Investigatory Powers Bill

Written evidence submitted by Chief Inspector Keith Conradi, Air Accidents Investigation Branch, Chief Inspector Steve Clinch, Marine Accident Investigation Branch, and Chief Inspector Simon French, Rail Accident Investigation Branch (IPB 22)

The case for the retention of communications data acquisition powers by the air, rail and marine accident investigation branches of the DfT

This evidence is being jointly submitted by the following:

Keith Conradi, Chief Inspector, Air Accidents Investigation Branch, Steve Clinch, Chief Inspector, Marine Accident Investigation Branch, and Simon French, Chief Inspector, Rail Accident Investigation Branch

SUMMARY

1. The purpose of this submission is to restate the case for the Accident Investigation Branches (AIBs) retaining their existing powers under RIPA for the acquisition of communications data (including data associated with the internet). These powers will only be used when absolutely necessary to support an investigation into a transport accident, and when the AIB cannot obtain the required evidence from another source.

2. The AIBs are functionally independent bodies within the Department for Transport, separate from the transport regulators [1] , and report directly to the Secretary of State on all investigation matters. The AIBs therefore fulfil a unique function that requires them to work independently of the police or regulators. On occasions they will conduct safety investigations when there are no parallel police or regulatory investigations.

3. The AIBs recognise the sensitivity associated with the use of their powers under RIPA. The AIBs exist for the sole purpose of improving safety, and do not apportion blame or conduct prosecutions. The use that the AIBs make of RIPA powers is focused on the investigation of accidents and incidents, not the gathering of large quantities of general intelligence. Consequently, the AIBs’ use of RIPA data is always measured and proportionate to the potential safety value to be obtained.

STATUTORY RESPONSIBILITIES OF THE AIBs

The Air Accidents Investigation Branch (AAIB)

4. The AAIB investigates aircraft accidents and serious incidents that occur in the UK, and participates in accident investigations worldwide where there is a specific UK interest. The AAIB may provide technical assistance to the Ministry of Defence in support of service inquiries investigating military aircraft accidents.

5. The AAIB conducts investigations into civil aviation accidents in accordance with the Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 1996 (SI 1996/2798), and Regulation (EU) 996/2010 of the European Parliament and of the Council of 20 Oct 2010 on the investigation and prevention of accidents and incidents in civil aviation. These regulations take account of international standards and recommended practices for this activity described in Annex 13 to the Convention on International Civil Aviation (the Chicago Convention).

The Marine Accident Investigation Branch (MAIB)

6. The MAIB conducts investigations into marine accidents involving merchant ships, fishing vessels and (with some exceptions) pleasure craft, in accordance with Part XI of the Merchant Shipping Act 1995 and associated secondary legislation. The Merchant Shipping (Accident Reporting and Investigation) Regulations 2012 (SI 2012/1743) put this framework into effect.

7. The UK is obligated to investigate marine accidents by the International Maritime Organisation’s Maritime Safety Committee Resolution MSC.255(84) [2] adopted on 16 May 2008, and Directive 2009/18/EC of the European Parliament and of the Council of 23 April 2009 establishing the fundamental principles governing the investigation of accidents in the maritime sector [3] . The EC Directive requires member states to carry out safety investigations into Very Serious Marine Casualties [4] involving most types of vessels.

The Rail Accident Investigation Branch (RAIB)

8. The RAIB conducts investigations into railway accidents including those occurring on tramways in England and Wales, and the UK side of the Channel Tunnel, in accordance with the Railways and Transport Safety Act 2003 (RTSA). It is the independent railway accident investigation body for the UK, as required by Directive 2004/49/EC of the European Parliament and of the Council of 29 April 2004 on safety on the Community’s Railways, which requires the UK to investigate serious accidents (as defined by the Directive), and has discretion to investigate other accidents and incidents.

9. The Railways (Accident Investigation and Reporting) Regulations 2005 (SI 2005/1992) implement that part of the Directive dealing with rail accident investigation that was not implemented already by the RTSA. It sets out the procedures for dealing with specified accidents and incidents, including notification requirements, dealing with evidence and publishing reports and recommendations.

EXISTING AIB POWERS RELATED TO RIPA

Communications Data (CD)

10. Under the Regulation of Investigatory Powers (Communications Data) Order 2010, an AIB Inspector can access communications data on the grounds that it is necessary in the interests of public safety under s22(2)(d) of RIPA.

