House of Commons - Regulation of Investigatory Powers Act 2000

Regulation of Investigatory Powers Act 2000 - Home Affairs Committee Contents

Summary

· The principle of journalistic privilege is enshrined under the Police and Criminal Evidence Act 1984 (PACE), as journalistic material is given special protection from seizure by the police. If the police want to seize such material, they must apply to a judge. The holders of the material, for instance journalists and their employers, can resist disclosure of such records.

· There are two distinct sets of powers under the Regulation of Investigatory Powers Act 2000 (RIPA) relating to communications. First, RIPA provides powers to intercept the content of communications, for example, by listening to telephone conversations or voicemail messages (Chapter 1 of Part 1 of the Act). The warrant is signed by the Home Secretary, Foreign Secretary, Northern Ireland Secretary or Scottish Ministers and oversight is provided by Interception of Communications Commissioner.

· Second is the power to acquire communications data, such as records of who contacted whom, when, from where and for how long (Chapter 2 of Part 1 of the Act). Authorisations for the acquisition and disclosure of communications data are issued by 'designated persons' within the organisations seeking the data, for instance a Superintendent in a police force. The senior officer can only approve the acquisition of data where they believe it is necessary and proportionate in the specific circumstances, and they must record their considerations at the time. Oversight is conducted by the Interception of Communications Commissioner through a team of Inspectors reporting annually.

· This inquiry addresses police forces' use of RIPA powers to acquire communications data in the course of investigations. In two recent, high-profile cases, police have used RIPA powers to obtain material which might be regarded as journalistic material for the purposes of PACE. In the Metropolitan Police's Operation Alice (the investigation into the so-called "Plebgate" incident and subsequent events), the Metropolitan Police accessed a journalist's telephone records to establish whether the information provided to his newspaper might have emanated from within the MPS. In Kent Police's Operation Solar (the investigation into perversion of the course of justice by Constance Briscoe in relation to the trial of Rt Hon Chris Huhne and Vicky Pryce) the police used RIPA powers to obtain material from Associated Newspapers Limited (ANL) after an application by the police for access to the material under PACE had already failed because ANL had successfully claimed in court that journalistic privilege applied.

Introduction

1. The principle of journalistic privilege is enshrined in the Police and Criminal Evidence Act 1984 (PACE), which obliges the police to go to court and ask for a judge's permission to obtain journalistic material.[1] The journalist is then notified and is able to attend court and resist disclosure of such records.

2. There are two distinct sets of powers under the Regulation of Investigatory Powers Act 2000 (RIPA) relating to communications. First, RIPA provides powers to intercept the content of communications, for example, by listening to telephone conversations or voicemail messages (Chapter 1 of Part 1 of the Act). The warrant is signed by the Home Secretary, Foreign Secretary, Northern Ireland Secretary or Scottish Ministers and oversight is provided by Interception of Communications Commissioner.

3. Second is the power to acquire communications data, such as records of who contacted whom, when, from where and for how long (Chapter 2 of Part 1 of the Act).[2] Authorisations for the acquisition and disclosure of communications data are issued by 'designated persons' within the organisations seeking the data, for instance a Superintendent in a police force. Oversight is conducted by the Interception of Communications Commissioner through a team of Inspectors reporting annually.[3]

4. This inquiry addresses police forces' use of RIPA powers to acquire communications data in the course of investigations. In two recent, high-profile cases, police have used RIPA powers to obtain material which might be regarded as journalistic material for the purposes of PACE. In the Metropolitan Police's Operation Alice (the investigation into the so-called "Plebgate" incident and subsequent events), the Metropolitan Police accessed a journalist's telephone records to establish whether the information provided to his newspaper might have emanated from within the MPS.[4] In Kent Police's Operation Solar (the investigation into perversion of the course of justice by Constance Briscoe in relation to the trial of Rt Hon Chris Huhne and Vicky Pryce)[5] the police used RIPA powers to obtain material from Associated Newspapers Limited (ANL) after an application by the police for access to the material under PACE had already failed because ANL had successfully claimed in court that journalistic privilege applied.

