Home Page

Column 1289

House of Commons

Friday 4 May 1990

The House met at half-past Nine o'clock

PRAYERS

[Mr. Speaker-- in the Chair ]

Orders of the Day

Computer Misuse Bill

As amended (in the Standing Committee), considered.

New Clause 2

Search warrants for offences under section

3 To move the following Clause :--

(1) Where a justice of the peace is satisfied by information on oath given by a constable that there are reasonable grounds for believing--

(a) that an offence under section 3 above has been, is in the process of being, or is about to be committed in any premises ; and (b) there is reasonable cause to believe that any person has in his custody or under his control or on his premises anything which there is reasonable cause to believe has been used, is being used, or is intended to be used to commit an offence under section 3 of this Act ;

he may issue a warrant authorising a constable to enter and search the premises, using such reasonable force as is necessary. (2) A warrant under this section--

(a) may authorise persons to acompany any constable executing the warrant ; and

(b) remains in force for twenty-eight days from the date of its issue.

(3) In executing a warrant issued under this section a constable may seize an article if he reasonably believes that it is evidence as aforesaid.

(4) In this section "premises" includes land, buildings, moveable structures, vehicles, vessels, aircraft and hovercraft.'.-- [Miss Emma Nicholson.]

9.35 am

Miss Emma Nicholson (Torridge and Devon, West) : I beg to move, That the clause be read a Second time.

Mr. Speaker : With this it will be convenient to discuss the following : New clause 3-- Warrants for the surveillance of telecommunication traffic --

(1) A justice of the peace may issue a warrant requiring the person to whom it is addressed to mount surveillance of public telecommunication traffic as described in the warrant, and to record its contents ; and such warrant shall require the person to whom it is addressed to disclose all the recorded material to police in such manner as described in the warrant.

(2) A warrant may only be issued by a justice of the peace : (

(a) after an application supported by an information in writing, has been made by a constable, and

(b) in pursuit of sections 2 and 3 only of this Act, and (

(c) a warrant issued by a justice of the peace shall be restricted to the surveillance and recording of computer transmissions only.'. Amendment No. 9, in clause 14, page 8, line 36, at beginning insert

Subject to subsection (1A) below,'.

Column 1290

Amendment No. 3, in line 36, leave out justice of the peace' and insert circuit judge'.

Amendment No. 5, in line 38, leave out

or is about to be'.

Amendment No. 6, in line 40, leave out

or is about to be'.

Amendment No. 10, in line 43, at end insert--

(1A) The power conferred by subsection (1) above may be used only in circumstances in which--

(a) The nature of any material or signal transmitted from or to the premises in respect of which the warrant is sought gives reasonable grounds for believing that an offence under section 1 above has been committed in the premises in respect of which the warrant is sought ; and

(b) more than one person resides or is employed at the premises in respect of which the warrant is sought.'.

Amendment No. 18, in line 47, at end insert--

but does extend to searching the contents of a computer for evidence of the offence aforesaid, albeit that evidence may be amongst material of the kinds mentioned in section 9(2) of the Police and Criminal Evidence Act 1984.'.

Amendment No. 16, in clause 16, page 11, line 4, leave out The reference in section 14(2)' and insert--

In section 14--

(a) the reference in subsection (1) to a circuit judge shall be read as a reference to a county court judge ; and

(b) the reference in subsection (2).'.

Amendment No. 7, in clause 17, page 11, line 37, at end insert-- ; and an individual cannot be authorised to access a computer by a warrent served under section 3 of the Security Services Act 1989'.

Miss Nicholson : I shall speak to new clauses 2 and 3 amendment No. 18, which stand in my name. That does not reflect upon the other amendments which have been grouped with my new clauses and amendment, which have been tabled by other hon. Members.

New clause 2 seeks to place a provision in the Bill for search warrants for viruses and for other amusingly named irritants which can be put into computer systems and which, as we all know, can cause considerable problems for their users. Current legislation has not yet caught up with the age of information technology. That is why the Bill is so welcome. I congratulate the promoter--my hon. Friend the Member for Romsey and Waterside (Mr. Colvin)--on the excellence of the work that he has already done. I shall make my contribution in the spirit of getting the Bill through the House on Report this morning so that it may make its way to another place. I do not do so in any delaying sense.