11. The AIBs have no powers related to Directed Surveillance (DS) or Covert Human Intelligence Source (CHIS).

Data requests

12. Requests under RIPA are for data that communication service providers still hold for their own business purposes.

13. The AIBs do not use retention notices issued by the Home Secretary under DRIPA.

Authorisation level – Single Point of Contact (SPoC)

14. Each AIB has its own SPoC, who advises whether an application is appropriate, lawful and practical, and provides a consistent and knowledgeable interface with service providers.

Authorisation level - Designated Person (DP)

15. Each AIB has its own DP, who is at Principal Inspector level or above, independent of the investigation concerned and of the SPoC. If demonstration of further independence is necessary, the DP approving the request to obtain access to communications data can come from one of the other AIBs.

WHY ARE RIPA POWERS REQUIRED BY THE AIBs?

Telephone records (see annex 1 for case studies)

16. There are five principal reasons why access to the incoming and outgoing call data from a telephone provider can be crucial to an AIB investigation:

a) Knowing that a mobile phone was active around the time of an accident can point to possible sources of distraction that might have affected events.

b) The location of the mobile phone at the time of a call can assist in timeline/location reconstruction.

c) Telephone call records can establish whether specific or safety critical communications took place as claimed.

d) Identifying third parties who had telephone conversations with those involved can provide sources of information about the circumstances prevailing at that time.

e) Transport accidents and incidents are sometimes unobserved. The time that a victim’s mobile telephone ceased to be active on a network can provide vital information about the timing of an accident.

Internet records (see annex 2 for examples)

17. The capability of mobile phones to connect to the internet using Wi-Fi means that not all text messages or voice communications are undertaken using SMS or conventional mobile voice communications. An individual may use the internet facility on their mobile phone to conduct voice or written communications, without this activity being registered by telephone records. AIBs may need to access internet records to ensure that they have considered all sources of evidence in an investigation.

18. In all three transport modes there is an increasing tendency for safety related information to be stored and accessed via the internet. Examples include:

· safety critical updates to software or systems;

· online databases and other information such as weather forecasts;

· electronic maps and charts;

· permits to work and maintenance standards that are accessed online.

19. It may be necessary for investigators to understand when such data has been accessed, and by whom. Information concerning the use of the internet can also provide evidence of personal behaviours that may have impacted the performance of people involved in an accident.

WHAT WOULD BE THE IMPACT IF AIBs COULD NOT ACCESS COMMUNICATIONS DATA?

20. Denying the AIBs access to communications data would result in inaccurate investigations and ambiguity about the causes. Weaker and ambiguous investigation reports would not satisfy the public, nor would they provide a sound basis from which to make compelling safety recommendations. This may result in the potential for further loss of life and calls for public inquiries to provide the answers the AIB was prevented from delivering.

COULD COMMUNICATIONS DATA BE OBTAINED BY OTHER PUBLIC AUTHORITIES ON BEHALF OF THE AIBs?

21. No. There are no other public authorities that conduct independent and thorough investigations, solely aimed at improving transport safety, and not at the apportioning of blame or liability or prosecution of any individual. All other investigatory bodies investigate for potential prosecution purposes. Enforcement bodies will not always conduct parallel investigations to the AIB’s investigation and may not obtain communications data for their own purposes.

22. Chapter 2 of RIPA permits a DP to acquire communications data if it is necessary for one of the purposes listed in section 22(2). However, it would be difficult for a DP working for an enforcement body to justify acquiring the data on behalf of an AIB (while s.22(3) permits a DP to permit another person within the same relevant public authority to access the data, there is nothing to allow them to permit someone from another public authority or organisation to do so). It is therefore unlikely that any enforcement agency would be willing or able to obtain communications data on behalf of an AIB that had no legal entitlement under RIPA [5] .

23. The AIBs are required to be functionally independent from enforcement authorities and to be seen not to apportion blame or liability. An agreement that information should be supplied to an AIB by a law enforcement body could be perceived to be contrary to both requirements.

HOW MUCH USE HAVE THE AIBs MADE OF RIPA POWERS OVER RECENT YEARS?

