TUESDAY 10 NOVEMBER 1998

SIR BRIAN TOVEY

  72. Good morning, Sir Brian. You have been sitting in on our proceedings this morning, so I think we will get right into this question of intangibles because that is the area of your greatest expertise. We have already heard that the people who would be affected by the policing of intangibles feel that it would be rather difficult to impose controls in any sensible way. Do you think you could perhaps clarify this question of how you would see the policing of intangibles? Do you think it would be better if such a regime were at least an EU and Wassenaar wide regime? Is it practical to try to achieve some kind of broad controls of the kind which have been mooted?
  (Sir Brian Tovey) May I answer the second part of your question first? The latest paper from the Commission proposing various changes to the present EU regulation on export control does include words not altogether unlike those in the White Paper about intangibles. The message that there should be some kind of control of intangibles is certainly accepted within the EU, or I believe will be unless one or other of the Member States blackballs the idea. I cannot unfortunately speak for the 33 or so members of the Wassenaar arrangement. Our first concern is that controls on intangibles should apply broad cast rather than be narrowed down to a few countries, for example the members of the EU, otherwise we get, as we put it in our paper, less of a level playing field. That is one concern. The other concern is how one actually applies this. One of the many hats I wear is that of chairman of a small research and development centre. As it happens, this is the subsidiary of a Japanese company so I have no problems about the information going to and fro the parent company in Japan. However, one can imagine a situation in which an R&D laboratory is in regular contact with companies in all sorts of different parts of the world. Of course I accept the logic of the control on intangibles: there is no gainsaying the fact that if one is required to seek an export licence for information to send it through the post one should also seek an export licence to send it by e-mail or post it on the Internet or whatever. What I do fear is that policing this within companies is going to be extremely difficult, particularly in an R&D environment where clever people are really quite accustomed to getting onto their PCs and sending messages saying "What do you think of this? Would it not be a good idea if we did that?", etcetera, probably entirely unaware that they might be breaching an export control regulation. If they were to send that sort of information through the post, there can and would be systems for asking what they are sending to X and saying it needs to be seen to make sure that it does not breach the regulations. It is much less easy when you are talking about this relatively free and easy method of communication over the Internet. That is a major problem. I do want to emphasise that there is nothing wrong in principle with the idea of controls of intangibles. It is clearly right in principle. It was something one was driving a coach and horses through, or perhaps some people were, but how to police it is a difficult one.

  73. What about the question of the cryptography of it? Do you think if people were ingenious enough they would be able to devise systems which would not be crackable and therefore it would be even more difficult to police?
  (Sir Brian Tovey) Yes. Of course the whole question of cryptography is a difficult issue, as I am sure you appreciate. On the one hand, with the development of the global trading pattern we now have, electronic commerce is undoubtedly going to be a major means of conducting trade in the future. For that purpose industry does require cryptography for two reasons, one of which does no harm to the interests of Government, namely for things like digital signatures, so that you know that an e-mail actually does emanate from Mr X, Y, Z of company A, B, C. On the other hand, it is needed for the security of the information which is being sent, which obviously, since it is going over the ether, is at least in theory interceptible by hostile intelligence agencies, etcetera. On the other hand, Government rightly requires to be able to derive information from communications under certain very clearly defined conditions. We have in this country an interception of communications Act which sets down the circumstances, sets down the requirement for a Secretary of State to sign a warrant, etcetera. The question therefore is: how in the world does one reconcile these two? How does one on the one hand assure industry that its communications are confidential and reliable and how on the other hand is Government under these very carefully defined circumstances to continue to derive important information, be it about drug running, terrorism, crime, etcetera, from the interception of communications within a proper legal framework? The answer lies somewhat in this area. It is the business of Government to say under what circumstances it requires access to communications in their unenciphered form. It is the business of Government to decide that. I think it is the business of industry to respond to that kind of requirement and propose ways and means of fulfilling it, which I might say will be different according to the mode of communication. Overcoming encipherment, if I may put it that way, is one thing when you are talking about messages passing say over the Internet or over landline or whatever. It is quite another when it comes to overcoming encipherment in the context of mobile speech, the GSM or the third generation mobile system, etcetera. It is for industry to face the requirement, to say that this is what Government requires and how should they respond to that requirement with minimum damage to the legitimate need of industry to communicate securely. The problem arises when the two functions become muddled, when Government not only says they have a requirement but says they think it should be met thus and so. If I may put it this way, this is as foolish as it would be for industry to say there is no requirement. It is not for us to say.

  74. In a world of instantaneous communication worldwide, is it not practically impossible to prevent the export of intellectual property other than through the voluntary cooperation of the firms concerned? One can see that you can pass laws and provided the firms cooperate in that, with the threat of some sanction if they do not, obviously, then it will work. Anybody determined to communicate intellectual property in today's world can do so and there is no physical way in which it can be prevented.
  (Sir Brian Tovey) I rather fear you are right and that is why we expressed a sort of concern, not about the principle but about the practicalities of the control on intangibles. I could not fault what you have just said.

