House of Commons - Counter-terrorism - Home Affairs Committee

Counter-terrorism - Home Affairs Committee Contents

6 Oversight of the security and intelligence agencies

145. The oversight of the security and intelligence agencies has long been a matter of concern for this Committee. In reports in 1992 and again in 1997[161] we have recommended that the security service (which is nominally under the purview of the Home Secretary although its head reports directly to the Prime Minister) ought to be subject to scrutiny from the Home Affairs Committee. We have consistently been denied the opportunity to take evidence from senior officials who work in the national security structure and we are highly unimpressed that we had to summon the independent Intelligence Services Commissioner in order to take evidence from him. For information we have attached an analysis on the UK and US systems of oversight of the security and intelligence agencies which examines the plaudits and criticisms of each system (found at Annex B). We believe that the current oversight is not fit for purpose for several reasons which we set out below.

Parliamentary oversight

146. The UK's intelligence and security agencies were not recognised in statute until 1989 (MI5) and 1994 (MI6 and GCHQ) when a ruling from the European Court of Human Rights required them to be to be placed on a statutory footing. The Intelligence and Security Committee was set up by act, the Intelligence Services Act 1994 (and later amended by the Justice and Security Act 2013), which means that it is a statutory body, rather than a Select Committee appointed by the House.

147. The Intelligence and Security Committee was set up as a Committee of nine parliamentarians appointed by the Prime Minister after consultation with the Leader of the Opposition. The Chairman of the Committee was also appointed in the same manner. The Committee were then required to produce an annual report to the Prime Minister who, in consultation with the Intelligence and Security Committee, would then redact any information considered to be harmful to national security before presenting the report to Parliament at a time of his or her choosing.[162]

148. The statute concerning the Intelligence and Security Committee was then amended by the Justice and Security Act 2013 which made the following changes:

· The relevant House of Parliament now appoints their own of the 9 members of the Committee (although only on the basis of nominations by the Prime Minister in consultation with the Leader of the Opposition)

· The Chair of the Committee is now chosen by the membership of the Committee

· It broadened the remit of the ISC to allow it to examine operational matters under certain circumstances

· It required the Committee to report to Parliament although the Prime Minister is still, in consultation with the Intelligence and Security Committee, able to redact the report[163]

· It no longer allows the head of the security and intelligence agencies to refuse to provide information to the Intelligence and Security Committee (although the relevant Secretary of State can still refuse to allow the Intelligence and Security Committee access to any information he or she decides that such information is 'sensitive', should not be disclosed 'in the interests of national security' or it is 'information of such a nature that, if the Secretary of State were requested to produce it before a Departmental Select Committee of the House of Commons, the Secretary of State would consider (on grounds which were not limited to national security) it proper not to do so.')

· Witnesses to the Committee are given the benefit of their evidence to the ISC being barred from use in any criminal, civil or disciplinary proceedings (unless the evidence was given in bad faith)[164]

149. In the time of its existence, the Intelligence and Security Committee has been subject to criticism in regards to a number of their inquiries. The Intelligence and Security Committee's report on the intelligence and assessments around Iraqi Weapons of Mass Destruction led to significant criticism of the Committee. The Hutton report published many of the documents which the Intelligence and Security Committee had examined but decided not to publish and the Butler report highlighted information about MI6 withdrawing intelligence which the Intelligence and Security Committee had failed to examine in their report.[165] Furthermore, it later emerged that the Committee had not been provided with all the relevant JIC assessments by the Government despite assurances to the contrary. The Intelligence and Security Committee later concluded that this had been a mistake rather than a deliberate attempt to mislead the Committee but still expressing considerable concern that such a mistake could take place. One academic described this as a "masterful understatement" given the nature of the inquiry.[166] On two occasions the Committee has been required to return to issues that were subject to earlier inquiries. The first occasion was the 7/7 bombings. It emerged that despite the Committee's earlier reassurance that that the security service had not sought to investigate two of the bombers when they had appeared on the periphery of another investigation, MI5 had had them under surveillance for more than a year. The second is that of rendition where the Committee's inquiry cleared the security service of collusion in torture only for a High Court Judge to undermine this assertion in his judgement on the Binyam Mohamed case which we refer to later in paragraph 34 of Annex B. Following the decision to conclude the Gibson inquiry which was examining "whether Britain was implicated in the improper treatment of detainees, held by other countries, that may have occurred in the aftermath of 9/11"[167] the Intelligence and Security Committee have now been asked by the Government to

168

Professor Sir David Ormond admitted the information given to parliamentarians before the vote on the second Iraq war was inaccurate.

