Oral evidence: Investigatory Powers Bill: technology issues, HC 573Tuesday 8 December 2015

Oral evidence, 8 December 2015.

Witnesses

Professor Bernard Silverman, Chief Scientific Adviser, Home Office, Richard Alcock, Programme Director of the Communication Capabilities Directorate, Home Office, and Dr Robert Nowill, Cyber Security Challenge UK Chairman and Herne Hill Consulting, gave evidence.

Chair

Welcome. It is a pleasure to have you here giving evidence at our second session on the Investigatory Powers Bill. Thank you for taking the time. I will dive right in. You may have heard some of the evidence from the previous panel, techUK and BT. We had some discussion about the issue of definitions in the Bill, which is causing some concern among industry and was raised in our first session. We have been discussing the balance between future-proofing the legislation and having definitions that are workable for those in industry. In closing, Mr Hughes made a very important point. He said that it is difficult for business to propose definitions if they are not defining the purpose for which the legislation is defined, yet we are hearing concerns that the definitions are too vague and are making it difficult for businesses to estimate cost and technical feasibility. Could I start with you, Mr Alcock? Do you have concerns that the definitions in the Bill are too vague? Do you think that more work needs to be done to tighten up the definitions?

Richard Alcock

Chapter 2 in part 9 of the Bill sets out the definitions of “communications data” and “content”. That is in response to the challenge that was set by David Anderson QC, who said that we ought to try to define those two things in particular. Telecommunications are by definition very complex, particularly in the internet age. Trying to produce definitions that are robust and will stand the test of time is quite hard, but we have been engaging very closely with industry over the past number of months—talking to them and to colleagues in other comms service providers—to establish the best form of words. We think that what we have addressed in the definitions of service providers, in terms of communications data and content, is quite clear. People may have their own interpretations, but what we are trying to do through the Bill is to set out clearly what is meant by communications data, what is meant by content, and the entities to which those obligations may well apply.

Chair

With the previous panel, we were wrestling with the question of exactly what the definition of equipment might be and whether, with the rise of the internet of things, it might apply to a nanny cam or an autonomous vehicle, whether that would be appropriate and whether it is the intention of the Bill. Perhaps you could help to clarify that, because witnesses to this Committee have not been sure.

Richard Alcock

One of the key aspects of the Bill is necessity and proportionality. In every case where an obligation was served on a particular organisation, it would be subject to very strict tests of necessity and proportionality. I cannot go into specific cases of how that might be applied, for security reasons, but the safeguards are increased significantly through the Bill. We now see judicial oversight for some of the most intrusive warrants that exist, new oversight by a new judicial investigatory powers commissioner and regular reviews of those arrangements.

Chair

Professor Silverman, we have just been discussing the issue of the technical advisory board. Some concerns were raised about the make-up of the board and exactly what its responsibilities would be. In particular, the comments were that there was a desire for the board to consider not just technical issues but also strategic issues, cost and, most of all, legal issues, given that almost everything arising from the Bill will have legal ramifications. What is your view on that?

Professor Silverman

It is obviously a good idea to have an independent advisory board to support legislation of any kind. There are lots of examples across government of boards that do that. Interestingly, of course, all I can talk about professionally is scientific advisory boards. I had not thought about this in detail, but it is a very good idea to have a board that covers things like legal issues as well. I gather that the current technical advisory board has not been consulted very often, which is not a sign that it is no good or not necessary; it may be a sign that the difficulties it is there to resolve have not arisen. In principle, the idea of a broadly based advisory board is important, but it is key that its terms of reference should be properly laid out. If you have a technical advisory board and it is going to mission-creep into legal issues, it is much better that it should have proper, formal legal terms of reference, rather than that it should be a scientific advisory board that then decides that it will have opinions about commercial and legal things.

Chair

If the technical advisory board has not been consulted very often regarding the technical aspects of the Bill, which is quite a technical Bill, have you, as the CSA in the Home Office, been consulted very often on this?

