Joint Committee on the Draft Investigatory Powers Bill
Oral evidence: Draft Investigatory Powers Bill, HC 651
Wednesday 2 December 2015
Members present: Lord Murphy of Torfaen (Chairman), Victoria Atkins MP, Suella Fernandes MP, Mr David Hanson MP, Stuart C McDonald MP, Matt Warman MP, Baroness Browning, Lord Butler of Brockwell, Bishop of Chester, Lord Hart of Chilton, Lord Henley, Lord Strasburger
Questions 39-75
Witness: Sir Mark Waller, Intelligence Services Commissioner
Q39 The Chairman: Sir Mark, a very warm welcome to you. We are very grateful for you coming along to talk to us about this extremely important Bill and the changes it makes to the oversight of our services. Have you anything you would like to say before we open up our deliberations, or shall we go straight to the questions?
Sir Mark Waller: I wondered whether I could, in a minute, say things you already possibly know, but just, as it were, set the scene. As you know, I am the Intelligence Services Commissioner and have been for nearly five years. My primary role is to check, after the event, that the agencies have been obtaining warrants and authorisations to carry out some of the most intrusive activities that they do, and that they do it on a proper legal basis. Essentially, my check relates to all intrusive activities apart from interception. Some of those activities are the subject of the draft Bill—that is to say, the equipment interference—but others are not. For example, intrusive surveillance is not the subject of the Bill. I have oversight of two other areas: the first is bulk personal data, which is dealt with in detail in the Bill; and the second is consolidated guidance and the application of the Guidance, which, although it is not in the Bill, will presumably have to be taken over by the oversight body that is forecast by the Bill.
If I may say this in relation to the Bill, I think the present system works very well and provides safeguards. I say that because I see the agencies taking lawfulness very seriously and by taking authorisations very seriously, and I see the same among Ministers and in departments. But I can obviously see that it is impossible to explain exactly what I do very easily to the public, and that therefore there are members of the public who may not have confidence in the system that looks at things after the event, so I can see the merit of having judicial oversight. The way the Bill has it is right: that is to say, the Minister takes the decision and then there is judicial review of that decision. To that extent, I support that aspect of the Bill.
The Chairman: Thank you very much. That was most useful.
Q40 Lord Butler of Brockwell: Sir Mark, having had the privilege of often having you as a witness at the Intelligence and Security Committee, could I pursue the point you have just made? You have said, and certainly from my observation I would agree, that the present system has worked well. On the other hand, having three commissioners has not been widely understood by the public, and that is a fault. In the way it has actually worked, has there been, in your experience, any confusion between the three commissioners as to your separate roles? Indeed, has there been any overlap?
Sir Mark Waller: I do not think there has been any confusion between the commissioners, but there are areas of overlap, undoubtedly. For example, under the present scheme, you may go and get a property warrant, which is ultimately going to lead to an interception warrant. To that extent, in one sense, two commissioners are looking at the same exercise, so there is some overlap. But I do not think there is any confusion. We and the interception commissioner share an office, for example, so it is quite easy—if there is a problem, one can address it. I have never found confusion with Sir Christopher Rose, and now Lord Judge.
Lord Butler of Brockwell: Would you be satisfied with a system in which the new proposed Investigatory Powers Commissioner took over all the roles of the three commissioners? Does that need any further amendment to the Bill, or is the Bill satisfactory in that respect?
Sir Mark Waller: The trouble with one commissioner trying to deal with what all three commissioners deal with at the moment is that it is just far too much for one man. In relation to what I do, I am paid for something like 140 days in the year. The interception commissioner is paid for a certain number—I do not know what his days are—and then you have the surveillance commissioner. Frankly, although that is all I am doing, as it were, it is more than enough for me. I also worry, to be quite honest, about whether I would like to do the job I am doing 100% of my working time in a year. I am not sure I would. I do not know how to put it, really, but you have to probe and probe, and do your reading. Would I like to be going from one week into the next week all the time? No, I do not think I would. I would find difficulty in thinking that one person could cope.
Lord Butler of Brockwell: Did I understand you right when you said at the beginning that there is one form of intrusive surveillance that is not covered in the present Bill? If I did, should it be?
Sir Mark Waller: In my view, there is an inconsistency if you do not. It is fair to say that it will be covered by the same system that I say works very well, but there is an inconsistency. If you think in terms of intercept being an intrusion into privacy, surely the bug in somebody’s house or somebody’s flat is just as intrusive. It is difficult to think that it is not. I do not quite know David Anderson’s view on this, but, given his previous view that you needed judicial authorisation, I would have thought it must be the same in that area.
Lord Butler of Brockwell: You are telling us that, at the moment, the placing of a bug in the entrance into somebody’s premises is not covered by the system proposed by the Bill.
Sir Mark Waller: That is right, although I think one ought to emphasise that it can happen by virtue of equipment interference. Of course, if there is some equipment interference, that is covered by the Bill; but, if you are just looking at a bug under a sofa or whatever it might be, as I understand it, that is not covered by the Bill.
Lord Henley: Lord Chairman, I am very grateful for you allowing me to come in now. I was going to come in later on, but, after Lord Butler’s questions, I just wanted to ask Sir Mark whether he could say more on what he thought about the extra costs of what is being proposed. Is it going to be that much more expensive; if so, why; and is that justified?
Sir Mark Waller: Let us take those one by one. Why is it going to be more expensive? Well, as I understand it, the costs are assessed on the basis that you are going to have this body, plus the top person and at least four judicial commissioners. I would have thought that was an underestimate. I do not know how they reach the present figures, but it seems to me that that is likely to be an underestimate. If you say that somebody is going to have to look at 100% of the warrants and authorisations, you have already multiplied the task that either the interception commissioner or I do. The interception commissioner talks about 50% in terms of the review; I look at something in the region of 17%. I see the total description of what a warrant involved, and I see 100% of those, but in terms of looking at the paperwork that lies behind it, as anybody who is conducting a judicial review of a decision of the Minister will have to do, in my time I only managed to look at some 17%. If you say, “No, you have to do 100%”, that is a massive amount of extra time. You asked me whether I thought it was justified; I do not think it is.
The difficulty, which I understand, is that the public perception is not satisfied by an after‑event review. I suggested at one time that you might do it by simply notifying a judicial commissioner of every warrant that is issued, giving the commissioner the opportunity to look at it, and him or her having a staff who would point up to them anything that looked problematical.
I am going to say something more that is not in answer to your question. There is a lot of concentration on the authorisation process. My judgment is that people should not be so concerned about the agencies wanting to act unlawfully; they do not. What has to be watched is that there may be a rogue in the agencies who might use the very powerful methods that are available. Rogues do not go and get warrants. One thing that certainly must not get lost in all of this is the oversight required to see that the agencies have the structure and methods in place to ensure there are not rogues, and that anybody doing something in the agency cannot do it without other people seeing. That, in my judgment, is more important than the authorisation process.
The Chairman: That is a very interesting point; I totally agree. You mentioned earlier on that you saw the difficulty of replacing three commissioners with one. Of course, the new structure is that of a single commissioner, but with a team of commissioners working for him or her. What about the problems, though, in the work you currently do as the Intelligence Services Commissioner? We have touched on what they are and how they are different from intercept. Do you think that any of that could get lost in the restructuring, in that there is not a specific Intelligence Services Commissioner in the sense of what you do, as opposed to your replacement? In other words, your replacement has an overall brief for everything, whereas you are specifically dealing with non‑intercept surveillance of one sort or another. How do you think that would work out?
Sir Mark Waller: I hope the Investigatory Powers Commissioner would understand that it is important to have a senior judicial figure in charge of each particular area, including the ones over which I have oversight at the moment. I would have thought that was key. If that happens, there is absolutely no reason why that which I oversee should get lost.
Q41 Lord Strasburger: Sir Mark, it might help us understand your concerns about workload a little better if you tell us how many staff you have working for you and their levels of technical expertise, in particular in relation to CNE.
Sir Mark Waller: I now have three staff, although for a lot of the time I have been operating with one. Technical expertise, no, but we go down and learn from GCHQ, for example, about the CNE activity. I am not too troubled about the fact that I do not have technical expertise, because, in terms of checking what I am checking, which is whether intrusion into privacy is justified, I do not see that I have to have that technical expertise. That does not worry me so much. I also think that the strength of the system I am responsible for at the moment is that I do it. I do not have individuals going in who are not judges; I read the documents, and I am analysing whether the case is made out or not. Maybe I am wrong, but I think that is one of the things that the agencies appreciate and why they take the authorisation process so seriously.
Lord Strasburger: Just for clarification, you are saying that neither you nor any of your staff have expertise in CNE.
Sir Mark Waller: Not technical expertise, no. That is absolutely fair.
Suella Fernandes: Just to follow up, what is your view on the proposal that the new regime of commissioners will be supported by technical experts, will have in‑house legal teams and will have the option to buy out extra specialist advice like legal counsel?
Sir Mark Waller: If I am absolutely honest, I do not believe it is that necessary. I have been dealing with the CNE activity and with the intrusive aspects, and all I can say is that I do not feel I am in any difficulty in understanding exactly what they are seeking the authorisation to do. I can see it. The question is: “Have you made a case that it is necessary to do that?”. I read that case and see it made.
Then the next question is: “Is there an intrusion into privacy?”. The answer is that there will be in relation to the target, but you have to look at whether there is collateral intrusion, because whatever you are attacking may be used by other people. You then look to see, first, whether they have methods by which they keep that to an absolute minimum; and, secondly, whether they have procedures in place to destroy or not look at the material that has been obtained and that they do not need. I do not believe I need a great deal of technical expertise in order to make those judgments, but others take a different view.
Suella Fernandes: That was by way of follow‑up. To put the actual question I wanted to ask, what is your opinion of the proposed new authorisation regime for warrants, including review, in comparison to the old? Do you think it provides a better form of safeguard?
Sir Mark Waller: If you have a judge looking at 100% of the warrants, one cannot but say that it must be better. Do I think the safeguards will actually be greater? I do not think they will, but I think the public require something that is pre‑event. Although I think the present system works, I can see that you may need something before the event, which the present system does not have.
Suella Fernandes: I am sensing from your response that it is more that justice is seen to be done by the public, and that is the sole reason the judicial element is included, but the qualitative, substantive nature of the decision‑making is not necessarily going to be enhanced.
Sir Mark Waller: When you say “justice”, it is a matter of the public having confidence. The agencies require very intrusive measures and this Bill is adding to them. I completely understand that the public have to have confidence and that that should involve judicial review at the pre‑event stage.
Q42 Baroness Browning: Could I ask you about training for the new judicial commissioners? Presumably they will be required to be subject to a vetting procedure despite the fact they have held high office as judges, we understand.
Sir Mark Waller: I doubt it.
Baroness Browning: You doubt they will be vetted.
Sir Mark Waller: I was not, and none of the commissioners, as far as I know, ever have been.
Baroness Browning: Do you think that is a good idea?
Sir Mark Waller: To be honest, it has never worried me, since I was not vetted.
Baroness Browning: Can I worry you now?
Sir Mark Waller: No, I do not think you can worry me, honestly. Remember, we are talking about people many of whom will have sat in the Court of Appeal. They will have had before them cases involving secret material. They are not vetted for that purpose. They are strictly trained in terms of having safes, which they have to have in their room, and they have to go through all the procedures, et cetera. Maybe somebody has been secretly vetting—but, as far as I know, they are not vetted.
