|
UNCORRECTED TRANSCRIPT OF ORAL EVIDENCE To be published as HC 910-ii House of COMMONS MINUTES OF EVIDENCE TAKEN BEFORE HOME AFFAIRS COMMITTEE
Tuesday 14 February 2006 LORD CARLILE OF BERRIEW QC PROFESSOR ROSS ANDERSON, MR DAVID LATTIMORE and MR PETER SOMMER MR DARREN GREENER, MR VINESH PARMAR and MR GREG SMITH Evidence heard in Public Questions 75 - 182
USE OF THE TRANSCRIPT
Oral Evidence Taken before the Home Affairs Committee on Tuesday 14 February 2006 Members present Mr John Denham, in the Chair Mr James Clappison Mrs Ann Cryer Mrs Janet Dean Nick Harvey Steve McCabe Mr Shahid Malik Gwyn Prosser Mr Richard Spring Mr Gary Streeter Mr David Winnick ________________ Witness: Lord Carlile of Berriew QC, a Member of the House of Lords, the independent reviewer of terrorism legislation, gave evidence. Q75 Chairman: Lord Carlile, thank you very much indeed for joining us. As you know, this is the second evidence session in our inquiry into the detention powers. We decided to have the inquiry because of the extent of the parliamentary controversy about this issue of the Terrorism Bill and in the knowledge that the Government was likely to return to terrorism legislation in the next 18 months. Of course yesterday we had the Chancellor of the Exchequer backing an extension for the 28 days which is currently going through the system, so it is basically quite a live issue for the Committee and we are very grateful to you for joining us for this session to share your knowledge in this area. Can I start with a fairly general question. You have in the past criticised the level of public information which has been made available about the proposed extension of pre-charge detention and also the failure to explain exactly what the problem was that was being tackled. How do you think the issues could have been explained better both in terms of the problem to be tackled and the justification for the powers? Lord Carlile of Berriew: I will give you an example to start with, if I may. Recently I produced my first report on control orders. In an appendix to that report, I reproduced, and this was not proposed, but I reproduced the control order that is imposed on most of the 'controllees', as I call them, and that enabled you, parliamentarians, and the public at large to see the extent of the restrictions placed on people who are subject to control orders, something which had not been in the public domain before. The extent of the restrictions could tell the public two things, possibly in the alternative, possibly conjunctively: that the people who are controlled are dangerous to the extent that those controls are required; and/or that the extent of the controls is so great that they come to the very limit of restrictions on human rights. Now, I think it is legitimate to have that debate from the proper level of public information as to what the restrictions are. I believe the same applies across the board on those issues. The Government should give the public as much information as they can without compromising public safety. I think this is one of the few things in the area of terrorism legislation that the Americans are better at than us. I hasten to add that I think that their legislation, the Patriot Act, for example, would never have got through the two Houses of this Parliament and it probably would have brought a government down, but, in terms of public information, they give much more. Q76 Chairman: That is a very helpful reply. You indicate that, in relation to control orders, more information could be made available to the public. What would you have liked to see the Government say about the nature of the problem that led to the call for increased pre-charge detention? What sort of information about the problem that was trying to be tackled could have been made available, in your view, and was not? Lord Carlile of Berriew: I would like the Government to say more about the nature of the terrorist threat. The information is actually available in the public domain; you just have to know where to go and look for it. I would prefer it if the Government made it a little more accessible and perhaps I can give you an example. If you look at what is generally called the 'first generic judgment' of the Special Immigration Appeals Commission in what had become known as the 'Belmarsh cases', you would see there a fairly encyclopaedic description by a judge, by a High Court judge, of the nature of al-Qaeda and its connected organisations at the time that judgment was given. Journalists on the whole, if those present will forgive me, are rather lazy and they like to have stories written for them, by and large, and do not like to look in rather dense resources, like the judgment of Mr Justice Collins there. I would like to see the Government simplify that kind of information because it is a very long judgment, but putting it in the public domain so that people understand the complexity and, therefore, often impenetrability of the terrorism threat. Q77 Chairman: Would it be too much to ask you, for the purposes of this Committee, to give two or three further details about the sorts of issues which you understand, the sort of factual issues which you understand which you suspect the public are not aware of or do not appreciate? Lord Carlile of Berriew: I could select, for example, as I mentioned earlier, the complexity of al-Qaeda which is not an organisation, as I understand it, in the same terms as, say, the Provisional IRA; rather, it is a loose co-fraternity of people with similar political and terrorism interests, so that would be one example and I think more should be said about that. Another example, and this is getting into a sensitive area, is the issue of the way in which imams are allowed to enter this country and take up posts in mosques around the country. There are some wonderful imams in this country, I have met a few of them, but very little has been done in the past to look in any detail, I believe, into the past history of imams who have gone into some cities, and the good imams do not want the bad imams anyway, so I think there is an issue there which needs to be discussed. I would give you two more examples very briefly, and one is the radicalisation mainly of young men in universities. If you talk particularly to young female students in the larger, and perhaps more rackety universities, you will find that there is a degree of concern expressed about some societies in those universities from which women are usually excluded and where there might be radicalisation. A final example I would give is the issue of radicalisation in custodial settings. Richard Reed, the shoe-bomber, appears to be somebody who was radicalised in a custodial setting. I can only give you anecdotes on that, but I have received anecdotal evidence from governor grades that this is occurring and that it is a worry to them. I do not want to exaggerate the problem, but there certainly is an issue in that context. Q78 Chairman: That last point in fact is one that this Committee drew attention to in a report produced nearly a year ago now based on our study of what had been happening in France and the Netherlands, so the Committee is certainly familiar with that. If I understand what you say, Lord Carlile, when it comes to explaining the nature of the problem, what you are really talking about here is actually having a much higher level of public understanding about the nature of the terrorist threat as a whole, if that is right. What do you think could have been done in general to explain the case for increased detention more directly? Clearly one can understand the terrorist threat does not necessarily lead to the argument for increased pre-charge detention, so what could have been done by the Government to make that case more clearly? Lord Carlile of Berriew: The Government, I think, has learnt the lesson of what it did not do, but should have done, by announcing that the new Terrorism Bill, whenever it appears, the consolidating and amending Bill that Charles Clarke announced, will go to a scrutiny committee. I believe that a lot more would have been achieved if the current Bill, as was the original intention, but later withdrawn, had been placed before a scrutiny committee. As it happens, I chaired the joint scrutiny committee, and there was at least one person here who was a member of that committee, on the draft Mental Health Bill. The result of the evidential process of that committee has been positive in legislative terms in that we do not yet have a Mental Health Bill, so somebody is thinking about the findings that the Committee made. I believe that an evidential process would have been more successful than the political process and may, for example, have amended the views of highly respected parliamentarians, like Mr Winnick, if I may say so, who took an entirely understandable approach in parliamentary terms, in House of Commons terms, to the way the Bill was presented. Q79 Chairman: Mr Winnick will have his go in a moment. Lord Carlile of Berriew: I thought he might! Q80 Chairman: If I can look at one further question, which is to look at pre-charge detention itself, we had a session last week with Liberty, JUSTICE and similar organisations and much of the discussion was very much on the assumption, the underlying assumption, that the purpose of pre-charge detention was to enable interviewing and questioning to continue. It is fairly clear from your remarks that actually you think that is largely irrelevant because suspects will probably be well-advised to remain silent. If the purpose of pre-charge detention is not actually to enable you to question the suspects, what is the purpose and what is the justification for it? Lord Carlile of Berriew: As the Committee knows, I am still a practising advocate. I doubt if there are many advocates in this country or solicitors who would ever advise a suspect in custody at Paddington Green to answer questions unless they wanted to co-operate with the authorities for what we will loosely call 'plea-bargaining' purposes, to reduce their sentence or to try and obtain immunity or something of that kind. The reason for that is that you have to measure, and this is something I am often asked to do though not in terrorism cases because I do terrorism cases for obvious reasons, but in other cases I do, one is often asked to measure the damage done as between answering questions on the basis of carefully managed disclosure by the police, which could get suspects into an awful lot of trouble later if he tells lies about an aspect, on the one hand, and the adverse inference direction that is given if you do not answer questions, on the other. Most of us involved in serious cases would say that the adverse inference direction is a flea bite compared with the danger, the risk of hostage to fortune of answering questions, so, in my view, the interviewing process is actually becoming not entirely irrelevant, but near to irrelevant. To turn to the second part of your question, Chairman, the purpose of the detention period in terrorism cases, first of all, is to ensure that the act is not perpetrated, the conspiracy is not brought to fruition and, secondly, to enable the orderly gathering of evidence in order that a prosecution can be brought, not any old prosecution. It is actually, I think, in the public interest for people to be prosecuted and convicted of what they have done. I am not a believer in arresting people for shoplifting in order to get the evidence to prosecute them for murder. I believe that it should be a proper process and a fair process aimed at what is believed to be the incident, the crime. In terrorism cases, there are reasons for arresting very early, and they are too obvious to state, I suspect, to one of the members of this Committee, and I, therefore, think that a period when police and others can gather evidence while a suspect is detained is potentially very valuable. However, I do think that the 90 days argument was very badly managed because it started from the wrong end of the spectrum. If you look at the proposals that I made in my report in which quite independently, the police did not suggest 90 days to me, I suggested a 90-day maximum, it actually started with a raft of judicial control and rights to ensure day-by-day management of the period when the person was detained with a view to it being brought to an end at the first sensible opportunity. Q81 Chairman: The point that we were being put by last week's witnesses would be: how could you possibly be sure enough that somebody should be locked up to prevent them committing a crime when you have too little evidence to charge them with anything at all? Lord Carlile of Berriew: Well, I do not know of any case in which people have been detained without the evidence of reasonable suspicion that justifies an arrest, though I am not saying I have looked at every case that has gone to Paddington Green. There are some cases, including a couple that I am afraid are still in the pipeline, still sub judice, where I believe that very early arrest was absolutely necessary and the current legislation may have had an effect