Paul Flynn: You accepted the likely existence of weapons of mass destruction, did you not?

Professor Sir David Omand: Yes.

Paul Flynn: And you were wrong.

169

150. Both the shadow Justice Minister and the Chairman of the APPG on Rendition have questioned the ability of the Committee to do so.[170] The Joint Committee on Human Rights has criticised the Intelligence and Security Committee noting that

171

We invited Sir Malcolm Rifkind, as Chair of the Intelligence and Security Committee to give evidence to us on its work. He declined to do so.

151. We asked the Immigration and Security Minister why the relevant departmental select committees were not able to scrutinise the work of the services, he told us that

172

152. We undertook a comparison between the UK and US systems of oversight.

Parliament House Senate

Number of members 9 21 15

Number of staff 8 and one part-time investigator.[173] 36[174] 45[175]

Membership appointed by Parliament, following nomination by the Prime Minister who must consult with the Leader of the Opposition Party leadership Party leadership

Members vetted prior to appointment[176] No No (but all members of the House of Representatives are automatically given access to classified material upon their election) No (but all members of the Senate are automatically given access to classified material upon their election)

Confirmation of appointment of key officials[177] No No Yes

Access to classified material Access can be refused by Secretary of State[178] Total Access Total Access

Can reveal classified material without permission from the executive No No Yes, with the approval of the full Senate

Prior notification No legal duty (although the ISC has informed agencies that it would expect to be 'properly and promptly informed' of their activities.[179]) Yes (except in times of emergency when the agency can delay reporting for up to two days) Yes (except in times of emergency when the agency can delay reporting for up to two days)

Produce annual reports on the work of the Committee Yes Yes Yes

153. In 2007, researchers wrote that robust accountability by a legislature relied on three factors-authority, ability and attitude.[180] There are two different approaches to legislative oversight which are discussed in academic literature-the 'police-patrol' and the 'fire-alarm' model. The police-patrol model is defined as the legislature examining a sample of activities carried out by an executive agency, the idea being that it will detect any activity which contravenes the legislature's expectation of practices and that such surveillance will discourage an agency form engaging in actions which would result in disapproval or action on the part of the legislature. The fire-alarm model is a more reactive model whereby the legislature will be alerted to activities which contravene the legislature's (and the public's) expectations of practice by interest groups, the media or even their electorate.[181]

154. Whilst the US and UK have similar 'police-patrol' bodies within their legislature, their 'fire-alarm' bodies differ. In US, responses to perceived failures within the intelligence community have tended to be presidential or congressional commissions. In contrast, in the UK, the response in recent times has been to set up an inquiry, usually led by a senior judicial figure (which is therefore outside of the legislature). However these two approaches appear to be converging-the UK's Commission on Banking Standards was similar in its nature to a Congressional Commission whereas the presidentially-ordered review into intelligence and communications technologies could be seen as being similar to an independent inquiry, such as the Butler Committee.

155. It has been suggested that oversight committees in both the US and the UK were aware of the programmes highlighted by Edward Snowden's leaks to various media outlets.[182] Following those leaks there are a number of inquiries being held in various legislatures on the issue of balancing privacy with security. In the US, the reaction of Congressional Committees has been to hold inquiries with Judiciary Committees in both the House and the Senate holding inquiries as well as the Intelligence Committees. It is obvious that the latitude afforded to congressional committees to examine intelligence matters by the executive is perhaps the key difference between the US system and the UK system where the Government consistently refuses to allow committees other than the ISC to ask questions on the work of the security and intelligence agencies. Given that a number of important issues have been raised and debated as part of the work of the Judiciary Committees, it is perhaps telling that the debate has been more charged in the US where more representatives are able to scrutinise the work of such agencies.