Baroness Browning: As to the training element, presumably these will not be people who have expertise in this field to the degree to which they are going to need to apply it. How do you envisage the sort of training needed and, from your own experience, what would be helpful by way of training?
Sir Mark Waller: I can only speak in relation to my position. I am not quite sure what sort of training you have in mind. My predecessor was Sir Peter Gibson. I shadowed him for a period of months before I took on the job, and I went down to the various agencies to discover exactly what it was they were being authorised to do and how it worked. I visited Ministers’ offices as well. At the end of the day, I do not believe my task requires a great deal of training beyond that which I have already had as a judge, in that I am looking to see what case has been made for getting an authorisation.
That is set out sometimes at too great a length, but, on the whole, at length anyway. First of all, it sets out the case of necessity. It is easy for me to judge whether that is a case that has been properly made. Then the second area I am concerned about is proportionality, which is the intrusion of privacy. Once again, it is possible for me to see, first, how that has been limited; and, secondly, at the end of the day, when there is some intrusion into privacy, how that has been justified by the necessity case. I suppose I would have quite liked to go to school and have somebody teach me all that, but I do not think it required me to do so.
Q43 Lord Hart of Chilton: There has been some criticism of the judicial review principles by Andy Burnham and David Davis, who said that the judicial review test gives judges too little power because it only relates to process. David Pannick, on the other hand, has written an article saying, no, that is not right, because it allows a judge full power to look at the merits of a case. I assume by that he means that you could look at it from a Wednesbury point of view as to whether the Secretary of State had properly and reasonably come to the conclusion that he did. I wonder if you can help us a little further in looking at the factors that judicial review would take into account from a commissioner’s point of view.
Sir Mark Waller: I thought Lord Pannick’s article absolutely hit it on the head, in the sense that he said a judge should have vigilance, to make sure the agency is acting within its power and adopting the right test, and then circumspection, acknowledging the superior knowledge of the Executive in national security matters. What I do and what I would understand a judicial commissioner to have to do is, first of all, look to see whether a case of necessity is made. To put that another way, would a reasonable Minister take the view that a case for necessity was made?
It is almost invariable that the case for necessity is made: they say that there is a terrorist or whatever it is. The real question that I concentrate on is the proportionality, because it seems to me that, even on a non‑judicial review basis, you can look very carefully to see, first, the extent of invasion of privacy; secondly, whether there is collateral invasion of privacy; thirdly, whether somebody has measures under which they reduce that to the minimum; and, fourthly, whether they have properly balanced the necessity for getting the material against the invasion of privacy. I think a judge will—and I do—look very carefully at that last one. That is what I understand Lord Pannick to be saying: it is not quite as simple as saying, “Would a reasonable Minister”, et cetera; you look very carefully at that last aspect because that is what you are being asked to look at.
Lord Hart of Chilton: So you think it can safely be described as a double lock system.
Sir Mark Waller: I say that for two reasons. The first is that what must worry members of the public is that these agencies are doing things outside their powers. There is no question but that a judge can look at that and, if they are acting beyond their powers, the judge will stop it. Secondly, because of the area we have just been dealing with, it seems to me that collateral intrusion particularly is something a judge is well capable of assessing, looking at and seeing that it has been properly dealt with. So it is a double lock, yes.
Q44 Matt Warman: It seems to me that the move from retrospective analysis of a decision to looking at it in advance is a shift, and it indicates that you could prevent something from happening rather than complain about it after it had happened. I wonder if you could give us a sense of how often you have looked at things retrospectively and thought that they should not have happened.
Sir Mark Waller: There is one example in the whole of my time where I was troubled as to whether it should have. That was an occasion on which I went back to a Minister and I said, “I am troubled about that”, and the Minister cancelled that warrant and produced another one. That is the only time in five years. As I say, the agencies, in my experience, are extremely keen to get this right. People would be surprised at the amount of documentation that lies behind each of these warrants, arguing out the case for necessity and for proportionality. Of course, also in these submissions is the risk that they may be found out or whatever. That is all there too, but the really important ones for review are necessity and proportionality.
Matt Warman: In practice, while this double lock would not change the decisions in all bar that one case, it would provide much greater reassurance to the public because it is happening in advance.
Sir Mark Waller: Exactly that.
Matt Warman: So there is a real benefit to doing it, as well as being seen to have a benefit to doing it.
Sir Mark Waller: Because of the confidence it gives to the public, yes.
Bishop of Chester: It surely feels different to have approval before the event, rather than review after the event. Culturally, it feels different, but you are saying in practice that there is not much difference.
Sir Mark Waller: No. I am agreeing with you that there is a difference, and it must give the public more confidence if the review is before the event, rather than after the event. I agree with that.
Bishop of Chester: In Lord Pannick’s article, which I do not have here, he spoke of a margin of discretion or appreciation being part of the judicial review process. Does that mean that the commissioner is likely to give the Minister the benefit of the doubt?
Sir Mark Waller: In terms of necessity, I have no doubt that that would be right. In terms of proportionality, if it has not properly been dealt with in respect of invasion of privacy, I do not think there would be any question of giving the Minister the benefit of the doubt.
Q45 Stuart C McDonald: Sir Mark, I have just a couple of supplementary questions to things you said earlier. First of all, are there times when technical expertise or support could be useful: for example if you are considering proportionality and whether other forms of monitoring might be less invasive? Even where services are using measures to reduce the level of interference in someone’s privacy, would it not be useful to have technical expertise or support?
Sir Mark Waller: I do not really think so. When someone wants to use a particularly intrusive method, they will say, in the submission dealing with proportionality, that they have considered these less intrusive methods and, for one reason or another, they cannot use them, so they have taken the decision that the only way—and this is often the expression—they can get at this particular bit of information, which is vital for the necessity case, is by this method.
Stuart C McDonald: Is it not useful to have technical expertise, then, to be able to challenge and assess whether that is an accurate assertion?
Sir Mark Waller: What sort of technical expertise? I am sure I am not allowed to ask you questions, so I refrain from doing that, but I am not quite clear. Are you trying to say that nobody can do this oversight job or judge necessity and proportionality without effectively being a technical expert, a computer expert, a CNE expert?
Stuart C McDonald: Or having technical support, rather than just one member of staff.
Sir Mark Waller: Maybe I would increase my staff, and if somebody supplied me with a technical expert I suppose I would say, “That is very nice”, but I am not sure how often I would use them.
Stuart C McDonald: Earlier on, you also emphasised how important it would be to have methods to ensure there were no rogues in these agencies. How do we go about doing that? What would the commissioner’s role be in trying to make sure these methods were in place?
Sir Mark Waller: There are two ways in which I try to do it, anyway. The first is that, if I visit an agency or a station, I often at the end say, “I do not believe a single word you have told me. I think there is a room behind, in which people are operating without authority and just for their own ego. How do you show me that that is untrue?”. It takes them a little by surprise, initially, but the reality is that they do explain how it is impossible because people cannot do things on their own. They have recognised the problem there will be if there is a rogue, and they make sure that nobody can operate any of the equipment they are talking about without somebody else knowing and without it having to go to senior people. I try to ensure that that process is in place.
I also try to ensure that they have a vetting process, which they obviously have to have at the beginning, before they employ somebody. You have to have a very good vetting process to make sure that you do not have rogues coming in. The real key is to make sure that nobody can operate without other people knowing.
Stuart C McDonald: I have two final questions, to provide public reassurance more than anything else. Who picks the warrants that you review? Who chooses which ones you have a look at?
Sir Mark Waller: I personally pick them. It is not a completely random pick, because I get a complete list of all the warrants and they have a subject‑matter description, so, if I look and think, “Well, I wonder”, I will pick that one. Otherwise, I pick at random.
Stuart C McDonald: Finally, earlier on, you said you were very confident that there was no systematic abuse within any of the agencies of the capabilities they have. Others are not quite so confident about that. Is there anything we can do to insure against an agency systematically going beyond the powers it has through warrants, for example? Is that possible? How would we ever know if an agency was systematically just not applying for warrants or ignoring the scope of warrants?
Sir Mark Waller: Taking the first, if they are going to do this, they are not going to apply for warrants; they are going to do it without warrants. You have to be right that, if there was a conspiracy or a wickedness from the top of the agency down to the bottom, they could do things unwarranted, because they have very powerful kit to use. Can anything be done to prevent there being a conspiracy overall? The answer to that has to be: you must appoint good people at the top; make sure there is a good appointment process for the people working at the agencies; and have a system under which people cannot do things individually.
Mr David Hanson: To follow up on that question from Mr McDonald, did you see it as any part of your current role to undertake post‑evaluation of the warrants that you agreed or authorised? Take, for example, the one you had difficulty with, where you subsequently authorised a revised warrant. Do you see it as any part of your current role to revisit the exercise of that warrant, or is that solely for the independent reviewer in due course?
Sir Mark Waller: I do that. I do not systematically say, “This is what I am going to do. These are the warrants for which I am going to look at the authorisation process. These are the ones I am going to look at in terms of whether the conditions have been properly applied”. Obviously, in the course of one’s inspections, one is looking at warrants again, and one will look to see whether the conditions on which they got the warrant have been complied with.
Mr David Hanson: Have there ever been occasions, then, on which you have felt subsequently that the authorisation requested and the authorisation given by yourself were disproportionate, subsequent to your approval?
Sir Mark Waller: No, there have not.
Mr David Hanson: The Bill itself, under Clause 176, provides for the Secretary of State to fund the judicial commissioner—
Sir Mark Waller: May I correct that last answer? Nobody should say that the agencies are completely perfect and do not make some mistakes, but they report errors, on the whole. I do not want there to be any misunderstanding. For example, there are occasions on which, by human error, somebody has allowed an authorisation to run out. I am not talking about a ministerial authorisation; I am talking about an internal authorisation. That is an error and, if they find it out, they have to report it. I may talk about it on the day when I go to inspect, or I may want to go and talk about it immediately, if it is something serious.
Mr David Hanson: I simply ask that question because I recall, in my previous ministerial life, undertaking an exercise of requesting a warrant, only to find that it was not subsequently used. Then a request came to renew it, and it was not subsequently used. It was an interesting reflection on how much assessment you make subsequently of the use of any particular power. That was all, but you have answered that question.
I will move on to the issue of funding. As I was mentioning, Clause 176 of the Bill provides that “The Secretary of State must, after consultation with the Investigatory Powers Commissioner and subject to the approval of the Treasury as to numbers of staff, provide the judicial commissioners with (a) such staff, and (b) such accommodation, equipment and other facilities”—this is the key point—“as the Secretary of State considers necessary”. Does that in any way limit your subsequent independence, as it is the Secretary of State who determines the staff, accommodation, equipment and facilities?
Sir Mark Waller: I would have thought it would absolutely not limit independence. Their independence is ingrained in judges and I do not believe that the fact somebody has the purse strings, as it were, for the resources has any effect on independence. If it did not happen, it might have an effect on your ability to do the job, but that is rather different. I do not believe that the fact the Secretary of State ultimately holds the purse strings would affect anybody’s independence.
