Column Number: 1
Second Standing Committee
on Delegated Legislation
The Committee consisted of the following Members:
Chairman:
Mr. Martin Caton
Baldry, Tony (Banbury) (Con)
†Barlow, Ms Celia (Hove) (Lab)
Binley, Mr. Brian (Northampton, South) (Con)
†Blears, Hazel (Minister for Policing, Security and Community Safety)
†Carmichael, Mr. Alistair (Orkney and Shetland) (LD)
†Donohoe, Mr. Brian H. (Central Ayrshire) (Lab)
†Garnier, Mr. Edward (Harborough) (Con)
†Hall, Mr. Mike (Weaver Vale) (Lab)
†Hamilton, Mr. David (Midlothian) (Lab)
†Heyes, David (Ashton-under-Lyne) (Lab)
Jack, Mr. Michael (Fylde) (Con)
MacShane, Mr. Denis (Rotherham) (Lab)
Oaten, Mr. Mark (Winchester) (LD)
†Pound, Stephen (Ealing, North) (Lab)
†Prisk, Mr. Mark (Hertford and Stortford) (Con)
†Ryan, Joan (Lord Commissioner of Her Majesty’s Treasury) (Lab)
†Taylor, Ms Dari (Stockton, South) (Lab)
Emily Commander, Committee Clerk
† attended the Committee
The following also attended, pursuant to Standing Order No. 118(2): Beresford, Sir Paul (Mole Valley) (Con)
The Committee consisted of the following Members:
Column Number: 3
Tuesday 22 November 2005
[Mr. Martin Caton in the Chair]
Draft Retention of Communications Data (Further Extension of Initial Period) Order 2005
4.30 pm
The Minister for Policing, Security and Community Safety (Hazel Blears): I beg to move,
That the Committee has considered the draft Retention of Communications Data (Further Extension of Initial Period) Order 2005.
The order is made under sections 105(3) and 105(5) of the Anti-terrorism, Crime and Security Act 2001, which was introduced in response to the new threat from terrorism as demonstrated on 11 September 2001 and, four years later in this country, on 7 July. The purpose of the order is to extend for a further two years the period known as the initial period, during which the Secretary of State may by order authorise the giving of directions to require communications service providers to retain communications data. The initial period was extended by Parliament once previously, in December 2003. That extended period will end on 13 December 2005. I would like to explain why the Government believe that an order for a further extension is necessary.
Communications data, which are data about communications traffic—how communications are made, not what was actually said or written—remain a vital investigative tool. They provide evidence of associations between individuals and events in time and place. They can also provide evidence of innocence and alibi. If data were not available, it would be much more difficult for the police and the security service to investigate associations between people who are involved in serious and organised crime and terrorist events. Many individuals who have been convicted of some of the most serious offences with evidence from communications data would have escaped detection and prosecution if the data providers had not kept such data for us.
The availability of the data is not guaranteed, and the effectiveness with which the police can investigate offences sometimes depends on which communications service provider the suspect, victim or witness used. Service providers are normally required to erase data or to make them anonymous once a communication is completed, unless they need to retain them for business purposes. Once the provider has no need to keep data, they are destroyed, sometimes within days or even minutes of the communication. One consequence of a vibrant and competitive communications sector of the kind that we
Column Number: 4
have in this country is the trend to reduce costs. It is clear that there are business pressures to get rid of data virtually as soon as the traffic has taken place.
Two years ago, as well as extending the initial period in which Parliament can give directions, Parliament approved a voluntary code of practice under section 103 of the 2001 Act that enabled service providers voluntarily and lawfully to undertake to retain data, in line with the code, that they might otherwise have been forced to erase or anonymise under the normal data protection laws.
The Act also provides for funding from the Government to help companies, thereby ensuring that providers who voluntarily choose to retain data receive some contribution towards the cost. I believe that that investment can be justified on behalf of the public if it preserves vital evidence that may be used in dealing with serious and organised crime and terrorist planning.
I pay tribute to the communications service providers and their staff, who tirelessly assisted the police and the security service following 7 July.
Sir Paul Beresford (Mole Valley) (Con): I apologise for coming in a few moments late. As the Minister talks faster than I can hear, and as English is my second language, could she explain clearly and simply which data are kept, whether they are kept only within this country, who the data come from and go to, and which individuals, groups or companies keep them?