Professor Silverman

Yes. I should explain that we work together very closely. I am regularly at meetings where the progress of the Bill is talked about. I have therefore been aware from the very beginning of what was going on. My job is to make sure that the appropriate Departments of the Home Office have the appropriate scientific and technical capability. To be frank, they know much more about it than I do scientifically. I am very satisfied that Richard and his colleagues have the scientific and technical capability to deal with this. Furthermore, I was very impressed by the consultation exercises they went through. They talked to industry and suppliers and had round tables of experts. I cannot throw the ball to my neighbour on my left, but Robert Nowill was at one of those. I went to one the other day and was very impressed by the openness of discussion and the way in which the team was able to discuss at the highest technical level with the other people there. They were experts of all different opinions and were quite frank. I was very impressed by what was going on.

Chair

Dr Nowill, you were part of those debates and discussions. Some that we have heard imply that there are still some concerns and questions remaining. One, in particular, is how clause 190 will work out. That is the technical feasibility test. Do you have opinions on that?

Dr Nowill

Yes. To answer the first part of your question, the technical round tables went into a good level of detail on many of the thorny problems, including things like encryption and the ability to influence or obtain information from service providers who are overseas, in unfriendly countries. They did so not so much in an ethical sense but in a pure technology sense—can this be done? In terms of where we are on that clause and others around it, what do you want to explore?

Chair

What would be a technical feasibility test that would ensure that inappropriate intercept requests were not made?

Dr Nowill

It depends on what the example is or what the real-life case would be. We would have to have sufficient technology expertise in the room to be able to develop a case study or a use case to see whether it was going to work, in the most complex cases.

Graham Stringer

Professor Silverman, I listened carefully to your answers to the Chair. As the Home Office’s scientific adviser, what advice did you give in the consideration of this Bill?

Professor Silverman

Thank you, Mr Stringer. One thing that I did was to challenge quite hard on section 193(6). I think Richard will remember. I read that in detail and said—

Graham Stringer

You will have to remind me what that is.

Professor Silverman

It is the definition of the content of a communication. It is one of the tricky things. I said that with a communication it has to be explained in ways that I can understand how we will decide what are the communications data and what is the content, because that is one of the key issues that have been raised. We spent quite a long time with the team explaining. I am now content that that has been thought through. It is the difficulty of expressing science in legalese. I am now content that they have worked hard at doing something that is quite difficult to understand in plain English but satisfies both a legal and a scientific requirement to give us a proper definition that will work of the distinction between the who, when, what and how, which are the communications data, and the content—the text of an email or something like that. That is an example of the sort of detailed challenge that I gave.

Graham Stringer

Were there any other areas where you gave scientific advice? There is a second question, which may as well go at the same time. Did you give advice, as you mentioned to the Chair, about the structure of scientific advisory committees, how they should relate to one another and how quickly they should produce protocols?

Professor Silverman

No, I did not do that. Of course, as you know, I have done this for other committees, and we would do that. That is the sort of thing that would be worked out under codes of practice, but I would be very happy to do it.

Graham Stringer

Did you want to say something, Mr Alcock? You looked as though you were bursting to say something.

Richard Alcock

No. We have worked, and my team has been tested very thoroughly by Professor Silverman and by colleagues in industry and academia on the preparation of the Bill.

Graham Stringer

What communications data should law enforcement agencies have access to that they do not access already?

Richard Alcock

The Investigatory Powers Bill brings together a number of investigatory powers in response to three independent reviews—the review by David Anderson QC, the Intelligence and Security Committee review and the RUSI review. Right now, law enforcement can access communications data, where necessary and proportionate. For serious organised crime, interception can be granted by Ministers. The challenge with moving technology is that the kind of information required for some law enforcement investigations is not available, because it is not retained by certain communications service providers. One new power that the Bill brings forward relates to what are called internet connection records. In simple terms, that means identifying the communications service that a person was using online at a particular point in time. Of course, what the Bill tries to do is to retain those data relating to individuals, but it also sets out clearly the terms under which the data can be accessed. Those three terms are as follows: one is to identify a person from a particular IP address—an internet protocol address; the second is to identify a person who may have been using an illegal website; the third is to identify what communications service an individual may have been using over time. Those internet connection records cannot be used for any other purpose. Part of the Bill brings forward a new legal sanction whereby misuse of those retained data can result in imprisonment, so you have very strong safeguards. The intention is to create a new class of data—internet connection records—and to store those data, but to access them under those three strict terms. Law enforcement is satisfied, as are the agencies, that that will help them in their fight against crime. To give you one operational example, the Child Exploitation and Online Protection Centre, which is now part of the National Crime Agency, recently did an investigation into child sexual exploitation cases in relation to the exchange of indecent imagery. They say that 14% of those cases could only have been resolved had comms service providers retained internet connection records. That is exactly the kind of thing that we are trying to address by bringing forward the new power.