156. A number of the witnesses to this inquiry took the opportunity to highlight the improvements to the Intelligence and Security Committee which were contained within the Justice and Security Act 2013. There were suggestions that the committee ought not to be judged on its previous failures but rather time ought to be given to see how it worked under the new regime. Other witnesses felt that there was still room for improvement. These improvements include:

· Election of the membership of the Committee by the House of Commons

· The Chair of the Committee being a member of the Opposition and not a former Minister with responsibility for any of the agencies

· Ensuring that the Committee have access to relevant expertise (for instance in terms of the technological aspect of the work carried out by the security and intelligence agencies)

· Allowing other parliamentary Committees to scrutinise the work of the security and intelligence agencies.[183]

157. We do not believe the current system of oversight is effective and we have concerns that the weak nature of that system has an impact upon the credibility of the agencies accountability, and to the credibility of Parliament itself. The scrutiny of the work of the security and intelligence agencies should be not the exclusive preserve of the Intelligence and Security Committee. Whilst we recognise the importance of limiting the access to documents of a confidential nature, we believe that as the relevant departmental select committee, we ought to be able to take oral evidence from the head of the security service. Engagement with elected representatives is not, in itself, a danger to national security and to continue to insist so is hyperbole. There are questions about the accuracy of information provided to the House by the security and intelligence agencies in the past, particularly in 2003. As future decisions on warfare look likely to be determined by votes of the members of the House of Commons, there is heightened importance in ensuring that the House is accurately informed in future.

158. Furthermore we recommend that the Commons membership of the Intelligence and Security Committee should be elected like other select committees and that the Chair, who should always be a member of the Commons, ought to be subject to election of the whole House, as is the case for Select Committees. We further recommend that the Chair should always be a member of the largest opposition party.

Judicial and expert oversight

159. We took evidence from two of the other three offices responsible for oversight—the Commissioner for the Interception of Communications and the Commissioner for the Intelligence Services. We did not take evidence from the Investigatory Powers Tribunal. However, we wish to take this opportunity to note that in its latest annual report, the Investigatory Powers Tribunal has failed to disclose how many cases were decided in favour of the complainant. The 2010 (inaugural) annual report of the Investigatory Powers Tribunal was a forty page document. The 2011 report was a three page statistical release. The 2012 annual report was a two paragraph new story on its website.

160. Nick Pickles told us that the Investigatory Powers Tribunal was a weak method of oversight and that given the introduction of closed material proceedings following the Justice and Security Act 2013, it was also unnecessary.[184] The statistics which have been produced by the Investigatory Powers Tribunal indicate that out of 1468 the Tribunal has received it has decided in the favour of ten complainants. None of the ten successful complaints were made against the security service. In an interview with BBC Radio 4 in November 2013, Mr Justice Burton, President of the Investigatory Powers Tribunal explained the process.

What we do when receive a complaint is that we make inquiries of the respondent who are suspected or suggested to have taken part in this complaint and we then obtain their answers and we can and do inspect the files. There is nothing we cannot see.

When Mr Justice Burton was asked how he could be sure that everything was provided to the Investigatory Powers Tribunal, he replied that it was never possible to be completely sure but that the agencies were under a statutory duty to comply with the Tribunal.[185]

161. The BBC Radio 4 interview with Mr Justice Burton was the first time a member of the Tribunal had spoken to media since the Tribunal had been set up. When questioned as to his motivation, Mr Justice Burton explained that he was

186

162. The Investigatory Powers Tribunal is the only body which can investigate individual complaints against the security and intelligence agencies and actions taken under the Regulation of Investigatory Powers Act. It ought to command public confidence in its actions. For there to be public confidence there must first be public understanding of the work of the Tribunal. We recommend that the if the Investigatory Powers Tribunal are unwilling to voluntarily produce a detailed annual report on their work, that legislation be amended so that they are required to do so. Such an annual report should, at the very least contain the number of cases it has received and the outcome of cases determined in that year with comparable data for the previous four years. We also recommend that the data be broken down to show which agency the complaint was against.