It would be wrong for me, however, to miss the chance of warning the House of the deficiencies of the Bill and about the concerns which Scotland Yard and I have that the Bill as it stands will be unenforceable in any practical sense of the word, and may turn out to be a short-term measure unless it is amended rapidly. Alternatively, there will have to be a follow -up Bill, which I hope will come from the Government, to put this Bill right.

As we know, the police have been struggling for a long time to combat computer-related crime with existing legislation. There has been some success under the Criminal Damage Bill 1971. Perhaps one good reason for the Bill coming before the House is the failure of the Forgery and Counterfeiting Act 1981 to offer the police any help. Large losses due to computer fraud have been reported by the CBI and the City. Although those figures cannot be verified--the police cannot keep proper records, as so much of computer fraud does not come within

Column 1291

current criminal legislation--the number of cases being reported to the police is increasing all the time. Weapons are badly needed to combat new forms of crime.

Having set the scene, I turn directly to new clause 2. I shall give a typical example of why it is badly needed. Let us imagine that the owner of a small shop employs three staff to look after his customers and to control the stock records. All the stock records are on a computer system and the staff have authorised access to the computer. The three staff naturally use it daily. Let us suppose that one of them does not have the salary that he believes he should enjoy, and he therefore becomes disgruntled.

Unknown to the rest of the staff, but in a normal scenario in today's world, he has a small computer of his own at home, and on that machine the creates a "time bomb". That is a small piece of programme and a few instructions that are destructive of his employer's system. The term "time bomb" is used to describe a piece of destructive programming which takes effect on a particular date. The employee, in this context, copies the time bomb on a floppy diskette, takes it to his place of work and inserts it on to the hard disk of his employer's computer. That is not a difficult thing to do. On a pre-set date, his small piece of programme is triggered and it wipes out all the records on the employer's computer. Of course, the employer has a back-up for his data in the grandfather-father-son sequence, but the employee uses his employer's computer to delete that as well.

There is a financial loss to the shopowner, who must revert to his paper records for his stock keeping. He has to call in an outside computer programmer, who discovers the time bomb, disposes of it and inputs the paper into the computer to restore its files to the orginal condition. If it is a small shop, it would cost the shopkeeper the fees for couple of day's work for a computer programmer--perhaps £480. Programmers are quite cheap, at about £30 an hour, and he would need to do 15 or 16 hours work. The loss is equivalent to about a half-day's taking. However, it has caused the shop owner great anxiety and he is concerned that it might happen again.

The shop owner calls in the police to discover which member of staff is responsible so that he can be prosecuted. Of course, the police also do not know who is responsible, and they mount an investigation. None of the staff has a criminal conviction. They all have track records as reliable and trustworthy employees. The police interview the three members of staff, who all deny the offence. The police later discover that one member of staff is attending an evening course on computer programming. They then receive an anonymous telephone call from a man claiming that that same member of staff has a computer at his home address. The next day, that same member of staff complains that his salary is not high enough, and he asks for a rise.

It is obvious that one of the three staff has committed the offence. One of them is attending a computer course, but although the police have been told that he has a computer at home, that cannot be verified. He has denied the offence, but he is a suspect. It is probable that evidence of a time bomb would be found on his home computer. The police decide that they have reasonable grounds to believe that they would find that evidence if they searched his home address.

Column 1292

Of course, this is a hypothetical case. Let us assume that the Bill has already become an Act. The police look to the Act for the power to obtain a search warrant. Under section 14, they can apply for a search warrant if unauthorised access has been gained to the computer--but the employee in question is authorised to use his employer's computer. In addition, the power of search is restricted to searching the place where the offence took place, which is the shop. The police can find no power in the Act to search the suspect's home address to find evidence of a time bomb.

The police look to other legislation for the power to search, because without a search warrant they cannot succeed. Section 6 of the Criminal Damage Act 1971 would have given the police the power of search, but section 3(6) of the Computer Misuse Act has removed that power as the offence is no longer construed as criminal damage. The Police and Criminal Evidence Act 1984 does not provide the power of search, because no serious arrestable offence has been committed. The police could search the home address if they first arrested the employee. However, the employee has denied the offence and the police have no evidence to the contrary. They are unhappy about arresting the employee in the hope of finding the necessary evidence later to justify the arrest. That is a perfectly proper stance for the police to take. It would not be proper for the Computer Misuse Act to encourage the police to arrest someone purely because they believed that there might be a possibility of finding evidence. However, the Act offers them no other route. Faced with that problem, the police might write to their local Member of Parliament asking his advice about whether they should make the arrest. After all, it is the House that has given the police that ethical and moral problem. It is difficult to know what advice the local Member of Parliament should give the police.

