Home Secretary James Cleverly, leads the Second Reading debate of the Investigatory Powers (Amendment) Bill.
The Secretary of State for the Home Department (James Cleverly)
I beg to move, That the Bill be now read a Second time.
The first duty of Government is to keep our citizens safe. The United Kingdom faces an enduring threat from terrorists, hostile actors and organised criminal groups, and that threat is evolving and becoming more sophisticated. It is not enough for us to keep pace with those who would do us harm; we must endeavour to get and then stay ahead of them. The investigatory powers are the legal powers available to law enforcement, the intelligence services, MI5, the Secret Intelligence Service, GCHQ and other public authorities where appropriate to obtain communications and data about communications.
The Investigatory Powers Act 2016 provides a clear legal framework for the use of those powers, combining world-leading safeguards and oversight with giving agencies the tools they need to protect us. There is a double lock for the most sensitive IPA powers, meaning that an independent judicial commissioner must approve a decision by the Secretary of State to issue a warrant under the IPA. The use of any of these powers must be assessed as necessary and proportionate, with strong independent oversight by the Investigatory Powers Commissioner. The Investigatory Powers Tribunal provides a robust mechanism for providing redress in respect of any unlawful use of those powers.
Mr Alistair Carmichael (Orkney and Shetland) (LD)
The Home Secretary will be as aware as I am that very occasionally those in charge of our intelligence and security services do not act in the best traditions of this country in their offices, and I am thinking of cases such as Belhaj and Boudchar. Where people have been the victim of mistreatment—as a consequence of UK complicity with foreign powers, for example—should there not be a right for those people to have access to the information about that?
James Cleverly
I listened carefully to the right hon. Gentleman’s point. I am not sure it is directly relevant to this matter, but I take on board the points that he makes. He will forgive me if I do not address them directly at this point; I want to consider them properly.
The IPA is sound legislation, but the nature of these threats has evolved since 2016, and we are confronted by greater global instability and technological advances, and they demand that we act. Terrorists, child abusers, organised criminals and malign actors from hostile states have exploited technological advances. Our job is to ensure that the UK’s investigatory powers framework remains fit for purpose. The changes that this Bill proposes were informed by the independent review of the IPA published by Lord Anderson of Ipswich in June 2023. The Bill received cross-party and Cross-Bench support as it passed through the other place. Every Government amendment was accepted, and I thank the members of the Intelligence and Security Committee of Parliament for the productive way they engaged with and helped to shape the Bill.
In particular, we have agreed to tighten the drafting of clauses 22 and 23 in line with amendments proposed by the Intelligence and Security Committee. Those changes put beyond doubt that the Prime Minister may delegate warrants for the purposes of obtaining communications of parliamentarians in two, and only two, exceptional circumstances: the personal incapacity of the Prime Minister and a lack of access to secure communications. There is also a limit of five Secretaries of State to whom this responsibility could be delegated in those circumstances. Further to that, in respect of new part 7A, parliamentary scrutiny will be enhanced through a statutory requirement for the Secretary of State annually to inform the Intelligence and Security Committee about the new regime for bulk personal datasets.
Sir John Hayes (South Holland and The Deepings) (Con)
My right hon. Friend mentioned the ISC’s scrutiny of these matters. He will understand the concern about widening the number of people who can play the role previously played exclusively by the Prime Minister. I understand the reasons for that, but has he considered limiting that to those Secretaries of State who have warranting powers?
James Cleverly
We looked at that. There is a balance to be struck, and actually the bulk of those Secretaries of State to whom the function could be delegated in those two exceptional circumstances do have warranting powers—I think the Secretary of State for Defence is the only one who does not. My right hon. Friend’s point is a fair one, but the scope of the Bill is not much greater than that.
Mr Kevan Jones (North Durham) (Lab)
As a member of the ISC, I welcome the Government’s acceptance of our recommendation. However, I would like to understand why they are not accepting our other, simple proposal: that when a delegation takes place, the Prime Minister would be informed about that afterwards.
James Cleverly
I think it is inconceivable that the Prime Minister of the day would not be informed of the use of a delegated authority.
Mr Jones
It is not about the Prime Minister not being informed about the delegation; it is about the Prime Minister looking at the case afterwards—they would not be second-guessing it, obviously, because it would already have been agreed. We suggested that, as a matter of course, the Prime Minister should be informed afterwards of the contents of that warrant. For some reason, the Government are resisting that. I cannot understand why.
