My Lords, first, I express our thanks to David Anderson QC, the Independent Reviewer of Terrorism Legislation, for his independent review of the operational case for the bulk investigatory powers contained in Parts 6 and 7 of the Bill, including the Operational Case for Bulk Powers document published with the Bill. The review came about as a result of pressure from the shadow Home Office team during the passage of the Bill in the Commons and is intended to assist in our consideration of the need for the bulk powers in the Bill.
While there had been three preparatory studies, pre-legislative and legislative scrutiny by a number of parliamentary committees, and the Government’s presentation in March of the operational case, consideration of the Bill had not included an authoritative, independent analysis of the operational case for the bulk investigatory powers in Parts 6 and 7. This is now the first opportunity we have had to discuss Mr Anderson’s report as it was not available either at Second Reading or the days spent in Committee prior to the Summer Recess.
The review by David Anderson, which became available last month, considered the operational case—whether there was one, and the strength or otherwise of any such case—for four of the powers in the Bill, namely: bulk interception, bulk equipment interference, bulk acquisition of communications data and bulk personal datasets. These powers can be used only by MI5, MI6 and GCHQ. It seems that the UK is one of five EU member states, the others being Germany, France, the Netherlands and Sweden, which have detailed laws that authorise the conduct of activities similar to at least some of the powers that Mr Anderson was asked to review.
In chapter 4 of his report Mr Anderson sets out the methodology by which he sought to evaluate the operational case for the powers under review. In paragraph 4.5 on page 72 he states that:
“A frame of reference is needed for the purposes of evaluating the utility or otherwise of the powers under review”.
Mr Anderson says that such a framework is not provided by the Government’s operational case, to which I have already referred, since it,
“categorises the purposes served by the powers under review in ways which lack coherence and consistency”.
He says that he had to ask the security and intelligence agencies to agree a classification against which their claims of utility could be evaluated. Perhaps the Minister can give us the Government’s response to Mr Anderson’s views on the operational case for the bulk powers he was asked to review.
Each member of the review team was in agreement with the conclusions of Mr Anderson’s report and with the single recommendation that he made. The report’s conclusion is that there is,
“a proven operational case for three of the bulk powers, and that there is a distinct (though not yet proven) operational case for bulk equipment interference”.
Equipment interference in bulk as opposed to a targeted equipment interference warrant is a new power. The report also found that:
“The bulk powers play an important part in identifying, understanding and averting threats in Great Britain, Northern Ireland and further afield. Where alternative methods exist, they are often less effective, more dangerous, more resource-intensive, more intrusive or slower”.
Mr Anderson was not asked to reach conclusions as to the proportionality or desirability of the bulk powers, as opposed to the operational case for them, on the grounds that these are matters for Parliament.
David Anderson’s report makes a single recommendation, which is covered by this amendment. That recommendation is that a technology advisory panel of independent academics and industry experts should be appointed by the Investigatory Powers Commission to advise on the impact of changing technology and on how MI5, MI6 and GCHQ can reduce the privacy footprint of their activities.
While the report finds that the bulk powers in question have a clear operational purpose, it accepts that technological changes will lead to new questions being raised and that adoption of the recommendation for a technology advisory panel will enable such questions to be asked and answered on a properly informed basis. I hope that, when he responds, the Minister will indicate where the Government stand in relation to the single recommendation in the report. We fully support the recommendation and the case that Anderson has made for the panel, which we believe should be established as soon as practicably possible.
While there is only a single recommendation in the report—and this is our first opportunity to discuss it—other points and issues are addressed. I should like to take the opportunity to raise some of them with the Government and to seek a response on the record prior to making any decisions about what and what not to raise on Report.
Paragraph 2.84 on page 45 of the Anderson report states:
“It has come to my attention that some”,
bulk personal datasets,
“may contain material that is comparable to the content of communications, and in rare cases even material subject to”,
legal professional privilege.
“In the light of these facts I have already recommended to the Home Office that consideration be given to the introduction of additional safeguards to the Bill and Code of Practice”.
Can the Minister say what action the Government have taken or intend to take in the light of what David Anderson has said in the paragraph to which I have just referred?
In paragraph 2.53 on page 36 of his report, Mr Anderson states:
“The Government has expressly acknowledged that targeted thematic EI”—
equipment interference—
“operations, like their bulk counterparts, can take place ‘at scale’, and that they may cover a large geographic area or involve the collection of a large volume of data”.
He goes on to say that nevertheless the thematic equipment interference power is subject to fewer limitations. He says that, in particular, targeted thematic equipment interference operations,
“can be conducted by a wider range of authorities (including the police) … need not be connected with national security, and … need not be overseas-focused”.
In paragraphs 2.56 and 2.57 on page 37 of his report, David Anderson says that he has previously commented that the widely drawn provision for targeted thematic equipment interference in practice introduces an alternative means of performing bulk equipment interference but with fewer safeguards, and that it should be possible to reduce the scope of targeted thematic warrants,
“so as to permit only such warrants as could safely be issued without the extra safeguards associated with bulk”.
He goes on to say that that comment relates to the desirable scope of targeted warrants under Part 5 of the Bill and not to the powers that he was tasked to review. Consequently, he says that he has not pursued the matter in his report, apart from noting that it would be particularly important for those authorising and approving warrants to ensure that the thematic powers are kept within strict bounds and not used as a means of avoiding or circumventing the restrictions that are quite property being placed on the authorisation of bulk warrants.