9.45 am

Do we really want to encourage the police to arrest someone on flimsy grounds of suspicion, so that they might later obtain the necessary evidence? The evidence might not be found. The police suspicions may be incorrect. New clause 2 would solve the problem and provide the police with a lawful and proper means to obtain a search warrant. The home address could be searched without having first to make an arrest. Evidence might then be found to justify making an arrest that deprives the suspect of his liberty.

Would not that be a more appropriate way to deal with the matter? I accept that this House does not want to offer the police further search powers-- or, indeed, any powers--unless it is absolutely necessary, but the alternative is even more worrying. It may not impinge upon our consciences today, but it will impinge heavily upon the police if they do not have the additional power of search at the home address because, if they wish to pursue the crime, as we have asked them to do, they will be forced to make unnecessary arrests on flimsy grounds. It is a matter of some gravity that I believe is best addressed by new clause 2.

New clause 3 deals not with the powers of physical search, but with the powers of electronic search. It seeks the power to obtain warrants for surveillance. It is a difficult and troublesome matter. I draw the attention of my hon. and learned Friend the Minister to the Council of

Column 1293

Europe Legal Affairs Committee directive "Computer-related crime", which will come into effect in 1992. It contains the recommendation adopted by the Committee of Ministers of the Council of Europe on 13 September 1989 and the report by the European Committee on Crime Problems, Strasbourg, 1990.

The problem may well come before the Minister, even if he and the House do not wish to examine it properly within the context of this Bill, although that is exactly where it should be examined. I accept that the vehicle of a private Member's Bill is fragile, and perhaps this heavyweight debate is too much for it to bear. That strengthens the view of myself and many others that this should be a Government Bill, so that we could discuss all related matters freely and easily. It is a highly related matter and an acutely difficult topic, but we should not duck it in the Bill.

No one would deny that cases of tapping are notoriously difficult to investigate. Scotland Yard's computer crime unit has been attempting to investigate such offences since the unit's inception in 1985. Its experience has been that the hacker often works alone--perhaps from his bedroom at home--on a personal computer, using the telephone line to communicate with other computers. The hacker can also use the international telephone network--but because that is expensive, he usually gains access first to a local computer, from which to bounce off his transmissions to other computers, which keeps his own telephone bill to a minimum. The hacker often makes his overseas telephone calls through a third party's computer line, whose owner then incurs the call costs.

The evidence of any offence that is committed travels along the telephone wires. The problem confronting the police is how to recover that evidence. The Strasbourg directive points out that there are problems in respect of

"the powers of entry and search premises, the powers of seizure, the duty of witnesses to testify, the duty of witnesses to produce evidence, and the problems of wire tapping In most countries it is questionable whether or not the above-mentioned traditional coercive powers are adequate for all aspects of investigations in computerised environments, since most of the traditional provisions were created with respect to tangible property or telephone communications between human beings and not expressly designed for intangibles and the special needs of the computerised information society."

The fuss and bother, and the fears and concerns rightly expressed by right hon. and hon. Members in respect of freedom of information and personal privacy, do not apply to digital transmissions of computer data, which merely happen to use the same route. It is not at all the same thing as settling down to listen in to a personal telephone conversation. If the House is as concerned about the tapping of telephone conversations as the Committee considering the Bill was led to believe, surely it should address itself to the prevalence and ease of purchase of tiny devices with which any member of the public can tap into virtually any unscrambled telephone conversation in the United Kingdom.

If we are not fussed about that form of listening in to our fellow citizens' telephone conversations, why are we ultra-sensitive and over- concerned about monitoring digital transmissions of computer data, which are totally and wholly incomprehensible to any human ear? I suggest that it is merely because computer data employ as their transmission medium the same telephone lines that the rest

Column 1294

of us use to exchange knowledge. It is the monitoring of human conversation that should concern us, not that of computer data. The stance may be taken by my right hon. Friend the Minister, by the Bill's promoter and by other right hon. and hon. Members-- though it is not my stance--that we need not worry about monitoring telephone data transmissions at this time--but if we duck that issue today, it will be put back on our plates tomorrow by the European Community, which considers it of immense importance, particularly in relation to the European convention on human rights, to monitor developments and an issue that should be considered further with a view to harmonising the various coercive powers that exist.

