example, missing persons or to rule people out of an investigation and try to minimise more intrusive techniques to gain content from that. It is very valuable in its own right.

Shabana Mahmood

So the oversight regime is less stringent than it would be for content. Given that you are both saying that they are both valuable, why is there different treatment when it comes to oversight?

Paul Lincoln

Oversight is by the Investigatory Powers Commissioner in all senses and all the powers in the Bill. There is perhaps a question about the authorisation, which you talked about, where Parliament has traditionally said that communications data is a less intrusive form than content, and the authorisation regime that maintains a very similar process that we have today reflects that.

Shabana Mahmood

Do you agree that it is a less intrusive form?

Paul Lincoln

Personally I do, and the Government have reflected that in the way in which the Bill has been put together.

Shabana Mahmood

Is that view shared across your sector, as it were?

Paul Lincoln

Yes. Law enforcement and the intelligence agencies will say that that is the same.

Shabana Mahmood

What is the rationale for Schedule 4? I can understand why police forces and intelligence agencies need to have access to communications data or are entitled to see acquisition of the data. I was slightly nonplussed by local authorities being on that list, given that by 2020 it would be a big deal if they can trim a tree or fill a pothole, rather than acquiring communications data, which might be beyond their resources.

Paul Lincoln

A wide range of bodies have access to communications data. The Financial Conduct Authority might use it for conducting investigations into insider trading. The Maritime and Coastguard Agency might use it for finding missing people at sea. For local authorities, ways in which to investigate might include rogue traders, environmental offences or benefit fraud. David Anderson said that if you have relevant criminal investigation powers you should have the tools associated with that, and communications data is one of them.

Lord Hart of Chilton

Just one point. I did not quite get the answer to the question about the justification for allowing legally privileged communications to be intercepted. As you probably know, the Bar Council has raised strong objections to the fact that privileged communications between an individual and a lawyer are not safeguarded. Why is that?

Paul Lincoln

Special considerations apply to legally privileged material. Their safeguards are set out in codes of practice as part of this. Unfortunately, there may be situations in which people try to abuse the privileges available to them. Therefore, there is not a complete bar on such activity in terms of interception.[2]

Lord Hart of Chilton

Some might not consider that to be sufficiently justifying it, but that is the answer. Thank you.

Lord Butler of Brockwell

I understood that the Home Secretary said in her statement that local authorities would no longer have access to communications data, and I cannot find them in Schedule 4. Could local authorities in certain circumstances select this data?

Paul Lincoln

There are two points there. Local authorities have to go to a magistrate before they are able to access communications data. That was introduced in, I think, 2012. There have been some instances where potentially the powers have been abused. Part of the rectification of that was to bring in a magistrate. The second question is probably to do with internet connection records, where the Home Secretary is on record as saying that local authorities will not be allowed access to internet connection records for any purpose.

Lord Strasburger

Are you aware that most experts consider communications data, especially that including internet connection records, to be at least as revealing as content these days? A former NSA general counsel said that it absolutely told you everything about someone’s life and that if you have enough metadata you do not need content. A former director of the CIA said, “We kill people on the basis of metadata”. Do not the most intrusive elements in communications data need a higher level of authorisation than the current entirely internal process?

Paul Lincoln

We agree that parts of communications data are more intrusive than others. As part of that, the Bill sets out the different authorisation levels, which are internal authorisation levels, with those that are more intrusive having to be signed off by a higher person in terms of the rank structure in any given organisation recognising the sensitivities behind it.

Dr Andrew Murrison

Can I just press you a bit on communications data and the long list of authorities that have access to this. I think you are referring in 2012 to the case that Poole Borough Council lost at tribunal, where it was found to have overstepped the mark. Do you feel it is sufficient for these authorities to apply simply to a magistrate to gain the access that they say they require, or do you think that list needs to be revised? I certainly know which I think.

Paul Lincoln

Our approach has been to continue the process which requires a magistrate to sign off, which is an additional level to what it would be in other organisations. On top of that they have to go through a mandated single point of contact for quality assurance before going to make the request. The National Anti-Fraud Network is part of that, which has been pretty successful, and David Anderson recommends the NAFN as one of the most successful bodies in this area.

Dr Andrew Murrison

Do you feel that their access to this data will mean that their skills in other means of detecting fraud might become degraded? Do you agree that fraud covers a whole load of things from the most serious crime to the frankly trivial?

Paul Lincoln

To put the numbers into perspective, only 0.5% of requests made for communications data overall are made by local authorities. It is a relatively low number in comparison with investigations in the round.

Dr Andrew Murrison

That is no justification though, is it?

Paul Lincoln

For access in their own right?

Dr Andrew Murrison

Not ensuring the job that we have to do to scrutinise this legislation at this stage would not be justification for us to overlook this particular thing; simply to say that it is so small that it does not really matter?

Paul Lincoln

I was not suggesting that. But in terms of the safeguards put behind this, certainly the Government have responded to that previously, and we have kept the same method, which involves the magistrate and the single point of contact through the National Anti-Fraud Network.

The Chairman

Can we move now to Miss Fernandes? Is your voice holding up?

Suella Fernandes

I think it is getting worse. Why has 12 months has been chosen as the timeframe for data retention?

Paul Lincoln

You could choose a range of different periods for which you might have retention. The data retention directive previously allowed for a timeframe between six months and 24 months. The UK decided to adopt a maximum of 12 months when it first introduced its legislation in this area. The 12 months was considered to be the right balance as to the level of intrusiveness in holding that amount of data. It was done on the basis of surveys by looking into the way in which law enforcement used the powers. The critical reason for going up to 12 months is child sexual exploitation cases. Certainly when a survey was done on this in 2012, 49% of all requests made in child sexual exploitation cases were for data between 10 and 12 months old. That is a very significant period, which is reflected in the position that we have taken.