James Cleverly
I understood the point that the right hon. Gentleman was making—perhaps my answer was not clear—but I suggest that it is inconceivable that the Prime Minister would not routinely be informed of the exercise of this power. Ultimately, that is a level of granularity that would add complexity to the Bill without utility. But, as I have said, through the passage of the Bill thus far, we have listened carefully to the Committee’s suggestions, and although we may not always agree, I can reassure him, other members of the Committee and Members of the House that we will continue to act in listening mode in relation to the Committee’s suggestions.
Joanna Cherry (Edinburgh South West) (SNP)
On that point, will the Home Secretary give way?
James Cleverly
I will, but I do want to make some progress.
Joanna Cherry
I thank the Home Secretary for giving way. He mentioned listening to scrutiny by the ISC. The Joint Committee on Human Rights has issued a call for written evidence on the Bill, and as he will know from the human rights memorandum, the Bill raises important human rights issues relating to the rights to privacy and to freedom of expression, and possibly the right to an effective remedy. Will he therefore undertake to look closely at any correspondence that the Joint Committee might send him when we have completed our scrutiny of the Bill?
James Cleverly
I reassure the hon. and learned Lady that we will do exactly that.
I turn to the measures in the Bill. We are creating a new regime for bulk personal datasets that have low or no expectation of privacy: for example, certain datasets that are widely publicly or commercially available. Bulk personal datasets are an essential tool to support our intelligence services in identifying fragments of intelligence within a large quantum of data, in order to disrupt threats such as terrorism and hostile state actors. The Bill seeks to create a new statutory oversight regime for how the intelligence services access and examine bulk personal datasets held by third parties. It will place that oversight on a statutory footing, increasing the transparency of the regime. The regime will be subject to strong safeguards, including the double lock.
We are also making changes to the notices regime that will help the UK anticipate and address the risk to public safety of companies rolling out technology that precludes lawful access to data. We want to work with those companies to achieve common goals, but we must have the tools available when collaboration falls short.
Suella Braverman (Fareham) (Con)
I know that the Home Secretary wants to make progress, but I am grateful for the opportunity to comment.
These reforms to the IPA are necessary to upgrade our world-class regime and ensure that our frameworks are kept up to date with evolving threats and, importantly, technology. We know that the terrorists, the serious organised criminals, the fraudsters and the online paedophiles all take advantage of the dark web and encrypted spaces: to plan their terror, to carry out their fraudulent activity and to cause devastating harm to innocent people such as children, in the field of online paedophilia. Does he share my concern and indeed frustration with companies such as Meta and Apple? The former has chosen to roll out end-to-end encryption without safeguards and the latter has rolled out advanced data protection, which will allow these bad actors to go dark, which will severely disable agencies and law enforcement from identifying them and taking action, and will enable—indeed it will facilitate—some of the worst atrocities that our brave men and women in law-enforcement agencies deal with every day.
James Cleverly
My right hon. and learned Friend—and immediate predecessor—makes incredibly important points. Digital technology and online technology have been a liberator in so many ways, but, sadly, as has been the case with technology throughout time, it has also been used by those who would do people harm. Indeed, she mentioned in particular the harm done to children. We take that incredibly seriously. We value the important role of investigatory powers and will continue to work with technology companies—both those well established at the moment and those of the future—to maintain the balance between privacy and security, as we have always done, and ensure that these technology platforms do not provide a hiding place for terrorists, for serious criminals and those people taking part in child sexual exploitation.
The three types of notices under the existing IPA are data retention notices, technical capability notices and national security notices. Those notices must be both necessary and proportionate, and they are of course subject to the double lock. The Bill does not introduce any new powers for the acquisition of data. The changes are about ensuring that the system is up to date and remains robust. The Bill will create a notification notice allowing the Secretary of State to place specific companies under an obligation to inform him or her of proposed changes to their telecommunications services or systems that could have an impact on lawful access. This is not a blanket obligation, and it will be used only where necessary and proportionate, and then only on a case-by-case basis.
The notice does not give the Secretary of State any powers to veto or intervene in the roll-out of a product or services. It is intended to ensure that there is sufficient time for appropriate consideration of the operational impact of the proposed changes, and potentially for discussions with the company in question about them. The public, rightly, would want their representatives to know in advance if companies were proposing to do something that would put public safety at risk, and responsible companies will work with Governments to avoid endangering people, who are of course also their customers.
The Bill will also amend the IPA to require the company to ensure that existing lawful access is maintained. That means the company cannot legally take any action that would negatively affect the level of lawful access for our operational partners during the review period. In the other place, the Government tabled an amendment to allow a timeline for review of a notice to be specified in regulations. We also gave the judicial commissioner further powers for managing the review process. Taken together, they ensure that companies are clear on the length of time that a review can take, which reduces uncertainty for their business as well as providing greater clarity for the review process. In the other place, my noble colleague Lord Sharpe of Epsom also committed to a full public consultation before amending the existing regulations on the review of notices, and laying new regulations relating to the notification notices.