5. On 5 October 2014, The Mail on Sunday claimed that Police used RIPA "to secretly spy on The Mail on Sunday" in the Constance Briscoe case, and that Detectives "sidestepped a judge's agreement to protect the source for their stories." The article also stated that Police "trawled through thousands of confidential numbers called by journalists from a landline at the busy newsdesk going back an entire year, covering hundreds of stories unrelated to the Huhne case."[6]

6. Kent Police have confirmed that they made use of the RIPA in the investigations of Mr Huhne, Ms Pryce and Ms Briscoe. Kent Police have stated that they "welcome a wider debate on whether this specific investigatory power — when used in lawful pursuit of serious wrong doing — should be the subject of judicial authority or oversight from an appropriate regulatory body when matters of journalistic privilege are apparent."[7]

The Regulation of Investigatory Powers Act 2000

7. The Regulation of Investigatory Powers Act 2000 (RIPA) provides a framework for lawful interception of communications, access to communications data, surveillance, and the use of undercover agents and informers (known collectively as "covert human intelligence sources (CHIS)").

8. There are two distinct sets of powers under RIPA relating to communications:

a) powers to intercept the content of communications, for example, by listening to telephone conversations or voicemail messages (Chapter 1 of Part 1 of the Act), and

b) powers to acquire communications data, such as records of who contacted whom, when, from where and for how long (Chapter 2 of Part 1 of the Act).

9. Parliament has enabled a wide range of public authorities, in addition to the law enforcement and the intelligence agencies specified on the face of the Act,[8] to be able to use these powers, as they have statutory regulatory functions or duties to investigate certain areas of criminal activity.[9] The government has announced that this list is to be reduced.

10. More detailed rules governing the use of RIPA are set out in the statutory Code, which was approved by Parliament, and includes:

· the statutory purposes for which public authorities may obtain data;

· the type of data public authorities may obtain;

· which senior officials within public authorities may exercise the power to obtain data; and

· which individuals within public authorities undertake the work to obtain data.

11. Authorisations for the acquisition and disclosure of communications data are issued by 'designated persons' within the organisation seeking the data, for instance a Superintendent in a police force. The senior officer can only approve the acquisition of data where they believe it is necessary and proportionate in the specific circumstances, and they must record their considerations at the time.[10]

12. In order to intercept communications, a warrant issued by the Secretary of State is generally required. Before giving a warrant, the Secretary of State must be satisfied that interception is necessary to obtain the information required; that the information could not reasonably be obtained by other means; and the interception is proportionate to what it seeks to achieve.[11]

13. Section 5 of RIPA sets out the possible justifications for interference with an individual's right to a private life under the Human Rights Act 1998:

· in the interests of national security,

· for the purpose of preventing or detecting serious crime,

· for the purpose of safeguarding the economic well-being of the United Kingdom, "in circumstances appearing to the Secretary of State to be relevant to the interests of national security,"[12]

· for the purpose (in circumstances appearing to the Secretary of State to be equivalent to those in which the Secretary of State would issue a warrant for the purpose of preventing or detecting serious crime) of giving effect to the provisions of any international mutual assistance agreement.[13]

CURRENT REVIEWS OF RIPA

14. There are three ongoing inquiries in relation to RIPA:

a) The Intelligence and Security Committee of Parliament (ISC) announced on 17 October 2013 that it would be broadening its inquiry into the laws which govern the intelligence agencies' ability to intercept private communications. It held public evidence sessions in October 2014 as part of its Privacy and Security Inquiry. In addition to considering whether the current statutory framework governing access to private communications remains adequate, the Committee is also considering the appropriate balance between the individual right to privacy and collective right to security. In particular, the Committee is assessing proposals for specific changes to specific parts of legislation governing the collection, monitoring and interception of private communications.[14]

b) The Home Secretary, Rt Hon Theresa May MP, stated on 10 July 2014 that she had asked David Anderson QC, the Independent Reviewer of Terrorism Legislation, to lead a review, before the general election, of the capabilities and powers required by law enforcement and intelligence agencies, and the regulatory framework within which those capabilities and powers should be exercised.[15] The Data Retention and Investigatory Powers Act 2014 requires the Secretary of State to initiate this review.[16] Mr Anderson will assess whether Part 1 of RIPA needs to be amended or replaced, and at the effectiveness of current statutory oversight arrangements.[17]

c) The Deputy Prime Minister, Rt Hon Nick Clegg MP, announced an independent Surveillance Review (ISR), to be carried out by the Royal United Services Institute (RUSI), on 4 March 2014. The ISR's purpose is to review the relationship between the needs of security and law enforcement in relation to civil liberties concerns in an era of rapidly evolving communications technology. The review will be delivered to the Deputy Prime Minister after the next General Election and will be considered by the Government alongside the Intelligence and Security Committee review and the Anderson review.[18]