Graham Stringer

Do you think that all the gaps that the security services felt were there and that you have just outlined have been plugged?

Richard Alcock

What we try to do through the Bill is provide an array of different capabilities that give law enforcement and the agencies an array of different powers to meet the operational needs. There may be instances, in some cases, where the powers in the Bill will not be able to satisfy operational requirements, but we will continue to work with industry, which is really important, and with operational stakeholders to ensure that we have an array of capabilities. Again, those will be subject to strict oversight, safety and security controls.

Graham Stringer

To ask the Chair’s question again, following those questions, do you think that the Bill is future-proofed? Do you think that you will be back here in two or three years’ time saying that there are more gaps?

Richard Alcock

I would not anticipate revising the Bill in two or three years’ time. From the work that we have done and the work we have discussed with industry, academics, comms service providers and, importantly, the operational stakeholders, we feel that the powers that are made clear in one place, in this Bill, will meet the operational requirements for the foreseeable future.

Graham Stringer

Is the Bill having any impact on the current practices and capacities of the security and intelligence services?

Richard Alcock

In what context?

Graham Stringer

Just the fact that it exists. Is it changing practices?

Richard Alcock

There is an array of legal bases on which the agencies and law enforcement carry out certain operations. The only new power outlined in the Bill is that in relation to internet connection records. There is a strong legal basis for all the other powers that are contained in it. What we have tried to do in bringing forward the Bill is to bring everything together in a single place that is hopefully more easily understood, clearer and transparent for the public, so that they understand the totality of investigative capabilities that exist. We are increasing safeguards as part of this package, and rightly so. From working with operational stakeholders, we do not feel that those safeguards will have any operational impacts, if that makes sense, but the Bill will provide greater oversight.

Matt Warman

As Richard Alcock knows, we have been talking about this in the Joint Committee on the Bill. One thing that has come up there quite often is the issue of technical capability notices and what they might cover. Could you talk a little about what the technical capability notices in clause 189 might cover and whether it would include encryption?

Richard Alcock

In the context of communications data, we would define the kind of information or fair data fields that we would want a comms service provider to retain for a period of up to 12 months. The process by which we would do that is not as simple as engineers in the Home Office working up a list and then sending it to a supplier. We work very closely with the comms service providers, even before serving a notice, to understand the technical feasibility, practicality, costs and robustness of the arrangements, noting that in the context of communications data all the data that are retained and used, where necessary and proportionate, have to be built to an evidential standard. Once that was done, we would serve a written notice, signed by the Home Secretary, on those suppliers, defining the specific fields and data fields that we wished to collect. Those fields will be a function of the different industry suppliers, by virtue of the fact that all the back-office and technical systems are quite different, depending on which comms service provider you are talking to.

Matt Warman

At the Joint Committee, we heard Sir David Omand, for instance, say that he did not anticipate that notice including a request to decrypt stuff that is end-to-end encrypted. Is that your understanding as well?

Richard Alcock

In the context of interception, section 12 of RIPA mandates that there is an expectation that information is provided in the clear, effectively, by those on whom a notice is served. It may be the case that a service provider has certain encryption arrangements, but when you are putting someone on interception cover you want to be able to understand the content. There is an expectation—a clear mandation, in fact—that data will be provided to law enforcement in the clear, as has been the case. This Bill does exactly the same as section 12 of RIPA.

Carol Monaghan

The previous panel was quite clear that any compliance costs should be met by the Government, rather than the businesses. TechUK asked whether the figure of £174 million was a benchmark or a limit. First, can I ask how the compliance costs on businesses were estimated?