24. The table below shows the number of investigations conducted by the AIBs for the period 2009 to July 2015 for which communications data was required, and the type of data used.

Jan 2009 –July 2015

Number of investigations

Traffic Data

s.21(4) a

Service Data

s.21(4) b

Subscriber Data

s.21(4) c

AAIB

9

10

10

9

MAIB

6

8

8

5

RAIB

10

21

21

0

Totals

25

39

39

14

WHAT WERE TYPICAL OUTCOMES WHERE AIBs HAVE OBTAINED COMMUNICATIONS DATA?

25. Case studies are provided at Annex 1.

WHAT WOULD BE THE IMPACT IF AIBs COULD NOT ACQUIRE COMMUNICATIONS DATA UNDER THE NEW LEGISLATIVE FRAMEWORK?

26. It would not be possible to complete some investigations to the standard demanded by the AIBs’ statutory obligations, by those affected by the accident and by the general public.

27. Based on historical usage, the impact of the lack of the communications data would have been:

· Ten cases – the chronology would have been less accurate and less detailed. In two of these cases it would not have been possible to refine the time that an individual went missing.

· Five cases – it would not have been possible to confirm accurately who was involved, at what stage, and when decisions where taken.

· Four cases – distraction could not have been ruled out as a possible cause.

· Two cases – conflicting accounts of actions which preceded the accident would not have been resolved.

· One case – it would not have been possible to identify the position of a vessel that sank with the loss of four crew.

Annex 1

Case summaries of accidents where communications data was of critical use in the investigation

AAIB – 20 August 2014 – Light aircraft crash in Buckinghamshire

1. T he pilot of a privately owned and operated light aircraft sent a text message to his family stating his plane was ‘out of control’ moments before it crashed into a field near Padbury , Buckinghamshire.

2. The pilot’s mobile handset was recovered but was not suitable for forensic examination. Section 21(4)(a) and (c) data requests have assisted investigators to establish the exact times of sent and received messages and to identify other communications. This data will be presented evidentially to assist HM Coroner.    

AAIB - 16 January 2013 - Helicopter Crash over London

3. A helicopter collided with a construction crane in central London.  The pilot and a pedestrian on the street below were fatally injured . S everal other pedestrians were seriously injured.   I t soon became apparent that the accident was not a ‘scene of crime’ and the police agreed that primacy for the investigation would rest with the AAIB. 

4. Evidence from third parties suggested that the pilot was using the text facilities on his mobile telephone during the flight.  The progress of the flight, before the accident, was recorded on radar but it was essential for the AAIB to synchronise this with the use of the mobile phone to fully determine the activities of the pilot. 

5. The police did not access communications data using their powers under RIPA , but had they done so they could not have shared that data with the AAIB.  Mobile communications data obtained by the AAIB proved to be fundamental in the investigation.  Had it not been obtained the investigation would have fail ed in its legal duty to fully investigate to determine the cause.

RAIB - 09/10 August 2012 - Collision between two trains at Arley

6. E ngineering work was taking place between Nuneaton and Birmingham. A t about 04:20 , one engineering vehicle collided with another, resulting in the derailment of one of the vehicles and damage to both . One of the seven staff involved was taken to hospital and o thers with minor injuries were treated by paramedics.

7. The mobile telephone communications between the parties were key to establishing a timeline for the events preceding the accident , confirm ing the number and timings of calls made between key staff . This was essential to gaining an understanding of the sequence of events because there was a fault with the recording system for voice communications at the signal box and this information could not be retrieved in any other way.

8. Without access to communications data the investigation would not have gained a complete understanding of how such a dangerous event, which could have easily led to fatalities, took place . T he opportunity for identifying valuable safety lessons would have been lost.

RAIB - 27 December 2012Derailment of a freight train at Barrow upon Soar

9. A freight train derailed about 1 mile north of Barrow upon Soar station, Leicestershire. The embankment failed under the weight of the train because water within it had reduced its stability. A visual track inspection had been planned for three days before the accident, but it was not completed. It is possible that this inspection would have discover ed the embankment’s reduced stability.

10. In the following days, the person who should have carried out the track inspection took his own life. One of the other members of the team was his close personal friend. Given the completion of the paperwork, the loss of a key witness, and the relationship between him and another key witness, communication s data w as critical in establishing where the staff were at given times. This enabled the RAIB to demonstrate that the area where the train derailed had not been inspected three days prior to the accident, as had been planned and recorded.