Mr. Michael Colvin (Romsey and Waterside) : My hon. Friend referred earlier to the Council of Europe. Was that a slip of the tongue? Did she really mean the European Commission?

Miss Nicholson : I was referring to both bodies, in respect of a joint initiative. The issue is one that concerns all countries of Europe, North America, Australia, and many others throughout the world--including the USSR, which now has its own hackers club. In the United Kingdom, it is possible to monitor digital transmissions and capture evidence only with the use of a data monitoring cartridge. It is specially designed to record computer data, not human speech--hence the validity of my point that there is an enormous difference of perception as to whether the police should be given monitoring powers in relation to digital transmissions. The data monitoring cartridge identifies and records only computer data, not human speech.

It was strongly argued in Committee that the police can already obtain the permission of a victim to trace incoming calls and to install a data monitoring cartridge on his line. That is comparable to the arrangements relating to obscene telephone calls. If I were the victim of such calls, I could ask the police to tap my line. The problem for the police in respect of digital transmissions is proving the source of the calls. In the case of international data transmissions, are the police to request the international call carrier to trace calls made to the United Kingdom, and then the carrier in this country to complete the trace to the call's origin? Unfortunately, that is technically impossible. Britain has two main types of telephone exchange, Strowger and system X, of which the first is the older version that uses non-automatic switching. One encounters vast problems in respect of that type of exchange. Another problem is that detection relies on the carrier agreeing to assist the police. The major telephone communications carrier in this country is British Telecom plc, but now we also have Mercury--and I am personally in favour of breaking up that duopoly, but that is by the bye.

Unfortunately, British Telecom has often proved unwilling to assist the police in computer cases, despite comments to the contrary, I justify British Telecom's stance on the ground that it is a private company and no longer a state monopoly, so it is entirely within British Telecom's capacity and good judgment whether or not it wishes to assist the police. Why should it do so, when it can no longer be coerced into co-operating because it is a state monopoly?

Column 1295

The corollary is that British Telecom often does not assist the police, and that causes the authorities great problems if they are not given powers of search and monitoring of transmission lines by this Bill or by any other legislation. I believe that British Telecom's reluctance to co-operate is due not least to the cost incurred in mounting such an exercise, with no prospect of financial recompense.

I give an example of the difficulties that British Telecom's intransigence- -understandable though it may be--cause to the police. In respect of an investigation that is currently under way at New Scotland Yard, the solicitor of the victim concerned is even now seeking an audience with the Home Secretary to discuss the appalling situation in which the police find themselves because, over a period of months, British Telecom plc has not bothered to reply to police requests for assistance.

It is often known who hackers are and where they live, but it is never know who will be their next victim. In those cases, the victim cannot authorise the police to monitor his telephone line because he does not know whether he will be, or has been, attacked.

The proper place for the data monitor cartridge is on the hacker's telephone line, as it would give crucial evidence about the hacker's activities, recording the date, time, length and duration of the call and who the victim is. Without that method of gathering evidence, the police have little, if any, chance to catch those responsible. Let us consider the cuckoo's egg. Dr. Clifford Stoll, who met me in my constituency the other day, told me that, when he started to track the West German hackers who got into at least 20,000 security computers in NATO and into many other industrial secret places, the Federal Bureau of Investigation told him that, if the hackers came from the United Kingdom, he would have no chance of tracking them down because he would not get the required co-operation.

10. am

We live and trade in the 20th century. In this fast-moving age of information technology, we need to track down criminals who use 20th- century methods. The personal computer was invented in 1984--the computer was probably a British invention--and it is a sadness to me that we lag so far behind in methods of computer surveillance. Millions of people now own and use personal computers. Computers are on the increase. It is a sunrise industry, and hardware and software costs are dropping all the time. In a free-market system, more and more people--thousands of millions--are beginning to use computers. It is logical to infer that computer crime will increase in proportion to the number of computers in use.

If the Bill is a serious piece of legislation, the basic principle of gathering evidence must be examined in detail. If computer hacking is to be an offence, we need to allow the police a method of enforcing such legislation. In the United Kingdom, the only realistic way to do so is to allow them to be granted a warrant from a court to allow such evidence to be obtained.