on the gathering of evidence. I think the Committee will have my meaning without my going into too much detail. Q82 Mr Winnick: No one in this room or indeed in the House of Commons any more than in the House of Lords for one moment underestimates the terrorist danger facing our country, so we have got common ground. I want to ask you one or two questions and, if the Chairman will allow it, perhaps I can just go back for a moment to the clerics. We have the very welcome seven-year sentence last week of a particular person. He mentioned various clerics who had come to this country and there is no doubt that there is a very strong feeling which clearly you share that some of them at least are involved in, and you implied as such, inciting hate, if I can put it in that way. Do you think it is possible for you to give any sort of estimated number? Are we talking of very large numbers? Are we talking about a handful of extremists who have not yet been, if you like, expelled by the congregation involved? Lord Carlile of Berriew: I could not give you examples, though there may be others here who are better able to give the numbers, but a small number can have a disproportionate effect if they are in the wrong place. If I had to guess, I would be amazed if there were more than 20 such clerics in the country, but that is a pure guess, or an impure guess, but it is just a guess. My worry is that they are in places where there are a large number, particular cities or custodial institutions very occasionally, places where there are larger numbers than elsewhere, of impressionable, young males. Those of us who are interested in politics remember our teenage years in which we had some very radical ideas, and I remember arguing communism at the end of my parents' bed when I was a teenager. If this cannot be properly controlled in a proper debating environment where all sides of the argument are shown, it is a dangerous business. Q83 Mr Winnick: Forgetting for the moment our teenage roots and politics and avoiding self-incrimination, perhaps we can carry on. In your paper, Lord Carlile, at page 18, paragraph 61, you say, "I am satisfied beyond doubt that there have been situations in which significant conspiracies to commit terrorist acts have gone unprosecuted as a result of the time limitations placed on the control authorities following arrest". That is a pretty serious statement to make. What evidence do you have? Lord Carlile of Berriew: In carrying out my role as independent reviewer, I go around the country and I talk to various organisations, including the police and other control authorities. That particular passage was especially based on information I was given by a police force, not the Metropolitan Police, relating to a number of suspects, and I cannot remember the exact number, but at least eight. I did a lot of reading into this subject because I was provided with a considerable amount of material and I was satisfied that that was the case. I have also had general descriptions of such events given to me by police officers in particular, including the Metropolitan Police, but that was principally founded on something outside the London area. Q84 Mr Winnick: If we take the mass murders of 7/7, there was no way in which they were suspected in any way by the police, am I not right? Lord Carlile of Berriew: There is absolutely no way in which they were suspected by the police. Q85 Mr Winnick: So it would not have made any difference whether it was 28 days or 90 days or five years - they would not have been apprehended and those mass murders would have been carried out as they were? Lord Carlile of Berriew: That instance was an illustration of a quite different problem, the problem we have been discussing in a way earlier, which is the radicalisation of young, indigenous males. These were British men. Q86 Mr Winnick: So the most terrible mass murder which had been committed for a very long time in this country would have taken place quite regardless of the 28 days or the 90 days and so on? You accept that? Lord Carlile of Berriew: Of course I accept that, but, and there is a "but" here, I believe there have been other mass murders which have been prevented by arrests and, as you quoted, there is at least one very significant set of instances, as I would call it, in which I believe that, although an incident or incidents were prevented by the arrests, it was not possible, for various reasons, to prosecute the persons concerned. Q87 Mr Winnick: But, you see, if we take what you have said and which I have quoted, that people have been released because of the time limit, one would, therefore, expect that those conspiracies would have actually resulted in murder. Lord Carlile of Berriew: No, because, and the same used to happen with the IRA, if people are arrested and thereby their conspiracy is disrupted, it is pretty rare for that conspiracy to be resumed. Only an idiot would start to resume their conspiracy because they will know perfectly well that their every move is likely to be watched. It may not be watched, but it is a reasonable suspicion, is it not, that you are going to be watched if you are released? Q88 Mr Winnick: So clearly, if that is the case, Lord Carlile, the 14 days were sufficient because, as you say, they were placed under detention for 14 days ----- Lord Carlile of Berriew: No, it was not sufficient because in that instance, and this is a set of circumstances crossing the Anglo-Scottish border, I have been told, and it is not just that I was told because I have seen quite a lot of documentation, and there was a review carried out internally in the police force concerned mainly with what had happened in the case, I have been told that there were people who ought to have been prosecuted about whom it was expected that they could be prosecuted if it had been possible to have enough time to gather the evidence while they were in custody. I know you are going to hear evidence later about computer encryption and that kind of thing, and I am not an expert on it, but all I can tell you is that the police say, and this is around the country, that it is formidably difficult to collect evidence during a short period while people are in custody when you have nipped a conspiracy when it is really only just in bud. Q89 Mr Winnick: That may be an explanation for the fact that no one has been released under the complaint and not charged because obviously they have to be charged, but, of the large numbers of people who have been released, no one, once released, was later charged with terrorist offences? Lord Carlile of Berriew: No, that is right, but there is a lot of overkill in this area because the police obviously have got to act more or less immediately on reasonable suspicion. Reasonable suspicion may be based on inaccurate information, but, if the police are given inaccurate information, that gives them a reasonable suspicion that there may be a terrorism act and they have got to do something about it. You are bound to have more arrests without what the police might regard as a result in this area than in most areas of crime. Q90 Mr Winnick: You describe the three months' post-charge detention as a "reasonable maximum", and you would clearly choose this period, and you were often quoted in the debates understandably by the Government and their supporters on this issue, rather than 28 days. Lord Carlile of Berriew: Yes. Q91 Mr Winnick: So why three months? Why not six months? Why not nine months? Lord Carlile of Berriew: It is a very difficult question to answer and the answer runs like this: nobody has suggested to me that 90 days was appropriate, but I have, as I said earlier, spoken to a lot of groups, the police and others, including of course the people who gave evidence before you insofar as they were willing to talk to me, over a long period of time, and I have been doing this now for over four years. I believe that there would never be an instance of more than about three months in which the police could not gather enough evidence if the evidence was available. I believe that there are only maybe a couple of cases every two or three years, and you might have a flurry of them and then have none for three years, in which it would be necessary to hold anyone for anything like up to three months. It was simply a judgment that I made. Six months, I would have said, was outrageous and 28 days, I think, was too little, but that is a judgment. Of course I emphasis, as I keep emphasising, that what I said was that we should introduce a new system which was consistent with the recommendations of the Newton Committee, a system that involved taking a senior judge and effectively making that senior judge something like a juge d'instruction, but better. The juges d'instruction are not judges, in my view, but they are basically very skilled prosecutors. I thought that, if we introduced a senior judge, a senior circuit judge with great experience of crime who would be there, on hand, with special advocates available to look at all the evidence on a day-by-day basis, we would probably get most people being released after, at the most, 14 days, but the judge would be there, giving reasons to examine all the material and could ensure that this was a fair procedure. Q92 Mr Winnick: Parliament increased the seven days to 14 days, as you know obviously, less than two years ago. Lord Carlile of Berriew: Yes. Q93 Mr Winnick: Therefore, do you believe it is justified to jump, having doubled the period in less than two years, from seven to 14 days? Do you, Lord Carlile, a distinguished lawyer as well as parliamentarian, consider it perfectly justified to go in one jump from 14 days to three months? Lord Carlile of Berriew: As long as a whole new raft of protections is introduced far and away beyond anything available for the 14 days to ensure that nobody is kept in for a day longer than is necessary. I actually believe that the Government was moderately sympathetic, perhaps more than moderately sympathetic, to the way in which I presented it, but it was thought it was perhaps too complicated to introduce it now. I do think, and I have said this publicly, that the management of the current Bill has not been particularly skilled, it did not need to be done in such a hurry, and I would have preferred an evidential legislative process, the sort of thing you are doing now. Q94 Mr Winnick: Lord Carlile, no one would exaggerate this, and certainly most of us have avoided doing so, by saying that three months is more or less what happened with the IRA and the Loyalists over internment, and obviously there is a difference. However, bearing in mind what you said earlier both to the Chair and to myself about extremists in the Muslim community, do you at all accept the argument that, if it was three months, the danger would be one of antagonising large elements of the Muslim community where people would be held for a maximum of three months, and I accept that it would be less in many instances, and then released in large numbers, like under the 14 days, without being charged, and would that not play right into the hands of the people that you and I recognise are very dangerous to the Muslim community as well as to the wider community in our country who would say in effect, "This is how Muslims are being treated"? Do you recognise the acute danger of playing right into the hands of those extremists? Lord Carlile of Berriew: Of course I recognise the point. I believe ---- Q95 Mr Winnick: A strong point? Lord Carlile of Berriew: Perhaps I could just finish. I believe that the Muslim community is extremely responsible and I believe that there are large elements of the Muslim community who are very keen that there should be a full raft of powers in place that ensure that the Muslim community is not subjected to the sort of criticism that is sometimes levelled at them. Let us not forget, we happen to be talking at the moment about Jihadists, but the last major lot of terrorism we had in this country was absolutely nothing to do with the Muslim community at all and it was connected with the island of Ireland. One of my concerns, and I think Mr Clarke now has this very much in mind, indeed I know he has had it in mind since he first became Home Secretary, is that we should have some permanent terrorism legislation that will stick and be reliable against all potential forms of terrorism which we cannot predict in the future and should hopefully last as long as the Offences Against the Person Act of 1861. Q96 Mr Winnick: Could you name anyone from the Muslim community who has come out in favour of the three months' proposed detention which you advocate? Lord Carlile of Berriew: No, I could not name any individual, but I did not have notice of the question and I might have been able to if I had done. Q97 Mr Winnick: But you cannot name any? Lord Carlile of Berriew: I cannot off the top of my head, no. Q98 Mr Streeter: Lord Carlile, I have got some specific questions about alternatives to detention based on evidence from witnesses to date, but just picking up the specific example you have given of cases where a longer period