Suella Fernandes

What assessment has the Home Office made of 18 months?

Paul Lincoln

You could go further than that, but this is the position that we have taken historically. Other nations have gone further. The Australians are a good example. They recently passed legislation to go for 24 months’ worth of data retention, but we thought that 12 months struck the right kind of balance between those two things.

Suella Fernandes

In terms of communications service providers and their holding of data for 12 months, has there been any assessment of the cost and workability of that?

Richard Alcock

As you would expect, we have had a number of meetings with the communications service providers on which we would likely serve notice under the new legislation. The retention period in the Bill obviously reflects the retention period proposed in this legislation. We have a very good relationship with the CSPs on which we serve notices now. We have worked with them throughout the summer, and before then, to think about the likely data volumes and to work out the estimated costs for the retention of internet connection records specifically. Those are contained within the impact assessment. It is important to note that it is an estimate. Why is it an estimate? That is because CSPs systems change all the time. There are mergers, acquisitions and so on, but it is the best estimate right now based on the work that we have been doing with them over the past few months.

Paul Lincoln

It is also worth clarifying that the period for a maximum of 12 months for communications data is already current practice in terms of data being stored by those that are under a data retention notice. So that is not a new proposal.

The Chairman

You said earlier that one of the reasons for the 12 months was the investigation into child abuse, but you also implied by that that other investigations might not need the retention for 12 months. Could there be a sliding scale of holding this material according to the nature of the investigation?

Paul Lincoln

There is a question, therefore, between retention and access. To be in a position where you can access data in relation to child sexual exploitation, you have to retain all data associated with communications for up to 12 months to able to make those connections. The question of access is then perhaps complicated in terms of practicality. You may end up missing a significant proportion of investigations. If I was to say that a firearms investigation needed data that was six months old, I might make a connection to a child sexual exploitation case that also needed nine to 10-months-old data, or to a prostitution ring that needed something else, and I would not necessarily be able to make the links between those different investigations by having access for different times.

Mr David Hanson

Can I just be clear? You said that the costs in the impact assessment are to cover the costs of the 12-month period. Are the Government entirely covering costs to service providers and any expanded retentions?

Richard Alcock

The costs are to cover reasonable costs for the additional retention of the internet connection records, so there is provision in the—

Mr David Hanson

So how much is the impact assessment figure? From memory, around £240 million is related to that cost.

Richard Alcock

It is £174 million over a 10-year period in relation to internet connection records. Right now, under existing legislation, in the last financial year we spent around £19 million on data retention, so broadly speaking we are doubling the cost of data retention.

Mr David Hanson

So, again, does the assessment over the 10-year period include an assessment of the expansion of the market, of different types of material, of different types of activity, of the capacity overall of organisations, of new providers entering the market? How do you arrive at that figure?

Richard Alcock

We have worked with industry over summer to look at the likely data volumes and the costs associated with that volumetric growth over time, so even though I gave the example of £17 million a year, the reality is that the cost may go up over that time. But, as I say, we have been working very closely with the comms service providers on which we are likely to serve notice to underpin the facts and figures within the impact assessment.

Mr David Hanson

So when we have the service providers in front of us in the near future and we ask them the same question, will they tell us that they are content with the amount of resource that they give them, or not?

Richard Alcock

As I say, we continue to work with the comms service providers to look at the estimates of volumetric growth and how we would go about implementing those systems over time. We make balanced judgments on the service providers on which we serve notices, and we sometimes have to make hard choices about where we put data retention notices. But, again, as I say, it is all about working very closely with law enforcement, to identify where most value can be accrued from retention, and with comms service providers to understand—

Mr David Hanson

One final question from me. Is that therefore a budget that you have to spend, or is that an assessment of the costs?

Richard Alcock

It is currently an estimate of the likely cost for implementing internet connection records over a 10-year period.

Mr David Hanson

With certain providers.

Richard Alcock

Yes.

Lord Butler of Brockwell

Why does the taxpayer have to meet the cost at all of these records being retained? Why can it not simply be a condition of providers providing services that they retain these records at their expense?

Paul Lincoln

What we have tried to do, and as we have done in the past, is to make sure that companies are not materially disadvantaged by having to meet the requirements of government in this space.

Stuart C McDonald

Just a quick follow-up question first of all. I was interested in what you said about doing surveys of police work in relation to retained data. You commented on the 49% of all requests in child sexual exploitation cases being for data between 10 and 12 months old. In how many cases where the data was between 10 and 12 months old did that data prove to be essential to the outcome of the case?

Paul Lincoln

You are probably better asking the law-enforcement colleagues who are giving evidence after us, but communications data is often the only start point for child sexual exploitation investigations.

Stuart C McDonald

Thank you very much. Also in relation to data retention, obviously one of people’s key concerns is security. When you are retaining data on such a huge scale, how can you be sure that that data is going to be securely retained?

Richard Alcock

Our retention systems are built to meet stringent security requirements, working in partnership with comms service providers to ensure that they meet very rigorous standards. Those systems are overseen by the Information Commissioner. We have annual accreditation. We have, typically, dedicated stores in which the comms data is held, which can be accessed only by law enforcement through encrypted data links and so on. As I say, it is a high priority for us to ensure that security and integrity. We have a very good track record of maintaining the security of existing data retention systems, and we are looking very much to build on that good practice, working in partnership with the comms service providers.