4.45 pm
David Anderson concludes his report by saying:
“I hope and expect that the IPC will keep a particularly close eye on this”.
I do not think it is unrealistic to suggest that if this issue had come within Part 6 or Part 7 of the Investigatory Powers Bill, which he was asked to review, rather than in Part 5, and in the light of the comments he has made in his report, David Anderson might have made some sort of recommendation on the point about the use of targeted thematic equipment interference, rather than simply expressing the hope that the Investigatory Powers Commissioner will keep a particularly close eye on this. Since this is also a matter that Mr Anderson has raised previously with the Government, and in the light of his rejoinder in paragraph 2.56 which shows that he does not appear to have been convinced by the Government’s response, what action do the Government intend to take on Mr Anderson’s view that excessive weight is being placed by the Government on the discretion of decision-makers and that it should be possible to reduce the scope of targeted thematic warrants so as to permit only such warrants as could safely be issued without the extra safeguards associated with bulk?
The Bill and the terms of reference of the Anderson review are based on a narrow definition of “bulk powers” and are limited to those powers that provide for data in bulk to be acquired by the Government themselves. Powers to require providers of telephone and internet services to collect and retain their customers’
data in bulk do not qualify as bulk powers, even when intelligence or law enforcement agencies have the power to acquire those data. Referring to bulk personal datasets in paragraph 2.74 on page 43 of his report, David Anderson says that the power to retain and use bulk personal datasets,
“differs from the other powers under review”,
for though, like them, the power in the Bill is exercisable only by the security and intelligence agencies, the reality is that the National Crime Agency, police forces and other bodies also obtain, retain and use bulk personal datasets outside the scope of the Bill, and will continue to do so.
David Anderson goes on to say that,
“it is well known that the analysis of bulk data is already conducted at a high degree of sophistication both within Government and, especially, in the private sector”.
Continuing, he says that the searching of bulk personal datasets by the security and intelligence agencies is performed in a way that is analogous to commercial techniques. However, far from claiming to employ searching techniques any more advanced than those available commercially, Anderson says that the security and intelligence agencies see themselves as “catching up” with the commercial sector. It seems that the examples Mr Anderson and his team were shown appeared relatively straightforward and were not indicative of the use of bulk personal datasets to predict in the highly sophisticated manner attributed to some private sector operatives.
The 2015 Intelligence and Security Committee of Parliament report criticised the absence of,
“restrictions on the acquisition, storage, retention, sharing and destruction of bulk personal datasets”.
This Bill sets out to address those concerns. But how and when are those concerns about the obtaining, retaining and use of bulk personal datasets by all those outside the security and intelligence agencies, including the private sector, going to be addressed? I would be obliged if the Minister could respond to that question in his reply.
David Anderson refers in paragraph 1.20 on page 8 of his report to the principal safeguards applicable to the powers under review. He goes on to say that it remains to be seen whether further safeguards will be needed in relation to certain capabilities, such as accessing communications data as a consequence of EU law. A footnote at the bottom of page 8 refers to the opinion of the Advocate-General in the case of the Home Secretary v Tom Watson MP, involving a legal challenge to the Data Retention and Investigatory Powers Act 2014 and the principal safeguards pressed by the Advocate-General, including prior independent approval and a ban on use for the investigation of ordinary or non-serious crime. Although the opinion of the Advocate-General does not represent a decision by the court, do the Government take the view that the safeguards pressed by the Advocate-General are already incorporated in all relevant sections of the Bill? I raise this point also in light of the fact that Mr Anderson’s terms of reference did not provide for his review to cover the whole range of powers that could be described as bulk powers.
The powers in this Bill which are liable to result in the collection or retention of large quantities of data not relating to current targets but which fall outside the scope of his review include, of course, the proposed new power to require the retention of internet connection records and the power to target equipment interference on equipment in a particular location, for example, which will be covered by the thematic emergency interference power.
In paragraph 2.41(b) on page 33 of his report, David Anderson states that it is not currently envisaged that the bulk acquisition power in the Bill will be used to obtain internet connection records. In a footnote at the bottom of that page, though, Mr Anderson states that he has been told that this is no more than a statement of present practice and intention and that neither the Bill nor the draft code of practice rules out the future use of the bulk acquisition power in relation to internet connection records. Can the Minister say in what circumstances the Government might wish in future to see the bulk acquisition power used in relation to internet connection records, and whether going down this road would necessitate further legislation or a change in the code of practice to which the agreement of Parliament would have to be obtained?
Finally, I come back to the single recommendation in the report for the setting up of a technology advisory panel, appointed by and reporting to the independent Investigatory Powers Commission, to support both the IPC and the Secretary of State by advising them on the impact of changing technology on the exercise of investigatory powers, and on the availability and development of techniques to use those powers while minimising interference with privacy.
Mr Anderson says in paragraph 9.30 of his report on page 128 that he was strengthened in his resolve to make this recommendation by learning of the existence, not publicly disclosed until now, of the scientific advisory committees, or SACs, that give external advice to, respectively, MI5, MI6 and GCHQ. This is not the only matter that has emerged into the public domain in recent months relating to our security and intelligence services and the way in which they function. One only hopes that in future there will be rather harder challenges made about the need to keep information secret which if made public would not constitute a threat to national security or the effectiveness of our security and intelligence services, but which might, if made public, enhance trust over the necessity for the powers that they have, the way in which they are exercised and the safeguards and checks that apply. I move Amendment 194H.