would have enabled the police to prosecute rather than release, I do not recall the Government arguing that in the run-up to this Bill going through Parliament. We were crying out for specific examples where the 90 days would have been helpful and I do not recall them coming up with any examples, albeit anonymous examples, at all. I know you do not speak for the Government, but can you comment on that? Lord Carlile of Berriew: I thought that the Government, and I think ministers occasionally, have cited what I have said to what Mr Winnick read out. It is very difficult to cite examples in this area because it involves revealing quite a lot of information about cases. Q99 Mr Streeter: But you have just done it. Lord Carlile of Berriew: Well, to a limited extent obviously and I have not said anything which I think will do any damage. There are cases at the moment, as I put it, in the pipeline about which there are concerns as to whether the police have had sufficient time to garner all the evidence that would have been available. There is an interesting leader in The Times which I read on the tube this morning, or a feature article, about this whole area and it makes the point that there is of course a lot of information available about the tools of terrorism, particularly very low-grade fraud. It is pretty easy to bring together the evidence of credit card fraud and other small frauds which are used to fund terrorism, but that is only at best, if I can use a football analogy, league one and it is neither championship nor premier league. If one is going to obtain the information that shows the premier league terrorism conspiracies, one needs to go far beyond that fairly basic evidence. It is like the whole question of drug crime where it is pretty easy to catch people who are small-scale street distributors, but it is much more difficult to catch the very big fish because it involves a great deal more work and that is more difficult in volumes, in multipliers in the world of terrorism, I believe. Q100 Mr Streeter: Our friends from JUSTICE have made three specific suggestions which they prefer to the current detention provisions. The first one is developing the threshold test for prosecutors, secondly, bringing into force Part 3 of the Regulation of Investigatory Powers Act, and then, finally, allowing intercept evidence. Can you comment on how you react to that? Do you think they would be useful mechanisms or useful tools, particularly the use of intercept evidence which of course is a big political debating point? Lord Carlile of Berriew: I agree completely with JUSTICE on all three points. I think they would all be helpful and useful developments. I think there is a danger of this whole intercept evidence issue, however, being exaggerated in its importance. My own view is that the use of intercept evidence in British courts would be very useful. I have been in the odd case in which intercept evidence was used, but it happened to be foreign intercept evidence, so it was admissible, and I was in a case where Dutch intercept evidence, for example, was used. However, I think that intercept evidence would be of greatest utility in catching people who have committed serious money laundering offences and drugs crime. There would be some cases, I suspect a very, very small number, in which intercept evidence could be useful in catching terrorists, but I cannot see myself any good remaining reason why we should exclude its use. After all, it does not have to be used and it only has to be disclosed if its disclosure materially assists the defence case or materially undermines the prosecution case, and that is the basic rule of disclosure, otherwise it does not have to be disclosed. At the end of the day, they do not have to prosecute either, but I do think it has a small potential for utility in this area. Q101 Mr Streeter: But you do not think these three tools could replace detention? Lord Carlile of Berriew: No, I do not think they would replace it. Of course when you say "detention", by that I understand you to be saying a reasonable period for investigation after arrest. Q102 Mr Streeter: Yes, 28 days. Lord Carlile of Berriew: No, I do not think they would replace it. They might accelerate the release time. Q103 Mr Streeter: You have already commented on my next question, the police charging a suspect with a lesser crime and holding them in custody while gathering evidence for a greater crime, but could you just comment more fully on your views about that? Lord Carlile of Berriew: This was the suggestion that I think was put forward most strongly by the Party to which I happen to belong early in the debates on the Bill. In France they arrest people for something called 'association malfaiteur', and it does not come much vaguer than that, and incidentally the comparison of the French and Spanish system generally favours British human rights standards which I can go into in more detail if you would like. I do not believe that it is right for somebody to be arrested and charged with, and my analogy was shoplifting rather than murder, using telephone cards as currency, which is one of the things which has been done for asylum-seekers who may be interested in terrorism, when, in reality, what you are investigating is a big terrorism conspiracy. I think people should be charged, and prosecuted, for what they are thought to have done. I do not think it is fair to people to say, "We're arresting you and charging you with a trivial charge", then put them in Belmarsh on a charge of credit card fraud, keep them there for the 18 months it takes to bring a really big terrorism offence to trial, much longer than 90 days, and then half-way through or near the end of that period say, "Woops, terribly sorry, old chap, but we have not been able to get the evidence together, so if you kindly come down to the Woolwich Crown Court and plead guilty to obtaining telephone cards by deception, you will not get three months' imprisonment and you can go home". I think that is fundamentally dishonest and I do not agree with it. It is a very naïve view. Q104 Mr Streeter: That is very clear. Finally, could I have your views on the use of tagging, surveillance, bail conditions or control orders as alternatives to custody in this area of course. Lord Carlile of Berriew: I said in my recent report that I think more should be done to review the extent of the control orders as apply. That is really why I insisted on, or I said I wanted, the standard control order to be included in the report. I think the Home Secretary has accepted in principle now that there should be within the Department regular reviews of each case to see whether every restriction is really needed. My own view is that the control orders that are imposed at the moment, in all but one case, and that one case happens to be the only case where a British national is the subject of a control order, they come close-ish, some might say "perilously close", I would merely say "close-ish", to derogation. I think we are still on the side of non-derogation, but it could be challenged. Q105 Mr Malik: I welcome Mr Winnick's intervention earlier on because I do think language is incredibly important. You talked about good imams and bad imams and obviously that describes them, but it does not give any sense of the quantum. The same equally is true for this notion of moderate Muslims and extremists. I think that actually undermines confidence, it deepens quite a mistrust, it reinforces all the stereotypes and it damages community cohesion. For me, terms like "mainstream Islam" would then give a sense of quantum and extremists obviously would be a small part bolted on to that somewhere. I just want to come back to a point, and that is why I am pleased that you asked about it, David, but I just want to come back to a point that you raised which was that, and hopefully it is a correction, that actually the last terrorist attack in this country was not in the name of a united Ireland, but it was in the name of killing black ethnic minorities, Muslims, Christians, whoever they might be, and it was David Copeland, the bomber in Brixton, Soho and Brick Lane where he killed three and maimed over 80. This is the real problem with this whole debate actually, that the focus in all the examples you gave, there was not any white supremacist, not any animals rights activist, there was not anything about Christian fundamentalists, anti-abortionists, and the focus was just Muslim, Muslim, Muslim. Is it any wonder then that people out there think that this legislation is targeting Islam and Muslims when we ought to be saying that this legislation discriminates only on the grounds of those who would be engaged in, and involved with, terrorism and not on the basis of religion? The whole debate is extremely counterproductive, so how do we improve this debate? Lord Carlile of Berriew: First of all, Mr Malik, I say, and I hope you will not think this patronising, that I have been hugely impressed by the way you have dealt with these issues publicly. I know the area you come from very well as I was brought up in Burnley and my mother still lives there, so I know the area extremely well, and I think the way ---- Q106 Mr Malik: You are trying to endear yourself to me! Lord Carlile of Berriew: We are both claret supporters, are we not! I think the way that what you have done has resonated has been very good. I would, however, throw the question back at you and say that I have merely responded to the questions that have been put to me and the language I have adopted in answers has been derived from the language of the questions. I agree with you entirely. I think it is very important that we should look at terrorism as a whole and it is very unfortunate that Muslims are feeling stereotyped by all this. It is extremely important that the police in particular, for example, when they are searching and stopping people at airports, should not stereotype, and I have said that the number of section 44 searches under the Terrorism Act could be reduced by 50% without damage to national security and the number of Schedule 7 stops at ports could be reduced by the same proportion without risk to national security. Underlying your question is a dilemma though. I have been asked by the Government, and have accepted the task, to prepare a report on the definition of "terrorism" in British law, and this is going to take a number of months. I issued a call for papers recently and there are going to be public events if people wish to attend them and I hope they will. You raised a number of potential terrorism issues about which I have had questions raised with me about whether they are terrorism at all. Is, for example, animal rights activity a terrorist activity or is it just a very bad, common crime? There is, therefore, a genuine question about how wide the range of terrorism should be in law. The Bishop of Oxford, on the other hand, in a speech in the House of Lords very recently, and Bishop Harries is a man of great wisdom, proposed an extremely wide definition that would certainly have included the activities of the leader of the British National Party, a former constituent of mine, about whom I know much, too much, so I think there are difficult definition issues underlying what you say, but I will accept completely your thesis and I think we all have to learn how to deal with these issues, and some of them I gain from you actually as I listen to what you say. Q107 Mr Spring: Just turning to your report and your recommendations based on the Newton Committee, you talk about the fact that the existing system of scrutiny is designed currently for short periods and you say, "a more searching system is required to reflect the seriousness of the State holding someone in high-security custody without charge for as long as three months". Obviously we have, as you have heard, had representations and evidence from JUSTICE and Liberty. One of the things that arises out of their comments is that the current system of judicial oversight of pre-charge detention is invariably flawed because the adversarial system which operates in this country is one where the judge is likely to hear what the prosecution has to say and act accordingly. Now, in your proposals how do you feel that this contention of theirs and their concern could be dealt with? Lord Carlile of Berriew: The concern is a legitimate one, but I think it is over-expressed. If you look at the performance, and I am only talking about the performance, of judges under the Diplock system in the courts in Northern Ireland, and I am not making a comment about the merits of the Diplock system, the judges who have been giving judgment for many years now in the Diplock courts in Northern Ireland have learnt a completely new discipline and they do it extremely well. They give reasoned judgments and actually the prospects of being acquitted in a Diplock court are higher than the prospects of being acquitted before a jury, as it so happens. Now, I thought very hard about the kind of judges who would need to do the work I suggested in my proposal and it seemed to me that we needed senior