My Lords, I am very grateful to all noble Lords who have commented on David Anderson QC’s review. I take this opportunity to thank Mr Anderson for undertaking that review and I welcome his comprehensive report. The history of events leading up to the commissioning of that report was well rehearsed by the noble Lord, Lord Rosser. Mr Anderson
was supported by an expert, security-cleared team of his own choosing. The Government, and in particular the security and intelligence agencies, provided Mr Anderson and his team with all necessary information, access and assistance for them to undertake the review effectively. As the report itself makes plain, almost 250 members of the security and intelligence agencies have been involved in the review, dedicating over 2,000 man-hours to support it. This has ensured that Mr Anderson has had the necessary resources to undertake a detailed assessment of the operational case for bulk powers in sufficient time to inform today’s debate.
As has been said today, the report sets out in extensive detail the review’s working methods and the sources of evidence that have been used to determine whether the operational case for bulk powers has been made. As noble Lords will have observed, these sources of evidence include: 60 detailed and highly classified case studies; internal security and intelligence agency documents considering the utility of bulk powers, which address shortcomings and failures as well as successes; statistical information on the extent of the use of bulk powers; allegations made by Edward Snowden; and a number of previous reviews, including in the UK and overseas. In fact, David Anderson found that previous reviews were either supportive of the need for the bulk powers or that they were in some cases not relevant to the UK context.
In their consideration of all this evidence, the review team critically appraised the need for bulk capabilities, including considering whether the same result could have been achieved through alternative investigative methods. This question has not just been taken on trust. The expertise of the review team has meant that, in the words of Mr Anderson, the security and intelligence agencies have been put,
“to strict proof of what they assert”.
In relation to the scope of the review, David Anderson was specifically asked to consider the operational case for bulk powers. The sensitive nature of those powers means that this task rightly had to be conducted by a security-cleared review team. But the safeguards that apply to those powers are, rightly, a matter for Parliament to consider as part of our ongoing scrutiny of the Bill’s provisions. The Government are clear that the Bill ensures that robust safeguards and world-leading oversight will apply to the exercise of bulk powers. For example, every bulk warrant will be subject to the double lock; any subsequent examination of material collected must be considered necessary and proportionate for an operational purpose approved by the Secretary of State and a judicial commissioner; and before issuing a bulk warrant, the Secretary of State must consider whether the same result could be achieved through less intrusive means.
The noble Lord, Lord Campbell, pointed out that the review did not specifically consider whether the use of bulk powers is proportionate. That is true; but it is also true that the question of whether alternative methods could achieve the same result was examined in detail. This question is equally important to the consideration of whether these powers are proportionate
and necessary. The review has concluded that in the great majority of cases, there will be no effective alternative to the use of bulk powers and that where alternatives exist,
“they were likely to produce less comprehensive intelligence and were often more dangerous … more resource-intensive, more intrusive or—crucially—slower”.
I turn now to the conclusions of the review in a bit more detail. Taken together, they show that bulk powers are crucial. The report concludes that these powers,
“have a clear operational purpose”,
that they,
“play an important part in identifying, understanding and averting threats in Great Britain, Northern Ireland and further afield”,
and that the contributions made by bulk powers could not be replicated by other means. The review also concludes that bulk powers are vital across the full range of security and intelligence agency activity, including counterterrorism, cyberdefence, child sexual exploitation, organised crime and the support of military operations, and that they have been used to disrupt terrorist activity, prevent bomb attacks, facilitate the rescue of hostages, thwart cyberattacks and save lives.
This is a vital point. Mr Anderson is clear that questions of necessity cannot be entirely divorced from questions of proportionality. The noble Baroness, Lady Hamwee, rather neatly brought us into the domain of moral philosophy. The review concludes beyond all doubt that, were it not for the bulk powers, there would be more successful terrorist attacks, more successful cyberattacks, more dead hostages and military personnel and more abused and exploited children. It is now for Parliament to decide whether the powers that have prevented such atrocities are proportionate, given the threats faced by the UK and our European and other allies around the world, given the extensive safeguards and oversight provided in this Bill, and given the review’s conclusions that there are no effective alternatives. The Government firmly believe that they are.
Turning briefly to the individual powers under review, the report concludes that there is a,
“proven operational case for three of the bulk powers”,
with reference to bulk interception, bulk acquisition of communications data and bulk personal datasets.
In relation to bulk interception, the report concludes that it is of “vital utility” to the security and intelligence agencies and that alternative methods, alone or in combination, fall short of providing the same results.