Richard Alcock

The costs outlined in the impact assessment associated with the Investigatory Powers Bill of £174 million, to which you refer, are the capital costs of implementing internet connection records. Right now, my team are working with industry to put in place data retention systems and associated infrastructure, under existing legislation. We work with industry and provide data retention stores, which hold comms data. Data are accessed when necessary and proportionate. By virtue of the work that we have done with industry, we have formed quite a good relationship with some of the suppliers. We understand their architectures and we have evidence of historical costs. In terms of internet connection records, we worked over the summer with the service providers we are likely to place notices on. We shared information and projections over data volumes and estimates of historical costs for particular types of implementation, noting that those will vary over time, because comms service provider systems are constantly changing, either for technology’s sake or by virtue of mergers and acquisitions. We have had a number of bilateral and multilateral meetings with those providers to go through some of our assumptions. To answer your question, we have done a lot of work with a number of different people. We have a body of knowledge and historical costs from the work that we are doing now. From that, we have put together an assessment of the likely costs of implementing internet connection records over a 10-year period, noting that we will probably phase things in waves. We would not be able to implement everything in one place, as there is only so much industrial capacity. We would phase it over time. To give you an example of some of the numbers that were cited at the Joint Committee, last year we spent in the order of £19 million, in terms of capital costs for data retention. The cost, divided over 10 years, is about £17 million additional per year, so effectively we are doubling the capital cost for retention to implement internet connection records, noting that we already have systems in place and that the £174 million does not include the costs of what we do at the moment.

Carol Monaghan

Does your latest assessment tally with this figure of £174 million?

Richard Alcock

Yes, for ICRs—internet connection records.

Carol Monaghan

Okay. Does the figure for compliance cost allow for the possibility that the Bill’s measures might be applied to all communications service providers?

Richard Alcock

We work with operational stakeholders to identify the comms service providers from which we are most likely to get operational benefit. There are in the order of 200 or 300 organisations that would class themselves as comms service providers in the United Kingdom. In relation to comms data, we will certainly not place obligations on every one of those providers. As I said, we will already have spoken to those that are likely to have notices placed on them.

Chair

We have had some questions raised about what the £174 million will be relevant for. You said capital cost. Does that include the capital cost of securing the data?

Richard Alcock

Yes. When we place a notice on a comms service provider, it will include security provisions; things will have to be built to a certain standard. There are separate costs in relation to annual oversight. The Information Commissioner, for example, has oversight. My team also conducts individual independent audits of systems on an annual basis, but those systems do not go live until such time as they have met the implementation standards, which we would define as part of the notices that we served on comms service providers.

Chair

What about any increased revenue costs, such as requiring higher skills in the companies so that you had the requisite security knowledge to retain such bulk data?

Richard Alcock

In the majority of cases, our data retention stores are completely separate from the business systems that exist within comms service providers. Effectively, they are subject to their own security arrangements. We have very high standards, as you would expect, for the security of the data that we require CSPs to keep.

Stella Creasy

It is quite interesting to hear you talk about this, versus what the companies are saying about it. One point that they made—I think that what you are saying backs it up—is that the question of cost in itself will be used as a metric for the proportionality of the request made. What happens if you disagree?

Richard Alcock

I do not necessarily—

Stella Creasy

What happens if the companies disagree about the assessment that you make of how much it should cost for them to retain data to meet the requirements that you are making?

Richard Alcock

We continue to work with the comms service providers. As I said, their systems are always changing. We have produced cost estimates. Those cost estimates may vary, depending on the different CSPs. We are working and continue to work with industry bodies to validate and test how those things would be implemented over time, but it is a best estimate.

Stella Creasy

I appreciate that, but, as you heard, the previous panel was quite clear; they would like to see all compliance costs in this legislation, to accommodate some of the points we are talking about. You are talking about a negotiation process.

Richard Alcock

No. I am saying that the Government meet reasonable costs.

Stella Creasy

As we all know, one person’s reasonableness is another person’s unreasonableness. What happens if there is a disagreement? Obviously you will be able to serve a notice. How does that accord with working with those companies?

Richard Alcock

I can go only on historical precedent. So far the Government have paid 100% of the costs relating to implementation.

Stella Creasy

Okay. That raises a number of questions for us on the technology of this. Are we committing to 100% of the costs? If not, what mechanism is there within the Bill to resolve disputes over what the costs should be?

Richard Alcock

The Bill makes it clear that we will place an obligation to pay reasonable costs and will meet those reasonable costs. The fall-back, if there is a disagreement, is to go through the technical advisory board, which will have considered the technical implementation. If it was not possible for a particular organisation to implement things for a certain cost, that would be addressed through the TAB.