Mr David Hanson: The question is about “such staff”, for example. In theory, under Clause 176 of the Bill, a Secretary of State could determine that you were to have funding for particular types of staff. For example, we talked earlier about technical expertise. It may be that the Secretary of State deems that you do not need technical expertise, but ultimately you or a successor in a particular instance deems that you do. It is a question of whether the clause is sufficiently flexible to allow you to make those judgments within a budget, or whether the Secretary of State in any future regime could say, “We should have two support staff and one technical staff, and that is the funding I am giving”. If you deem that you need additional technical support staff, Clause 176 deems that the Secretary of State determines that. That may or may not be a problem. I am simply asking, from your experience, is that a problem?
Sir Mark Waller: No, but I am slightly hesitant about it. At a time of austerity, one has had to fight to get one’s staff. We have had to fight to get ours. On the whole, the answer is no, but I do stress that it is not something that is getting at the independence. It is something that just makes it more difficult to do the job.
Q46 Bishop of Chester: When you double‑lock a door, the two locking mechanisms have to be completely independent, otherwise it is not a double lock, by definition, in a sense. I am interested in the fact that the Investigatory Powers Commissioner is appointed by the Executive—by the Prime Minister—and makes subsequent appointments of the commissioners. I am not saying individuals would not be independent because of the nature of their backgrounds, but would it seem to separate the two locks, as it were, if it were not the Executive making the appointment but the Lord Chief Justice or someone more judicial?
Sir Mark Waller: I thought that I had heard they were going to use the judicial—
Lord Butler of Brockwell: Judicial Appointments Commission.
Sir Mark Waller: Yes.
Bishop of Chester: The draft Bill says that the Prime Minister makes the appointment.
Sir Mark Waller: Right. That is the present position as far as commissioners go. It is the Prime Minister.
Bishop of Chester: In Clause 167 of the draft Bill, it is quite clear it is the Prime Minister. Each commissioner, including the senior commissioner, is just appointed for three years, and if the Executive do not like how that person has been doing their job, without any further explanation they do not have to reappoint. Three years is quite a short period. I would be interested in your comments.
Sir Mark Waller: All I can say from my experience is that my being appointed by the Prime Minister has not made any difference to my role and what I do. I was not nervous, when I was coming to the end of my three years, about whether I might be reappointed or might not. It did not occur to me; I just did my job. If I may say so, there is a public perception point here, which you may be right about. I honestly had not thought that one through. There might be a public perception point. It might be better to have an independent body appointing.
The Chairman: Sir Mark, we are very grateful to you. It was a very interesting and useful discussion, and will help us considerably in our deliberations.
Sir Mark Waller: Thank you, Lord Chairman, for having me.
Examination of Witnesses: Lord Judge, Chief Surveillance Commissioner, Clare Ringshaw-Dowle, Chief Surveillance Inspector, Sir Stanley Burnton, Interception of Communications Commissioner, and Jo Cavan, Head of the Interception of Communications Commissioner’s Office
Q47 The Chairman: Lord Judge, Sir Stanley and your staff, thank you very much indeed for coming along to us this afternoon. As you know, this is a very important Bill. The Prime Minister described it as the most important of this Session. Much of the Bill refers to the change in oversight provision, so we are very grateful for your coming along. I wonder whether you want to say anything yourselves before we start asking some questions.
Lord Judge: I would like to say something, particularly in view of the discussion that has been going on with Sir Mark. I cannot think that anyone would have designed the present three‑bodied system. It would never have happened; it should not have done. We work piecemeal on the legislation; we produce piecemeal results; and we have produced three bodies, all of which have responsibilities in the broad sense that we are talking about and all of which work in different ways.
Let me give you some “for instances”. Sir Mark has just given evidence to you. He is the commissioner. He has no inspectors. Sir Stanley will tell you that he is the commissioner and, with his team, he has 10 inspectors. I will tell you that I have taken over the surveillance commission. I have seven inspectors, who are former police officers of no less than superintendent level, a Chief Surveillance Inspector, six commissioners, three assistant surveillance commissioners and, good heavens, there is even me. We all operate differently. The focus so far has been on Sir Mark, and I know that IOCCO, as it is called, has had quite a lot of input, but can I just explain to you how this leads to confusion and can be improved?
The Chairman: Please do.
Lord Judge: We have had to take on oversight and prior approval of undercover police authorisations. We all know about the relatively recent disasters caused by officers going wrong in undercover operations. There is an application to us and, mark this: we have to authorise. Neither of the other two Commissions authorises. Every single piece of intrusive surveillance, certain types of property interference and long term undercover operatives for which we are responsible is authorised in advance by a commissioner, who is a former judge.
The case is made out to us that there should be an undercover police officer in this particular, rather serious drugs case. The authorisation is made. In goes this brave young man or woman—and most of them are very brave young men and women—and they discover that there is quite a lot going on and it would be a good idea to have some intrusive surveillance, say into a car that is being used to transport the proceeds of drugs. He has to go back to his authorising officer. The authorising officer comes to us, and there is another application for intrusive surveillance to take place. That takes place, and that reveals something else: these drugs are actually to do with a potential terrorist ring.
That does not come to us; that goes to Sir Mark, but there is no pre‑authorisation by him. Somebody says, “We had better have some communications input”. That goes to Sir Stanley. There is no pre‑authorisation by him. Now, I am sorry to say this, but telling the story the way I have is entirely accurate. If you thought about it, you would say, “Is this really the way we are doing business?”.
Speaking only for my own team, every authorisation is made before any of the aforementioned intrusion takes place. The papers come to us, and I have a complaint about the quality of our equipment, but that is another question. A judge commissioner looks at them. He decides whether necessity is established and whether it is proportionate, which involves looking at the nature of the offence. You would not authorise intrusive surveillance for somebody who was stealing a tin of salmon from a supermarket. You are looking at sentences starting in the three to four‑year range and upwards. He checks for proportionality: is this a reasonable way to go about sorting this problem out? He authorises or does not, or says, “I want more information”. Then the process goes through.
At the other end of the process, every year my inspectors go in and conduct an inspection of every single police force in the country, Her Majesty’s Revenue & Customs and so on—all the law enforcement bodies. They conduct random analyses inspections of all the things for which the body is responsible, such as encryption. There are all sorts of different things that come under the remit of covert surveillance. They then write a report. The report is written to me. It goes to the chief constable. I write my own report to the chief constable. Sometimes I say, “This is being very well handled. Your authorising officers are well trained. The paperwork is very good. The explanations are excellent”, and so on and so forth. I have just written a very rude letter saying, “This is not good enough. You are not complying. There are too many breaches. There is too much inefficiency in this part or that part”, or whatever it is.
I write that to the Chief Constable, and then I go and see him, or one of my commissioners does. I go to all the big Forces. We discuss the report for the year. Most of the time—and this I hope does not surprise you—the chief constables are as anxious as we are that the job should be done properly. Apart from the reputational matter, they are men, and women now, who want the job done lawfully. They are also aware of the dangers of evidence being excluded at the trial process or an abuse of process argument leading to the whole prosecution being discontinued. I go there; we discuss it. If I am unhappy, I will go again. I have not had to, but I have only been in this job for a relatively short time.
I am not recommending it to you, but our system is very different from the one you have been discussing with Sir Mark, and from Sir Stanley’s. The idea that we should have a surveillance system in which there are three different bodies is itself absurd, and then three different bodies operating differently strikes me as daft. That is my opening statement.
The Chairman: Very interesting it was, too. Sir Stanley, do you want to make any comments?
Sir Stanley Burnton: As you know, I am the new boy on the block. I have the good fortune to have staff who have received a glowing report from David Anderson, as you will have seen. They have a range of competencies, including computer abilities. There were questions asked of Sir Mark about training. I have some computer knowledge; I was judge in charge of IT, but I could not go into a public authority and interrogate their computer system. We have inspectors who can and do just that.
We carry out an audit function. I believe that you cannot carry out an audit function properly unless you have some understanding of the business you are auditing. That does not mean to say you could do it yourself. I could not go into a computer and interrogate it to see how many search or interception warrants had been issued, and view the grounds and so on. But I like to think I have a sufficient understanding of what staff can do, and do, to carry out the functions of my office.
Like Sir Mark, as far as I am aware, there was no special security clearance carried out when I was appointed. On the other hand, when I was a judge, I used to do Special Immigration Appeals Commission, or SIAC, cases, which concerned terrorism and people who were alleged to be terrorists, so I have some acquaintance with that part of the job. Of course, I did criminal work, so I have some acquaintance with that area as well.
Q48 Lord Butler of Brockwell: May we take it from Lord Judge’s and Sir Stanley’s opening statements that you think it is a good idea that this Bill in future sets up a single Investigatory Powers Commissioner?
Lord Judge: I have no doubt about that. We also have to make all the three current bits of the system work in the same way. I personally think, although I have no experience of IOCCO or Sir Mark’s work, that the authorisation process is one of the strengths of what we do. You have to have an authorising officer who persuades you that this is appropriate—i.e. necessary and proportionate.
Lord Butler of Brockwell: If I may then clarify my understanding of this, in your area, Lord Judge, there is pre‑event judicial authorisation.
Lord Judge: Of every item of intrusion that comes within our jurisdiction for prior approval by a Surveillance Commissioner.
Lord Butler of Brockwell: In Sir Stanley’s area, this Bill will set up, except in the most urgent cases, pre‑event judicial authorisation. Is that correct?
Jo Cavan: It will in relation to interception warrants, but it will not in relation to acquisition and disclosure of communications data, which is the bulk of our remit. Around 500,000 requests for communications data are made on an annual basis, by a rather large number of public authorities. The judicial authorisation and the double lock that the Bill introduces are only in relation to the interception warrants, of which there are around 2,700 a year.
Lord Butler of Brockwell: Thank you very much. Then, if I understood what Sir Mark said, in the case, however, of somebody placing a bug in premises, there will be no judicial pre‑event authorisation. There will be a warrant, but there will not be a judicial pre‑event authorisation.
Lord Judge: If it is an application under part 3 of The Police Act 1997, which we deal with a lot, there will have been a pre‑judicial authorisation in advance (for activity in a private vehicle or premises). This is why the system desperately needs to be shaken up.
Lord Butler of Brockwell: What about in the case of the intelligence agencies? Did I misunderstand Sir Mark?
Lord Judge: No, you did not. The intelligence agencies work differently. If it is an ordinary police investigation, yes, every piece of intrusive surveillance is pre‑authorised. In the case of intelligence, it works differently.
Lord Butler of Brockwell: In the case of an intelligence agency, at the moment and under the Bill as proposed, there is no pre‑event judicial authorisation of the warrant.
Lord Judge: No.
Q49 Suella Fernandes: What do you think about the safeguards provided in the new system as compared to the current one? Do you consider that there are better safeguards under the proposed system?
Lord Judge: I think that pre‑authorisation is something Parliament needs to look at across the board—but I would, wouldn’t I, because I am convinced about our own little bit? If you do that, the papers come through to a commissioner, who knows what the law is, knows what he—or she, but we do not actually have any females—is looking for. If it is not good enough, if it is an urgent or relatively urgent thing, he speaks to the authorising officer, saying, “This is not good enough. Tell me more about this” or, “I am worried about the possibility that this suspect’s wife is going to have her life intruded on”. If satisfied—and usually you are, because they do not come unless they have a good case—then it is authorised. Then you inspect at the other end and you go through them.
I will add this, which I did not mention when I made my opening statement. From time to time, my inspectors will tell me that they are very worried about the commissioner having given an authorisation. They are not just examining the way the police are doing their work; they are a form of check that the commissioners are applying the law. Of course, it does not happen very often, but that is part of the process and I welcome it. If there is a case where I think the commissioner was wrong to make the authorisation, then I see him and say, “I think this was wrong” or whatever.