Stuart C McDonald

A related concern is about the definition of service provider. Someone suggested that the way that is defined just now means that pretty much any form of software provider could end up being saddled with these obligations to retain records over 12 months old. Do you have a response to that concern?

Richard Alcock

We will not be putting notices on every service provider as you suggest; we make balanced judgments about which organisations we would serve retention notices. Obviously I cannot go into detail about the organisations that we would intend to serve notices on, but we have been working with every organisation that would be likely to have a notice served on it.

Paul Lincoln

It is also worth saying that there is a route of appeal for those organisations if they think that this is a disproportionate thing to do. They can appeal to the Secretary of State, and there is a process involving a technical advisory board, which will consider the technical implications and cross-implications as part of that.

Stuart C McDonald

My final related question is about whether or not it is going to place UK-based communications service providers at a competitive disadvantage, in that some non-UK citizens will simply choose not to trade with UK-based providers.

Paul Lincoln

Part of that question is similar to Lord Butler’s question. In that respect, that is one of the reasons why we give reasonable costs back to the companies as part of that. Was there something else behind your question?

Stuart C McDonald

Not just in a financial sense but in the sense of the different obligations that are going to be placed on UK-based providers and non-UK-based providers. Some might simply say, “If there is going to be all this storage of my data, I’m just not going to use a UK-based provider”.

Paul Lincoln

The powers in this are not new; they have been known about for some time. Data retention is a widespread power that is used in many different countries, so I would think that that set of differentiators is likely to be limited.

Lord Butler of Brockwell

Going on to one or two technical issues, we understand that because IP addresses are not unique, you cannot identify a sender solely through the IP address, but you can identify them through the internet communications records: in other words, through what they have been to. So is it correct that providers keep records of internet connections?

Richard Alcock

Some do not at the moment. The purpose of the legislation is to ensure that they can where served under notice. The whole operation of communications over the internet is very complex. If you will indulge me, if you have a smartphone, that phone will then communicate with your comms service provider and you will have an IP address and what is known as a port address between those two nodes. There will then be another IP address and another port address between your comms service provider and the destination, whatever web service it is. So you have constantly changing IP addresses and port numbers, and because of that sometimes having the destination IP address or the internet connection record address is the only way of identifying a person to a communication.

Lord Butler of Brockwell

So have you reached agreement with the providers on how this is going to work technically? Do you have a clear agreement with them about what you are going to serve notices on for retention?

Richard Alcock

We have ongoing discussions with a number of comms service providers, as I mentioned before. Those service-provider systems are constantly changing. We have a good relationship with the service providers on which we are likely to serve notice, and we have a good understanding of their current technical systems. During all the conversations that we have with them, at no point have they said that it is impossible to implement.

Lord Butler of Brockwell

So when we see them, will we hear from them that they think that the exercise of these powers is practicable?

Richard Alcock

I hope they will say it is possible. They will say it is hard. They will say that there is more work to be done, because their systems are constantly changing. But, as I say, we have been having a productive dialogue with them for a number of months, specifically about internet connection records.

Lord Strasburger

Before I ask my question, I should mention that the Home Office estimate for the cost of implementing the communications data programme, which in terms of storage was considerably smaller, was, from recollection, £1.8 billion over 10 years. I want to talk about security. There are many breaches of cybersecurity every week. Examples from the last few months include: TalkTalk; giffgaff; a 13 year-old boy hacking into the email account of the current director of the CIA and accessing sensitive government data; and the theft of 4 million personnel records of US government employees, probably by the Chinese. How can the public have any confidence that their personal data, stored by the Government at their ISPs, will not be stolen, and who will be responsible when it is?

Richard Alcock

The retention systems are built to stringent standards, and those standards are set by the Home Office. Systems do not go live unless they have been independently tested and accredited. We are very confident in the arrangements that we have to maintain security of the data retention systems, and I cannot say more than that. We completely understand the threat, and because of that we put a lot of effort into ensuring that integrity.

Lord Strasburger

Who advises on that?

Paul Lincoln

We do not want to sound complacent, but the Information Commission provides independent oversight of those arrangements. As I say, it is one of four principal things that we look at: the physical security of buildings, infrastructure and the rest of it; technical systems, including firewalls and the like; personnel vetting systems, where that might be appropriate; and procedure—the processes, training and the like, which are put behind that.

Richard Alcock

And all that is accredited on an annual basis.

Matt Warman

I would like to talk a bit about encryption. We all know that, on the one hand, encryption is absolutely essential for everyday life. On the other hand it has also meant that some bits of communication that you were able to access are now not visible. There is provision in the Bill for the Secretary of State to make regulations to impose obligations on telecommunications service providers “relating to the removal of electronic protection applied by a relevant operator to any communications or data”. Does that mean that there is provision here to remove encryption, and, if so, how?

Paul Lincoln

I should start by saying that the Government are a strong supporter of encryption for information audit purposes and information assurance purposes. Some £860 million was spent on the national cybersecurity programme, and of course the spending review last week announced another £1.9 billion for looking at this. GCHQ probably does more for this country’s cybersecurity than any organisation. The Bill itself in effect replicates the existing legislation, which has been in place since 2000, and says in effect that we should be in a similar position to that of the real, physical world, where, as David Anderson says in his report and others have said, you do not want there to be places where people are allowed to go unpoliced and ungoverned. The same should apply in the internet world. So when you have taken the steps with regard to necessity and proportionality, you can place a requirement on companies to provide you with content in the clear.