judges, and I mean senior in terms of competence as opposed to age though they may coincide occasionally, with great experience of criminal law, preferably people who have both prosecuted and defended in their practising years who, I believe, would happily adjust to a new system like this. The stereotyping of judges, of whom I know a large number, is almost as risky as the stereotyping of anyone else and I believe that, if one were to take the example of a group of senior judges at the Old Bailey, and there are others around the country, and asked them to do this kind of examining judge work that I have proposed, I think they would do it very well and adapt to it extremely quickly. Most of them have pretty rigorous minds and that is the most important quality needed. Q108 Mr Spring: Thank you for that answer. Irrespective of the quality or qualities of the judges, specifically in your proposals you say that the judge should be provided with a "full and continuing account of all matters involved in the investigation in question", but who do you think should prepare that sort of information for the particular judge in question? Lord Carlile of Berriew: The Crown Prosecution Service basically, although I have suggested that there be added a special advocate there to scrutinise the material and make completely objective representations to the judge, both orally and in writing, and of course to make contact with the defence lawyers. I would like to see the whole special advocate system operating a little more flexibly than it is right across the board. Q109 Mr Spring: You talk about the special advocates and would such the special advocate who had received security clearance have contact with the detained person on whose behalf they were appearing even after they had been fully briefed on the investigation? Lord Carlile of Berriew: I think that they certainly should have contact with the lawyers for the detained person whose interests they are representing, but on whose behalf they are not strictly appearing. I believe that it should be in the discretion of the oversight judge to decide the extent to which such contact should take place. There is a danger of compromise and of undermining the whole system and each case has to be considered on its merits, but I would hope that, compared with, say, the SIAC system, the special advocate would be able to come a little closer to the defence interests in the case. Q110 Mr Spring: You talk about again the discretion of the judge and the sort of judge you have in mind and, as one of your proposals, you talk about the "suitable opportunity for written and oral defence representation against extended detention". What do you envisage by a "suitable opportunity for written and oral defence representation against extended detention"? Lord Carlile of Berriew: I do not think we should be too structural about this. The analogy I would take, I suppose, is the Woolf reforms, the civil procedure rules for civil courts where some work is done by the judge in chambers dealing in private, taking representations in writing, some is done on the telephone, which is a remarkable development for the legal system to have hearings by telephone, and some is done with hearings in a courtroom of one kind or another. I think the procedure should be flexible enough to enable the result to be right rather than there being a procedural straitjacket that might limit the prospects of the result. I think this is something that would have to develop. I see a group of judges doing this kind of job as something like a sort of collegiate body and with a great influence on their own rules and I would hope it would not be too formal. Q111 Mr Spring: Lastly, and I think we can guess what the answer to this will be, but just for the record as it has been put to us, on the question of increased judicial oversight, there is some criticism of your suggestion on the grounds that there are incompatible elements here of an examining magistrature and the common law system. Do you see any incompatibility in those? Lord Carlile of Berriew: I did, but I have been persuaded, partly by Newton and partly by looking year after year at these issues, that the common law system, which after all is built on flexibility, a system of precedent built on the potential for change, is more capable of adapting itself to this kind of requirement than possibly the continental systems are. I had a meeting very recently with Juge de Bouvier, the very celebrated and very able French number one juge d'instruction in these terrorism matters, and I asked him a number of questions and was slightly appalled by some of the answers. They do not tape-record interviews and, during the first two days of arrest while the suspect is under arrest for association malfaiteur, he does not have a lawyer present. He said to me, "Monsieur, this is a very productive period of interrogation"! I am not surprised because I practised at the Bar before the Police and Criminal Evidence Act 1984 when tape-recordings came into force. Now, I think our system is more flexible than that. I pointed out to him that in Welshpool Police Station they have a tape-recording suite, and it is not really very difficult to provide it. I think our common law system is adaptable. If you talk to French or Spanish lawyers, they say to you, "Well, I wish we had some of the elements of your system". Q112 Mr Clappison: I was very struck by the point you made that a number of cases which would need the longer period of detention is very small, but of course there is a strong public interest in making sure that every such case, and there will be serious cases, is properly investigated and, where appropriate, brought to justice. You have also been asked about the case which you told us of where significant conspiracies have gone unprosecuted and you told us a bit about that, but I wonder if you can just take us through the mechanics of how it is that those cases come to go unprosecuted because for somebody who is in detention at the time and they are released, they can still be charged later on, can they, with sufficient evidence? Lord Carlile of Berriew: Let me give you a hypothetical answer, but it is not beyond the bounds of reality. Supposing the police arrest a young male who shows physically all the signs of being a suicide-bomber. He has prepared himself physically, and there are certain physical signs which are well known, and he has prepared his life, as it were, to become a suicide-bomber. The police arrest him and they have more than reasonable grounds for suspecting that he is a suicide-bomber, perhaps they have had a tip-off, but they know nothing or next to nothing about his connections. Now, they have taken him out of circulation by arresting him, and that is fine, he is not going to be a suicide-bomber, but, if he is a suicide-bomber, you can rest assured that he is unlikely to be the only one in a group and there is likely to be some kind of cell and they need to discover more. If that person sits in Paddington Green or the Goven or the custody unit in Northern Ireland, which I visited very recently, and says, "I'm terribly sorry, but I've been advised to say absolutely nothing", which is going to happen in possibly 100% of cases, then it is actually very, very difficult, as it is a very slow process, to put together his life and times, his connections, years of associations, his travel details over the last five or six years; it is a slow process. I think that is quite a good and realistic hypothetical example of how one individual could lead to great investigative difficulties. Of course there is a particular problem if, say, eight individuals are arrested. You may have the same lawyers representing all or some of them. The Paddington Green process, the police will tell you rightly, is an extremely slow process because they do properly respect various aspects of the personal lives of the people concerned and certainly 14 days can disappear very quickly and there is an awful lot of administration. I hope that answers your question. Q113 Mr Clappison: I find that very helpful. Bringing to bear all your professional experience and also the experience you have had of four years in this post, you are telling the Committee then that, without the longer period of detention and taking into account the possible alternative courses of investigation, there remains a risk that a significant conspiracy would go unprosecuted? Lord Carlile of Berriew: Yes. Q114 Mr Clappison: Can I now ask you about a completely different subject. You were talking earlier on about the period in life when young people are very impressionable and you mentioned the influence that some extremist preachers would possibly have. You also mentioned universities and, for the sake of completeness, people could be influenced by extremists of many different kinds at university. Lord Carlile of Berriew: Of course. Q115 Mr Clappison: Just taking this area, can you say a bit more about the concerns which you have got in that area because what happens in universities is a matter of great concern? Lord Carlile of Berriew: This is entirely anecdotal, so I really would not pretend that I have evidence that I, as a lawyer, would regard as evidence, but, talking to young people, including young people quite close to home, as it were, to me, I believe that what I said earlier is true, that there are some societies in some universities which are very exclusive. They may include the sort of societies Mr Malik was talking about outside of anything connected with Islam at all, and I am sure there are many of them, though some of those might be all-female societies, there is exclusivism everywhere, but I am led to believe that there are some pretty intimidating groups in some, I suspect a small number of, universities. Nobody wants to inhibit people who are going through that very important education process that the university degree provides from being as conceptual as they like, their imaginations running riot, but there are dangers too. Q116 Mr Clappison: Do you know anything about the attitude of university authorities towards this? Lord Carlile of Berriew: No. Q117 Chairman: Lord Carlile, you have been enormously helpful this morning, drawing on your deep experience. Can I put one question to you and it is really asking, if I may, for your advice to myself, as Chairman of the Committee, as a whole. Much of the powerful evidence you have given depends on the information which is necessarily confidential and indeed last week witnesses said to us, "Well, you should just dismiss Lord Carlile's views because they are not based on public information and we cannot rely on them". As a committee, up until now we have chosen not to meet in private session, where we could of course get some of this information in a confidential session, largely, I think, because we are trying to judge these matters as other members of the public have to judge these matters on the basis of the publicly available information. If we get confidential information, we are putting ourselves in the same position as you and we cannot explain why we have reached any conclusions we have. Do you think it is absolutely intrinsically possible to reach a balanced judgment about the correct period of pre-charge detention without having access to information which is necessarily confidential because it is about past or current police inquiries? Lord Carlile of Berriew: No, I do not. I think, if I can answer the question in a slightly different way because this concerns me every day of my life, there is a trust issue, there has got to be a trust issue because not all information can be given publicly. The trust issue has been very damaged by intelligence information connected with the Iraq War which is perceived, rightly or wrongly, and I make no judgment on it, to be inaccurate, particularly what is described by the press as the "dodgy dossier". That has had a devastating effect on the level of trust given to MI5, anyone like myself, and I do not see that much and the press exaggerate what I see, who is able to what I ask to see and I am not refused anything that I ask to see. We would like to be trusted and we would like the public to believe what we say. The effect of past events means that we are not trusted as we would like to be. It is a matter for a committee like this whether you take it on trust or whether you get to see more information, and of course it is a matter for government as well in the end what they show you, but I do not believe one can make a fully objective judgment without seeing the information, unless you are prepared to say, "Well, we'll only take certain things on trust". Eliza Manningham-Buller will tell you in general terms roughly what I have told you, I think, and I see no reason not to trust her, far from it, but it may be of reassurance to the public if you were to see more. It is a matter for you, sir. Chairman: Well, that is very helpful and something the Committee will need to reflect on during the rest of the programme of this inquiry. Lord Carlile, you have been enormously helpful and thank you very much indeed.