Provided that you, as the citizen, are satisfied that, before people can come intruding in your life, a decision has been made by somebody independent of those who are going to do the intrusion, and there is a system for inspecting afterwards, at random, what the various bodies have been doing, that is a pretty good form of safeguard. In my experience—again limited—I do not see cases where people or authorities are applying unless they have good grounds for doing so, because they know they will be refused.
Q50 Lord Strasburger: My questions are for Ms Cavan. I would like to start by congratulating you on the transparency of your reports and your engagement with the public through Twitter. I wonder if Mr McDonald’s concerns about systemic difficulties and unwarranted activities would be allayed by the new commissioner being able to initiate inquiries on his or her own initiative, and perhaps even unannounced inspections. That is my first question.
Jo Cavan: On that note, we recently published a wish‑list of some of the ways we feel the oversight provisions need to be strengthened. In one respect, the ability and mandate of the new commission to launch inquiries or investigations, we feel, could be further strengthened. We also feel that access to technical systems could be more explicit in the clauses. At the moment, the drafting is outdated: it refers to providing the commissioner with information or documents, whereas these days we are generally not looking at paper. When our inspectors go in, they have full access to the technical systems; they run query‑based searches and look for compliance issues at scale, which is really important when you are dealing with these bulk collections. We think the oversight provisions and the clauses concerning technical system access and the ability to launch inquiries and investigations could be strengthened further.
Lord Strasburger: Lord Chair, would it be appropriate to invite Ms Cavan to put her views on how that might be strengthened to us in writing?
The Chairman: I am sure that would be fine.
Lord Strasburger: My second question is: how do you think we should strengthen oversight of international co‑operation between Five Eyes intelligence agencies?
Jo Cavan: There are some additional safeguards in the IP Bill for the sharing of intelligence with overseas agencies. These matters have been significantly debated during some of the recent Investigatory Powers Tribunal cases. As a result of further disclosures made in those cases by the Government, the safeguards have been published and they are now in an amended code of practice. Certainly, that is an area we are looking at during our inspections and audits.
Sir Stanley Burnton: The fact we can interrogate the computer records of the authority whose activities we are auditing reduces the need for unannounced visits, because we have access to the raw data.
Q51 Victoria Atkins: Following on from Lord Judge’s very helpful analysis of the oversight and review process, there is one angle that I am not sure the Committee has heard about yet, which is what happens at trial. Where an investigation results in a suspect being charged and a prosecution being brought, could you help us, please, with the duties on the prosecuting lawyer and prosecuting counsel to ensure that any warrants that may have been used during the course of that investigation were conducted properly, and the professional obligations on them as a reviewing process, in addition to all the reviewing processes you have already described?
Lord Judge: When everything has worked as it should have, and there has been no breach and no subsequent concern, that simply goes through. There is no disclosure. But, where there has been any breach—and, as Sir Mark pointed out, there are self‑reporting breaches as well as discovered breaches—it comes to me, and it is axiomatic that the first thing I do, having decided what should happen about the breach, is to say all the papers must now be retained and disclosed to the Crown Prosecution Service, in the event of a prosecution, for onward disclosure as seen fit. That is up to the prosecutor. That material, I am sure, would then go to counsel for the defence, who would then decide whether to make an application or not.
The other feature, which has been underlined by a recent decision in the Divisional Court called Chatwani, is that there is an obligation—it is obvious that there is, but the court has said so—on the person making the application to tell the whole truth. In other words, you set out the points you say are favourable to the application you are making and the authorisation you are seeking, but you also have to add the bits that do not fit. Chatwani was a case where what was going on was not properly disclosed and the Divisional Court said, “Quite obviously, you cannot work on the basis that the whole story is not told”. Failure to tell the whole story would itself constitute a breach, which would then have this system fall into place: retain it, keep it, disclose it if there is a prosecution. Of course, often there is not a prosecution, which raises a different problem, but if there is that is how it is done.
Victoria Atkins: In addition to the many sets of eyes in your organisations, there is also, if a case comes to court, the extra review conducted by lawyers and counsel to ensure that processes have been applied properly.
Lord Judge: Yes.
Q52 Baroness Browning: You heard me ask Sir Mark about training. I wonder what training you feel might be necessary for the new judicial commissioners.
Lord Judge: Rather like Sir Mark, what you are doing is making a judgment. This is what, if you are a former judge, you have been doing for however many years you have been doing it. You have been making decisions like this day in, day out. The questions are very simple: is this necessary? Where is the evidence? Yes, on this evidence, it is necessary. Is this proportionate? I must bear this in mind and that in mind, and that in mind. On this evidence, that is proportionate. Hang on, there is a bit of this that might involve the suspect having had conversations with his, for the sake of argument, doctor. You have to be careful there. I mentioned earlier an intrusive surveillance into the family car that is being driven by the wife. Nobody suspects her of anything, so you cannot have that; it is not proportionate.
That is all you are doing. You are making a judicial judgment, which is what you have spent your whole career doing. I am not saying you are infallible, and I made the point a few minutes ago in relation to my commissioners: when they get it wrong, my inspectors will tell me. But you do not need special training for that. What happened to me is, in effect, I went and shadowed my predecessor. I went out on inspections to see what my inspectors did and how they went about it, and to see that they were doing the job the way I wanted them to do it. I go out with my commissioners. We meet regularly and discuss the problems that are current. That is the training, and then you take over the job.
Baroness Browning: With the advance of technology and things moving on so quickly, particularly once this is in one collective body, could the choice of methodology in the application that comes before you be something you question—whether this route is going to be used or that route? Does that not require some technical knowledge on the part of the person making the decision?
Lord Judge: Not really, because, for necessity, that does not arise. You do not need to know whether the nature of the intrusion is a probe that is one inch long or six inches long; you need to know whether there is going to be a probe. Of course, I have overlooked this. I spent time, two days ago, sitting in the National Crime Agency, being lectured to about how some of the worst aspects of child pornography being transmitted around the world are dealt with. We do try to keep up with that.
But, no, you are making a judgment. In the new system, I have no doubt—and I disagree with Sir Mark here—that there should be one or two people with serious expertise in technology. I also think there should be a legal adviser. The law is extremely complex. RIPA is a dreadful piece of legislation. I say that with some strength of feeling, having had to try to understand it. Why do judges need a legal adviser? For that reason: to say it could be any one of 17 possible interpretations, rather than the five you thought you had. More importantly, in this system, from time to time you need advice. That is what I would like to happen, but then I envisage this as rather different from the bits and pieces you are seeing put together before you today.
Q53 Lord Hart of Chilton: You heard us discuss with Sir Mark the question of the judicial review principles that underlie the judge’s oversight. I wondered if any of you would like to comment further on what he said. We were exploring whether it is right to call it a real double lock system. Are there any points you would make, further to the points made by Sir Mark?
Sir Stanley Burnton: Judicial review is not simply a question of looking at process. In the context we are discussing, the commissioner has to look at necessity and proportionality. The degree to which judicial review is imposed as a test and the stringency of the test depend very much on the context, the facts of the individual case and the consequences of the administrative or governmental decision in question. In the context we are discussing here, it is not unfair to describe the process as a double lock.
Lord Judge: That is rather my view. My only hesitation, which is a lawyerly one but not totally without some force, is in using the words “judicial review” as a description of the test that has to be applied by the judicial officer. Judicial review used to be Wednesbury unreasonable mad. We would call it Wednesbury unreasonable, meaning only an idiot could have reached this decision. Nowadays, judicial review is less stringent than that: “He is not an idiot, but it is a really stupid decision”. That is not quite the same. “I am not sure many people would have reached this decision” is another test. We need to be slightly careful.
If you are talking about the Home Secretary, and I think you are, I have a separate point. There is a difference between national security warrants and ordinary criminal warrants. What we do should be the system for ordinary criminal warrants: an authorisation in advance. That is a double lock. National security is rather different. The Home Secretary has the most amazing responsibilities in relation to that. Judges second‑guessing is simply inappropriate. You have to have a stringent judicial review test. I am now coming back to what Sir Stanley said. You know you are dealing with national security; you know somebody might be planting a bomb. You are going to be very cautious about interfering and saying, “This man or woman, who is the Secretary of State, is daft”. So I think the double lock system will work pretty well.
Sir Stanley Burnton: You can forget about Wednesbury unreasonableness in this context. Interestingly, proportionality and necessity are tests that we have imported from Europe, and the proponents of the Bill are clearly happy to adopt them in this context.
Q54 Matt Warman: As a still fairly new Member of Parliament, it struck me, observing the procedures of Parliament, that, if you have some pretty crazy procedures around for long enough, they become lauded as institutions. You described a pretty crazy set‑up in your opening remarks, but does it not function as a sort of quadruple lock on what we have already, if you are constantly going back to ask for re‑authorisation? I wonder what we are going to lose by streamlining it, if anything.
Lord Judge: I am sorry, I must have been unclear. They are not re‑authorisations. Each one is a fresh authorisation by a different body. Sometimes the body will not even know what the earlier authorisation was. It is not a quadruple lock at all. Each is an individual one.
Matt Warman: So you do not see any strength from having three different people.
Lord Judge: No. I see potential for confusion. A much more coherent system would enable the same commissioner to look at one case. “This is the case of Snooks. This is the drugs ring. Right, the undercover officer has gone in. Here he wants this. Does the authorising officer think this is appropriate? Yes”, and so on. The whole thing can be kept, in effect, under one person’s eyes. It is much more proportionate. Sorry I was not clear enough. They are separate organisations.
Matt Warman: The argument that has been put is: at the moment, we have three commissioners, and, if one person makes a mistake, who is checking up? You would not accept any of that.
Lord Judge: People make mistakes, certainly, but we are all independent organisations. We talk; we discuss problems together, but we operate completely differently. It is not a system with the three sections of this keeping an eye on each other. We do not.
Q55 Lord Butler of Brockwell: When we took evidence from Home Office witnesses last week, they introduced a new concept, new to me anyway, of rationality. We asked whether reasonableness would be a test, and the witness seemed to dissent rather. He made a distinction between rationality and reasonableness. Is that a distinction you recognise?
Sir Stanley Burnton: The Wednesbury test is a rationality test: that no sensible administrator or executive correctly applying the law could have reached this decision. It is not a very stringent test; it is only in extreme cases that you are able to say something is Wednesbury unreasonable, whereas proportionality and necessity are more stringent.
Lord Butler of Brockwell: You are saying that there is no great distinction between reasonableness and rationality.
Sir Stanley Burnton: I am.
Lord Judge: I would not have noted any difference between them. I would not have argued the point with you. If you had said “Is it reasonable?”, I would not have said, “It has to be rational”.
Q56 Stuart C McDonald: I have a rather more mundane question about money, I am afraid. The impact assessment suggests that the new oversight and authorisation regime should cost around £150 million over 10 years. Would you regard that as realistic? If you do not feel able to answer that particular question, would you say that you have had sufficient resources to carry out your jobs fully, or are there other things you would have liked to do that you have been constrained in?
Lord Judge: I could give you a list of my complaints.
Stuart C McDonald: Please do.