Matt Warman

I understand that you might wish that to be the case, but in practice everything from my message from an iPhone to another iPhone is now encrypted end to end. Does this provision propose to tackle something like that, and, if so, how?

Paul Lincoln

Not everything is encrypted end to end. It would not suit the business models of many companies to encrypt their information end to end, and many of those companies would not tell you that their systems were unsafe, which they are not. But you have to think whether or not in the right circumstances you will ask people to unencrypt information, and people do do that for us.

Matt Warman

Where companies currently think it is right to provide a commercial service that involves end-to-end encryption, are you trying to tackle that, and, if so, how?

Paul Lincoln

All we have done is replicate exactly the same service. If you are providing a service to UK customers and the Secretary of State and a judicial commissioner think there is necessity and proportionality in order to be able to provide that information, those companies should be required to provide that information in the clear.

Matt Warman

Do you think that is practicable?

Paul Lincoln

We are not setting out for anyone how they should do that. It is for others to say what the best way is for them to achieve that. The Government do not want to hold the keys to encryption or anything like that. That debate happened a long time ago. The Government decided that they did not want to do that and have not set out technical standards in this regard. They are saying, “In the right circumstances, we want you to be able to provide this information in the clear”.

Matt Warman

I will come on to bulk equipment interference in that case. Could you all outline what bulk equipment interference is as far as you are concerned, and when it might be proportionate?

Lewis Neal

There is a difference between targeted equipment interference and bulk equipment interference. For targeted equipment interference, you might know the identity of the individual or the piece of equipment you are targeting. For bulk equipment interference, which is targeted at activity overseas and where the intelligence picture and the levels of information about your target are less, you would be able to seek authorisation to target equipment where you did not necessarily know a particular device or the individual that you were targeting.

Matt Warman

And when might that be a proportionate response?

Lewis Neal

Where you have a specific intelligence requirement overseas and you do not have the information but you might have an idea of the locality of the risk or the threat, the necessity would be set out and you would consider the proportionality of that action and potentially the types of information that you were seeking to obtain. Typically in that situation you might look at equipment data that enabled you to further identify the target and to develop a case for activities that have a higher level of intrusion.

Matt Warman

So you would see equipment interference in lay terms as happening at the level of internet infrastructure, rather than—

The Chairman

Order, order. There is a Division in the House of Lords. We will be back in 10 minutes. The Committee suspended for a Division in the House of Lords.

The Chairman

Again, apologies for democracy. Perhaps I may move now to Miss Atkins who I know has a number of questions.

Victoria Atkins

How does the data collected as a result of equipment interference differ from interception material?

Lewis Neal

Equipment interference is a range of techniques to acquire communication information from a variety of bits of equipment, from computers to mobile phones, whereas interception is making communications available while they are in transit. In practice you could use both tools to obtain the same levels of information, be it equipment data, communications data or content, but that would depend on your objective and exactly how you were using the tools. The legislation will require the agencies and the Secretary of State to consider the most proportionate way to acquire the data. If equipment interference may enable you to collect a certain bit of data, essentially you would use that technique as opposed to using interception where you may be collecting more data and a higher level of intrusion when it is not proportionate.

Victoria Atkins

Intercept material is not admissible, or indeed disclosable, in court legal proceedings. Why is it deemed acceptable for material acquired through equipment interference to be eligible for use in legal proceedings but not material acquired through interception?

Paul Lincoln

In principle the Government have no objection to having interception used in evidence. It is the default that you would want to have material used in evidence, but there have been a number of reviews into this over the years. The last was in December 2014, which concluded that it was not possible to introduce an intercept-as-evidence regime in this country. The benefits would not outweigh the risks and the costs associated with doing so. There have been seven or eight reports on this, which have all come to that same conclusion.

Victoria Atkins

I know that colleagues might be wondering why intercept materials is admissible in other countries under different regimes. Is it fair to say that those countries have different disclosure regimes that perhaps are not as demanding of law enforcement and prosecution agencies as the disclosure regime in this country?

Paul Lincoln

There is a combination of questions about disclosure. In particular, if you were to intercept someone’s communications and were trying to use that in court, you would potentially need to intercept every bit of communication that they have done and transcribe all that so that you could set out whether or not there was information that was contrary to that that would be used to bring a prosecution. There are other ways in which other countries’ regimes differ. We are not the only country in the world: for example, the Irish do not have an intercept-as-evidence regime either.

The Chairman

Thank you very much indeed. I am sorry that it has been a bit disjointed, but it has been an extremely valuable and interesting session. Many thanks for your time.

Lord Strasburger

Chair, may I correct my statement? I should have declared an interest. I have been a member of Liberty since I was a young man.

The Chairman

Thank you very much indeed.

Witnesses

Simon York, Director of the Fraud Investigation Service, HMRC, Chris Farrimond, Deputy Director Intelligence Collection, National Crime Agency, Keith Bristow, Director General, National Crime Agency, and Richard Berry, Assistant Chief Constable, National Police Chiefs’ Council

The Chairman

My apologies for the late running of the earlier session. This was a consequence of Divisions in the House of Lords. You are very welcome. As you know, it is an extremely interesting and important Bill that the Committee is looking at and we very much look forward to the points you have to make to us. Perhaps I could kick off by asking your views on the draft Bill. From your point of view, why have it at all, and how will its proposals affect the work of your own organisations? In that context, which of the powers in the Bill would you regard as new, and which are to be simply consolidated into a new Bill?