The Bill also clarifies the definition of a telecommun-ications operator, to make it clear that companies with complex corporate structures that provide or control telecommunications services and systems in the UK fall within the remit of the IPA. These changes do not directly relate to any particular technology, including end-to-end encryption, but are designed to ensure that companies are not able to unilaterally make design changes that compromise exceptional lawful access.
The Bill makes changes to the powers of public authorities to acquire communications data. Section 11 of the IPA made it an offence for a relevant person in a relevant public authority to knowingly or recklessly obtain communications data from a telecoms operator or a postal operator without lawful authority. The Bill will set out examples of the acquisition routes that amount to lawful authority outside the IPA, giving greater clarity to public authorities that they are not inadvertently committing an offence. Further targeted amendments will ensure that public sector organisations are not unintentionally prevented or discouraged from sharing data. Further changes will allow bodies with regulatory functions to acquire communications data.
The Bill also creates a new condition for the use of internet connection records—ICRs—by the intelligence services and the National Crime Agency. The IPA currently requires certain thresholds to be met on the known element of an investigation, such as exactly when a website has been accessed. That limits the ability of operational partners to use the ICRs to detect previously unknown criminals, terrorists or state threat actors who are acting online. The proposed measure will allow greater detection of high-impact offenders by removing the requirement to unequivocally know a specific time or times of access and service in use, and instead will allow these factors to be specified within the application.
Mr Jones
I understand the use of the measure for the security services, but the Bill broadens the scope of how many people could be dragged into it. There is no judicial oversight of the Security Service or whoever is using it. The Bill states that the measure is for national security and economic wellbeing—that is a catch-all for quite a lot of things. Although the intent is right, there need to be some safeguards to prevent innocent people being dragged into that potentially broad measure.
James Cleverly
I understand the right hon. Gentleman’s point. Innocent people’s data is often acquired in dataset capture, and it is always deleted. Economic wellbeing merely reflects the language that is used in other parts, for consistency across our various strands of work.
Mr Jones
I thought we were here today to scrutinise the Bill. It should not be a chore for the Home Secretary to be asked questions. The definition of wellbeing could be quite broad. I understand the meaning of national security, as I think he does, and the House, but wellbeing could have quite a broad definition and I am not convinced that I have seen what it is. I am not sure that consistency with other legislation is a great argument for including it in this Bill.
James Cleverly
The simple truth of the matter is that I disagree. In legislation of this nature, maintaining consistency of language with previous relevant legislation, including the Intelligence Services Act 1994, is incredibly important to clarity of intent. I recognise that the right hon. Gentleman has given thought to this, and we do not disregard his point, but we have thought through the importance of consistency of language, which is why we have maintained it.
Dame Angela Eagle (Wallasey) (Lab)
A general listener to our proceedings might worry that the new powers could be used for fishing expeditions, rather than the very specific powers that they replace. Could the Home Secretary give some words of reassurance from the Dispatch Box that the broadening of bulk data collection without specific dates will not be used for fishing expeditions, which might affect the privacy of ordinary citizens who have done nothing wrong?
James Cleverly
The hon. Lady makes an important point, but the powers could be applied to any bulk dataset collection, of which she knows there are many across Government. Provisions are in place to ensure that innocent people’s data is not held but deleted, and that our security services and other organisations that will utilise these powers always do so carefully and cautiously. There are relevant safeguards in place, as I have made reference to—the Investigatory Powers Commissioner and the tribunal—if there is wrongdoing. The proposals are put forward for a very specific reason. The Government have given thought to mission creep and broader expansion, and we feel that this is a modest extension that will give significantly greater protection to the British people.
Mr Jones
As my hon. Friend the Member for Wallasey (Dame Angela Eagle) just said, we need to give confidence to the public that what we are rightly doing to protect ourselves has that level of security in it. There is no judicial oversight of internet connection records. If we are to give these powers to the Security Service—which I approve of—we should be able to say to the public that they are proportionate and that there is an independent process to ensure that they cannot be abused. Surely, judicial oversight throughout should be important.
James Cleverly
The right hon. Gentleman specifically spoke about judicial oversight, but there is oversight—
Mr Jones
There isn’t.
James Cleverly
There is oversight by the Secretary of State through the warrant process, and oversight of the whole process by the Investigatory Powers Commissioner. Through the Committee on which the right hon. Gentleman sits, there is oversight of the Secretary of State’s function.