Lord Judge: Our technology is, for obvious reasons, supposed to be secure. Our Brexit system—I am so sorry; I have something else on my mind—our BRENT system is hopeless, so we want it improved. We wait too long for new appointments to happen, and so on and so forth. Parliament has to decide how much it is going to spend on protecting the citizen from the threats of crime and terrorism, and how much it is going to spend on ensuring that those who should not be being surveyed in any way at all are protected from it. If you go down this route, you will have to have—I would strongly recommend if I were asked, so I will tell you anyway—a location separate from the Home Office, and people working there who are not drifting in and out of the Home Office. The perception of independence is strengthened by going to a separate place.
I mean no discourtesy; our rooms are pretty cramped. You are going to have a big system. If you have the same number of commissioners I have, which is six plus me plus three assistant commissioners, that is ten before you start. If Parliament enacts a system in which there is authorisation for everything in advance, it is going to take a lot more people. It will cost a lot more. We can either do it on the cheap or spend more money. We are in times of great financial stringency. I am sorry, but this is really not for me to say. I might say it in a different role, but not here. Yes, it will cost a lot more.
Sir Stanley Burnton: I am not an accountant and I cannot give you a figure. My impression is that in order properly to run the system, there are going to be something like eight judicial commissioners, which is quite a lot of staff. They must be backed up with appropriate staff, with the kind of skills my office now has but more widely available. There will be more inspectors, who must be appropriately qualified. You are looking at significant sums of money.
Incidentally, on a question that Sir Mark was asked, it ought to be the chief commissioner who determines what staffing and resources are needed. He must, of course, approach the Treasury and agree a budget, but it seems to me to be inappropriate for the person who is being monitored in a sense to be the person who decides on the resourcing of the office. Indeed, internationally, one increasingly finds that judicial bodies are not subject to a Ministry of Justice, so far as resourcing is concerned. It is the judiciary that determines the resources it requires, subject to Treasury agreement.
Lord Judge: I entirely agree with that. The idea that judges will be looking at the Home Secretary’s decisions and saying, “We do not think that is right”, and then going cap in hand to that same Minister is not a sufficient separation.
Stuart C McDonald: That is helpful, thank you.
Q57 Lord Henley: I asked Sir Mark earlier about cost. This takes me on from Stuart’s questions. Are you saying that under the new arrangements you should, almost as the universities used to in the past, negotiate directly with the Treasury without any intermediary?
Lord Judge: That would be my view. I make this clear: I am not seeking appointment to be the high panjandrum for this. A direct communication between the Treasury and the Commissioner is the way to do it.
Sir Stanley Burnton: As a matter of principle.
Lord Henley: Is that because your independence would be undermined if you had to go through the Secretary of State?
Sir Stanley Burnton: The appearance of independence is undermined if one has to go through the Minister whose work one is supervising.
Lord Henley: I ask that purely because I remember, back in the long, distant past, that that is how university funding used to be done when universities were independent. It is no longer the case; there is a department that looks after universities. That might be the way forward.
Lord Judge: In the context of the way the judiciary works, there has been coming and going about this, but I used to agree a budget or not agree a budget. I also had the power, which I never exercised, not only to write and say, “I do not agree it”, but to say, “I am going public and this will not do”. You need some kind of arrangement like that. We are both in the same place. If we are going to supervise the Home Secretary, we must not be answerable to him or her for the money.
Q58 Lord Strasburger: Would you be attracted to the system that exists in New Zealand, where the people in your position have a fixed percentage of the spend on intelligence and policing, and the decision is taken out of politicians’ hands?
Lord Judge: The decision as to money?
Lord Strasburger: Yes.
Lord Judge: Ultimately, the Government have to find the money, so there has to be a discussion with somebody who represents the Government. Therefore, that is why we both say the Treasury.
Sir Stanley Burnton: I think I would need notice of that question.
Jo Cavan: If we went to that type of model, our percentage would no doubt be significantly lower than the percentage in New Zealand, because of the larger scale of our intelligence agencies, in particular the bulk collection we do, in comparison to New Zealand. Anyway, I do not necessarily think it is a bad model. I would say that the legal mandate and oversight provisions the New Zealand inspector general has are far more explicit and comprehensive than the ones in this Bill.
One of our points on the clauses around oversight is that they relate only to judicial commissioners; they do not relate to the commission. If we are going to create this world‑leading oversight commission, it is important that the commission is explicitly referenced and the legal mandate, powers and functions are comprehensively covered.
Lord Strasburger: For the second time, I will say something about judicial review. I asked the Home Office on Monday why the words “judicial review” were in there, and they could not really tell us. What would be the effect, do you think, if they were struck out? Would the Bill be better for it, or worse?
Lord Judge: Parliament has to decide what function the judge is to exercise. Judicial review is a well-known series of principles, even though occasionally you hear it expressed in different ways. As I said a few minutes ago, in terms of national security, the idea of the judge in effect making the decision simply cannot arise. If a bomb goes off in London tonight, it will be the Home Secretary who will be down there. It will be she who has to answer to the House about what has gone on; it will not be the judge. We have to be careful to remember that there is a political responsibility, which is in the hands of the Minister, and we cannot dilute that.
Sir Stanley Burnton: If I remember rightly, the legislation on control orders, which are orders short of imprisonment to control people who are suspected to be terrorists, also requires the judge to apply a judicial review test. In practice, of course, in SIAC, the judge hears, often in secret, the evidence that is available to show that someone is a security threat. He applies quite a stringent test, because he has the information and knows whether there is something justifying imposing a control order. The legislation has changed, but it is not dissimilar.
Q59 Bishop of Chester: The fear in some quarters is that this new system will end up with rubber‑stamping, that it will not be sufficiently independent. That is the fear abroad in some quarters. I am trying to imagine life in the increasing digital swirl in the years to come, with the exponential growth in communications and means of communication. How can we get some feeling of control and exercise oversight, and not simply be carried along in the tide? The threats in the 21st century will probably increase as well. Can you give us some idea as to how this double lock, this independent supervision, will work in practice?
Lord Judge: I hope I am not being discourteous. It is very easy to drum up anxieties. I am just as worried about criminals being able to get hold of information as I am about any of the authorities. We concentrate on the authorities. I do not know what is going on in this room even as we speak, but the technology available to serious criminals is, at the very least, as good as is available to law enforcement people. You trust your judiciary to make decisions against the state when it is appropriate to do so. I do not think anybody suggests that the judiciary nowadays is less independent than it was. In many ways, it is more so. You have men and women who have exercised these functions all their professional lives, first at the bar or as solicitors, then as judges. They are men and women of proven experience and quality. You just have to work on the basis that you should trust them.
Bishop of Chester: Would it be better for perception, if nothing else, if the appointment of the commissioners was not made by the Executive. Just as you made those comments earlier about having clear blue water between the Home Office and this, would it be better to involve an agency more independent than the Executive?
Lord Judge: It is the Prime Minister’s appointment. The Queen appoints the Lord Chief Justice, but that is on the recommendation of the Prime Minister. I do not suppose the Prime Minister spends a lot of time deciding what he is going to recommend to Her Majesty. There is, in the case of the judges, a Judicial Appointments Commission. I would not recommend that for these appointments. Apart from anything else, they have far too much to do and it takes a very long time.
For the very last commissioner who was appointed to my team—and this you could consider—a senior serving judge and a member of the Judicial Appointments Commission sat together, with my predecessor as an observer, and they chose whom it should be, and the appointment was then made. That is a perfectly sensible system. It is only theoretical that the Prime Minister has anything to do with it. It is very nice for me to be appointed by the Prime Minister, but I honestly do not suppose anything more.
Sir Stanley Burnton: By prescription, the commissioners are going to be either actual serving judges or former judges, and so one has to bear in mind that they will have been independently appointed, initially. Whether they will be full‑time judges working part time as commissioners or are expected to be full‑time High Court judges seconded to the commission, the Bill does not make clear. We probably both have concerns about the ability of the existing High Court to have people seconded to a different function, given that the High Court itself is under pressure.
Jo Cavan: Before we move on, I wanted to talk about the end‑to‑end process, because a lot of the debate has been focused purely on the double lock and the authorisation process in the first instance. Yes, that is crucial, but what is equally crucial is the post‑facto audit functions, which look at the process from end to end. We carry out over 200 inspections a year and make over 800 recommendations to improve systems and procedures in compliance.
The inspectors, during their inspections, are looking at post‑authorisation: was the actual intrusion foreseen at the time the warrant or authorisation was given?; has the conduct become disproportionate because the level of intrusion was not anticipated? They are looking at how the material that has been gathered has been used. Has it been used in accordance with the purpose that was set out in the warrant? They are looking at the retention, storage and destruction procedures for that material. They are looking at whether any errors or breaches occurred as a result of the conduct. All those post‑authorisation functions are critical to ensure that you are overseeing and auditing the end‑to‑end process. That is where the modification and ongoing review of these provisions come in.
Sir Stanley Burnton: The reviewer will also look at the duration of the warrant and may go to the public authority concerned and say, “How is it that this warrant has been renewed twice? What evidence have you been gaining from it? Was there any justification for its continuation for such a long period?’
Q60 Mr David Hanson: In relation to Clause 176, which establishes the budget, as we have discussed previously, are you therefore suggesting to the Committee that we should consider recommending a rewrite of that clause that separates completely the funding from the Secretary of State, not just in terms of the effective micromanagement that the clause could imply, although in practice it probably will not, but in terms of the principle that the Treasury should be the lead department that you directly negotiate with?
Lord Judge: If we retain the present Bill in relation to judicial oversight of the Home Secretary, yes, unequivocally.
Mr David Hanson: I have a second point. Lord Judge, I noticed you made the point that it is very nice to be appointed by the Prime Minister, but you are sure he does not take much interest in it. I suspect, as many people in the past, should you be a troublesome priest, he may take some interest in your reappointment. I am wondering, given what the Lord Bishop has said, whether or not consideration should be given to independent appointment, rather than direct ministerial appointment, into the oversight role, given that oversight role?
Lord Judge: If we envisage that, 20 years from now, the Prime Minister of the day decided that he or she was not going to re‑appoint somebody, and had no good grounds for doing so save that he or she did not like the colour of their face, or whatever it might be, there would be an absolute scandal. I really do not think Prime Ministers would want to get embroiled in that sort of thing.
We have to be careful about public perception, if you do not mind me saying so. Most members of the public, I suspect, want to know that those of us who have responsibilities in this field are seeing that the job is done efficiently, ie to protect them, and fairly, to protect their own rights. That is what they want. I do not think that they are going to be terribly fussed, largely, about whether the Prime Minister’s name goes on the appointment, or whether it is that of the Speaker of the House of Commons or the Lord Speaker. One has to be careful. That is my view about it. If I were in charge and, the Prime Minister failed to re‑appoint somebody and I thought this was the reason, I would go and see the Prime Minister and tell him, “I will go public about this”.
The Chairman: Thank you very much indeed. It was a fascinating session and we are grateful to all of you for coming along. You have given us very interesting stuff to chew over, to say the very least. Thank you very much indeed.
Lord Judge: Thank you.
Examination of Witnesses: David Anderson QC, Independent Reviewer of Terrorism Legislation, and Professor Michael Clarke, Retiring Director of the Royal United Services Institute
Q61 The Chairman: Welcome to you both. We very much look forward to what you have to say to us on what is obviously a very important Bill. I was going to ask a question that could be rolled into one, in a sense, if you have a statement that you would like to make. The question I was going to ask is: what do you think of the Bill? Perhaps you could answer that question and make any introductory comments to the Committee that you might like. You are most welcome.