Keith Bristow

Thank you Chair. Would you mind if I just made a few opening comments before getting to the specific question? First, thank you very much for seeing us so early. I am representing all senior leaders in law enforcement and policing, because we think this is so important that we need to come before the Committee quickly. Your team has also been very indulgent. I was anxious to bring three senior colleagues who are absolute experts in the breadth of law enforcement. One of our deputy directors here is Chris Farrimond. He provides many of the law enforcement capabilities to which the draft Bill refers, including lawful interception, CNE and the high-end capabilities provided for the whole of law enforcement. He is a very useful person to have here. Simon York from HMRC will be able to speak to serious criminality and the taxation system, which again demonstrates the breadth of some of the use that we have to put these capabilities to. Richard Berry is a very experienced police officer in a police force and leads for the National Police Chiefs’ Council on communications data. He can speak in some detail about communications data and how it is used across a whole range of policing activities. Why is this important? Technology has changed the way in which we all lead our lives, which is mostly a good thing for the law-abiding majority. But the reality is that serious and organised criminals in particular, who we target as an agency, also see very significant advantages from technology. That presents us with some very real challenges. The challenges come because the infrastructure of the internet provides some of these people with significant levels of anonymity, which is a challenge for us. The type of data that is stored and made available to law enforcement does not meet our purposes. The legislation within which we operate is not fit for purpose and was not designed at a time that reflected the age in which we live. The reality is that law enforcement is now experiencing a widening gap. We should remember that law enforcement work is evidential, which is different in many respects from other agencies—the SIA—and it is targeted. The capabilities that we use are brought to protect the public but also to bring people to justice and to discount people and prove alibis. In the Anderson report, David Anderson identified five purposes that we need for these operational capabilities. Those five purposes remain the same as when we spoke to David Anderson about them. The draft Bill goes a long way towards meeting our operational requirements. We recognise that our requirements are operational and need to be balanced against wider considerations that the Committee, the Government and Parliament in due course will take into account. Nothing I will say is intended to cut across any of that. We simply want to set out what we need to keep the public safe. One particular concern to which I want to draw your attention—we can put some others in a written submission—relates to internet connection records. The challenge for us is that we believe we need access to all the data that is retained on internet connection records. However, in the draft form of the Bill, that will be limited to three purposes only, which means that data will be retained by communications service providers that we could not request. As I said, this needs to be balanced against other requirements as well, but it is important to recognise that that limits some of our ability to protect the public and to fight crime.

Lord Butler of Brockwell

Sorry, you said three purposes. What are the three purposes?

Keith Bristow

This is not quite how it is worded in the Bill, but in operational terms one purpose is to resolve IP addresses. It is where a website contains illegal content—or what is called a communications website. For instance, codes of practice may help to refine this and develop our understanding, but it would not include a website where someone could book a rail ticket, which could be hugely important if it related to a missing person. We just need to be clear that data will be retained by service providers to which we cannot request access. Chairman, you asked specifically about what new powers and new capabilities this Bill would give us. Frankly, it preserves the capabilities that we have always needed, but in a digital age it does not make us more capable of doing things. In operational terms, it brings up to speed what we need to be able to do in a digital age compared to an analogue age. A lot of what we will talk about is comparing what is acceptable to the public, expressed in legislation in the analogue world, how we need to be able to do that in a digital world and how the world has changed.

The Chairman

That is very useful. Thank you very much.

Dr Andrew Murrison

I do not understand this bit about the extra powers that you say you want to have. My understanding is that you could apply for those. Are you specifically talking about missing persons, because clearly you will be able to get a warrant to get information in relation to serious crime? I am left somewhat confused. Can you clarify it?

Keith Bristow

We cannot request data retained on internet connection records unless it is for the specific purposes that I mentioned. Let me give an example, and Richard is very well qualified to talk about this. If there is a vulnerable missing person—a young person perhaps—and we are concerned about what arrangements they may have put in place to go abroad or to travel, we could not request access to an internet connection record to give us the lead to pursue that point.

Dr Andrew Murrison

Okay, but in relation to a serious crime, as presumably defined by the Serious Crime Act 2007, you would be able to request that data, would you not?

Richard Berry

If I can assist, sir, the major difference with this legislation is that the internet connection records would be retained. If data is retained, for example for business purposes, by a CSP—a communications service provider—then we can apply for that, but forward-facing. The big difference with this Bill is that there will be a retention of those internet connection records and, quite clearly, a process for us to apply for that.

Dr Andrew Murrison

So the information will be retained and you will be able to apply for access to it.

Richard Berry

Yes, but only for the limited categories that Mr Bristow mentioned: so, to resolve an internet protocol address—i.e. to attribute a communication; secondly, to establish whether a person has been using a communications site—Facebook, WhatsApp, those kinds of platforms; and, thirdly, if someone has been accessing illegal content—child abuse imagery or, indeed, terrorist material, that kind of material. There are other policing purposes that we would require access to internet connection records for.

Dr Andrew Murrison

What purposes are those?

Richard Berry

Well, for example; a banking website or, indeed, a travel website. There are case studies that we could furnish the Committee with in writing, if that would be useful, outlining some of those gaps. In a particular case in relation to human trafficking that involves booking flights and the movement of people, we would not be able to obtain that data under the provisions of this Bill. Perhaps I can speak from personal experience having run a large-scale anti-human trafficking operation where 85% of the actionable intelligence came from communications data. That was in the mobile phone era of 2008. We certainly could not repeat that kind of activity now, because the mobile internet communications platforms are where most people now communicate and do those transactions.