The review finds that the bulk acquisition of communications data is,
“crucial in a variety of fields, including counter-terrorism, counter-espionage and counter proliferation”.
In addition, the review states that case studies provided to the review team demonstrated that,
“bulk acquisition has contributed significantly to the disruption of terrorist operations and, through that disruption, almost certainly the saving of lives”.
On bulk personal datasets, Mr Anderson states:
“I have no hesitation in concluding that BPDs are of great utility to the SIAs. The case studies that I examined provided unequivocal evidence of their value”.
He goes on to conclude that in “vital” areas of work, such as pattern analysis and anomaly detection, there is “no practicable alternative”.
Mr Anderson’s conclusion in relation to bulk equipment interference, which I will come to in more detail in a second, is differentiated from the other powers under review in that he finds that there is a,
“distinct (though not yet proven) operational case”,
for its use. The reason for this difference is that bulk equipment interference has not yet been exercised. That is not to say that bulk equipment interference is a new power. While it has not yet been deployed, activity that would be classed as bulk equipment interference under the Bill could be authorised under existing legislation but, to date, GCHQ has carried out only equipment interference operations which would have been authorised under a targeted equipment interference warrant under the Bill. While acknowledging that bulk equipment interference has not yet been used, the review still concludes that,
“an operational case for bulk EI has been made out in principle”,
and that there are likely to be cases where,
“no effective alternative is available”.
In summary, the conclusions of this detailed and thorough independent review mean that there can now be absolutely no question that the operational case for the bulk powers in the Bill has been comprehensively made out. It now falls to us to decide whether to continue to provide our security and intelligence agencies with these vital powers to counter the threats we face.
Let me turn to some of the specific questions and points that noble Lords have raised. First, I turn to the issue of bulk personal datasets, which a number of noble Lords referred to. A bulk personal dataset is a dataset containing information about a range of people, most of whom are not of interest to the security and intelligence agencies, for example a telephone directory. A list of people who have a passport is another good example of such a dataset. It includes personal information about a large number of individuals, the majority of which will relate to people who are not of security or intelligence interest. Analysis of bulk personal datasets is an essential way for the security and intelligence agencies to focus their efforts on individuals who threaten our national security. The use of bulk personal datasets is not new, and the Bill does not provide new powers for acquiring them; rather, it provides robust transparent safeguards around bulk personal datasets, including a requirement for warrants to authorise the retention and use of them. The safeguards are comparable to those provided in relation to other powers in the Bill, including the double lock, for example.
The noble Lord, Lord Rosser, pursued these issues, and in particular raised the point in the review where Mr Anderson says that some bulk personal datasets may contain,
“material that is comparable to the content of communications”,
and, in rare cases, even material subject to legal professional privilege. He went on to say it is imperative that,
“consideration be given to the introduction of additional safeguards to the Bill and Code of Practice”.
We are carefully considering whether changes should be made to the Bill and code of practice to address the rare occasions when a bulk personal dataset may contain material comparable to the content of communications or subject to legal professional privilege, and discussions on that are going on at the moment. As David Anderson’s report also makes clear, in considering the sources of evidence, the review team specifically questioned whether similar results could have been achieved by other, less intrusive methods, I do not believe that anyone who has read this detailed and comprehensive report in full could come away with the impression that it did not consider hard evidence on that point.
The noble Lord, Lord Rosser, also flagged David Anderson’s comment that the Government’s operational case for bulk powers,
“categorises the purposes served by the powers under review in ways which lack coherence and consistency”.
The Government’s operational case for bulk powers was published in response to the recommendation of the Joint Committee that scrutinised the draft Bill, but we acknowledged that there was a need for the operational case to be subjected to independent scrutiny. That is why we commissioned David Anderson’s review, and the conclusions of the review are clear that,
“bulk powers have a clear operational purpose”.
The question was raised about bulk powers as distinct from targeted thematic powers. As noble Lords will remember, this issue was looked at by the Intelligence and Security Committee, and I will just quote a short passage from the speech of my right honourable friend Dominic Grieve MP, who is chair of the ISC, because it helps to inform this question. He said:
“The second issue concerns the agencies’ use of equipment interference. Our concerns focused on the way in which the use of this capability is authorised, rather than on the need for it, which is clear to us. In particular, we were not initially provided with evidence that explained the need for a bulk power, as opposed to a targeted thematic one. That is why we reported in the way we did. Following publication of our report, we received additional evidence from the agencies as to why they need bulk equipment interference warrants to remain in the Bill and they actually made a persuasive case. More importantly, the Committee was reassured that information obtained by such means will be treated in exactly the same way, with exactly the same controls, as data acquired under a bulk interception warrant. The Committee is therefore broadly content that there is a valid case for the power to remain in the Bill, but, just as with bulk interception warrants, we want to see the safeguards and controls in detail and hope to do so in the near future”.—[Official Report, Commons, 15/3/16; col. 838.]