David Anderson: I welcome this Bill, Lord Chairman. The law in this area has, until now, provided for extensive but vague powers, used in a way that the citizen could not predict and safeguarded by people who, for all their very considerable merits, have not been particularly visible to Parliament or the public. I would single out two major improvements that have already been happening over the 18 months since I started doing my review, A Question of Trust, though there is no causal relationship there, of course.
The first is the disclosure of significant and sometimes controversial powers that are already used but that people did not really know about before. You are looking there at bulk collection, the use of bulk personal datasets, the practice of equipment interference or hacking by the Government, and very recently, indeed on the morning the Bill was launched, a very significant data retention power that was previously almost entirely unknown. Many of those disclosures were prompted by proceedings in the Investigatory Powers Tribunal.
The second change is more proactive and visible oversight, in particular by the Interception Commissioner’s office, which I single out because it is the office most concerned with the subject matter of the Bill, but also because it operates so transparently. This Bill, as it seems to me, cements those improvements and builds on them. I believe that there is now a complete avowal of significant capabilities, at least in outline. If I am wrong about that somebody was concealing them from me, and, although that is always possible, I do not believe that is the case. What I applaud about the Bill is that, for the first time, Parliament will have the opportunity, as it should in a democracy, to debate the capabilities that are used or that it is desired to use and decide whether it considers them acceptable or not.
The Chairman: Thank you very much. To both of you, I express the Committee’s thanks for the reports you have produced recently, both of which will be immensely important for this Bill, but also for the public understanding of what you just described.
Professor Clarke: I convened a panel at the Royal United Services Institute, which we call the Independent Surveillance Review, consisting of 12 people who represented a pretty wide cross‑section of interests, from ex‑security chiefs through to people representing civil liberties arguments, practitioners, industry and so on. It was a very well-balanced group, but it was very wide. I am glad to say that our report was unanimous. We struggled with a lot of the issues and tried to take a publicly orientated view. We tried to start with big principles and then go down to the legislation, rather than starting with the legislation, because we thought that would be the most useful thing to complement David Anderson’s review and the review of the ISC.
Our review was generally favourably disposed to the present situation, but we felt, as other reviews had felt, that the legislation was not clear enough as it was. This legislation certainly helps to clear that. The oversight regime, we thought, was critical both in warrantry and in the oversight, and it was not that it was incapable of being amended with relatively small changes. The most important thing was that we felt there needed to be much greater public confidence in it; it was not that the public were not confident in it, but they did not know enough about it. We felt that an oversight regime and a warrantry regime that could command more public confidence, which is partly where we brought the element of judicial oversight into the warrantry, would be very important.
The aspect of this Bill that is different from the expectations we had is the scope of what it says about equipment interference and internet connection records. That is controversial but is allowable for within the principles that we articulated. The differences between the Bill and our recommendations are comparatively small. I would be happy to go through them later on, but they are comparatively small. The approach of the Bill is pretty consistent with the review that we arrived at.
Q62 The Chairman: Thank you very much. Before I ask Lord Butler to come in, I will take advantage of being in this seat by asking my other question, which was to come later but touches on what you just described. It is the issue of trust and confidence, which appears to be at the root of all this, but particularly the issue of whether the new system will also produce improved confidence and trust in the agencies and the law enforcement bodies. Is that likely to be the case?
Professor Clarke: It certainly could be the case, because there is generally high public trust in the work of the agencies. They are fairly popular. There is more ambiguity over the work of law enforcement. It is bigger, more complex and covers a wider range of things. There is a degree of cynicism over some of that. There is a degree of increasing cynicism over the role of the state in general to intervene or interfere in the communications of its citizens. It must be a clean and clear oversight regime, with clarity and lines of responsibility that the public can follow. We recommend specifically that whatever arrangement is made for the commissioners should be very outward‑facing, should try to publish more material and enter into a dialogue with the interested public that is wider than the dialogue that has been evident until now. That could be a big element in increasing confidence, not so much in the agencies, which do not need it, but in the police and in the role of Government itself.
On a final point, we began from the principle that this is not a series of technical issues. This represents something pretty fundamental in the bargain that the public make with the Government. In the digital age, this is the tip of a big democratic iceberg, and we have an opportunity now to get it right in a way that will be pretty important to the future of the political bargains we strike. This is one really important bargain that needs to be struck very explicitly and cleanly, as far as we can.
David Anderson: It struck me during my review that the people who need and deserve to be able to trust the system—not just the public, although public trust is very important—and who spoke to me most strongly about human rights, safeguards and the need to be trusted were the service providers, the telecoms companies that give assistance to Governments but are very nervous about being perceived to assist with things that are below board, and the intelligence agencies.
I had a message from somebody at GCHQ, which is probably too secret to disclose, but I will say it anyway because it is fairly innocuous. The reaction I had was, “I hope these new commissioners really make us work hard to prove that what we are doing is necessary and proportionate”. If you are trying to recruit people on the pavements of Shoreditch to come and use their technical skills to work for GCHQ, you do not want to be seen to be working in some shadowy grey area where you are dodging in and out of the law; you want to be able to assure them that there is an absolutely copper‑bottomed system in place. It is something that everybody wants.
People who are sceptical will be sceptical about safeguards as well. That is the way that people are. Commissioners will be portrayed, initially, as grey‑haired old people out of touch. Judges will be portrayed as rubber stamps. That is why it is so important that what they do is transparent and they publicise their work, so far as possible. I would like to see judicial commissioners, for example, not just making wise decisions but issuing guidance, so far as possible public guidance, so that people can see how carefully they are thinking about it. I could go on.
The Chairman: It is hugely important.
Q63 Lord Butler of Brockwell: I would like to talk about the drafting of the Bill, if I may. Your two reports made recommendations in strikingly similar words. Mr Anderson’s report said that the new law should be drafted in a way that is both “comprehensive and comprehensible”, and the RUSI report said that “a new, comprehensive and clearer legal framework is required”. Are you satisfied that the way the Bill is drafted sets out the powers and capabilities in as accessible and foreseeable a way as you had hoped?
Professor Clarke: Yes, from my personal point of view. I thought the explanatory notes that came with the Bill were pretty good, but the Bill itself is necessarily difficult because it combines a series of other legislative frameworks, which are very complex. We thought that one of the key elements of this sense of clarity would rest in the codes of practice. We said very specifically that the codes of practice should be written clearly in ways that ordinary people could understand. The Bill cannot be written in those ways, because it is a piece of statute legislation, but the codes of practice should be clearly written for the more general public. That, to us, would be a very important element of this whole package.
David Anderson: We set parliamentary counsel a probably impossible task, because we asked for a Bill that was comprehensive, and we asked for a Bill that was technology‑neutral. It is quite difficult to be technology‑neutral and at the same time explain exactly what it is that people are being authorised to do. I entirely agree with Professor Clarke that the code of practice, and not just that but other disclosure, is necessary.
If you are looking at accessible and foreseeable, it seems to me that it is not just about the Bill; it is about getting more material into the public domain as to the utility of some of these powers, in particular bulk, which sits there like an elephant in the room. We have heard discussions about how one can look to see if someone’s wife is using the car and whether that is collateral intrusion and so on, but if you are tapping a cable that potentially gives you access to the conversations of thousands or hundreds of thousands of people, you are looking at some very major issues.
Nobody should expect the Government to give away operational secrets or information that is damaging to national security, but it seems to me that we need more in the way of information if this is to be truly accessible and foreseeable. A modest start was made by GCHQ; they allowed me to publish six case studies at Annex 9 to my report. I pressed them unsuccessfully to release more detail, and I was introduced to other case studies they were not prepared to publish. It was a very good start, and I hope more will come.
There are other grey areas that one would not know about from the Bill. This is not a criticism of the Bill, but, for example, can the intelligence agencies use related communications data, which is a by‑product of bulk interception, to construct the web‑browsing records of an individual? There have been some publications recently suggesting that they might be able to do that. One might think there is nothing particularly wrong with that, but it seems to me it is a relevant thing to know about, particularly if one is discussing internet connection records. If this new, highly regulated power should be introduced for the police to make use of, what about the agencies? Do they already have similar powers in this area?
As to retention, what exactly are the types of data for which the retention powers in Clause 71 could be used? There are all sorts of technical questions about that. One does not expect to see in the answer in the Bill, but Parliament will need to see some answers on those sorts of questions if it is to be able to debate this on a fully informed basis.
Q64 Lord Butler of Brockwell: If I may ask one supplementary question on comprehensiveness, there remains some other legislation with powers of intrusion, such as the Police Act and the Regulation of Investigatory Powers Act. They are not all being rolled into this Bill. God forbid that the Bill should be made even bigger, but do you think that is regrettable?
David Anderson: In a way, we have all stuck to our remit, and perhaps we were too obedient about that. The Intelligence and Security Committee, I do not need to tell you, was looking at the intelligence agencies. You said there should be a new law for the intelligence agencies and the rest could keep what they had. I was asked to look at interception and communications data, but I was not asked to look at intrusive surveillance, directed surveillance, all the stuff that happens later on in RIPA, so I did not make any recommendations on that. I was not here for Sir Mark’s talk, but I have heard him say in other contexts that he thinks that was a missed opportunity and it would have been nice to build some of those powers in as well. One could have built in all the Intelligence Services Act powers.
I suspect there are limits to what human beings can do in a short timescale. I do not often publicly praise the Home Office, whose work I review, but I must say they have worked extremely hard on this. There are people in the Home Office who I know for a fact did not get a summer holiday this year because they were working on this Bill. If one had expected them to do something twice as long, that might have been too ambitious.
Professor Clarke: The ISC, although it dealt only with the agencies, talked about reviewing the whole raft of legislation. We thought that would make the Bill impossible, and certainly impossible to get through in time to meet the requirements of the sunset clause. We stuck to the areas of RIPA and DRIPA and some of the other legislation that we thought was capable of being brought under a single legislative framework.
Mr David Hanson: You have touched on it there. We are talking about the legal framework, but I am interested, before we move on to the legal framework, about the assessment of either of you as to the deliverability of the 12‑month holding of records, with both the provider and the Home Office being able to access those records. I wondered whether or not you had a view on that, as well as the legal framework.
Professor Clarke: My own view is that the Home Office, the agencies and the police can certainly have those powers, but they cannot exercise them entirely because of the international nature of the companies they are dealing with. One aspect of these proposals is that they will make it easier for companies who claim that they fall between different jurisdictions to comply with requests that they get from UK authorities, but they will not guarantee it by any stretch of the imagination. This legal framework will help, but in general the power of UK agencies to access as much as they have in the past is declining in any case.
Mr David Hanson: There is also the question of the funding. In the Bill, as we have already touched on, a large sum of money is allocated for support to the providers to deliver the service that the Government are expecting you or subsequent officials to regulate. Have you any assessment of whether those figures are realistic? We will return to that, as a Committee, in due course.
Professor Clarke: We have not made any assessment of that. The Bill came out after we finished our work, so I do not have anything to offer on those particular figures.
David Anderson: You asked about the deliverability of internet connection records. The first thing I would say about that is that the Bill has been a lot less ambitious, as it seems to me, than the old Communications Data Bill 2012, which I know some of the Committee knows very well. In particular, easily the most extensive and expensive feature of that Bill would have been the obligation on UK network providers to retain copies of all third‑party data running over their networks. I think the very modest estimate for that was £1.8 billion, but it was accepted that it would probably be a lot more.