Examination of Witnesses
Witnesses: Professor Ross Anderson, Foundation for Information Policy Research, Mr David Lattimore, Technical Manager, Digital Crime Unit, LGC Ltd, and Mr Peter Sommer, London School of Economics, gave evidence. Q118 Chairman: We are moving on now to some of the more technical issues. We are very grateful to you for joining us today. I wonder if you could introduce yourselves for the record. Professor Anderson: I am a Professor of Security Engineering at Cambridge University and I also chair the Foundation for Information Policy Research. Mr Lattimore: I am David Lattimore. I am the Technical Manager of the Digital Crime Unit at LGC Ltd. I have been involved in computer forensics since 1992 and I still carry a caseload today, so I have quite a bit of experience in that field. Mr Sommer: I am Peter Sommer from the London School of Economics. I am an external examiner at the Centre for Forensic Computing at the Royal Military College of Science, which is where a lot of law enforcement agencies get their training, and I am also the join lead assessor in this particular area for the Council for the Registration of Forensic Practitioners, which is a Home Office initiative to improve the quality of forensic work on the ground. Chairman: Thank you all very much for joining us this morning. Part of the case for extended pre-charge detention is the difficulty of obtaining computer-based information and so on, so I hope this morning's session should shed some light on the truths and otherwise of that. Q119 Steve McCabe: Does it surprise you that the three of you have such different views about how easy it is to access information on a computer? I wonder if I could ask each of you in turn to tell the Committee how you think it is possible in practice to access data and analyse it and how long you would normally expect this to take. If possible, could you account for the fact that there are such variations in the written evidence that you have provided to the Committee? Mr Sommer: I have not seen Mr Lattimore's evidence. To a certain extent you are in a ball of string territory. The purpose of the sort of evidence that I have been trying to provide is to arm you with the variables so that when you come to seeing the police and others you have sensible questions to put to them, you do not have to accept it at face value. In broad terms if you are examining a computer you do not need initially to make a copy of it. In his theoretical case study which he provides you with Mr Hayman says that it takes 12 hours. In fact, all of the leading products allow you to carry out what is called a preview, which is where you can be examining a computer safely so that you are not altering any of its data, within a few minutes of getting hold of it. What I believe you are concerned with in terms of your particular inquiry is not getting absolutely every bit of evidence that you are going to be producing in court but getting sufficient in order to be able to charge and, depending on how you manage the situation, you should be able to do that relatively quickly. That prompts me to make a mild criticism, if I may, of Mr Hayman's statement. I am sure it was done entirely sincerely. It seemed to me that he did not have a full grasp of how computer forensics works in the detail. Courses are available for line managers not to do the detail but to understand enough to be able to manage the situation properly. I greatly admire what he does, but I wonder if he would benefit from going on one of those courses. If he did so, he might be able to shorten considerably the period he seems to be going through. I am also relying partly on my knowledge of some of the cases that he is holding because I am instructed by the other side for them. Q120 Steve McCabe: In your evidence you say it takes 30 minutes to image and one of the other witnesses says it is a process that often happens overnight. That sounds to me like quite a variation and I am not an expert like Mr Hayman. Mr Sommer: Let me tell you what is involved. With the regular products you can look at about two gigabytes a minute and with a standard computer you pick up from the high street at the moment you are talking about 80 gigabytes hard disc, so it will take you 40 minutes to do the imaging. There is an exception and that is if it is a lap-top computer where you cannot pull the hard disc out it will take a great deal longer. I know Mr Lattimore reasonably well. We have not discussed our respective submissions. Maybe we will have a disagreeable appearance of argument in front of you. Q121 Steve McCabe: But 30 minutes would be your expert advice to the Committee, would it? Mr Sommer: I think you can get going on a preliminary exercise in 30 minutes but not an exhaustive exercise. It seems to me it is the preliminary exercise you are concerned with in terms of your inquiry. It is not getting final evidence you are concerned with but rather that it is enough to get to a charge. Mr Lattimore: With imaging computers it varies greatly from the type of hard disc, the amount of data on the disc, the software you are using to image with and the hardware you are using to image with. There are lots of factors involved. I have a technician whose sole job is to image computers daily and we have computers in every day of the week and most of the computers he images do take overnight imaging. They may finish at four o'clock in the morning or three o'clock or eleven o'clock, but we do leave them overnight to image. We have always used previewing as a form of investigation, but invariably what we find at the end of the day is we then go on to image that computer. An initial investigation is only to say whether we have got something there or not. Invariably all our computers are imaged because at a later date somebody will want a copy of that image. Professor Anderson: The point that I was making in my submission is that the amount of data that the police sees in civil matters is going up very, very rapidly and the police are falling further and further behind. A PC may have 80 gigabytes at the moment whereas a few years ago it would have been a few gigabytes and I would think that in ten years' time when the police raid someone's home they might find dozens or perhaps hundreds of computing gadgets on which data can be stored. It is common nowadays, for example, for people to back up their data on devices like an iPod and so in future when you raid somebody's house you will seize their iPod and see if there are data files on it. This business is going to be more complex and the police require a step change in their capabilities in this regard. Mr Lattimore: In one case last week we had a person who had five computers submitted from his home address and nine hard drives and all these hard drives had been to his work address and used in the machine there as well. To do that amount of data is very, very time consuming. Q122 Steve McCabe: With the exception of Mr Sommer, the other two witnesses are suggesting that the police case for 12 hours is not that ridiculous. Mr Sommer said that Mr Hayman did not understand it and he should go on one of these courses. In the police evidence they talk about a minimum of 12 hours to try and access this data. Mr Lattimore: If you asked me to do an investigation and give an opinion in 12 hours, I would be happy with the evidence I had given. Mr Sommer: It is purely imaging he is talking about, not the investigation. Mr Lattimore: It all depends on the hardware you are dealing with and the software and what is on the hard drive because it can vary. A 200 gigabyte hard drive may only take 20 minutes if there is very little data on it, but if there is a lot of data on it it might take overnight. Q123 Steve McCabe: Do you know what role the information obtained from computers plays in charging suspects as opposed to simply building the case? Mr Sommer: It depends entirely on the circumstances. It will vary considerably. Sometimes the computers are at the heart of it and sometimes they are entirely peripheral. That applies to any form of crime in which computers are involved as well as the terrorist cases. I currently am instructed in three terrorist cases and in one of them the computer evidence is really fairly peripheral, but there are a lot of other types of evidence in terms of what was located. The computer evidence base may slightly strengthen or slightly weaken the police case but in other instances it can be absolutely at the heart of it, particularly if you are charging people with a conspiracy where you have to infer a common purpose and you will tend not to write convenient letters to each other saying "Let us conspire to X, Y and Z". You then have to say there is a pattern of behaviour or a pattern of surveillance of targets or whatever it is which tells us that something might be going on and people are working together. So there is absolutely no straightforward answer to your question. I understand why you are putting it but there is no easy answer. Professor Anderson: In conspiracy cases critical evidence may come from traffic data obtained from phone companies. There are some particular types of offences where material from the machine in question is critical to charging decisions, child pornography being an obvious case. Mr Lattimore: I would tend to agree with both Peter and Professor Anderson. Out of all the computers I investigate, 70 or 80% of them are relevant to the charge. Q124 Chairman: When you say relevant to the charge, do you mean needed before the charge is made? Mr Lattimore: Yes, the data on the computer is relevant to the investigation. I deal with a lot of fraud cases along with various law enforcement agencies and they come to me with their computers and that data is used to prepare those charges. The one thing the police miss is the intelligence that is available on these computers. I know from all my years of investigating computers that nobody has taken this on board because the computer is a wealth of intelligence that is missed all the time these days. They have not got the time to deal with it, that is the problem. Q125 Steve McCabe: I do not think anyone doubts its value, I think we were simply trying to establish whether it was central to the charge and it sounds like the answer is it could be but it might not be. If decryption and analysis was the subject where the greatest weight was placed in determining a period of detention pre-charge, how long do you think that detention period would need to be? Professor Anderson: In the case of decryption, there are still a few products around where the act of searching for a key may take time, but this is largely a thing of the past. Encryption products nowadays tend to be either good or useless and if they are good then you either guess the password or you give up. In the future world, for which I hope we are legislating rather than the world that is in the past, I think you can reckon that the majority of the effort will be put into the analysis stage rather than into technical aspects such as seizing the evidence, bagging it, imaging it, decrypting it and so on and so forth, but the human effort will be the limiting factor. Hopefully if the tools become better that will be the main thing that you will have to worry about, ie how long an analyst can usefully work on the data before he either stops finding stuff or simply becomes weary and gives up. Mr Sommer: I have been following this as a parliamentary issue for rather a long time. When the legislation that is now in Part 3 of the Regulation of Investigatory Powers Act began its life in Parliament it was part of the electronic commerce legislation and I was the Trade and Industry Select Committee's specialist adviser then and I did a great deal of thinking about how it was supposed to work. At the time one of the things that the members asked the then Director of the National Criminal Intelligence Service was how big a problem it was and whether he had any statistics and when he was pressed he said they did not have statistics but that it was going to be a huge problem. They then asked for more detail and they came up with one case. I had predicted along with everybody else that encryption was going to become a much bigger problem than in fact it appears to have done. Let me give you an interesting analogy. If you look at Internet paedophilia, Operation Cathedral looked into the group called the Wonderland Club and the very sophisticated people using encryption. I worked on the case professionally. Some of the encryption could not be broken. At the end of that all of us involved in that said it was a big, big problem. Fast forward to the famous Operation Ore which started up with 7,200 suspects who had subscribed to paedophile sites and whose database was held in a computer held in Texas. Out of those 7,200 suspects - and I purposely got an informal figure from the National Crime Squad last week - there have only been 20 instances where encryption has been a serious problem. It may well be that although it is there as a problem, operationally it is a little less big than it was. I hope you will ask the Home Office and the National Technical Assistance Centre, the people who do the job, for their statistics. In my written submission I describe certain types of encryption and I hope you will get some statistics from them in the way the Trade and Industry Select Committee failed to do a few years ago. Chairman: We will follow that up. Q126 Mr Clappison: Could you tell us how easy it is in your experience to identify the presence of encrypted material and how effective the police's forensic tools are for dealing with it? Mr Sommer: The first thing you do when you start examining a computer is to say what programmes are installed and where is all the data held. If someone has got encrypted material on their machine the first thing you are going to be seeing is an encryption or decryption programme which as an experienced person you will know about. Often those programmes are not deployed but they are there if you start looking for them. What you find with a lot of the encryption programmes is that the first few characters in the encrypted file are always the same and you can search for those signatures. By doing a rough exercise and saying is there encrypted material on this computer as opposed to being able to decrypt it you do get a fairly quick sense. Looking at steganography, which is the technique of hiding information inside pictures, which in my experience is more talked about than actually seen, again there are some very interesting steganography detection programmes. You can detect it fairly quickly. You know whether it is going to be there. That may then, if you were going to introduce properly Part 3 of RIPA, give you a basis for asking for the key or punishing somebody who is willfully declining to give you the key. Q127 Mr Clappison: You have just told us that encrypted material is not as widespread as people once feared that it might be, but the sophisticated encryption which you have just told us about, how frequent a problem is that in your experience? Mr Sommer: It seemed to be rather less than people imagined. I work mostly for the defence, but I talk to a lot of prosecutors and the police and various other services because there is a fairly free interchange at a certain sort of level. My impression is that it is not as big as most of us thought it was going to be, but you must ask the Home Office witnesses yourself as they will have a much better overview. Q128 Nick Harvey: How frequent is it to find the key to sophisticated encryption through the