Stella Creasy

What obligations are there on the technical board to resolve this? Obviously the large-scale collection of data will be a prize for many people to go for. If, for example, the cost of securing data to a standard is disputed, you are suggesting that this panel will—

Professor Silverman

The proposed membership of the board “includes persons likely…to represent the interests of the persons on whom obligations may be imposed” and “persons likely…to represent the interests of the persons…on whose behalf applications for warrants” are made. This goes back to the protocols that Mr Stringer mentioned would be a very good idea. The technical advisory board would have on it expertise in both directions. It would be a good idea, therefore, for the protocols to include what you would do in case of a dispute over some of these things.

Stella Creasy

But we cannot rule out the possibility that companies could be served with a notice, having disputed the costs and having been unable to resolve that dispute within the panel. Presumably, there could be prosecution consequences for those companies if the issues cannot be resolved.

Richard Alcock

I am very confident that we would be able to resolve the issues. There is an absolute commitment from Ministers that we would make reasonable costs. We genuinely have a very good relationship with all the UK service providers in particular.

Stella Creasy

There is a flipside of that. If there is a general assumption that the Government will meet 100% of the costs, how robust do you think the £174 million calculation is? Given that you have always met the costs, because we have never wanted to go down the route of litigation or prosecution, what accountability will there be to us in Parliament, for example, for those costs?

Richard Alcock

We are working with operational stakeholders to understand where we would accrue most operational benefit from the retention of particular data types. Through that work, we have come to our best assessment of the organisations on which we would be likely to serve notices. We have worked with those organisations to establish best estimates, noting all the examples that previous witnesses have given, but we continue to work with industry to validate some of the assumptions, noting that we will need to do some detailed engineering work really to hone down some of the figures. I would expect us to go through a process, possibly, of looking at providers again and prioritising some over others.

Stella Creasy

That is my final question for you. You said that you probably would not place obligations on all comms providers. Clearly you have good relationships with some, which might mitigate issues through the panel, were there to be a dispute. Does that rather create the presumption that there might be companies you would not deal with, if they were sticking on the costs? Might that create a loophole of providers who might be more amenable to be used by people we might not want to use them? If cost is going to be one of the questions about proportionality, does that create a gap in the system?

Richard Alcock

I would not associate costs with proportionality. There are two things: necessity and proportionality.

Stella Creasy

That is what you said previously about understanding and using costs as a way of determining proportionality.

Richard Alcock

It is about understanding where best to make capital investments to meet the operational requirements. I should have said that it is about understanding how best to balance the investment. That is the best way of phrasing it.

Stella Creasy

So it makes more sense for you to negotiate with the bigger companies, say, and therefore—

Richard Alcock

Primarily, work will be guided by operational stakeholders. If we know, for example, that there is a particular organisation where we really need to get access to the data, we will work with that company. We will resolve technical issues and we will resolve the cost issues to meet the operational requirements.

Stella Creasy

Both of you will have big sticks. The companies can hold out, and the Government can threaten to serve a notice.

Richard Alcock

For a number of years, we have managed to maintain very productive, very constructive relationships with UK providers.

Stella Creasy

As long as someone picks up the bill.

Richard Alcock

We will make reasonable cost provision.

Victoria Borwick

We are back on electronic protection. There is reference in the Bill to the “removal of electronic protection.” Do you think that is a route to compromising encryption?

Professor Silverman

Scientifically, no. Encryption is very important. Without encryption, of course, you could not do electronic banking, order things online and do all sorts of really important legitimate internet activity. My understanding of the Bill is that what has to be removed is the electronic protection that the service provider itself has put on the message. It is not removing encryption; it is removing electronic protection. I do not know whether Richard wants to go into more detail on that, but the short answer is that there is no threat to encryption as such.

Richard Alcock

It goes back to my previous point about provision of data in the clear. Companies may have all manner of different encryption equipment, which Government support. At the same time, when a notice is served to provide intercept data, the expectation is that those data will be provided in intelligible form—in the clear.

Victoria Borwick

Dr Nowill, do you want to add to that?

Dr Nowill

It may not always be possible, which I think is your point.

Victoria Borwick

Yes.

Dr Nowill

The ISP or CSP could unwrap whatever they have put on, but if the underlying data stream is encrypted by something proprietary and unknown and is originating and terminating overseas, you would probably have the devil of a job digging into it.