If a serious crime, as defined under the Interception of Communications Act 1985, is committed, it is true that, despite the Computer Misuse Bill's weaknesses, the police can already make an application to the Secretary of State for a warrant. Does the House not realise that evidence

Column 1296

thus obtained cannot be used in court, because the 1985 Act was not designed to capture digitalised data transmissions for computer crime? It was designed for security purposes. Thus, the 1985 Act puts the police in a hopeless situation if they want to make the Bill stick. The paper produced by the Council of Europe, related to the European Community's work on the subject, also discusses the procedural law problems in full.

New clause 3 offers the police a practical method of obtaining evidence. The courts will be able to ensure that the law is not abused, because they will decide whether to grant a warrant to obtain the evidence that they will hear in future prosecutions.

Does the House not wish that the courts--the heart of British justice-- should decide rather, than that the police should have to go continually to the Home Secretary? The latter procedure is invisible to the public. That is an important point.

Mr. James Arbuthnot (Wanstead and Woodford) : Is my hon. Friend suggesting that the issue of warrants in such circumstances will be open and visible to the public?

Miss Nicholson : Yes. I believe that applying for a warrant will be, as my hon. Friend says, open and visible to the public and that that is the right and proper way forward, whereas seeking an application for a warrant from the Home Secretary is slow and invisible to the public. Was that my hon. Friend's point?

Mr. Arbuthnot : Yes, although I am surprised to hear my hon. Friend's answer.

Miss Nicholson : I am aware that I have been on my feet for a long time, and I do not want to take too much time which other hon. Members may wish to use. Amendment No. 18 is designed to write into the Bill the ability to search a computer which contains confidential information. That sounds a little esoteric, but at the moment the police are properly constrained from searching through data which include confidential information.

Let us postulate that the police have received a complaint from a research establishment which says that someone has gained unauthorised access to its computer system and has deleted some of the research data. That is a common scenario. Those responsible have sent the research establishment an electronic mail message which reads, "We are the super-hackers and we'll get you again soon." That scenario is similar to the case of the university hacker who is being prosecuted at the moment, whose activities I referred to in an article in The Times last year. It is true that the research establishment has not lost any money. It has a back-up of its data, and it takes perhaps three hours of the system manager's time to restore it. Although that is time wasted, the real worry is that the establishment has no idea how the hackers managed to crack its efficient computer security, and it is immensely concerned about the possibility of another attack which would unnecessarily delay the research project.

In the same article in The Times, I referred to the CERN establishment on the borders of France and Switzerland, where security has been massive, yet hackers have planted a virus. In our smaller British example, the systems monitor would provide the police with computer logs to show where the hacking call originated. The research establishment has a dedicated line to a local computer

Column 1297

bureau which processes some of its data. The computer logs show that the hacking call originated from the bureau, so the police would investigate the bureau and find that it has six employees and processes data for a number of clients, including banks, solicitors, a local supermarket and a number of accountancy firms. The majority of the data held by the computer bureau is highly confidential. The police cannot ask permission from anyone at the bureau to search the computer for evidence, because they do not know who committed the offence and they are worried that, if they ask for the search, the evidence may be destroyed immediately. As the hacker sent an electronic mail message, the police have reasonable grounds to assume that the message may still be in the bureau's computer, with other evidence of the attack--electronic fingerprinting. They look to the Computer Misuse Bill for powers to obtain a search warrant. Clause 14 gives a power of search at the bureau because unauthorised access has been gained from those premises, but that power of search would not extend to authorising a search for materials of the kind mentioned in section 9(2) of the Police and Criminal Evidence Act 1984. Remember that that Act was not designed with computer crime in mind, and that the type of crime that the Computer Misuse Bill seeks to identify was not a crime then. The police know that they have to search the bureau for computer evidence, but they will clearly come up against a mass of confidential information during their search. They realise that the evidence that they require is bound to be mixed up inextricably with confidential data, because the hacker will have used a disk on which client data are already stored--that is known as free parking. No serious arrestable offence has been committed, and the police cannot use the powers under the Police and Criminal Evidence Act. I refer again to the fact that, without new clause 2 the police lose their powers of search under the the Criminal Damage Act 1971. How can they search for evidence that leads to the making of an arrest? They cannot. Another crime will therefore not be solved, and the criminals will not be prosecuted.

My amendment solves the problem by allowing a search to be made of the contents of the computer system, despite the fact that the evidence may be contained within or held alongside confidential material. In the two new clauses and the amendment, I seek to make the point that the Bill will be only a slight vehicle without them. Unless the police have the powers contained in the new clauses and the amendment, they will be unable to identify or prosecute 99 per cent. of those whose activities will be unlawful under the Bill.