Hazel Blears: I can certainly help the hon. Gentleman. As I said, a voluntary code of practice sets out the kind of data that can be kept. Most are kept for 12 months, but some internet data are kept for six months. Subscriber information, which includes name, date of birth, installation and billing address, payment method and so on, can be kept for 12 months. There are telephony data, which include numbers or other identifiers associated with particular calls, international mobile equipment identity—IMEI—mappings, which are unique identifier numbers for particular phones, and short messaging service, enhanced messaging service and multi-media messaging service data—again, it is not the content of the traffic but the fact that it has taken place. Individuals can be tied in with events and circumstances such that someone who is investigating a serious murder, money laundering, people trafficking or terrorist events can search the records and map the associations that well may exist between people. The data include e-mail data, log-on data and web activity logs, which are kept for a short period of time—imagine the hundreds of millions of times that people log on to different websites.
The code of practice sets out a whole range of data that can be kept voluntarily under the terms of the Act. This applies primarily to data provided by service providers in the UK, but we are currently trying to negotiate rules in the European Union that will apply across Europe, so that there will be some harmonisation in the periods for which data is being retained. At present, many countries have different periods for allowing data to be retained; if we can get
Column Number: 5
consistency, that will help us to tackle the kind of crime that has those kinds of international links, and that we need to be able to follow through.
Sir Paul Beresford: Who can look at the data? For whom is the data kept so that it can be combed through?
Hazel Blears: The data is for the police and the security services to look at, in terms of investigating and preventing crime. That is its purpose. That is why it was included in the code under the anti-terrorism legislation. The provision is very narrowly circumscribed to ensure that law enforcement is the basic purpose for which the data can be accessed. It is important to get the balance right between keeping data to enable law enforcement and protecting people’s privacy. People need an assurance that the data will not be available to anyone who simply wants to trawl through that kind of information, so it is fairly closely circumscribed in terms of law enforcement.
The data have been used since 7 July. There has been fantastic co-operation from the various service providers. It has also been used in cases of murder, threats to kill and kidnap. I thank the service providers who, as part of their corporate social responsibility, have engaged in constructive dialogue with the Government in accordance with the voluntary code, and have talked to us about the various business models that they use and about how technology is changing. That is quite a complex field, and I am grateful to the service providers for having such a good relationship with the UK Government, and helping us to maximise the usefulness of the data.
Some of those service providers have considered which data that they retain for a business purpose they can retain for longer. They have looked at some interesting technical solutions for increasing their storage capabilities and the easiest way to retrieve data from that storage. They have identified the cost of those solutions and they look to the Government to contribute towards those costs, in line with the provisions of the Act. Indeed, we have done so.
The area is technically complex, involving very complicated communications networks, and it can take some months for a provider to work out exactly how it will extend the retention periods for its data and ensure that it can easily search for specific data.
When the initial period was previously extended two years ago, the Government believed, without the benefit of practical experience, that it would be possible to determine the effectiveness of the voluntary code of practice within three months. I think that that was very optimistic—
Mr. Edward Garnier (Harborough) (Con): Ninety days would have been easier.
Hazel Blears: Well, we were optimistic to think that we could do it in three months. It has turned out that what we were able to determine in that initial period was the willingness of service providers to have a dialogue with us and to co-operate voluntarily, but not necessarily to determine the effectiveness of all the provisions that form the technical part of the code.
Column Number: 6
We have now concluded agreements with some of the providers to support those technical solutions. Other solutions and agreements are in various stages of preparation and negotiation; we are dealing with some other providers who have not yet got the technical capability to retain the data. We are also in discussion with some other providers who have said that they will retain data for longer periods but only if required to do so. The order authorises the Government to issue directions should that be necessary. There are therefore some providers who are in the position of saying that they would like to help us, but would like to be required to do so.
Mr. David Hamilton (Midlothian) (Lab): The Minister talks about the present time. Can she indicate the difference between the providers—which ones volunteer and which ones are likely to hold back and wait to be instructed?
Hazel Blears: I understand my hon. Friend’s question, but I am not in a position to give him the specific information. Such information is commercially sensitive, and it is important that we continue to have good relationships with all the service providers. If I can, I want to get every provider to co-operate with the Government, because it is so important that we get the data. I am sorry that I am not in a position to give my hon. Friend that information.
Mr. Alistair Carmichael (Orkney and Shetland) (LD): Do I take it from what the Minister says that there are certain people who are willing to co-operate but only as long as they have to? Does she anticipate that we will be back here every couple of years to renew an order of this sort?