163. The information given to us by the Commissioners indicate that they examine a small number of warrants under the current oversight system. The Intelligence Services Commissioner told us that in 2012 he had examined 8.5% of warrants.[187] The Interception of Communications Commissioner told us that he had examined between 5% and 10% of the applications. He was not able to be more specific as he did not know how many applications there were.[188] When we asked the Intelligence Services Commissioner what percentage of consolidated guidance or disciplinary cases he examined, he was unable to tell us. Despite agreeing to inform us in writing, he has subsequently refused to do so and instead told us that he intends to 'try' and publish the figures in his annual report.[189]

164. We also have concerns regarding the Intelligence Services Commissioner's description of his investigation in to the allegations that GCHQ had acted illegally. In giving evidence to us, he told us that the extent of his investigation was a conversation with the second head of GCHQ. When we asked him if he'd undertaken any further investigatory work to satisfy himself that the agency had not been engaging in illegal practices, he replied that his investigatory work had not gone beyond that discussion.[190] For the purposes of clarity we have reproduced the entire exchange below.

Q734 Chair: You went down to GCHQ.

Sir Mark Waller: Yes.

Q735 Chair: You went to see who there?

Sir Mark Waller: I saw the second head of the agency, in fact.

Q736 Chair: How did you satisfy yourself? It seems, from your comment, that what you did was you had a discussion with them, you heard what they had to say and you have accepted what they had to say.

Sir Mark Waller: Certainly.

Chair: Is that it?

Sir Mark Waller: Certainly.

Chair: Just a discussion?

Sir Mark Waller: Certainly.

Chair: Nothing else?

Sir Mark Waller: Certainly.

Q737 Chair: That is the way you were satisfied that there was no circumventing on UK law. You went to see them. You sat round a table. You had a discussion—

Sir Mark Waller: You have to remember that I had done a year and a half's inspection. I have a very good idea as to what the ethos of this agency is.

Chair: Of course.

Because of our surprise that the Commissioner had been prepared to make a public statement in support of the agency without first undertaking a thorough investigation we later returned to the point of the fact that this was based on a single conversation. At no point during either exchange did the Intelligence Services Commissioner clarify that his statement was as a result of an investigation that went beyond the previously mentioned discussion.[191] Given that the questioning was very specific, we are unable to understand why there should have been any confusion concerning the nature of the question. However, in written evidence to us the Intelligence Services Commissioner later clarified that

192

165. In regards to the work of the two Commissioners, we have some sympathy with the assertion made by the Rt Hon. David Davis MP when he told us that the Commissioners are good people doing impossible jobs.[193] However, we also note that both of the Commissioner roles are part-time positions. The Interception of Communication Commissioner has assured us that he has enough resources with his team of investigators having been increased to nine last year.[194] The Intelligence Services Commissioner only has a personal assistant but he maintained that the strength of his role was that he alone was responsible for overseeing the warrants.[195] Both Commissioners felt that an Inspector-General would be unsuitable to undertake the work that they currently carried out. The Interception of Communications Commissioner thought that it would lead to a dilution of personal responsibility and the Intelligence Services Commissioner believed that it would create an "unnecessary bureaucracy."[196]

166. It is unacceptable that there is so much confusion around the work of the Intelligence Services Commissioner and the Interception of Communications Commissioner. We recommend that as a matter of urgency data is collected on how many applications there were under the Regulation of Investigatory Powers Act and how many people were subsequently subject to an application. Furthermore, the fact that the Intelligence Services Commissioner cannot tell us what percentage of consolidated guidance cases or disciplinary proceedings he has examined is concerning.

167. We have serious doubts that either the Interception of Communications Commissioner role or the Intelligence Services Commissioner role should be part-time. We are also concerned that the extent of the Intelligence Services Commissioner's staff is one personal assistant. The fact that less than 10% of warrants which allow intrusion in to the private lives of individuals are examined is concerning—we believe this figure ought to be at least 50%, if not higher. We recommend that the Commissioners are made full-time positions and that their resources are increased to allow them to examine half of the requests for information.

168. All parts of the oversight system need to do more to improve public confidence in their work. We recommend that each of the Commissioners and the Investigatory Powers Tribunal develop an outreach strategy which ought to be published as part of their annual reports along with details of how they have tried to fulfil the objective of improving knowledge of their work.