15. Section 94 of the Telecommunications Act 1984 gives extensive powers to the Secretary of State to take actions 'in the interests of national security or relations with the government of a country or territory outside the United Kingdom'. There is no public disclosure of how this is used, and none of our witnesses has been aware of anyone who considers it their role to scrutinise it or have any oversight powers. We believe this should be reviewed, and one of the Commissioners specifically tasked with oversight of this power, and for them to be given the information and access needed to fulfil this role. We also recommend that the government publish on an annual basis the number of times this power is used. We further suggest that the Intelligence and Security Committee conduct an inquiry into the use of this power.

Improving RIPA

EFFECTIVE OVERSIGHT

16. In 2013, there were 514,608 notices and authorisations for communications data, down from 570,135 in 2012. Of these, 87.7 % were submitted by law enforcement agencies and 11.1 % by the intelligence agencies.[19]

17. Independent, post facto oversight of RIPA is provided by the Interception of Communications Commissioner, Rt Hon Sir Paul Kennedy. The Interception of Communications Commissioner's Office (IOCCO) has 12 staff: nine inspectors, a chief inspector and head of office, and two support staff. The nine inspectors are out full-time visiting the areas where the powers are being used. It takes the inspectors three or four days to assess a large police force, with one day allocated to a small police force or other small authority. Sir Paul told us that there had been a "significant" rise in the number of staff since the end of 2012, "because additional burdens have been put on the office."[20]

18. Sir Paul told us that in the smaller public authorities, such as local government, IOCCO Inspectors examine all the applications submitted in the period under consideration. In the police forces and law enforcement agency inspections, IOCCO estimate that approximately 10 % of the applications were individually scrutinized in 2013.[21]

19. Richard Berry, Assistant Chief Constable of Gloucestershire Police and Chair of the National Policing Data Communications Group, told us that he had conducted survey which found that there have been 591 recordable errors in 2014 to date. There were 970 recordable errors in 2013. Recordable errors are those in which an error has occurred but is identified by the public authority or the communications service provider without data being acquired or disclosed wrongly. In effect, this is a self-correcting process within the system that prevents information being wrongly disclosed. It therefore should be considered as a safeguard from unnecessary intrusion. There are also instances when information is mistakenly disclosed and these are required to be notified to IOCCO as reportable errors.[22]

20. Michelle Stanistreet, General Secretary of the National Union of Journalists, told us that police forces have refused to provide information on what grounds are being used to collect journalists' communications data when asked by the press and by Freedom of Information (FOI) request. In response to FOI requests by the Press Gazette, 27 refused to answer on cost grounds, with many saying the information was not easily retrievable, and 17 cited the "risk of undermining national security."[23]

21. On 6 October 2014, Sir Paul launched an inquiry to determine whether the acquisition of communications data had been used to identify journalistic sources. He wrote to all Chief Constables and directed them, under section 58(1) of RIPA, to provide him with details of all investigations that had used powers under Chapter 2 of Part I of RIPA to acquire communications data to identify journalistic sources. His office will undertake a full inquiry into these matters and report the findings to the Prime Minister and publish them.[24] Three IOCCO Inspectors have been allocated to the inquiry.[25]

22. We urge forces to communicate openly and efficiently with the Commissioner regarding the information they give him about their work. IOCCO should be given further resources to carry out its job in an effective and timely manner, most notably their inquiry into the use of RIPA powers regarding journalistic sources.

UPDATED CODE OF PRACTICE

23. The communications data code of practice was drafted eight years ago and, unlike the interception or the surveillance code which were recently updated, contains no advice on dealing with professions that handle privileged information, nor on the use of confidential help-lines. This provides challenges for the Interception of Communications Commissioner's Office, in its role of inspecting public authorities on their compliance with the Act and its code.[26]

24. 'The Data Retention and Investigatory Powers Act specified that there should be a statutory code of conduct for the use of RIPA powers, and the Minister made clear in the debate that this would cover 'confidence, professional positions and matters such as legal professional privilege'.