There is an estimate of about a tenth of that cost over 10 years for internet connection records. They have done what I recommended and made out an operational case as to the respects in which the police would find that useful. Does that mean they are deliverable? Not necessarily. I am not seeking to express a view on this, because I do not have one and I am not competent to have one, but there are some serious questions there. Another Committee, I know, is taking evidence on some of these questions. Would it be technically feasible to assemble precisely the types of data that they say are wanted? Would it be operationally worthwhile?
My understanding is that, although no other western country currently seeks to deliver internet connection records, there was an attempt to do something very similar in Denmark. This happened until June 2014, when the law was repealed. One of the stated reasons for that is that the police had not found it as useful as they had hoped. No doubt one can learn from other people’s errors, and indeed I have heard that, in Denmark, they are thinking of reviving the idea. But it demonstrates that one cannot just run into these things without a deep technical understanding of how easy it is going to be to isolate and store precisely the types of data that the Government say they need.
Q65 Matt Warman: Going back briefly, I wonder if you could characterise to what extent the Bill, as it is, is a grand but not comprehensive tidying up exercise, versus the introduction of new powers.
David Anderson: For me, the headlines would be, first, transparency, as I said in my opening statement. It is key for democracy that the powers are out there. The second is enhanced safeguards at the authorisation level where intercept is concerned, and not so advanced when you are looking at communications data, and that would be one reservation I have. Thirdly, on powers, it preserves and makes explicit all the powers that are currently used and seeks to introduce one new one, the generation and retention of internet connection records by service providers.
Matt Warman: That makes it sound like you think the bulk of it is an aggregation exercise, with a small number of new powers.
David Anderson: Yes. It is a much more modest exercise in terms of new powers than the Communications Data Bill 2012. The reason it is so much bigger is because they bring into the Bill all these things that nobody had even heard of two or three years ago, but which are now set out.
Q66 Lord Strasburger: One of the powers you have already mentioned is bulk acquisition, which was only avowed on the day the Bill was published. You will be aware that the equivalent of that in the United States is Section 215 of the USA Patriot Act. You will also probably be aware that President Obama commissioned two reviews, in the wake of the Snowden revelations, and they both found that Section 215 powers were ineffective and do not make “any significant contribution to counterterrorism”. It was duly repealed, with effect a few days ago, I believe. My question is: would this Bill take the UK into stronger and more intrusive powers when the United States has started to travel in the opposite direction?
David Anderson: It is dangerous and difficult to make international comparisons, although I am not discouraging it, partly because—and this is not a comment on the United States—it is difficult to know exactly what is going on in other countries. I cannot put my hand on my heart and say that I understand the relationship between the Government and the former national telecoms provider in every European country or in the United States. I certainly would not have had any idea five years ago that the NSA had probes in the nine chief US internet companies, as was reported, under the PRISM programme.
There is, as you say, a parallel between a Section 215 power, where communications data internal to the US was gathered in one place, and the power that was avowed early in November, when the Bill was introduced to Parliament. We have seen the suspension of that Section 215 power. I think I am right in saying, although I might be out of date, that there had been rulings to the effect that the power is untenable because it was not sufficiently authorised by Congress. I do not believe that power has been tested against the constitutional guarantees of privacy, so I am not sure that one is necessarily saying that the American courts have gone further in relation to privacy, and indeed there are some respects in which they have not.
Lord Strasburger: Is it possible to answer my question in terms of avowed powers? Would it be true to say that avowed powers in the States are moving in a different direction to the one we are asked to move in with this Bill?
David Anderson: It is difficult to say, even in the United States. They have an executive order, 12333, pursuant to which all sorts of data are collected. It has not yet been reviewed. There is, I think, a proposal to review it, but very little is known about it. I could not tell you what the parameters of that power are, or what exactly it is used to do. You can give the Americans credit for a great deal, certainly in terms of judicial authorisation of intelligence warrants. They lead the world with the FISA court, and there are very few other countries that have attempted anything like that.
In terms of how useful 215 was, I hope that the utility and the proportionality of the newly avowed power will be tested before Parliament. I hope there will be a way of doing that. It may have to be done before the Intelligence and Security Committee. Of course, we already had a power, which everybody has known about for years, under the old data retention directive and now under DRIPA, whereby this sort of data can be retained by service providers. There may be a question as to the added value of retaining possibly similar categories of data in a single place. Is that all about speed of access, or are there other advantages that the intelligence agencies glean from it? It is a very intrusive power, and, if it is going to be justified, it is right that Parliament or Committees of Parliament should be given the opportunity to test its utility.
Professor Clarke: We spent in our panel, given the make‑up of the panel, quite a long time thinking about bulk access as a matter of principle. Views differed across the panel. We all eventually came to the conclusion that it was necessary for the purposes of national security and law enforcement, and for all manner of intelligence purposes.
One of the problems in talking about bulk access in this context is that there is a sense out there that only Governments do it, but of course everybody does it. It is part of our digital society. The old phrase is that unless you are one of a very small group of people indeed, Tesco already knows a great deal more about you than MI5 ever will. Data analytics are used by everybody: by retailers, by charities like my own. Everybody uses data analytics. Bulk exploitation of data is part of our society. When the Government do it, of course they should be held to a much higher standard because of what can follow from their conclusions, but bulk data is a fact of life. Our discussion is not whether we have or do not have it; it is how it is used and under what framework and what circumstances.
Q67 Suella Fernandes: In relation to bulk data, could you briefly give an example of how its possession has helped in intelligence and counterterrorism? I know there are many.
David Anderson: I can do it briefly by referring you to Annex 9 of my report. I only wish I could put names to the terrorists referred to in Annex 9, but I am told that I cannot. A few journalists have guessed, but that is as far as I can take it.
Suella Fernandes: The concern is that individuals who do not fall into the category of criminals or terrorists will have their browsing habits under surveillance and captured under bulk data, so my penchant for very expensive shoes and online shopping will be captured. Can you just describe the interest and the capacity among our law enforcement, intelligence and security services for that kind of information?
Professor Clarke: The safeguards in those cases rely on necessity, proportionality and legality, and the warrant that will now be required for bulk access will be much more specific. It comes down to the ethics of the agencies and the police, and how they operate the powers that they have. We on our panel were very impressed at the high ethical standards in general that apply.
The other great safeguard is the sheer physical capacity. One will be astonished at how little they can do, because it takes so much human energy to go down one track. The idea that the state somehow has a huge control centre where it is watching what we do is a complete fantasy. The state and GCHQ have astonishingly good abilities, but it is as if they can shine a rather narrow beam into many areas of cyberspace and absorb what is revealed in that little, narrow beam. If they shine it there, they cannot shine it elsewhere. The human limitation on how many cases they can look at at once is probably the biggest safeguard.
Lord Strasburger: You mentioned codes of practice. Governments have a habit of holding back codes of practice until long after Parliament has considered the legislation. Would you advise the Committee to urge the Government to publish draft codes of practice so that Parliament can see them while it is considering the Bill?
Professor Clarke: I would strongly advise that. That was a very clear conclusion from our work.
David Anderson: That is right. Of course, many of these codes of practice exist already. For example, an equipment interference code of practice was issued in February. You might notice, when you read it, it does not say much about bulk equipment interference, which is one of the aspects in respect of which some interesting questions are going to have to be asked. I would agree with that.
Q68 Lord Hart of Chilton: We have been asking witnesses about the judicial review principles that underpin judicial authorisation, and whether or not they constitute a true double lock system. Could you give us your comments on that?
David Anderson: I find it, as a rule, very foolish to disagree with David Pannick about judicial review. I think he knows more about it than anybody else in the world. I read his article and I agree with it, despite the fact it is not precisely what I recommended. It is much closer to what the RUSI panel recommended.
I would make one point in respect of which I think the double lock, in a sense, is unduly cumbersome. There may have been an echo of that from a previous witness. It is in relation to police warrants, which, in nearly all countries I know about, are perfectly straightforward: the police go to a judge and the judge gives them the warrant. It is not seen as an area where the intervention of a government Minister is necessary. I can see that, in national security matters, different criteria apply. Indeed, I recommended a double lock myself in relation to foreign policy and defence warrants. But in relation to police warrants, which are 70% of the whole and therefore represent 70% of those 2,300 warrants that the Home Secretary authorises every year, it seems to me that one could do without the politician or the Minister and go straight to the judicial commissioner.
Professor Clarke: We thought that the double lock, as the Bill came through, in principle is workable. It is undoubtedly more cumbersome than the present system, but that is probably a reasonable compromise in terms of bringing greater public confidence into the process and aligning us more with our international partners, which will have other advantages in persuading internet service providers to co‑operate with requests they could argue they do not need to co‑operate with.
Q69 Bishop of Chester: I was struck by Professor Clarke’s expression: a “clean and clear” process of judicial oversight. Bishops, of course, are appointed in some sense by the Prime Minister, so I have to tread carefully here, but I am glad it does not have to be renewed every three years in my case. I wonder whether it feels right to have three‑yearly renewal and the Prime Minister making the appointment, if you want to have a clean and clear process. I would be grateful for your comments.
Professor Clarke: This is a very powerful position and it will require the evident exercise of very high integrity that is unimpeachable. It is not difficult to find people who will do that, but they have to enjoy the confidence of the Prime Minister and the political establishment, and command public confidence as well. When I say “clean and clear”, we had in mind the National Audit Office, a big organisation that has important technicians and specialists in it, but also has a big effect at the policy stages and in post‑legislative scrutiny. Something approaching that is not unreasonable. The present system has been fairly ad hoc. It works reasonably well, but it could work in a much better way. It would be expensive.
We thought of four‑yearly renewals, renewable for a four‑year term, but three‑yearly is not a bad compromise. I personally would prefer it to be longer, so that somebody could build a greater profile in the work that they do, which the public would get used to.
Bishop of Chester: Five years?
Professor Clarke: Yes, that would be workable as well. One of the important aspects of this role is the outward‑facing nature of it. That is not an afterthought. It is important that the work of the commissioner should be outward‑facing, seen and understood, in the same way as Her Majesty’s Inspectorate of Prisons. It is a really important role and the public should understand what that person does.
David Anderson: I see the advantages of a five‑year term, and I see the advantages of making it a single term so that there would be no question of people being careful around the renewal period. I should say that I am appointed as Independent Reviewer of Terrorism Legislation for a renewable three‑year term. Did that affect the timing of any fights I might have wanted to pick with the Home Secretary? I do not know; perhaps subconsciously it did.
Another thing to bear in mind is that it depends slightly who you want to do this top panjandrum job. It has to be a senior judge or a retired judge. If you want a serving judge—I am not suggesting that retired judges are not fully vigorous and capable of working six‑day weeks, but that is the sort of person you probably want—and if you want to take someone out of regular judging for a few years and then put them back in the system, you might be pushing it to try to go beyond three years. They are familiar with the idea of the Law Commission: you leave the judiciary for three years to do the Law Commission and then you go back. If you are away from it for much longer, you might find people thinking, “Well, that is not really why I became a judge”.
Bishop of Chester: And the Prime Minister making the appointment?