Mr. Harry Cohen (Leyton) : I congratulate the hon. Member for Romsey and Waterside (Mr. Colvin) on promoting the Bill and on having provided answers and explanations for the difficult and important questions that were put to him in Committee.

The hon. Member for Torridge and Devon, West (Miss Nicholson) spoke eloquently to new clauses 2 and 3, both of which contain search powers that could be authorised by a justice of the peace. However, my amendment No. 3 would transfer that search power authorisation from a justice of the peace to a circuit judge. I believe that that would strengthen the Bill.

I shall not rehearse our debates in Committee on the extent of search powers by the police. If the Bill had

Column 1298

contained on Second Reading the search powers that were incorporated in Committee, I suspect that there would have been much stronger opposition to it. There would have been great concern about the civil liberty implications of those search powers. Anyone who owns a computer would be open to such action and his computer could be seized. I hope that the House will decide to amend those search powers so that they can be authorised only by a circuit judge, rather than by a justice of the peace.

As clause 14 now stands, any home owner with a telephone is now under threat. There could be a knock on the door at midnight. Even if the offence of computer trespass and unauthorised access has not been committed, a search warrant could be obtained from a justice of the peace, based on the belief that an offence will be committed. The search warrant would allow search and seizure to take place within a month of that belief having been formulated. It would allow for the breaking down of a front door, under the guise of reasonable force. I do not like that approach, and the Law Commission was unhappy about it. It referred to the need for strong evidence of the practical need for any extension of those powers. The Law Commission was not in favour of the Police and Criminal Evidence Act 1984 being used in these cases. In paragraph 4.11 of its report, it said : "We have already pointed out that even within the confines of the present law there are substantial and effective methods of identifying and apprehending both outside hackers and internal misusers of computers. In addition, if our recommendation is accepted that the ulterior intent'" hacking offence should carry a maximum penalty of five years' imprisonment, that will be an arrestable offence which, in a case where there is reasonable suspicion that the offence is being committed, will under the present law attract powers of arrest, entry in order to arrest, and search of the arrested person's premises. These are substantial weapons. To go further, as some have urged, and create powers of search before arrest, even in the case of suspected basic hacking, would be in effect to extend the search provisions of Part II of PACE to cases far different from the serious arrestable offences for which that regime was designed. For such a step to be contemplated there would, in our view, have to be as a minimum requirement very strong evidence of practical necessity, which evidence has not been provided by the, admittedly limited, submissions made to the Commission."

10.15 am

Amendment No. 3 would remove the authorisation of search powers by justices of the peace and transfer it to a circuit judge. Amendment No. 16 deals with the position in Northern Ireland, where authorisation would be by a county court judge. I consider that judges would be much more rigorous than justices of the peace in examining whether the police belief that a crime had been committed had any foundation.

Justices of the peace are unpaid, they have no technical knowledge, they are often elderly and perhaps it is easier for the police to convince them than it is to convince circuit judges. There are many more justices of the peace, so the police could choose one who might be more compliant. Authorisation by circuit judges rather than by justices of the peace would ensure that the search and seizure powers in the Bill are less open to abuse. The need to convince a circuit judge rather than a justice of the peace would probably lead to the evidence presented in support of a search warrant being of a much better quality.

It would not be unusual to seek authorisation from a circuit judge. Under section 4 of the Data Protection Act 1984, when the Data Protection Registrar seeks a warrant, he has to convince a judge that it is justified. The clause 1

Column 1299

offence in the Bill is similar to that which the Data Protection Registrar investigates. Paragraph 1 of schedule 4 to the Data Protection Act, which provides the Data Protection Registrar with his powers of search and seizure, begins with the words :

"If a circuit judge is satisfied by information on oath supplied by the Registrar."

If such a provision is appropriate under that Act, it would be equally appropriate to apply it to the Bill.

In Committee the hon. Member for Torridge and Devon, West moved an amendment relating to the Interception of Communications Act 1985 which was rejected. She realised then that there was a problem because she wanted a circuit judge rather than a justice of the peace to sign search warrants. The hon. Lady's amendment added the words, "or a circuit judge" nine times. I hope that she will agree that, as it is clearly what she wanted then, it is also appropriate in this case. For those reasons I shall, at the appropriate time, move my amendment No. 3 calling for a circuit judge, and county court judge in Northern Ireland having the power to authorise searches, rather then a justice of the peace. That is a small but important point, and I hope that the House will accept the amendment.