  75. In your comments about end-use control you reiterate your concern about the phrase "has grounds for suspecting" in this context, as in has grounds for suspecting that products might be used in weapons of mass destruction. You say that the term "has grounds for suspecting" is tendentious, ambiguous, obnoxious. We get the impression that you are not very fond of that particular phrase. In 1993 in your evidence to the Scott Report, you called it "morally repugnant and legally unsound". Is it in practice a real problem? Is it reasonable? Can the law not cope with the notion of grounds for suspicion? Is this terribly difficult to deal with?
  (Sir Brian Tovey) I think it is terribly difficult to deal with. Let us go back to first principles if we may. If a company knows that something that it is proposing to export to a given country is intended to be used by that country in the context of developing, producing, deploying, etcetera, weapons of mass destruction, that is one thing. If a company is told by the Government, by a department, that they would rather it did not export whatever the goods are because they have reason to believe that these will be used in the context of a weapon of mass destruction, fine. That is also totally acceptable. What seems to me—and I am sorry if my phraseology was rather fierce, but I do feel strongly about it—unacceptable is to ask industry to form something vague like a suspicion. How does one arrive at a suspicion? Is it because the chap who placed the order looked shifty at the time? Is it because it took him rather a long time to produce an end-use report? There might be 100 reasons for that. I just find it hard to see how this is really going to be applied in practice and whenever I have debated this question with my friends in the DTI, I have been told they have actually never successfully prosecuted anybody under this clause. I therefore ask myself: why have the clause? You may ask in that case why am I worried about it. I shall tell you why. Companies have legal advisers. These legal advisers are very powerful people because companies in general—there may be odd exceptions—do not want to get on the wrong side of the law. It is the last thing they want. Legal advisers are liable to say, "Hang on. Are you sure you do not have a suspicion about this?". The salesman or the marketing director says he does not quite know what they mean. "Well, I think on the whole it is safer not to." We do get cases like this.

  76. Is it not actually a good thing that that question is raised and that discussion takes place and then the company arrives at a considered view? I would have thought that is precisely—
  (Sir Brian Tovey) It is not a considered view, it is a kind of panic-stricken view.

  77. Presumably the company considers that a charge cannot be made against them that they had grounds for suspecting that they were exporting a product for purposes of mass destruction. Surely the right question is being asked and in virtually every case, as you say, the right conclusion will be arrived at.
  (Sir Brian Tovey) I fear it will not be, but we must agree to differ.

  Mr Berry: I think we must.

  78. You said this has happened. On how many occasions has this happened? You are presumably referring to projects in retrospect in which you could have participated which would have been okay which were morally without blemish but which companies you know did not participate in because they thought they would fall foul of this. How often does that really happen?
  (Sir Brian Tovey) I can only say that companies which might otherwise have supplied some relatively innocuous piece of equipment like a length of coaxial cable to a country which has a known biological or chemical warfare programme have said, "We had better not. You never know, it might turn up in a chemical warfare plant". That seems to me frankly a bit daft. A piece of cable is not going to make any difference. There have been cases. I think they are fewer now, I have to admit, because there have been no attempts to prosecute under this particular clause and perhaps legal advisers are getting a little bit more relaxed than they were. However, let us have one prosecution and you can be quite sure that the panic will be on again.

  79. Are you saying companies should have no problems about selling a bit of coaxial cable to Saddam Hussein, if there were a known factory producing biological weapons?
  (Sir Brian Tovey) It does not seem to me that they should. It seems to me that what the company should do is go to the Government, to the DTI, and say they have an order for so much coaxial cable and that the DTI should then make a judgement. If they think that selling it to Saddam Hussein is going to enhance his capability for developing chemical or biological weapons then of course they will refuse the licence. What is wrong is to ask companies to arrive at some sort of vague suspicion that this might be or it might not. Let us ask the question, that is the point.

  80. A number of British companies have been engaged over the years in supplying electronic equipment, for example to India and Pakistan. It has been pretty well an open secret that the speed with which India and Pakistan were able to acquire nuclear weapons does not suggest that they started from scratch and in nine months they had a bomb.
  (Sir Brian Tovey) True.

  81. Do you think that it would have been reasonable to have sought from the British companies which provided equipment which may well have been of assistance in the production of nuclear weapons in these two countries that they should perhaps have thought what they were doing, given that most people suspected that India and Pakistan were actually engaged in such work anyway?
  (Sir Brian Tovey) What would have been reasonable, and what indeed was done, was that companies wishing to export anything but the most very basic electronic devices, simple personal computers below a certain capability or something like that, would have under the regulations needed to seek an export licence. It was then, as I see it, entirely a matter for the DTI and its advisers in the Foreign Office, MOD and indeed in the intelligence agencies, to say sorry, but they did not think this something they could allow to go. It is wrong to try to lay the onus on the companies because what you are asking the companies to do is to exercise some kind of intelligence function which it is not the business of companies to exercise. Lastly, before we leave this, nowhere in the EU, apart from in Germany, is there this particular clause in the export control regulations of any Member State. The other Member States do have provision for companies which know and companies which are told, but not for suspicions.

  82. Thank you very much. We may well come back to you again. We are going to be looking at electronic commerce a little later in the year and I know that your past experience in a variety of areas might well be of assistance here. One small point I wanted to raise with you. There is a sense in which if you say you are going to police electronic communication as far as defence materials are concerned, a process is established and perhaps your former hunting ground, GCHQ, was given a responsibility for such a job. Is there not a danger that that would perhaps provide the pathway into a far wider range of communication policing which would raise in its turn civil libertarian concerns of a not unreasonable kind?
  (Sir Brian Tovey) I have to be very careful about answering questions about my dim, distant past. It is 15 years ago and I am still bound by the Official Secrets Act but I shall do my best. I do not believe it would; I do not believe it would. I believe, and you are entitled to think I am naive but I do believe, that in this country the intelligence agencies are under sufficient control, particularly now when we have a parliamentary committee which looks at their activities on a regular basis, that they are well controlled and that the likelihood of their being induced to expand their activities into areas which could be damaging to civil liberties is frankly so small as to be nil.

  Chairman: We may well return to this at a later stage. Thank you very much for your time this morning.