25. IOCCO is only able to provide an estimate the proportion of applications that it individually scrutinises. Sir Paul told us that this was due to the inadequacy of the statistical requirements in the Code of Practice. He has consulted with the Home Office, setting out the revisions and enhancements of the statistical requirements that he believes are necessary to assist IOCCO with its audit role.[27]

26. We note Sir Paul's recommendation to the Home Office concerning the need for improvements to the statistical requirements in the RIPA Code of Practice. It is vital that the statistical requirements are enhanced, so that the public can be better informed about the use which public authorities make of communications data.

27. On 15 October 2014, the Home Secretary announced that the Home Office was conducting a review of the use of RIPA in response to concerns over its use to access journalists' phone records. A revised code will be published in draft "this autumn" and will be subject to public consultation.[28]

28. The Home Office should hold a full public consultation on an amended RIPA Code of Practice, and any updated advice should contain special provisions for dealing with privileged information, such as journalistic material and material subject to legal privilege.

TRANSPARENCY AND RECORD-KEEPING

29. Michelle Stanistreet told us that the allegations concerning the use of RIPA had "sent shockwaves through the journalistic industry" and that "without that relationship of trust between journalists and potential sources and whistleblowers the impact on journalism is potentially immense."[29] We fully share the concern of journalists that their sources of information should be fully protected, and that journalists have gone to prison on occasions rather than reveal where their information came from.

30. Law enforcement agencies do not routinely record the professions of individuals who have had their communications data accessed under RIPA, as there is no statutory or regulatory requirement for them to do so.[30] At the time that communications data are requested, the police may not know the professions of those individuals whose data they are requesting.[31] In some cases, we were told, requests might cover quite broad categories of person, such as every mobile phone which was in a particular location at a particular time, or everybody who made a call to or received one from a specific number. While we accept that some RIPA requests might inadvertently include journalists, this is not the same as the Alice and Solar cases in which journalists themselves were knowingly targeted by police.

31. It is an offence for anybody to disclose publicly even the existence of a warrant under RIPA.[32] There is also a requirement to destroy the product of the interception and matters relating to its administration at the conclusion of its use.[33]

32. George Osborne stated on 19 November 2014 that RIPA "is a tool used to fight against serious crime, and yet it has been used to investigate journalists and sources that journalists have… That was not what Parliament wanted that Act for. If it's not something the prosecuting authorities and the criminal justice system can address, then it's something I think the government will have to address."[34]

33. RIPA is not fit for purpose, with law enforcement agencies failing to routinely record the professions of individuals who have had their communications data accessed under the RIPA. The recording of information under RIPA is totally insufficient, and the whole process appears secretive and disorganised with information being destroyed afterwards. Whereas we acknowledge the operational need for secrecy both during investigations and afterwards (so that investigative techniques more broadly are not disclosed), we are concerned that the level of secrecy surrounding the use of RIPA allows investigating authorities to engage in acts which would be unacceptable in a democracy, with inadequate oversight. We recommend that the Home Office use the current review of the RIPA Code to ensure that law enforcement agencies use their RIPA powers properly.

1 That is, "material acquired or created for the purposes of journalism". See Police and Criminal Evidence Act 1984, section 13. Back

2 Regulation of Investigatory Powers Act 2000, Chapters I (Interception) & II (Acquisition and disclosure of communications data). Back

3 IOCCO, RIPA Back

4 Operation Alice Closing Report (Metropolitan Police Service, September 2014), paragraph 5.65 Back

5 See R v Constance Briscoe, Sentencing remarks of Mr Justice Jeremy Baker, 2 May 2014 Back

6 The Mail on Sunday, How police hacked Mail on Sunday phone: Officers used anti-terror laws to track down judge protected source who exposed Chris Huhne's speeding points fraud, 5 October 2014 Back

7 Assistant Chief Constable Matthew Horne to Nick Craven, Operation Solar, 10 October 2014 Back

8 Section 25 Back

9 They are listed in the Regulation of Investigatory Powers (Communications Data) Order 2010 (S.I., 2010, No. 480) Back

10 IOCCO, Operation Alice Back

11 RIPA, s5(2)(b) Back

12 Data Retention and Investigatory Powers Act, s3(2) Back