carelessness of the user? Mr Sommer: You point your finger at one of the main techniques that is used. With people using sophisticated techniques you probably are not going to be able to break the system. You can forensically examine a computer and you may find the key or you may find part of the stuff is encrypted in plain text form. It is one of the most important techniques that you use. Q129 Nick Harvey: Would bringing in Part 3 of RIPA help? Mr Sommer: I think it would. Obviously there are broader issues which I am not here to discuss that are human rights aspects to do with people not being forced to self-incriminate. At a practical level, bearing in mind the way Part 3 is supposed to work, it does go before a jury and if you say you have lost your key the jury have to decide whether you really have lost the key. It would be an important tool if only because you would be able to disrupt a suspect. I think you need to explore why Part 3 has not been brought in and that was basically because the Home Office was overambitious in producing its detailed proposals. There is very little difficulty in terms of legislating for stored data, in other words data found on a hard disc. They also wanted to introduce it for data in transmission, but you then run into problems with the techniques used by the financial services industry when they use what are called session keys, ie every time you transact the key changes and nobody knows what the key is at any one time, so forcing disclosure becomes difficult. What should have been done and maybe still should be done is to try and do the easy stuff because it is going to be helpful and we will leave it to some sort of think-tank people to come up with a solution to the more complicated stuff. Mr Lattimore: The problem with Part 3 is that if I was a suspect and I had encrypted data on my computer I would quite happily go to court and take the two years because I know I am going to be out in a year's time. A terrorist or a paedophile is going to take the two years, that is the big problem. Mr Sommer: You are still disrupting the terrorist's units, which is an important element of what Alex Carlile said to you earlier on. Professor Anderson: I tend to be slightly sceptical about this. Okay, it may provide holding charges to get people that you cannot get on any other basis but, given the extremely low prevalence of encryption use by bad guys, quite frankly you would be better getting after them for tax evasion or social security fraud. I am not sure that it is a good use of the senior management time in the Home Office pursuing such a small and specialist matter. Q130 Nick Harvey: Have you any other suggestion for plugging gaps in this area of legislation? Mr Sommer: Remove the bar on the interception of telephone evidence. Q131 Chairman: No, in terms of computer data. Mr Sommer: Trying to interpret Parts 1 and 2 of RIPA, whether it is content or communications data, is becoming increasingly difficult because of the problem of legal interpretation. This has all been drafted in terms of you can make a distinction between the voice component and the traffic component, who contacts who, when and for how long, and it makes it much more difficult when you are dealing with e-mails or web-based e-mails or voiceover Internet protocol or things like that. There are going to be problems which are completely unavoidable. Q132 Nick Harvey: Could this be updated with the right technical advice? Mr Sommer: Updated in what terms? Q133 Nick Harvey: To try and address these moving targets that you are describing. Mr Sommer: I think it is going to be impossible. If you look at the behind the scenes discussions about interpretation in terms of Part 1 and Part 2, the affected Internet service providers and if you look at what you type into a web browser when it is content and when it is traffic data, there are suggestions and understandings but it has not been tested in court yet. Q134 Nick Harvey: How helpful are manufacturers of encryption software? Can they provide a key to anything that is generated using their products or is it possible for someone else to develop encryption and maybe sell it on in a way that the manufacturer cannot determine? Professor Anderson: I think what you have to watch out for here is that from later this year the encryption landscape is going to change with the release of Microsoft Vista, the next generation of Windows operating system which will support the use of a chip called a TPM which manufacturers are putting on PC motherboards. What this means is that by default your hard disc will be encrypted using a key that you cannot physically get at. This is being done for a number of commercial reasons: firstly, to do digital rights management and download music and films and, secondly, by the software vendors so that they can lock the customers in tightly and charge more for their products. An unfortunate side effect of this from the point of view of law enforcement is that it is going to be technically fairly seriously difficult to dig encrypted material out of systems if people have set it up competently. One issue that was in fact discussed at IPEC here a couple of weeks ago is whether there might in the medium term be some kind of obligation placed on computer vendors, hardware vendors like Intel or software vendors like Microsoft, to see to it that 'back door' keys be made available. Certainly if I were running the appropriate department in the Home Office I would be getting into conversations with Microsoft about this issue now rather than in November when the product is shipped. Q135 Mrs Dean: How widespread are the skills needed to decrypt computers? How much training is necessary to bring someone up to the required standard? Can one expert supervise a team of less skilled analysts? Professor Anderson: Once we achieve maturity in this field you will see a hierarchy of skills in the police and elsewhere. At present and over the last 20 or 30 years the police have tended to see computer experts as being a breed apart. You had a detective constable here and a detective superintendent there whose hobby happened to be computers rather than yachting and so he got called in when there was some complex business going on. That is not going to wash in the modern world because computers are everywhere, in our lives, in our homes, in our businesses. In future, rather than thinking of the computer expert as the guy in a white coat with a degree in the Home Office licence and all the rest of it, you are going to have to see basic computer skills embedded at all levels in the police force and elsewhere, amongst civil litigators for example, because this issue affects civil as well as criminal matters, and then there will be a hierarchy of people with perhaps slightly more expertise, people who do regular retraining of detective constables and then higher up there will be the PhD grade people who are involved in designing the next generation of tools. At present we do not have anything like that ecology of forensic expertise. Mr Sommer: I agree broadly with Ross's analogy. I think the situation may be slightly better than he is describing. If we look at the people at the National Technical Assistance Centre, I know a number of them, they do not talk a great deal about their work, but I have known them in previous jobs and I have also seen their academic work and articles they have written. These are broadly speaking people who are highly adept at using tools that have been created by others. If you go back to Ross's reference to a hierarchy, there are people who have come out of law enforcement and who do this sort of work and operate at the second layer; in other words they use tools created by others very, very intelligently and that is probably the greatest need. At the top level, when you have got something that is really new and really difficult, Doctoral level as opposed to Masters level, then I suspect they have to go to Cheltenham or there are a few private sector places where they can get it. NTAC, even if you know the people socially, is not an organisation that chats a great deal about itself, but I do hope from your position as a parliamentary Select Committee you can ask them about these issues based on the background that we are able to give you here today. Mr Lattimore: I was involved in NTAC. I am not going to go into too much detail about it. I set it up with a number of other people and I was operational in there for a number of years and our success rate was very, very good, but it is not just a matter of brute forcing encryption, there is a lot of work that goes in by a team of people that all work together, all with different skills and that is the way forward for dealing with encryption in the future. Q136 Mrs Dean: If the police had twice as many computers and skilled operators, would it mean that they could achieve the results twice as quickly as they do now? Mr Lattimore: No. The police would never ever be able to deal with this type of encryption because (a) they have not got the time and (b) they have not got the hardware to deal with it because you do need specialist hardware which most police forces cannot afford to purchase and that is the beauty of NTAC. Q137 Mrs Dean: So what you are saying is that there are the resources available but the police have not called on them, are you not? Mr Lattimore: Some police forces call upon them and some do not. Some see it as they have failed in what they are doing. Some used to use us all the time and our success rate was in the 70% range which was very, very good. Q138 Mrs Dean: Do the police need to reassess their approach to decrypting computers, and is the volume of evidence available, or potentially available, on computers effectively unmanageable? Mr Sommer: I think that sort of exaggerates the position. What we are trying to do is avoid making these sweeping statements. There are situations when life is jolly difficult, but then that is no different from any other sort of crime when a police officer may feel there is a bit of evidence if only he could find it. The fact that they can see it there is a small part. Q139 Chairman: I want to pursue this point because this is at the heart of our inquiry. You have been very helpful in explaining more about the processes and the issues. I think all three of you in different ways have made it clear that the technical issue of decryption itself does not justify the 90-day detention period because it is the analysis of what you get from the computer that is most important to the possibility of laying charges. Could each of you just briefly say from your knowledge of this field whether you think the difficulties in the process of decrypting and analysing information provides support to the idea of an extended period of pre-charged detention in terrorist cases and, if so, how long? That is the crux of the issue. You have set out the issues and how it works very clearly for us. Does this justify the case for an extended period of pre-charged detention? Professor Anderson, you were very clear in your evidence that encryption per se did not justify the 90-day detention period. If you take the process of encryption and analysis, in your view does it justify extending the period of pre-charge detention and, if so, how long? Professor Anderson: I do not think it makes a very strong case. I do not have huge experience of terrorist cases; I have only been instructed in one of them. I have done a number of other crime cases and a large number of complex civil cases. In my experience people take as much time as they have got. Even if you have got a civil case that drags on for months and months and months, the work is always done in a rush just before the deadline to submit papers. I think that if a case is to be made for extended time limits then perhaps what the Committee should consider is whether there is any noticeable difference in outcomes between Scotland, which has got very, very tight time limits at all parts of the judicial process, England and countries like, let us say, France and Spain which can be very much more dilatory. My view tends to be, based on my experience of these things, that you work for a certain amount of time on a heap of data and then you run out of ideas or you run out of puff or you run out of money. Whether your two weeks of intensive work forms part of the 110 days that you have in Scotland or part of the two years that you have in England or part of the five years that you have in Italy probably does not make much difference to the amount of work that is involved. Q140 Mr Winnick: I will take that as a no! Mr Lattimore: I believe you have got to judge each case on its merits. Every case has to be looked at to see how much data you have got and whether you need the 90 days. Lord Carlile said about having a judge there to look at the evidence. The judge needs a team behind him, IT specialists who know this field and who can advise him on the data that the investigators are looking at. Q141 Chairman: Taking Professor Anderson's point, can you think from your own personal experience of a case where somebody or a team has worked flat out for 90 days? Mr Lattimore: Yes, myself. I have worked on cases that have taken longer than 90 days to crack. I am not going to go into the techniques I use because I want to keep them out of the public domain. You do a lot of work in the background before you mount the attack on the encrypted data and once that work has been done you have got somebody else that may have to write a programme to attack the data, then you put it onto a very big computer and the work goes on. If it is not done after 28 days you are not going to get it done at all. It normally comes about very quickly once you have done the initial work. That work used to take me three or four weeks. I would be sat at my hard drive doing a lot of biographical programming on a suspect for three or four weeks. It is very time-consuming work. Mr Sommer: I agree with what everyone has been saying. Q142 Chairman: Professor Anderson and Mr Lattimore have said two different things. Mr Sommer: In terms of their experience, I could pick up bits from both of them. I do not think that you can look at the encryption issue and say this is what is going to tell us what the period of time ought to be; it does not really help you. If you are looking, as you are, at the other arguments against having extended periods then, on the encryption issue, there is nothing magic that we can tell you and say "Oh, yes, there is a magic figure to do with the period involved in decrypting which will now help us fix the time". Q143 Chairman: On the process of decryption and the analysis of what you then get, if you take those as the two key elements put together, do you see from your experience of these cases a justification for saying the police may need up to 90 days to carry out those processes before making a charge on occasions? Mr Sommer: In that case I will side with Lord Carlile. In other words in a very small number of instances there may be a case for it. It is only supportable in the terms on which he was putting it to you, which is a highly detailed review. I think Dave Lattimore's suggestion to you that this team that Lord Carlile is talking about would almost certainly need to be augmented by IT advisers specific to whatever special advocate or supervising judge he might have --- Q144 Mr Malik: So on rare occasions up to 90 days could be justified? Mr Sommer: On very, very rare occasions, yes. Chairman: Thank you very much indeed. It is a very complex area. You have covered it very clearly in a short time.