Hazel Blears: I anticipate our gaining a proper sense of the effectiveness of the voluntary code and of whether we need to move to the second stage, which is to have mandatory directions. The voluntary code may be sufficient to cover the whole area that we want to cover. It is looking more likely that, in some cases, we will want to issue directions and will therefore use the power available to us under the provision. At the moment, we are not clear how much of that power we will need to use to issue directions, which is why we are asking for a further extension for a two-year period, but I hope that during the course of that period, I, or even my successor, will not be here repeating some of these assurances. It has taken us longer to assess the effectiveness of the voluntary code of practice than perhaps we initially anticipated. In a complex technical area such as this, perhaps that is not really surprising. As technology changes, there are new business models to be developed and it becomes more likely that things are not as clear as we had hoped.
Mr. Mark Prisk (Hertford and Stortford) (Con): The Minister referred to costs that the Government were helping to mitigate. What has been the cost to the taxpayer so far? Given that we will be asked to affirm the order at the end of our deliberations, will she also give us some idea of the total cost that the Government expect will accrue to the public purse as a result of the order?
Column Number: 7
Hazel Blears: In one case, we have been able to agree a process for one of the major providers to extend its network traffic data retention period to 12 months. That has cost about £750,000 plus VAT. I am told that in this area that is extremely good value for money. Some of the figures that have been bandied around, certainly in the European context, have run to millions of pounds, if not tens of millions of pounds, so that figure is quite reassuring. I understand that we are budgeting about £6 million annually to help companies to comply.
We do not fund every single part of the process. Clearly, some providers are making their own contribution by developing business solutions as well. We are keen to get good value for money for the public purse out of the investment that we are making. We will ensure as we go through that the benefits to us in terms of law enforcement clearly justify the investment that we are making for those companies. It is fair to say that we have a good relationship with our service providers and that they are trying to do as much as they can to help us.
I understand that a further order will be required under section 104 of the Anti-terrorism, Crime and Security Act 2001 before any direction can be made. This order keeps the window open to allow us to come back. I, or my successor, may well be back to ask for a further order at some point in the future. I would not want the Committee to be misled about that.
If we do not make the order today, it is possible that some of the providers will disengage from the dialogue in which we are currently engaged. Having this window enables us to keep that lever in relation to the companies in order to develop the technical solutions to bring the data forward.
The voluntary code has been an important building block on which we have built the foundations of a practical, viable and lawful scheme. The full value of the investment of the considerable time and energy that service providers have given and are continuing to give will be realised by cementing the good will that exists in relation to our service providers.
The primary and most important responsibility of any democratic state is to protects its citizens from the threats posed by terrorism and it is right that, in doing so, the Government seek to strike the right balance between the public interest and the business interests at stake, and between the need to retain data for the public good and the need to destroy data out of respect for individuals’ privacy. As in all such areas, we are constantly trying to strike the right balance. This order gives us the option of continuing to bring forward directions for the service providers, should we need to do so at some point. I commend the order to the Committee.
4.45 pm
Mr. Garnier: Mr. Caton, I welcome you to the Committee. May I assure you that the content of our deliberations will remain entirely secret, unlike the content of any mobile telephone conversation that you
Column Number: 8
might have had today? I use the word “secret” because few people attend these proceedings or read the Hansard—
Mr. Mike Hall (Weaver Vale) (Lab): Will the hon. and learned Gentleman give way?
Mr. Garnier: May I just finish the sentence? I appreciate that it was not my best joke. [Hon. Members: “Ah.”] I am glad that there has been a demonstration that on the Government Benches, which are normally peopled by the silent, there is blood pumping through the veins; I am delighted that people are up and about.
I was with the Minister for most of the way, until she used the expression “dialogue with the Government”. It seems to me that dialogue with the Government over the past seven or so years has been a conversation between the deaf—the Government—and the mute—the outside sectors with which they are having the dialogue. None the less, if the Minister tells me that there has been a fruitful dialogue between the communication service providers and her Department, I believe her. It is a good thing.
Mr. Hall: Has the hon. and learned Gentleman finished his sentence now?
Mr. Garnier: I am always happy to give way. I had thought that the hon. Member for Weaver Vale (Mr. Hall) was a Government Whip, but he seems to have moved further down the Bench.
Mr. Hall: I am sure that the hon. and learned Gentleman did not mean to say this in the way that he did, but he said that our proceedings were dealt with in secret. We are being broadcast.