Victoria Borwick

Do you think that there is any way that the Bill could provide a means of balancing and reconciling those points? Obviously there will be competing demands for gaining access to encrypted communications, which we have talked about, and protecting such communications. As you say, people do not want their bank details to be hacked into. Do you think that there will be some in-built review mechanism? How would you envisage taking this forward and checking on it six months later, to see that it is working as people want it to work?

Dr Nowill

It is hard to generalise. It would be a case-by-case thing. It depends on what the underlying data are, what the operational requirement is and what the encryption is. It is difficult to say, “Yes, we would just do this,” because the “this” would not be constant.

Victoria Borwick

Inevitably, the skills involved are constantly ongoing, improving and developing. As you say, it is not quite a fixed position. Does anybody else have any views on maintaining that?

Richard Alcock

I go back to the point that I keep making. It is about forging constructive working relationships with the comms service providers. All comms service providers are different. All systems are different. We need to work out pragmatic ways in which we can satisfy requests from the UK Government.

Chair

The argument that we have been hearing and the questions that have been coming to us arise from clause 189(4) (c), putting an obligation on CSPs “relating to the removal of electronic protection,” the question being whether companies would be forced to replace products because some have end-to-end encryption at CSP level but others have it at user level. This is related to the point that Dr Nowill was making about whether there was third-party encryption. The question is whether companies would be required to change their entire business model in response to the Bill, in terms of encryption. That is quite an important point to clarify.

Richard Alcock

Going back to what I said, the expectation is that, when served with a notice, providers would provide us with data in the clear. That would involve working with the particular provider of the day to work out how best that could be achieved.

Chair

You are looking frowny, Professor Silverman.

Professor Silverman

No.

Chair

Would you like to add to that?

Professor Silverman

No. I have nothing to add to that.

Dr Mathias

What role do you envisage for DPI—deep packet inspection—either currently or in future practices?

Richard Alcock

Deep packet inspection technology is used by comms service providers all the time right now for network monitoring and such things. One way in which internet connection records might be implemented off switch—not in an individual’s business systems—would be through the application of deep packet inspection technology to collect the communications data from the system. That is one way in which that could be done. DPI is used all the time by CSPs now. They are very familiar with the technology. The suppliers that we use in support of our work are very familiar with the technology. Again, it depends.

Dr Mathias

Does that technology blur the content/data line?

Richard Alcock

The key thing is that within the Bill we have clearly defined comms data and content—I hope. What we would seek to do through the implementation of any technical arrangements would ensure strict compliance with those definitions. The answer is no. We would absolutely ensure strict compliance with the definitions, as Parliament will, hopefully, agree.

Dr Mathias

You do not think that it is unnecessary snooping.

Richard Alcock

I do not recognise the term snooping. We have clear powers in the Bill. We are trying to implement those powers in a technically robust way, and we are confident that we can do that.

Dr Mathias

What do you mean when you say that you do not understand the term snooping?

Derek Thomas

He doesn’t recognise it.

Dr Mathias

You do not recognise it.

Richard Alcock

This is an Investigatory Powers Bill. I know that it has been characterised as a snooper’s charter by some, but it is an Investigatory Powers Bill.

Chair

He does not agree, Tania.

Professor Silverman

Snooping would be illegal, because I would take snooping to mean exactly the inappropriate looking at things. The offence that is introduced here is looking at things you are not allowed to look at. That is snooping. Inspecting something when a warrant hasn’t been signed by the Home Secretary, a judge and so on—

Richard Alcock

With strict safeguards.

Professor Silverman

Yes, with strict safeguards. I am going beyond my scientific remit, but snooping is banned by the Bill. Snooping will get you two years in prison.

Richard Alcock

It will.

Dr Mathias

Two years.

Professor Silverman

Whatever the offence is.

Graham Stringer

It is a definitional argument, isn’t it?

Professor Silverman

Yes, it is.

Stella Creasy

It is a bit like reasonableness. It is one thing in one man’s eye.

Chair

Professor, we are very happy for you to go beyond your remit at any moment you feel inclined to comment. I would like to thank the panel. We are about to have a vote, so I will bring this evidence session to a close. Thank you for the evidence we have received. Some of the evidence from this panel is reassuring. Some of it is quite contradictory to evidence that we have received from other witnesses. I hope that we may be able to write to you for points of clarification going forward, but I thank you for the time that you have given us today. I wish you luck as the Bill proceeds through the House. Oral evidence: Investigatory Powers Bill: technology issues, HC 573 21