Keith Bristow

Might I add two things? Of course the codes of practice, when published, may help us to understand this, but this is our interpretation of the purposes that we can request internet connection records for, and those do not include some of what we will need to access, even though the data is retained.

Dr Andrew Murrison

I am afraid that I am rather confused, because for serious crime—the list is well laid out and, I think, well understood—my understanding is that you would be able to get that information. I am bewildered by what you say. However, there is a question, of course, about what further cases and crimes you may request information on. I think there would be some resistance to extending the list of serious crimes beyond that given in the 2007 Act, if that is what you are requesting.

Keith Bristow

I am not making any requests; I am setting out the consequence of our understanding, which would allow us to request access to data that has been retained by service providers. You make a point about serious crime, but of course a missing vulnerable person is not a serious crime.

Dr Andrew Murrison

So to cut to the chase, is that your concern?

Keith Bristow

It is one of the concerns, but they are wider than that, because, as we understand it, we can only request data that has been retained by service providers for those three purposes.

The Chairman

So you are telling the Committee that to a certain extent the Bill does not do enough, as far as you are concerned.

Keith Bristow

The question that as law-enforcement professionals we are seeking to answer is: what do we need to protect the public? I am setting out what I believe we need to protect the public, but, as I said in my opening comments, Chair, we absolutely accept that there are wider considerations for this Committee, for Government and for Parliament to consider. I do not think, therefore, that it is for us to set out the operational choices.

The Chairman

You also indicated that any possible codes of conduct that might be constructed might resolve some of these issues.

Keith Bristow

I am not confident that they will resolve them, but they will probably clarify them.

The Chairman

Before Lord Butler asks his question, do any of your colleagues have any comments to make on this?

Richard Berry

Sir, if it would be helpful, the subsection that we are referring to is subsection (4) of Clause 47, which is entitled “Additional restrictions on grant of authorisations”.

Lord Butler of Brockwell

I am puzzled, like Dr Murrison. Are we to understand that you could not request communications data to establish locations of suspected persons?

Keith Bristow

If it is for the three purposes that we have set out—

Lord Butler of Brockwell

Which are—

Keith Bristow

If it was a communications website, for instance, if we wanted the internet connection record for a Twitter or Facebook account—an account that is used for communication—we could request the data, and under the Bill the data would be retained and in a format that we could access. We are talking about websites that are not about illegal content, are not communications websites—bearing in mind that these terms are yet to be defined—and not IP resolution. Those are the areas where we understand that we could request access to the data that the service providers have retained on internet connection records.

Lord Butler of Brockwell

So we are only talking about internet connection records; we are not talking about mobile telephone records.

Keith Bristow

We are talking specifically about ICR.

Lord Butler of Brockwell

This is the distinction: we could still get mobile telephone records to establish the location of a suspect.

Keith Bristow

We could if a mobile phone was used as we currently understand it and as it has been used historically, but of course the really big challenge here is that people are communicating in a different way over the internet. We are confident in our interpretation that we could request access for communication sites, but our understanding is that we could not request the internet connection record of another type of website that might give us an investigative lead, such as one for booking travel tickets or banking.

Lord Butler of Brockwell

It seems to be a very big gap.

Victoria Atkins

Following on from that, would you still be able to contact let us say the travel agency, using your example, to ask whether it had business records to show that this request was made and that X number of tickets were bought?

Keith Bristow

More traditional investigative techniques could be used, but we need the lead in the first place on which travel agent we need to contact. Making the analogue-versus-digital point, the person will not have gone into somewhere on the high street; they will have interacted online. That will be the challenge.

The Chairman

It would be useful when this session is over if you gave us some written evidence with respect to some of the points that you have just made, because, as you can see, members of the Committee are interested in them. Can I ask a question myself here? It regards current oversight powers. How do the investigatory powers that you currently possess work at the moment? What sort of oversight is there? Will there be a change as a result of this Bill?

Keith Bristow

I will ask Chris to deal with that question, but I will just make a remark to start with. We think that the authorisation and the scrutiny regime is hugely important, because public confidence is what underpins our ability to keep the public safe. It seems to us that because we cannot expose all our operational tradecraft, because we would be exposing it to the very people we want to tackle, we have to have a very clear regime that gives the public confidence that those sensitive techniques are being properly scrutinised. We think this is very important.

Chris Farrimond

There are two aspects to authorisation and oversight, and they are two quite separate parts. The authorisation process for some of our activities is internal, and some of it goes up to the Secretary of State. In each of those cases, whatever the investigatory power is, we go through a process whereby the applicant has to write down what they require, the proportionality, the necessity, the collateral intrusion, and give their justification. Then, whatever the application is—whether it is a police Act application for intrusive surveillance, a standard surveillance application, or an application for communications data—each application contains the same different aspects of the information: the proportionality, the necessity et cetera. It will then go through the various parts of the chain. It goes to an authorising officer in every case—as I say, in some cases it goes right up to the Secretary of State. Those records are all retained and they are available for inspection at a later date. We have two oversight regimes at present. One is provided by the Interception of Communications Commissioner’s Office—IOCCO—and the other is provided by the Office of Surveillance Commissioners. The oversight regimes that they use are quite similar in that they come in for a pre-arranged inspection, on an annual basis for the most part, and we open up our records to them, give them access to our systems and let them see whatever they wish to see. For a period of a week, they will go through the records and pull out the ones that they want, and we will provide witnesses in the form of investigating officers, the applicants or whoever they wish to speak to. They will write a report based on that. Under the new legislation we envisage something that looks very similar, except that it contains one body rather than two, which we regard as fairly useful.