Examination of Witnesses
Witnesses: Mr Darren Greener, Systems Technology Consultants Ltd, Mr Vinesh Parmar, Telecoms Forensic technical manager, Digital Crime Unit, LGC Ltd, and Mr Greg Smith, Principal, Trew & Co, gave evidence. Q145 Chairman: Good morning. Thank you very much for joining us. As you know, we are carrying out an inquiry into the case for extended pre-charged detention. In the latter part of today's sessions we have looked at some of the technical arguments that the police have put forward for extending detention while they gain evidence that might be used in a charge. This session is going to look particularly at mobile phone technology in the broadest sense. I wonder if you could introduce yourselves very briefly for the record and then we will begin the questioning. Mr Smith: My name is Gregory Nigel Smith. I am Principal in the firm of Trew & Co. I have been involved with mobile telephone evidence for over 17 years, 13 years of which have been dealing with the current technology called GSM and three years with the new 3G technology. I run training courses for law enforcement agencies to educate them in this area of mobile telephone evidence. I conduct expert evidence in relation to mobile telephones and some other devices. I work for both the prosecution and the defence. Mr Parmar: I am Vinesh Parmar. I have been working with the forensic mobile team for approximately five years now, primarily with Thames Valley Police as a forensic analyst. I am now with a company called LGC doing the same type of role. Mr Greener: I am Darren Greener. I work for a company called Systems Technology Consultants. I have worked as an expert witness investigator on mobile phone evidence for the last four years. I present evidence on a range of issues, from mobile phone examinations, billing analysis and sub-site analysis predominantly in criminal cases in the UK. Q146 Mrs Cryer: I would like to ask you some questions about obtaining data from mobile phones. I wonder if you could describe for us the role played in charging suspects by information obtained from mobile phones rather than in building the final case. Do you expect this to change in the future? Would you like to see change in the future? Mr Parmar: It is definitely going to be case dependent or inquiry dependent as to what value the evidence would have, if any at all. There have been cases where it is the only evidence in terms of being able to charge a particular suspect and in other cases it has been a question of showing a particular pattern which leads on to the charging of a suspect. Mr Greener: I would agree that it is very much a crime dependent thing. A lot depends on the crime itself in relation, for example, to threatening behaviour and things like that. It may be the messaging and the content of text messages which are on there that is important. We may have videos and image sources that may relate directly to a crime that has been perpetrated. Q147 Mrs Cryer: Could you describe for us the causes of delay in obtaining and analysing information from mobile phones? Should it be determined that this be the main factor in determining the length of pre-charge detention? Could you suggest how long this pre-charging detention should be to accommodate this sort of inquiry? Mr Greener: Delays can be included from the start. The actual phone may not come to the analyst straightaway as it may be subject to DNA evidence or another type of evidence for drugs and things like that. When we finally get access to the phone there may be problems with the phone itself, ie it may be PIN locked. These obstacles need to be overcome. When we come to looking at the data and the phone, sometimes it is the case that the phone needs repairing or there is no charge in the phone. There is a wide variety of handsets available on the market today and we have to find the right charging equipment and things like that which is not always available. There are initial delays before we start analysing the data and then we come on to other issues that may be to do with the sheer volume of data on these phones nowadays that have very high capacity levels. Q148 Mrs Cryer: So there is a variety of reasons for the delays. Mr Greener: Yes. Q149 Mrs Cryer: And therefore you cannot suggest a period that would be needed to produce evidence prior to charging? Mr Greener: No. It is always done on a case-by-case basis. Q150 Chairman: Are we talking hours, days, weeks, months? Mr Smith: One cannot use one particular technical problem to hijack everything as I do not think that is correct. If you obtain a mobile telephone that has no PIN or PUK connected to it, there is no reason why you cannot turn the evidence round within seven days. People are concerned that if they have a mobile telephone that has been password protected three or four times and that causes delays then everyone should quote the worst case scenario but that is not the case. We are not dealing with the worst case scenario. If somebody picked up 20 or 30 mobile phones you may find one or two are problematical but the others would not be a problem at all. Q151 Mrs Cryer: So far as your experience is concerned, how useful is information obtained from a mobile phone handset without accessing the supporting data from the network providers? How long do you believe they take to provide the necessary information? Mr Smith: There are two sides. Whether the data on the handset has any substantive evidence in court largely depends upon how it relates to the crime. Quite often I have seen a judge saying, "I see an SMS text message here on the handset. Have you any substantive proof by way of a calling that it was sent?" and when we say we have not they kick it out and say they do not want it. The other side of the coin is that a lot of the work that they do with mobile telephones very rarely comes through into evidence, it is used for intelligence, which is a completely different matter and has got nothing to do with the detention of people. Mr Parmar: I would agree with those points. The actual data that is produced in a report format is pretty meaningless unless there is network data to corroborate subscriber checks and billing records and so forth. Without that the actual data is going to be meaningless. Mr Greener: One of the factors about a lot of the data contained within the phones is it is time stamped by an internal clock on the phone that is programmed by the end user of the phone and that is why we need to obtain the billing data, to confirm whether these events recorded within the phone are correct or not. Q152 Mrs Cryer: From the providers? Mr Greener: Yes. Q153 Chairman: How long does it normally take for network providers to provide the necessary information? Mr Parmar: It depends on the level of the crime. They have got to have five levels and they are graded one to five. Q154 Chairman: What about if it was a terrorist case? Mr Parmar: Level one is a threat to immediate life. So it really depends on whether the particular terrorist incident dictates that. If it is a level one incident then it is usually within two to three hours or, for the worst case scenario, it would be within 24 hours that the information would be available. That is not just obtaining data from the UK networks, that is also obtaining data from non-UK networks. Mr Smith: It is severity that produces those speeds. Chairman: Obviously we are asking you general technical questions but we are centred on terrorist investigations. I think it is reasonable to assume it is towards the upper end of that. Q155 Mr Malik: Are you detecting an increase in the encryption of data on mobile phones? Is that a trend that you are starting to see or not really? Mr Smith: No, I am not seeing any increase at all. It is probably not happening at all. Mr Parmar: I have had a few instances over the last few months where I have experienced encryption to do with external components associated with the handset in terms of memory cards. At the moment there is no solution. Q156 Mr Malik: Can you expand on the memory cards point? Mr Parmar: What we are seeing now is a change in technology, a trend towards additional storage capacities within the handset itself. What most manufacturers are doing is not only giving you an internal memory store but giving you an expandable memory store by way of a memory card, which is basically just a small chip which can vary in terms of capacity so far as memory is concerned. It is mainly used to store multi-media files in terms of pictures and videos, but I have seen cases where other data can be stored on there which is not detectable by the device itself. There is an element on some of these devices whereby you can password protect it. It is not a very strong encryption but nevertheless there are no tools that allow us to start decrypting that information, but not enough is known about it at this moment in time. A lot more research and development needs to be put into that particular area. I have also seen further increases in security options available on the handset itself by certain manufacturers. The facilities are there, but I have not seen them being used in the main at this moment in time although that could possibly change as time goes on. Q157 Mr Malik: To what extent are the problems you face created by the volume of data available on, for example, calls made and received? Mr Parmar: As far as the call history data is concerned, that is usually not historic, that is going to be pretty much current and it is going to be a small amount. For example, normally you are looking at ten missed calls, ten received calls and possibly a maximum of 20 dialed calls that can be obtained from a device. Is that data accurate? No, you cannot rely on that information just from the device itself, it has to be corroborated by a billing record to confirm that those calls were successful. Q158 Mr Malik: So the volume is not a major issue is what you are saying. Mr Parmar: No, it is relatively short and it has been for a number of years. Mr Smith: It is the interrogational interpretation of it that takes the time. Q159 Mr Malik: If there was twice as much resource within the police service to deal with this issue, would it be dealt with twice as quickly? Mr Smith: I think the problem is not chucking money at it. I do not think the problem is trying to find 24 personnel. I think the issue is providing the right skill sets and experiences they need to deal with it. The problem is that there is a dichotomy between what the law enforcement agencies are asking for and what they do through their training centre of excellence which they have just started with mobile telephone courses. How that would impact on them getting the job done quicker we think would be negligible. It is the skill sets that are missing and the experience, it is not the production line bang it on, bang it out type of effect. Q160 Mr Malik: How widespread are the skills needed in telecoms forensics? Mr Smith: I think it has to be subject specific. If somebody has telecommunications experience coming into the wireless domain, which we are, then that is useful and the same would be quite right to say for computers. I think you need the discipline in the subject that you are dealing with and then to have the others use those other skills and to bring them together so you get a symbiotic relationship. Q161 Mr Malik: Are you a rare commodity? Is there enough of you out there? Mr Smith: The answer is no. Vinesh is one of the highfliers in this country and so is Darren. I have the longest track record in this country in dealing with mobile evidence. Q162 Mr Malik: Can one expert direct a team of less skilled assistants in this area of work? Mr Parmar: Certain organisations, not just law enforcement agencies, will have key people in key areas. They usually split the process up. When it comes to telecoms, they will have those that specialise in the data recovery process and those that specialise in the presentation analysis of that process. In some areas those processes will be split plus you will have a third element where there is somebody that is proficient in all areas. I believe that in