Mr. Garnier: In future, I promise to make my ironic remarks very obvious and I will ensure that my jokes, in so far as they are intended to be faintly amusing are filtered through the Parliamentary Private Secretary, the hon. Member for Ealing, North (Stephen Pound), whom I always look to as a judge on these things, so that they can be translated and so that the hon. Member for Weaver Vale is not allowed to miss out on any of the fun that we are having.
I will return to the substance of the order. The order perhaps represents a practical step in the struggle against terrorism and other serious crime, both in the United Kingdom and internationally. To that extent, it has our support. It also represents a further step in the advance of secret government. We should be wary of permitting the Government not to come back every so often to renew this power. If it is an important power, the Government can justify it. If it is a power that is abused or is no longer of any practical use, it should not be renewed.
Despite the dialogue, conversation, or whatever we want to call it, that the Minister entered into a moment ago, requiring the Government to come back from time to time to justify the use and the extension of the power is an important process, particularly on matters such as this.
Column Number: 9
I will ask the Minister one or two questions, some of which have been touched on but not wholly answered. What IT or human resources have the Government available to store and analyse the hundreds of millions of mobile, internet and other wireless communications, such as text messages, every year? Where are they kept? Where are they analysed? The Minister says that the security services can, on request, see text messages. Down to what level of investigation and what level of detail are the security services permitted to go? How many communications service providers have volunteered to retain data for the Government? How many have been directed to do so by the Secretary of State?
Presumably, some of the service providers—possibly most of them—may not be resident in the United Kingdom or within the jurisdiction of England and Wales. To what extent are they susceptible to the order and to the terms of the Anti-terrorism, Crime and Security Act 2001 under which the order is being made? What treaties or other international agreements have the Government entered into to obtain the sort of co-operation that is required from extra-jurisdictional service providers?
The Minister mentioned co-operation within the European Union, but, of course, many service providers are based in the United States. I think that the Committee is entitled to reassurance about that.
Are the lists of service providers who have either volunteered or been directed to comply publicly available? If not, why not? What effect would publication of the list have on the market value of the shares in any of the companies in question? Alternatively, is it the Government’s advice that there would be no effect?
My hon. Friend the Member for Hertford and Stortford (Mr. Prisk) asked the Minister about cost. There is a cost, not only to the industry but to the taxpayer. It was not clear to me from the Minister’s answer whether the £750,000 plus VAT was a charge going into or coming out of the Home Office’s budget, or to what extent that budget was shared between the Home Office, the Foreign and Commonwealth Office, and the security services. The public are entitled to know from which Government budget it comes. The £750,000 may be a historical cost, but we should know the projected cost of the exercise for the industry and the Government, in the widest sense.
Sir Paul Beresford: Perhaps I may put a further question about how the security forces deal with encrypted messages. What happens if they fail to break the encryption?
Mr. Garnier: I have no doubt that the Minister will give us a quick lecture on the Regulation of Investigatory Powers Act 2000, which touches on encryption. I look forward to her answer.
The Minister says that the order is a useful tool in the struggle against terrorism and serious crime nationally and internationally, and I am prepared to accept that. However, how many convictions flowed from the order’s predecessor, which would enable us to be more confident that the power that she seeks is
Column Number: 10
justified and proportionate to the evil that we want to tackle? It is one thing to demand what are essentially secret powers to snoop on other people’s private communications, if the intention is markedly to reduce serious international crime, terrorism and similar crimes—and if that is the effect. However, if the measure simply nibbles at the edges of that activity, the Government should be a little more candid about the numbers.
Paragraph 7.8 of the explanatory memorandum accompanying the order states:
“Because the arrangements being undertaken by communications providers, particularly those with significant undertakings, involve a complex process of conception, design, evaluation and implementation it is the Government’s view that the requirements of the code of practice cannot yet be fully reviewed. For that reason the Government seeks to further extend the initial period provided for in section 105 of the Act.”
If that is true, it is perhaps a good reason for extending the initial period under section 105. However, we need more information about when the Government are likely to be able to comply with the requirement. Perhaps the Minister could help me with that when she makes her winding-up remarks. That having been said, and the hon. Member for Weaver Vale having returned to his correspondence, I can sit down.
4.55 pm
Mr. Carmichael: Mr Caton, I also welcome you to the Chair. This is the first occasion on which I have had the pleasure of serving under your chairmanship, and you are most welcome to our deliberations. I shall not detain the Committee for long; I just wish to be clear about what the Government are asking us to agree.