169. Our decision to examine the oversight system following the theft of a number of documents from the National Security Agency by Edward Snowden. The documents were stolen in order to publicise mass surveillance programmes run by a number of national intelligence agencies. The documents were sent to several journalists and subsequently press reports detailing the programmes have been published in a number of countries. There have been criticisms of the newspapers who have published details of the programmes but Alan Rusbridger, Editor of The Guardian newspaper responded to those criticisms by noting that

197

One of the reasons that Edward Snowden has cited for releasing the documents is that he believes that the oversight of security and intelligence agencies is not effective.[198] It is important to note that when we asked British civil servants—the National Security Adviser and the head of MI5—to give evidence to us they refused. In contrast, Mr Rusbridger came before us and provided open and transparent evidence.

170. The security and intelligence agencies are staffed by brave men and women who in many cases risk their lives to protect this country. They deserve our gratitude and they deserve to be honoured for their work. The best way to honour them is by ensuring that there are no questions about their integrity and, in order to prove this, there must be adequate scrutiny of their actions. The current system of oversight belongs to a pre-internet age, a time when a person's word was accepted without question. What is needed is a scrutiny system for the 21st century, to ensure that sophisticated security and intelligence agencies can get on with the job with the full confidence of the public.

Regulation of Investigatory Powers Act 2000

171. The Investigatory Powers Tribunal, The Intelligence Services Commissioner and the Interception of Communications Commissioner were all created under the Regulation of Investigatory Powers Act 2000 (RIPA). The Act provides the legislative framework for the use of methods of surveillance and information-gathering used in efforts to prevent crime, including terrorism. RIPA makes provision for:

· The interception of communications

· The acquisition and disclosure of data relating to communications

· The carrying out of surveillance

· The use of covert human intelligence sources

· Access to electronic data protected by encryption or passwords

· The appointment of Commissioners and the establishment of a tribunal with jurisdiction to oversee these issues.[199]

172. There are a number of criticisms of the Regulation of Investigatory Powers Act including the number of bodies which are authorised to access private information,[200] its complexity and whether its provisions are appropriate given the advancements in technology since it was drafted. This is not the first time in this Parliament which we have had cause to highlight inadequacies with the Act. In our 2011 report on the Unauthorised tapping into or hacking of mobile communications we commented on the confusion concerning the interpretation of Section 2 of the Act and the impact which that had had on subsequent decisions to investigate and prosecute allegations of unlawful behaviour on the part of the media.[201] In 2006, then-President of the Investigatory Powers Tribunal Lord Justice Mummery acknowledged that in the experience of the tribunal the Act had been "a complex and difficult piece of legislation."[202] The Interception of Communications Commissioner acknowledged that there was a case for simplifying the Act although he didn't consider it a priority.[203] The Independent Reviewer of Terrorism Legislation told us that

204

THE DATA RETENTION DIRECTIVE AND SECTION 94 OF THE TELECOMMUNICATIONS ACT 1984.

173. A number of our witnesses have highlighted the importance of the collection of data communications in regards to criminal investigations. The Home Secretary has informed us that

205

The Interception of Communications Commissioner has recently warned that

206

This is a view shared by Charles Farr[207] and in the Government's annual review of the CONTEST strategy, it was noted that existing legislation is no longer sufficient to ensure that it is always possible for law enforcement and the security and intelligence agencies to obtain domestic communications data from communications companies.[208] Sir David Omand, former Director of GCHQ, has argued that "Democratic legitimacy demands that where new methods of intelligence gathering and use are to be introduced they should be on a firm legal basis and rest on parliamentary and public understanding of what is involved."[209] He told the Committee that he did not believe that had been achieved.[210] The recent ruling by the European Court of Justice, striking down the Data Retention Directive which required telecoms companies to store the communications data of EU citizens for up to two years, is likely to further increase debate around whether legislation is sufficient. When we asked the Home Secretary what impact the ruling had on the provision of communications data, she stated that work was currently being undertaken to assess the implications of the ruling.[211]

174. It is essential that the legal position be resolved clearly and promptly. It is currently unclear whether CSPs are obliged to store communications data as they were previously, or indeed if they are allowed to, because of the Data Protection Act. It is also unclear if the Home Office will continue to pay CSPs for their work on communications data.