order to be able to be in a position to do this type of work successfully you need to understand all the elements. You do not have to be an expert in all elements, but if you have an understanding of all elements and choose a specialist area then you should be quite successful. That is the view that law enforcement and other organisations need to take when they are recruiting and training their personnel. Q163 Mr Malik: Are there resources that the police have not called on that might make their work easier? Mr Parmar: It is not a question of not utilising resources, it is a question of the police understanding what it is they require. Too often we get requests which say we want everything, which in reality is not a workable request. What we find is that law enforcement agencies need to start understanding the data that is available and to start understanding what is possible evidence or what is intelligence and they need to split it and make valuable requests to us so that we can do the best job we can. At the moment a lot of work we do is fishing expeditions where we are basically requested to grab everything out of there and we do not know the case history. Q164 Mr Malik: Are there external organisations that could assist the police that are not being engaged at this time in your view? Mr Parmar: At the moment the law enforcement agencies do utilise the resources that are out there. Q165 Mr Malik: So to your knowledge it is not really an issue at the moment, is it? Mr Parmar: No. Mr Greener: If I could answer that, I am often instructed by defence solicitors and therefore on many occasions I go into police constabularies throughout the country to audit the work that has already been done by the prosecution. Going back to a previous question about the level of resource, it is often found that that level of resource does not match the resources which are outside the Police Service or is not at the same level of competence. It is often the case that a particular person who may be skilled in one particular package is used to examine a phone and things like that. I have had a number of conversations with various police officers and detectives at various times who say that they would like to use our skills but they do not have the authorisation to commission us to do any work themselves. It is often already pre-arranged at a contract level at some stage, so as an outside organisation we are excluded or we are not utilised and requested. Q166 Chairman: Can I just check one thing for my understanding? What I think you are all saying to the Committee is that the challenges here are not actually the handset issues. The challenge in terms of understanding and analysis is the records from the phone companies of the calls made and so on. Is that broadly right? Mr Smith: Broadly speaking that is correct. Q167 Gwyn Prosser: Mr Smith, you know our inquiry is trying to put together the estimate of time taken in particular cases with the 90 days which the Government wanted to put in place as pre-charge detention. When you were answering questions to Mrs Cryer you started telling us about pin numbers and access blockers et cetera, and you said that of course you had had a lot of these in some particular cases. I think you said in the worst case scenario that could take a long time "but we are not talking about that; we are talking about the general run-of-the mill case". But we are not here; we are talking about those particular cases which can have huge ramifications and might take 90 days. In that context, in the same way as Mr Sommer earlier on said that yes, there could be rare occasions when the work of the computer forensic people might take up that full 90 days, is that your view as well with regard to your technology? Mr Smith: Yes, I would say that is quite correct. There is a section where, if you allow an individual or an individual is smart enough to put all the passwords and identity numbers in place, you can have on the 3G up to 16 different passwords which would take you a long time to crack. Most people do not bother; that is the truth of the matter, so 90 days, yes, but I think that must be scrutinised very carefully as to the reasons for that. Q168 Gwyn Prosser: But perhaps a determined terrorist might bother. Mr Smith: I would not say they do not. I do not know. All I can say is that I think it is a balance. Q169 Gwyn Prosser: Mr Parmar, we have heard a lot of criticism and qualifications about the way the police use this technology. Would you say there is a need to re-assess the whole approach to telecoms forensics? Mr Parmar: Yes, I believe so. I believe a lot more resources and a lot more training and awareness have to be put into it for those who are involved in this type of work to understand exactly what they are doing and what they are responsible for. I think there is a general lack of understanding in that respect. What I do find - and this is no criticism - is that generally law enforcement will send the people who are responsible for this type of work on two- or three-day courses and no further training is offered. I do not believe that is a correct approach. I believe that it requires long term investment and long term resources just in the training to make sure that the people who are doing this type of work are up to date with current practice and current technology. Q170 Chairman: Would you know if that applied as much to specialist parts of the Police Service with largely anti-terrorist work as it would to general policing? Mr Parmar: I am not just making references to specialist areas or to general practices. It is not just applicable to law enforcement; it is applicable generally to all those technicians that do this type of work. There does not appear to be a mechanism in place where certain skills have to be attained throughout a certain period of time. Greg will back me up on this as a trainer, as to whether there is anything official about that. Q171 Chairman: You may not know the answer to this question, in which case say so, but would you say that those who specialise in anti-terrorism investigations have similar weaknesses in the way in which they approach telecoms analysis as you see in the Police Service generally? Mr Parmar: Are you making reference to the people involved in terms of doing this type of work? Q172 Chairman: Yes, because obviously the starting point for our inquiry is that the police are saying to us, "We need 90 days because various parts of our investigation, which may include telecoms analysis, take a long period of time". You have made some very important points about the general quality of the police understanding mobile telecoms issues. It is obviously relevant to this Committee to know whether those weaknesses are shared by those police officers who would be responsible for counter-terrorism investigations. Mr Parmar: I do believe there is an element of weakness there, but as to what quantity I could not comment. Q173 Gwyn Prosser: Mr Greener, some witnesses have argued that the length of time that telecom data is held should be increased by legislation. Would you support that? Mr Greener: I would very much support that. The existing legislation is at best historic data for 12 months, and one element that we have from the data is the ability to track historically people's movements or whereabouts at a particular time. In cases where we are conducting this type of cell site analysis, as it is termed, tracking where the mobile phone placed a call according to the various masts that are run throughout the country, if we are talking of a large network of phones which produce that sort of pattern that in itself takes a period of time and a lot of survey work and a lot of mapping work to produce that. It is often quite a way down the investigation before you find other phones that are coming into the fold, as it were, and therefore they require separate analysis in themselves, so 12 months' retention of that, for both the purposes of the prosecution and then afterwards therefore the defence to verify various things is often not long enough. On that basis of cell site analysis it can be the case that I am instructed some 12 months after the incident date and therefore there is not any further extended record in relation to that cell site and the movements of those particular phones. Q174 Gwyn Prosser: What about the standardisation of call data? Mr Greener: Yes. We have mainly have four network providers, all providing call billing data or cell site analysis data. There is a variance between those operators in terms of the level of detail that you get to work on, to analyse, so a standardised, across-the-board output would be beneficial to the analyst and would also minimise the skill set slightly across all analysts so that the data was understood by one and all. Q175 Gwyn Prosser: Are there any other gaps in legislation which you would like to see filled? Mr Smith: No, I think we already have it. The biggest problem that people have with legislation is that they do not bother to read it. Therefore, if they do not bother to read it or try to get some interpretation of it, they misunderstand it and they go on from that misunderstanding to make a mistake. Q176 Gwyn Prosser: I am talking more in terms of legislation which would be beneficial to forensic analysis. Mr Smith: Oh, I apologise. Mr Greener: For me, where we have discussed the legislation to extend the retention of the data, standardisation across that data would certainly be beneficial, but I cannot think of changes to the existing legislation further than that. Mr Parmar: I cannot see any issues with the current legislation. Mr Smith: Not at all with the CP Rules coming out, by the way. Q177 Mr Winnick: Mr Smith, in answer to Mr Prosser you said that there may be instances where the police require the 90 days to get the information. Would it not be also the case that you could say that the police require more than 90 days? If they require up to 90 days in certain instances, presumably very exceptional, the same surely would apply, would it not, to the argument that the police require double that amount of time in very complex cases? Mr Smith: There is always the potential for that to arise. It would be wrong to say otherwise. Q178 Chairman: I am going to put to Mr Greener and Mr Parmar a question that Mr Smith has answered about whether from your knowledge of mobile telecoms issues and the analysis of them you personally think that the pre-charge detention of up to 90 days can be justified by the complexities involved in doing telecoms analysis. Mr Greener: I think the 90 days will allow more time to galvanise the initial evidence that we are working with and to analyse it thereafter from the existing 14 days that I believe it is to gather in the phones. Q179 Chairman: Are you saying that on the basis that there are things that you simply cannot do within 14 or 28 days that you think are necessary to support a charge? Mr Greener: I am basing it on experience in cases where phones are being brought into the investigation along the way, so it is the gathering of evidence period. Q180 Chairman: Thank you. Mr Parmar? Mr Parmar: It is going to be based on the amount of items which have been submitted for examination. If it is a large volume then the current timespan is probably not going to be enough, so therefore I would welcome a 90-day extension to give us that opportunity to look at every possible device that has been submitted. My experience dictates that in particular high profile cases we do not just receive one or two devices, for example. We see possibly 30 or 40 different individual items to look at and that takes a considerable amount of time. Q181 Mr Winnick: Why 90 days, as I put the question to Mr Smith? Why not longer? Mr Parmar: The 90 days would give us more time to deal with the request as opposed to having to deal with a 30-day request when it comes to examining, say, 30 different items. Q182 Mr Winnick: But if you had 180 days that would be even more time, would it not? Mr Parmar: There is that, yes. Chairman: Gentlemen, thank you very much indeed. It has been a very useful session. |