Having read the helpful and extensive explanatory note that accompanies the order, I understand that the information retained would be, for example, that a phone call was made at a certain time and date, and—in relation to mobile communications—at a certain place. I understand that it is within the power of a service provider to pinpoint the place from which a particular mobile phone is operated. I seem to recall that that was crucial to the investigation of the murders of the two young girls from Soham. If that is the nature of the information that is to be retained, it is an eminently sensible provision.
The Minister said in response to an earlier intervention that the limited nature of the order with which we are dealing means that a further order will be necessary at a later date. That further order will, of course, require the very closest of scrutiny because it will describe the range of information that is to be retained. Indeed, given the requirement for the Government to finance the retention of data, we must scrutinise the Government’s requests of us most carefully.
I am still slightly unclear as to what the Government require us to do today. It seems that the Minister has asked us to introduce what is effectively an instrument of compulsion in order to ensure voluntary compliance. If there is some way in which that circle can be squared, I shall be interested to hear it. Could the Minister tell us what were the barriers that necessitated the further order? Are there matters of
Column Number: 11
substantial difference between the Government and the service providers, or have the Government not had sufficient time to make a full assessment of the operation of the various codes? She has told us about the access to information that is available to law enforcement agencies, which is quite proper. She said that that information could often be crucial to the establishment of an alibi. Can she also tell us what access to data is available to a private individual?
4.59 pm
Hazel Blears: First, I shall address the issues raised by the hon. and learned Member for Harborough (Mr. Garnier). He asked what IT resources we had to store and analyse data. The law enforcement agencies do not store and analyse all the data that is available. Normally, as I understand it, the law enforcement agencies would wish to search data against suspects. They would follow lines of inquiry and would seek to obtain information—about traffic, not content—from the agencies that store it. That would be a matter of the agencies pursuing specific areas in which they were interested, rather than having the complete mass of data that might be out there. It would be physically and technologically impossible for law-enforcement agencies to constantly examine all of the data that exist. Therefore, it is a matter of trying to hone their inquiries into the areas in which they are particularly interested.
The hon. and learned Gentleman asked how many volunteers there were and how many people had been directed. At this point, nobody has been the subject of directions; the very purpose of the order is to allow the Government to continue to have the option of making a direction, should that prove necessary, after we have assessed how well the voluntary code of practice has served us in getting the co-operation of all the service providers. In answer to the hon. Member for Orkney and Shetland (Mr. Carmichael), I should say that the purpose of the order is to allow us to continue to have that option. As I said in my opening remarks, we believe that some service providers will welcome the legal certainty of being given a direction, although they are perfectly happy to provide the data in terms of their business operation.
The hon. and learned Member for Harborough asked whether the provisions applied to foreign service providers. No, they apply only to UK-based service providers, although we have discussions with people from right across the world, because these issues are international. However, our law relates to UK providers. The hon. and learned Gentleman also asked about treaties that have been entered into with others. I cannot add to the information that I gave about current negotiations across the European Union on consistency and harmony.
I say to my hon. Friend the Member for Midlothian (Mr. Hamilton) that the lists of volunteers are not public because of commercial sensitivity. I have given details of the cost. It is £6 million per annum, although we are not yet at the point of incurring substantial
Column Number: 12
expenditure. Our budget is £6 million per annum, but we are still working with the service providers on what the costs might be. I gave an illustration. One company, a major provider, has worked out that it can comply for less than £1 million. Some of the figures for individual providers talked about in Europe have been in the tens of millions of pounds, so it is important to get that into proper perspective.
The hon. Member for Mole Valley (Sir Paul Beresford) asked about encryption, which is clearly an increasing problem. During our discussions of counter-terrorism legislation, we had a long debate about the problems of encryption. There is an existing offence of failing to give encryption keys and in that Bill we have planned to increase the penalty for that. I hope that that will persuade more people. As I understand it, there is also to be a code, to be issued under the Regulation of Investigatory Powers Act, for regulating encryption compliance. I am told that that code is to be published shortly; I have no further information than that.
The hon. and learned Member for Harborough asked about convictions and the hon. Member for Orkney and Shetland rightly said that in the case of the Soham murders data on communications traffic were extremely important. They were also important for the convictions for the Real IRA bombings at the BBC in Birmingham and the drive-by shootings in Birmingham and Nottingham. In such cases, convictions were based at least partially on access to such communications data. In a whole range of serious crimes, such access has proved an extremely useful tool.
| 