David Anderson: I ought to oppose that, I feel, because I understand the argument that it might be perceived as political, but I cannot help echoing what the judges have said to you. These are people who have been independent all their lives. They have been self‑employed. They then took a judicial oath to show neither fear nor favour, and they do not. Yes, one could introduce consultation with the Lord Chief Justice, or by agreement with the Lord Chief Justice, perhaps bringing in the Judicial Appointments Commission and possibly some sort of parliamentary hearing. For the purposes of public perception, that may be a good idea. I suspect you would be better judges of that than I would.
Q70 Stuart C McDonald: First of all, I have a supplementary on a couple of things you said earlier. You both referred to a degree of public scepticism and cynicism, which largely arises because we are aware of all sorts of capabilities and practices being used that we had never heard about. How do these provisions prevent that from happening again? How can we ensure that things are not going on that we should know about but do not?
Professor Clarke: Partly because this Bill will tighten up a lot of powers and they will all be in one place. One of the reasons for some cynicism among those who took an interest in this is that they thought, as there were so many different legislative frameworks that the agencies or the police could use, it was almost as if there were loopholes that would allow them to do what they wanted. That was part of the basis of the cynicism. That would not exist to anything like the same degree under this legislation, so the tidying up and the clarity with which it could be presented, with the oversight, would provide a much greater reassurance.
As David said earlier on, those who will not be convinced will not be convinced by it. In a way, the battleground in terms of public confidence is the more average person, who feels that at least they know there is a process. They may not know the details of it, but they did not even know there was a process until last year. At least if they know there is a process, they can take some interest in it and feel confident that the people operating that process are operating it independently.
David Anderson: In recent months, it has been the Investigatory Powers Tribunal that has been the main battering ram in securing avowal of programmes. That may conceivably be something of a one‑off. I regret to say this, because I do not condone what Mr Snowden did, but it was information allegedly disclosed by Snowden that prompted some of those cases and eventually prompted avowal by the Government. I do not think that is a good model on which to proceed for the future.
The key has to be the commissioners. I have very high regard for what the commissioners have done, but I remarked in my report that it was not the courts, commissions or committees of London that disclosed to the British people what was going on; it was the revelations that originally came from Mr Snowden. That is not the way it should be. I hope one advantage of this big new commission, with the technical expertise, with the weight to get inside the agencies and work out what is going on there, is that these things will not come as surprises, and, if these commissioners feel there is something important going on that ought to be disclosed, they will write to the Prime Minister, as I wrote to the Prime Minister about the power that was disclosed on the morning of the Bill. I suspect they will find, as I found, that there is no resistance whatsoever to doing what is clearly right.
Q71 Stuart C McDonald: That is helpful, thank you. You have suggested that international comparisons might not be all that helpful. Nevertheless, I was planning to ask you about international comparisons, so I will do so. Are there ways in which this Bill, perhaps in its provisions relating to oversight, data retention, bulk collection, goes further than what similar countries have put in their legislation?
David Anderson: If one were taking a very general look at it, this is a very extensive set of powers, certainly by western standards. We are a major SIGINT power. That is reflected in the powers and that is why we need such strong safeguards to go with them. Moving away from those glamorous agency‑type powers, one is also looking at things like the retention of quite basic call data by service providers, largely for the use of the police and other users of data.
Possibly reflecting the public mood in this country, although there are safeguards, they are not as tight as they are in some countries. For example, in Germany they have just reintroduced their own data‑retention law. They require the data to be kept for four weeks, whereas the idea here is it would be held for 12 months. The Germans are going to require judicial authorisation for anybody who wants to look at it, which people are saying over there is going to be very cumbersome. Jo Cavan told you that there were half a million applications to look at communications data last year. Plainly, one could not ask people to go before a judge on each of those occasions.
As a nation, we seem to be less concerned about our own privacy, at least vis‑à‑vis the Government, than some of our neighbours in Europe and indeed across the Atlantic. That is probably reflected in what is a pretty strong suite of powers. That is why we need a strong suite of safeguards to go with them.
Professor Clarke: The only thing I would add is that there is an idea around this legislation that our country that has a high reputation in intelligence matters. We have a global intelligence capacity that not many other countries have, and that plays to our advantage most of the time. This represents a modern piece of legislation and, if the oversight capacity and the confidence that can be built into it are there, and if we put enough resources into it, it can be a world leader in legislative provision. One of the aspirations behind this thinking is that it would act as a very good example of how to get the balance right for a power that wants to retain high intelligence capabilities.
Q72 Stuart C McDonald: I have one final question. Correct me if I am wrong, Mr Anderson, but I think you said earlier that you some reservation about provisions relating to communications data. Could you expand a little on that?
David Anderson: One of the submissions I heard from a lot of people is that you can tell more and more these days from communications data. It is not any longer just the writing on the envelope; it can be the location data showing where someone was. Quite a lot of personal information can be detected, particularly when bulk personal datasets are combined. My reaction to that was not to say you have to bring in a judge every time. You cannot require a judge to authorise a simple reverse lookup when you are looking for a lost child in an emergency. But I said that there are categories of communications data requests that ought to be independently authorised, so why not by the commissioners?
I gave some examples—people looking for sensitive information about whom a lawyer might have been talking to and other novel or contentious cases, which is a concept that the commissioners would have to build up over time—that, it seemed to me, ought to be authorised by the commissioners. The commissioners ought to be able to put out guidance so that people would know the principles on which they were acting and you would have a principled framework governing these things, instead of the opinions of lots of different designated persons in different places.
Behind that idea was the way the law seems to be moving in Europe. There was a case, Digital Rights Ireland, last April, saying that you needed a prior independent authorisation even for quite simple communications data requests. The High Court this year decided that DRIPA was invalid because of a failure to give effect to that requirement. The Court of Appeal retrieved the position, from the Government’s point of view, a couple of weeks ago by indicating that it was going to ask the European Court of Justice what it really meant. It will probably be 18 months or so before we find out the answer.
There is quite a lot of pressure from a number of angles. There were not many disappointments, to be honest, and I think they gave effect to the great majority of my recommendations and those of RUSI, but one reservation is that they did not do much to improve the authorisation of communications data, not just by police but by others as well.
Lord Butler of Brockwell: To follow up on that, how confident can you be that this Bill is going to pass the requirements of European law?
David Anderson: It is a very sensitive question, because the Court of Appeal has decided it is going to ask the questions of the European Court. I do not believe the questions have yet been finalised or sent off. If one restricts oneself to what has happened in other countries, my understanding is that around five constitutional courts and some other courts, in countries such as the Netherlands, Belgium, Slovenia and Austria, have already decided that national laws based on the data retention directive, as ours was, are not valid. The High Court here said the same thing. The Swedes were made of sterner stuff; they asked Luxembourg the question, and so did our Court of Appeal. Trying to predict the results of litigation is a mug’s game and I am not going to succumb to the temptation.
Q73 Matt Warman: You both implicitly mentioned the idea that this is the UK leading the world on the kind of legislation that we are going for in this area. The other side of that argument is that, if it is taken by regimes that do not share our judicial oversight and our values, it could essentially be misused. Is it ever reasonable to draft our legislation in the light of what another country might do with it for good or evil?
Professor Clarke: I would say no, because our legislation is for us. In a way, this will provide a model of legislation, because of the oversight provisions and independence that is meant to be built into that. If other countries that did not share the same democratic values imitated this but in a way that was a façade, that would be fairly clear.
One thing that we say in the RUSI report is that a start can be made by bringing together countries in the OECD and some of the like‑minded liberal democracies. We need to create a much bigger consensus on the way in which legislation should handle this increasingly complex relationship between citizens and government in the digital age. This legislation could provide a basis for discussions with a lot of our partners. There will, of course, be quite big differences, because there are big cultural differences between the way Germany, the United States and Britain, let alone France, see these issues. There is a case for saying that a piece of model legislation would be a good example, and we should not try to second‑guess what less democratic countries would do in response to it.
David Anderson: We are not at the privacy‑minded end of that spectrum, but it is very important that we reach out and make our law understandable to people who are in a slightly different place. That is because this law has a huge extraterritorial reach. We assert the power to do a lot of things beyond our own frontiers. It is also because, as Professor Clarke was saying, to the extent that our law enforcement and intelligence agencies are seeing the world going dark, that is, in part at least, because there are internet service providers in other parts of the world, particularly the United States, that are wary of accommodating foreign Governments in their requests for information, particularly if those Governments do not respect what they see as the safeguards available in the United States, one of which is judicial authorisation.
I do not put it on the basis that we should set a good example for the rest of the world, although it would be an admirable thing if we could. I put it on the basis of self‑interest, producing a law that is acceptable to the rest of the world, whether you are looking at courts in Luxembourg or tech companies in California, because that is the way to advance our own interests and to make sure that the people who need it can get the information they need.
Q74 Matt Warman: Finally, one of the crucial extra powers is the retention of internet connection records. Do you feel that that case has been adequately made publicly? Do you feel that the public have got behind that yet?
David Anderson: The Government have produced a 24‑page operational case, as I recommended they should. I did not recommend 24 pages, but they have produced an operational case. They made out their case for three reasons why the police and others might want that information. That is now free for committees to interrogate, and no doubt you have started that process already. As I said earlier, the question marks that still remain in my mind relate to feasibility, cost, security of storage and all these other matters.
One always imagines the police will ask for all the powers they possibly can, but they are very conscious, particularly at a time of financial stringency, that they have to train people to use these new powers. They need to devote budgets to doing do. If it turns out to be a bit of a damp squib, as may have been the case in Denmark, they will feel they have wasted their money, so it needs a cool, hard look. I applaud the Government for doing that in relation to third‑party data retention, which was said to be essential back in 2012 and which is now not essential anymore because it does not feature anywhere in the Bill. That has saved the country a very great deal of money.
I am not saying that internet connection records are in the same basket. I can certainly see how useful they could be, particularly in IP resolution and in tracing the fact that people have been using communication sites. How easy is that going to be to achieve technically, when nobody else in the world yet really does it? I do not know.
Professor Clarke: There is a principle behind that, which we talked about quite a lot in our panel. Is it the case that, in principle, law enforcement should have a right to try to go wherever the criminals are, or are there some areas in which we say, even if criminals inhabit them, the Government do not have a right to go? There is no easy resolution to that issue, other than to take a view, either yes or no. That, in a sense, is what we are talking about. Whether the adequacy of internet connection records as an investigative tool is correct, we do not know. We just do not know how useful it will be, but it does raise exactly that principle. Do the Government have a right to go anywhere where the criminals might be?
Q75 The Chairman: I have one final question, which relates to the first one I asked. You are satisfied with the draft Bill, by which I understand that you are satisfied that the major recommendations of both your reports have been taken on board.
David Anderson: I have not totted them up. I can say that around 90% or more of mine have been wholly or substantially taken on board. Although my report, I am afraid, is very long, most of it is descriptive and the recommendations themselves fit into about 20 or 25 pages, whereas this Bill is closer to 200. For me, the challenge is going down a level into the detail and seeing whether those who have applied themselves to that detail have made all the right decisions.
Professor Clarke: As Chair of the RUSI panel, I can say that the Bill met most of our expectations in terms of the recommendations that we made. Also, at the end of our report, we elucidated 10 principles and said any future legislation must meet those 10 tests. I would recommend you have a look at those tests. I think the legislation meets most of them.
The Chairman: It has been a fascinating session. Thank you both very much for coming along. I am sure you will be interested in the recommendations we eventually give the Government. Thank you very much indeed.
Oral evidence: Draft Investigatory Powers Bill 2