Mr Jones
I agree, and I support that oversight, even though this Government have not made our job on the ISC easy. Unless I am missing something, there is no judicial oversight of internet connection records in the Bill. If we want to give people confidence, that backstop of judicial oversight should be important.
James Cleverly
As I said, I noticed that the right hon. Gentleman specifically said that there is no judicial oversight—
Mr Jones
There isn’t.
James Cleverly
I am not disagreeing, but there is oversight. The Committee on which the right hon. Gentleman sits is part of that oversight process.
Holly Lynch (Halifax) (Lab)
The Home Secretary has just touched on the importance of the oversight role of the ISC, particularly in relation to these additional provisions. I wonder whether he remembers the passing of the National Security Act 2023. During the final stages of that important piece of legislation, the Government tabled an amendment in lieu promising that they would progress a review of the memorandum of understanding within six months of the Act coming into force to ensure there was an updated and robust relationship between the ISC and the Government, and the Prime Minister in particular, the ISC having been unable to secure a meeting with the Prime Minister since 2014, remarkably. Given the nature of the ISC’s important role in these provisions, I wonder whether the Home Secretary could update us on that review.
James Cleverly
That is not an element of this Bill. On a commitment for the Prime Minister to meet with the Committee, I will look at the details.
Yvette Cooper (Normanton, Pontefract and Castleford) (Lab)
Will the Home Secretary give way?
James Cleverly
I want to make progress to ensure that everyone who wishes to speak in this debate is able to do so, but I will give way to the right hon. Lady.
Yvette Cooper
On that point, will the Home Secretary encourage the Prime Minister to go before the Intelligence and Security Committee at the soonest opportunity? My understanding is that that has not happened for 10 years.
James Cleverly
I cannot make a commitment on the Prime Minister’s behalf. Members of the Committee will know that I appeared before the Committee in my previous role, and I think it is important that Government do make themselves available for this scrutiny. As I say, it would be inappropriate for me to demand of the Prime Minister attendance anywhere, but I will pass on the right hon. Lady’s point.
Sir Julian Lewis (New Forest East) (Con)
I will assist the Home Secretary with a little context. When I was a ranking member of the Intelligence and Security Committee between 2010 and 2015, it was a matter of routine that the Committee went to see the Prime Minister once a year, usually in the Cabinet Room. That stopped in 2014. Successive Prime Ministers have failed to reinstate it, although it must be said that the shortest-lived of them did offer to meet with the Committee, but sadly ceased to be Prime Minister before that became possible.
James Cleverly
The lengths that some people will go to to avoid Committee scrutiny. I am trying to remember where I was; it has been such a long time since I looked down the page of this speech. All such applications must be necessary and proportionate and subject to independent authorisation or inspection.
The Bill will also strengthen safeguards for journalistic material within the Investigatory Powers Act’s bulk equipment interference regime, aligning it with changes to the bulk interception regime that are under way to ensure compliance with obligations under the Human Rights Act 1998. Prior judicial authorisation will be needed before material obtained through bulk equipment interference can be selected for examination using criteria where the purpose is to identify, or is highly likely to identify, confidential journalistic material or confirm a source of journalistic material. Prior judicial approval is also necessary before such material may be retained for purposes other than its destruction. The other measures in part 5 of the Bill will ensure that the resilience and protections of the regime are maintained and enhanced.
The Bill will also make improvements to support the Investigatory Powers Commissioner in effectively carrying out their role, ensuring that the world-leading oversight regime remains resilient, including powers to enable the IPC to appoint deputies, delegate some of their functions to judicial commissioners and the newly created deputies, and put certain functions on a statutory basis. The Bill will ensure there is a clearer statutory basis for reporting errors to the IPC.
Joanna Cherry
I sense that the Home Secretary is coming to the end of his speech. We have mentioned parliamentarians and journalists, but I want to talk about another important group: trade unions. Some people fear that the Bill will open the door even further than its parent Bill on the surveillance of trade unions. Does the Home Secretary agree that there should be no place for the surveillance of trade unions in a democracy? If so, will he consider amendments to the Bill to ensure that that does not happen, including a redraft of clause 5?
James Cleverly
I take the point that the hon. and learned Lady puts forward. There are a number of organisations not explicitly mentioned in the Bill where that argument could be made, and I am not sure it would necessarily be useful or right to list them all, but I will take on board the point she makes in good faith—genuinely.
The Bill will bring the Investigatory Powers Act up to date with the modern age, provide greater clarity, make the system more resilient and retain the world-leading safeguards of civil liberties and commercial integrity. Above all, the Bill will mean that the men and women who work so incredibly hard to keep us safe, often without recognition, have the tools they need to do so in the modern era. I therefore commend the Bill to the House.