I hope noble Lords will appreciate that we have been around this course before. There is a need for both powers, as I hope will now be accepted.
5.30 pm
However, I was asked about the difference between big data used by the security and intelligence agencies and data that other parts of government hold, or indeed data collected by business. Data sets compiled or used by different parts of government are used in a huge variety of ways, but they are primarily designed to help to deliver services as effectively and efficiently as possible. In an intelligence context, bulk personal data sets are held expressly for the purpose of helping the intelligence agencies in protecting national security
and counterterrorism, combating proliferation and serious organised crime and safeguarding the UK’s economic well-being.
As outlined in David Anderson’s report, A Question of Trust, commercial companies hold a vast amount of data about individuals, including many that can be bought and sold by data brokers. He states:
“It may be legitimately be asked, if activity of a particular kind is widespread in the private sector, why it should not also be permitted (subject to proper supervision) to public authorities”.
I think that is the right way of looking at it. We should remember that the Information Commissioner provides oversight of how other parts of government and business hold and use data under the authority of the Data Protection Act and other legislation but, to state the obvious, the use of data by the private sector is outside the scope of the Bill. Of course it is an important issue but it is not one for us to deal with today.
The noble Lord, Lord Strasburger, asked about bulk equipment interference. It is unique among the powers reviewed by David Anderson in that, while permissible under the existing statutory framework, as I have explained, it has not yet been deployed; however, it is not a new power. Equipment interference operations have always been designed and delivered in line with the legal framework in force at the time. The existing legal framework does not have bulk equipment interference as a bespoke concept. However, all agency operations have been conducted in ways, and with safeguards, that have ensured that they are necessary and proportionate and that they comply with the current legislative framework. The new Bill creates a new bespoke statutory framework for bulk equipment interference that ensures the same strong safeguards across the piece.
The value of bulk interception to find threats overseas, while still enormously important, is of declining value as there is a greater use of encryption. Bulk equipment interference will help the security and intelligence agencies to maintain their ability to understand what is happening in, for example, Syria. A bulk equipment interference warrant will be required when the material that is expected to be acquired needs careful sorting after acquisition to filter out and destroy excess information, whereas thematic equipment interference will be used when the subjects can be more clearly targeted.
I was asked about internet connection records and legislating to acquire ICRs in bulk now. There are no plans to acquire ICRs in bulk at present. To be clear, the safeguards that apply when acquiring communications data in bulk would apply equally to all types of communications data. It would not be right to differentiate between different types of communications data, given the strong safeguards in place for the bulk powers. The point here is that we are seeking to legislate not just for the technologies of today. We have quite purposefully sought to make the Bill technology-neutral.
To seek to legislate for the power to acquire ICRs in bulk in future would highlight a change in the intelligence agencies’ requirements. Obviously, highlighting gaps in capabilities and indicating when the powers in the Bill may be used in certain ways can give criminals and terrorists an advantage. It goes without saying that
that could endanger national security. It would not be sensible to broadcast to terrorists and serious criminals that we intend to implement a new capability from a certain date, which is exactly what we would be doing if we required the agencies to come back to Parliament every time they needed to update the technologies.
Speaking of technologies, I want to address the contents of the amendment. The Government absolutely agree with Mr Anderson’s assessment that those authorising, approving and overseeing the exercise of bulk powers must be alert to the impact of technological change on their utility and impact. I am sympathetic to the amendment, and we are giving very careful consideration to Mr Anderson’s recommendation. The noble Baroness, Lady Hamwee, asked what more the Government need. My answer is that what we need and hoped for are the views expressed by the Committee. I listened with particular care to the noble Lord, Lord Carlile, who gave us his views on Mr Anderson’s recommendations. I am grateful to him and we will consider very carefully what he said. It is precisely because we did not want to pre-empt today’s discussion that we have remained silent on the issue. The review was specifically commissioned to inform our debates. We will listen carefully and respond shortly, when we are in a position to consider in the round both the findings of the review and the subsequent debate in the Committee.