The Chairman

Thank you very much indeed. Moving to communications data, Miss Atkins.

Victoria Atkins

This is for all witnesses: how do you use communications data and for what purposes?

Richard Berry

If I might share the statistics with the Committee. Very helpfully, they were published on 20 November by the interception commissioner’s office based on 100,000 communications data applications, so they are a really good data set. It varies massively. In this example, 80% of communications data applications are for the prevention and detection of crime, and 20% are submitted for interests of national security or, certainly in terms of vulnerable persons, to prevent death or injury in an emergency. So there is an 80:20 split there. From the 80% used for prevention and detection of crime, a quarter of those are in relation to police submissions for burglary, theft and robbery—volume crime. Just under a quarter are for drug offences and just under 20% are for sexual offences. Then we have smaller and smaller chunks: 12% for harassment, 8% for homicide, fraud and deception, and violence against the person; and 1% for firearms offences. So there is a very broad spectrum of criminality.

Victoria Atkins

How valuable is this data to your investigations? I will come to prosecutions in a moment.

Richard Berry

It is essential, for example for establishing a lead, a seed upon which to build an inquiry. For example, if we take stalking and harassment, which is a very topical issue, around domestic abuse victims. To be able to establish a particular communication and an evidential line of inquiry around a victim being stalked, would be incredibly useful, in fact – vital, to support and corroborate an allegation.

Keith Bristow

We should remember that communications data for us in law enforcement is evidential. Sometimes we do not need to go any further than the communications data. We do not need to turn it into further authorisations for content. It is the “who, what, where, how”.[3] Sometimes it is sufficient that we prove that to either eliminate someone from our inquiries, to find a vulnerable person or to start the process of bringing an offender to justice.

Victoria Atkins

I will ask you about context and contact in the context of prosecutions in a moment. How valuable is it in relation to successful prosecutions?

Richard Berry

That can very much depend on the case itself. In a conspiracy case where communication between conspirators is part of proving the offence, it is absolutely vital. In terms of other offences, it could be considered vital. But it could also be important, for example, if we knew a particular person was in a particular place when an offence took place. We might use CCTV evidence to corroborate and identify that person in that location. It really depends on the particular offence being prosecuted and the nature of the evidence we are able to gather.

Victoria Atkins

Drawing together not just communications data evidence that deals with context but also cell site analysis of where mobile phones are at certain times of the day, is it possible to draw a timeline of a criminal offence in action that you can then present to the jury?

Richard Berry

Absolutely. It is commonplace now to produce a sequence of events—that is the term we use—and an analytical chart on the sequence of events showing communications and where people work geolocated by their phones, and to supplement that with other forms of evidence.

Victoria Atkins

Mr Lincoln mentioned very briefly an example of a warrant not being extended in circumstances where, for example, the target perhaps has got hold of another telephone. How common is that sort of activity in organised crime gangs?

Richard Berry

Operational security is as important to criminality as it is to law enforcement. People regularly are changing their devices, setting up false accounts and swapping devices. All those tactics and techniques are used. It takes a lot of investigation to be able to understand who is using a device at a particular time, what it is being used for at that time and how it fits into the overall picture of that criminality.

Victoria Atkins

Just to get the point into context, the length of call can in itself help prosecution counsel when suggesting to a jury, for example, that that is the moment at which the drugs were dropped.

Richard Berry

Absolutely.

Chris Farrimond

I offer one or two other examples. One is about the range of use of comms data. The National Crime Agency receives the bulk of referrals in respect of child sexual exploitation on behalf of the United Kingdom. Just from one source, we receive about 1,500 per month. In many cases, resolving that IP address is the only way we can identify the victim or the perpetrator. I am sad to say that in 14% of cases we cannot resolve it at all. There is no way to do it and there is no way of identifying that victim or perpetrator. That is single-source intelligence and, if we did not act on that, there is no other way of doing it. We have similar examples, as will Richard, with missing children where there is no other way of identifying them but for this methodology.

Simon York

Can I give you an HMRC perspective on this? Last year, we made just over 10,000 communications data requests. That supported 560 investigations. I think that those numbers represent the complexity and the conspiracy involved in many of these cases. Almost 100% of our requests were in relation to preventing and detecting crime in contrast to the wider needs of the NCA. This can be in relation to anything from smuggling to tax fraud to trying to criminally exploit HMRC’s repayment systems. Literally billions of pounds are at stake here. Last year, investigations where we used communications data and intercept together prevented around £2 billion loss to the UK Exchequer. That is how important it is to us.

Victoria Atkins

Is it fair to say that a lot of those investigations involve serious organised crime gangs?

Simon York

Almost all of them, yes.

Lord Butler of Brockwell

Leading on from that, was I right to understand that you were saying that internet connection records although useful are not, as defined in the Bill, sufficient to help you to identify all senders, the users of all IP addresses?

Chris Farrimond

Some IP addresses are more difficult to resolve than others. A standard home broadband is a static IP and it is relatively easy to resolve down to an address. When you use your mobile phone, your IP address is allocated to that phone just for the few seconds that you make that search and then it is allocated to someone else somewhere else in the country. It is really complicated. The IP addresses get swapped around mobile phones, tablets and everything else around the country a lot of times per day. Trying to get complete resolution for some of the more complex ones is not possible at the moment. We believe that ICRs will allow us to close that gap quite considerably.

Lord Butler of Brockwell

Right, but it will not close it completely. I understand that you cannot always resolve IP addresses, but if you get internet connection records you can identify the users of the address.