Amendment No. 10 sets out conditions under which search powers are allowed. I tabled it because that argument was used in Committee as justification for the search and seizure powers in the first place. In Committee, it was stated that British Telecom had all the powers it needs to locate where somebody is using a computer in his own room to hack into a computer somewhere else. However, it was said that extra powers would be needed in case there was more than one person on the premises. That was the sole justification given in Committee as to why these draconian search and seizure powers are needed. I tabled amendment No. 10 to call the bluff of the Bill's promoter and Minister. My amendment repeats exactly what they stated : that there are reasonable grounds for believing that the signal has come from a premises, and that

"more than one person resides or is employed at the premises" It will be most enlightening to hear from the promoter, and perhaps the Minister, why amendment No. 10 is not acceptable to them, as its contents were their sole cause for proposing the draconian search powers in the first place. I await the answer with interest. Amendment No. 7 relates to search powers not so much as they are generally applied, but as they are specifically applied. It refers to the security services and their powers. We need some answers as to what powers they have in relation to hacking because that matter has never been discussed in the House. We did not discuss it during debates on the Security Services Act 1989 or the Interception of Communications 1985, and it has not been properly discussed during debates on this Bill. That is why I moved my amendment stating that "an individual cannot be authorised to access a computer by a warrant served under section 3 of the Security Services Act 1989". I was appalled to learn from the Minister, in asides in Committee--at columns 19 and 72 in the Standing Committee report--that the Security Services Act 1989, by default, legitimises hacking by the security services. I hope that that will be explained in more detail because the more I think about it the more I find it another example of how the Government keep reducing parliamentary democracy while giving unrestricted powers to the security services to

Column 1300

do almost what they like. It is the opposite to what has been happening in eastern Europe, where the security services' powers have been curtailed and sometimes removed. Attempts are certainly being made there to make them more accountable, whereas our services are less accountable under this Government.

As the House knows, the Security Services Act legalised burglary through a warrant signed by the Secretary of State. That was highly contentious legislation, opposed by many and severely criticised by all parties, including some Conservative Members. The hon. Members for Thanet, South (Mr. Aitken) and for Aldridge-Brownhills (Mr. Shepherd) made strong cases against it. I am sure that most hon. Members thought that the warrant allowed the security services physically to break into premises, as long as they did not commit another offence. I emphasise the word "physically" because, as I understand it, under the terms of the warrant, the authorised person can invade premises in that way. Until the Minister spoke in Committee there was no sign that the warrant could authorise MI5 staff to hack into any computer whenever they wanted, without committing this Bill's proposed offence of unauthorised access. That power to give a warrant to legalise computer hacking was not discussed in debates on the Security Services Act. The way in which the matter is being pushed through means that the House is being deceived because we are not having a proper debate, and those powers are not being properly restrained and decided on.

Hacking, although perhaps not physical burglary, is remote burgalry. It occurs on a much larger scale than the physical burglary of premises. If someone hacks into a computer he gets all the information from it, vast amounts of which can be used or misused. That issue was raised when the Interception of Communications Bill was being debated, and the Government made the concession that any intercepted information not needed by the security services would be deleted and would not be held. That was an important concession, but there is no such concession in this Bill. Under its powers, the security services can hack into a computer, get all the information, keep it for as long as they like and use it for whatever purpose they like. They are under no obligation to delete the information. On page 360 of "Spycatcher", Peter Wright states :

"The main interest F branch (of MI5) had in the Computer Working Party was to establish widespread computer links, principally with the National Insurance Computer in Newcastle."

The Government data network will give them wide powers and the police computer will give them vast amounts of information, as will all the private computers that they can hack into. They do not have to adhere to the data protection principals because, under section 27 of the Data Protection Act 1984, they are exempt from doing so. There is no code of practice about how they should use the information and the Data Protection Registrar has no powers over them.

In The Guardian on 6 April 1989 it was stated that the security services had information on the political activities of about 1 million people in this country, and I suspect that that is an understatement. Clearly, with the hacking power that they are being given, they will be able to obtain even more information, and have almost unlimited access.

In section 23.21 of its report, the Lindop committee stated that with independent supervision the security services would

Next Section

  Home Page