11. Without access to communications data the investigation would not have gained a complete understanding of how such a significant event took place and the opportunity for identifying valuable safety lessons would have been lost.

MAIB - 16 May 2014 – Loss of the yacht Cheeki Rafiki and its four crew while crossing the Atlantic

12. T he UK registered yacht Cheeki Rafiki capsized approximately 720 miles east-south-east of Nova Scotia, Canada while on passage from Antigua to Southampton. Despite an extensive air search that found the upturned hull of the yacht, the four crew remain missing.

13. Cheeki Rafiki had sailed from Antigua on 4 May. The only information about the vessel’s movements and the thoughts / concerns of its crew was contained in communications data that was accessed by the MAIB under RIPA. Specifically, the vessel’s position, as recorded by the INMARSAT system each time Cheeki Rafiki’s satellite telephone connected to the network , allowed investigators to accurately reconstruct the vessel’s track up until close to the time of its loss.

14. Further more , connection times and telephone records enabled investigators to pursue enquiries leading to a full understanding both of the yacht’s deteriorating condition and the advice passed to the skipper by the principal of the managing company. Without access to data obtained through RIPA the investigation would not have uncovered sufficient evidence to draw meaningful conclusions or make substantial recommendations.

Annex 2

Examples of internet communications data that could prove important to AIB investigations

Downloading safety critical updates to software or systems.

1. Computer based systems are increasingly being updated over the internet during use, and investigators will need to check whether the latest updates were available and in use at the time of an accident. For example, the International Maritime Organisation has passed an amendment [6] to the SOLAS [7] Convention that requires all ships engaged on international voyages to be fitted with Electronic Charting Information and Display System (ECDIS). The schedule for implementing the amendment runs from July 2012 – July 2018. Corrections and updates to charts can be pushed to the user, or pulled from the web sites of designated suppliers by the user. Any grounding incident will require the investigators to check whether and when the relevant chart corrections were downloaded.

Accessing safety critical information.

2. Aviators and mariners are increasingly choosing to access the latest weather forecast from the internet. Analysis of the timeliness and source of weather information can help determine whether or not those involved were making decisions using the appropriate weather information. In the railway industry key safety related information such as maintenance standards, permits to work and safety data is often accessed via the internet.

Inappropriate use - fatigue.

3. Numerous air, marine and rail accidents occur partly or wholly because the operator in charge of the relevant ‘vehicle’ is fatigued. Such fatigue is often the result of telephone or internet activity during designated rest or off-watch periods.

Inappropriate use – deviation.

4. Evidence from internet searches can indicate the source of information subsequently used by an operator to deviate from standard routes or procedures. The investigation into the crash of the Germanwings Airbus A320-211 in the French Alps on 25 March 2015 that resulted in the deaths of 144 passengers and 6 crew used evidence from internet searches to examine the co-pilot’s state of mind in the days prior to him deliberately crashing the aircraft.

March 2016


[1] The transport regulators are: the Civil Aviation Authority (CAA), the Maritime and Coastguard Agency (MCA), the Office of Rail and Road (ORR) or , in the case of the Channel Tunnel, the Intergovernmental Commission.

[2] MSC.255(84) – Code of the International Standards and Recommended Practices for a Safety Investigation into a Marine Casualty or Marine Incident (the Casualty Investigation Code).

[3] Amending Council Directive 1999/35/EC and Directive 2002/59/EC of the European Parliament and of the Council.

[4] A very serious marine casualty is one that involves loss of a vessel, death, or serious pollution (as determined by the member state).

[5] The code of practice issued by the Home Office states:

[5] "The purposes for which some public authorities may seek to acquire communications data are restricted by order. The Designated Person may only consider necessity on grounds open to their public authority and only in relation to matters that are the statutory or administrative function of their respective public authority. The purposes noted above should only be used by a public authority in relation to the specific (and often specialist) offences or conduct that it has been given the statutory function to investigate."

[6] Passed at the 86th session of the IMO’s Maritime Safety Committee (26 May to 5 June 2009)

[7] Safety of Life at Sea Convention, Chapter V, Regulation 19.2.

 

Prepared 24th March 2016