Chris Farrimond

I am afraid that my knowledge of technology is not good enough to give 100% on this, but we believe that it will massively close the gap. It could be up to the whole amount.

Lord Butler of Brockwell

Just going back to the three purposes for which you can use it, you say that you can attribute connection from an IPR. Then you could discover that someone had been a user of Facebook. How does it help in a criminal investigation to discover that they are a user of Facebook?

Chris Farrimond

It means that we can ask Facebook. Certainly, when we are talking about vulnerable children, threats to life or anything like that, we find that communication sites of that type are extremely helpful.

Lord Butler of Brockwell

If you go to Facebook, are you going to the content and not just the communications data? Would you seek a warrant? If you did seek a warrant, would that be effective with Facebook?

Chris Farrimond

At that stage we would not need to go for an interception warrant, because we would not be intercepting communications in the course of their transmission.

Lord Butler of Brockwell

I understand.

Chris Farrimond

It would be stored data at that stage, so we would be looking for the stored data that Facebook had in that instance.

Lord Butler of Brockwell

And Facebook would be able to tell you with whom the person who was suspected had been communicating with.

Chris Farrimond

It should be able to do that, yes.

Lord Butler of Brockwell

I understand. Thank you.

Stuart C McDonald

What would you say is the operational case for 12 months in particular being the maximum time for requiring the detention of communications data and internet connection records?

Chris Farrimond

I know that the Home Office, who were here before, gave you some figures. We have a table here that it might be helpful for us to include in our written submission to you, but let me give you some examples. In a 2012 survey right across policing in the UK, of all crime types within 0 to six months approximately 84% of comms data was applicable: that is to say, when we needed it, 84% fell within the 0 to six months, 13% within the seven to 12 months, and 3% in the 12 months-plus. But that does not give the whole picture. For child abuse, only 42% fell within the 0 to six months, and 52% fell within the seven to 12 months. There are also figures for terrorism offences, sexual offences and financial offences. We can give those figures, but this quite clearly shows that the closer you are to the date, generally speaking as soon as the investigators get hold of the case they are going to want to get the data, but sometimes it takes a bit longer, for whatever reason. For instance, we do not immediately get the referrals that I spoke about a few minutes ago involving child sexual exploitation; sometimes it can take a few months for them to come through, which may be the reason for the 52%. Either way, I think it shows pretty consistently that 12 months is a reasonable point at which to draw the line.

Keith Bristow

It is worth differentiating between types of investigation. As an agency and collectively, we sometimes investigate criminals; we are proactive, so we want to know how they were transacting at that moment. With reactive investigations, of course, often we do not know what data we need until an offence has been reported to us and we are some way down the track with an investigation. I suspect that is exactly why, with child abuse, data retention is further down the line in time terms.

Simon York

The position for HMRC is a little different. Our figures show that more than 50% falls into the six to 12 month period. Indeed, quite a lot falls beyond 12 months. We are doing a lot of reactive, or historical, analysis. We have some real-time stuff, perhaps smuggling, but if it is more in the tax evasion area it can be a lot more historical; if it involves the use tax returns, we will not even do that analysis until 12 months after the year ends. We are in quite a different position from that of the National Crime Agency. Overall, we feel that 12 months is a reasonable balance to be struck, but we have a lot of cases that fall within that six to 12 month period.

Stuart C McDonald

Okay. We will obviously need to look in detail at the tables that you provide, but is there not a danger that what you are describing there is practice rather than what is essential. Is there analysis that shows that the information that you get from records that are between six and months old ends up being crucial to a case?

Richard Berry

If I may help with that, there are types of crime that require communications data perhaps two or three years after the offence has been committed and subsequently reported. Boiler-room fraud is a classic example of the picture of the criminality only emerges some years later, so clearly the 12-month period for the retention of communications data is not particularly useful for that particular criminality. Also, criminal justice processes kick in. If we are looking at an alibi or identifying further witnesses, subsequent applications for communications data up to that 12-month period can also be incredibly useful for a particular investigation because of the interests of justice and if the disclosure regime highlights that further inquiries are required by the police at that time. We have not mapped it, but I understand that that kind of data may be produced in the future and we can start to understand the value of data at a particular point in time for a particular crime type.

Stuart C McDonald

Thank you very much. Finally, as far as you are aware, how do such rights of access up to 12 months compare to rights of access that colleagues in other jurisdictions have?

Richard Berry

Our comparison is with the Australians, who have recently been given a two-year retention period. I understand that in the original period the data retention directive was for 24 months, so we are striking a balance in many respects. Twelve months seems to be the period when the optimal value is obtained by law enforcement.

Stuart C McDonald

In terms of internet connection records, this is fairly unique, is it not?

Richard Berry

We do not have that evidence.

Bishop of Chester

This is the first time I have spoken on this matter and I need to declare that I have no interests. Can I go to the question of the length of the period? Is there frustration that it is only 12 months in serious cases in HMRC, for example, where you cannot go back beyond 12 months? Australia has fixed two years. Is this a source of frustration to you in your investigation of crime?

Keith Bristow

I think there is a need to understand the mindset of the investigator. All the best investigators are rigorously focused on doing what they need to do to keep the public safe. Chris has given numbers demonstrating 0 to six months and six to 12 months. There are also numbers that show data after 12 months that would have benefited the investigation. My sense is that there is some science that points to 12 months, but there is also the professional judgment that, when you look at the numbers, the data appears to be less relevant after 12 months. Of course our mindset that is we want every opportunity to protect the public in every set of circumstances, but that has to be balanced against other considerations.