175. The report by the Joint Committee which examined the draft Data Communications bill in 2012 highlighted that not all communications data collection is undertaken under the Regulation of Investigatory Powers Act 2000. The Committee noted that

212

However, unlike the provisions in the Regulation of Investigatory Powers Act under which communications data can be obtained, there is no statutory oversight or review of the use of Section 94 of the Telecommunications Act 1984.[213] When we asked the Minister for Immigration and Security about the use of Section 94, he told us that it was under the remit of the Intelligence and Security Committee. He also stated that

214

In fact section 94 of the Telecommunications Act is much broader than only national security. It states that the directions given by the Secretary of State must be 'in the interests of national security or relations with the government of a country or territory outside the United Kingdom'. This latter point about relations with other countries makes it a much broader power, which could be implemented on any grounds following a request from any other country for any reason. The grounds for secrecy are even broader still, adding concerns about 'the commercial interests of any person' to exemptions for national security and foreign relations. We are disappointed that the Minister left out these important aspects in his response, as it gives a very different perspective on the breadth of the powers. Furthermore we understand that the Intelligence and Security Committee have not in fact looked at the use of this Section and so there is currently no scrutiny of its use by any of the relevant commissioners or Parliamentarians.

176. We note that there have been a number of consultations and reviews of the Regulation of the Investigatory Powers Act since it was passed with amendments to the Act which have both increased and restricted its scope.[215] RIPA is a very unclear piece of legislation. In the Interception of Communications Commissioner's 2013 report he said

216

He went on to say that there may be significant institutional overuse of the powers to access communications data under Chapter II of RIPA.[217] He also highlighted the unreliability and inadequacy of the statistical information provided for RIPA communications data requests.[218] Sir David Omand, former Director of GCHQ, described sections of RIPA as a little obscure and said "I do not think the ordinary person or Member of Parliament would be able to follow the Act without a lawyer."[219] Furthermore several witnesses have noted that there is a current requirement for improved communications data legislation.[220] The ambiguities mentioned here lead us to believe that the Regulation of Investigatory Powers Act ought to be updated.

177. Given the criticism which the Regulation of the Investigatory Powers Act is subject to, we believe that the legislation is in need of review. We recommend that a Joint Committee of both Houses of Parliament should be appointed in order to hold an inquiry with the ability to take evidence on the Act with a view to updating it. This inquiry would aim to bring the Regulation of Investigatory Powers Act up to date with modern technology, reduce the complexity (and associated difficulty in the use of) the legislation, strengthen the statistical and transparency requirements and improve the oversight functions as are set out in the current Act. We recommend that the inquiry address the areas of concern raised with us concerning communications data and the oversight of Section 94 of the Telecommunications Act 1984.

161 Home Affairs Committee, First Report of Session 1992-93, Accountability of the Security Service, HC 265; Home Affairs Committee, Third Report of Session 1998-99, Accountability of the Security Service, HC 291 Back

162 http://www.legislation.gov.uk/ukpga/1994/13/section/10 Back

163 http://www.legislation.gov.uk/ukpga/2013/18/part/1/crossheading/oversight-by-the-intelligence-and-security-committee-of-parliament/enacted Back

164 http://www.legislation.gov.uk/ukpga/2013/18/schedule/1/enacted Back

165 The UK's Intelligence and Security Committee, Ian Leigh, Democratic Control of Intelligence Services, Born and Capriana (eds), 2007, Pp 192-194. Also, "A Very British Institution": The Intelligence and Security Committee and Intelligence Accountability in the United Kingdom, Mark Phythian, The Oxford Handbook of National Security Intelligence, Loch K. Johnson (eds), 2012, p707 Back

166 The UK's Intelligence and Security Committee, Ian Leigh, Democratic Control of Intelligence Services, Born and Capriana (eds), 2007, , P193 Back

167 HC Deb, 6 July 2010: Col. 176 Back

168 HC Deb, 19 Dec 2013: Col. 915 Back

169 Q592 Back

170 HC Deb, 19 Dec 2013: Col. 917; 921 Back

171 Joint Committee on Human Rights, Twenty-third Report of Session 2008-09, Allegations of UK Complicity in Torture, HC 230, para 65 Back

172 Q884 Back