Investigatory Powers Bill



1. This written evidence supplements the oral evidence given this morning to the Public Bill Committee.

2. In November 2015 I welcomed the draft Investigatory Powers Bill, which was based in considerable part on the recommendations of my June 2015 report "A Question of Trust" [AQOT] and on those of the RUSI panel in its July 2015 report "A Democratic Licence to Operate". I also welcome the pre-legislative scrutiny by three parliamentary committees, and the Government’s decision to adopt most their 198 recommendations.

3. The Bill in my opinion does the big things right. In particular:

a. It is world-leading in the way that it frankly sets out the powers that are used and aspired to, and supports most of the controversial powers by an operational case.

b. It greatly improves the safeguards on the exercise of those powers, in terms of both authorisation and oversight.

The specific criticisms and comments below should be read in the light of that generally favourable appraisal.


4. I recommended that the practice of issuing thematic warrants be continued into the new legislative regime: AQOT 14.61-14.63, Recommendations 27 and 34. But as I noted there:

a. I envisaged their utility as being "against a defined group or network whose characteristics are such that the extent of the interference can reasonably be foreseen, and assessed as necessary or proportionate, in advance" – for example, a specific organised crime group.

b. I also recommended that the addition of new persons or premises to the warrant should normally require the approval of a Judicial Commissioner, so that the use of a thematic warrant did not dilute the strict authorisation procedure that would otherwise accompany the issue of a warrant targeted on a particular individual or premises.

5. On both counts, the Bill is considerably more permissive than I had envisaged. Thus:

a. The wording of clause 15 (interception) and still more so clause 90 (EI) is extremely broad. The ISC noted this in relation to the EI power in February 2016 (para 14). The Operational Case lodged with the Bill also acknowledged (8.5) that a targeted thematic EI warrant may "cover a large geographical area or involve the collection of a large volume of data". This matters, because as the Operational Case also acknowledged (8.7), the protections inherent in a thematic warrant are in some respects less than those inherent in a bulk warrant. The very broad clause 90 definition effectively imports an alternative means of performing bulk EI, with fewer safeguards. The Government’s explanation for this – that it will opt for a bulk warrant where extra safeguards are deemed necessary – may be argued to place excessive weight on the discretion of decision-makers. If bulk EI warrants are judged necessary, then it should be possible to reduce the scope of clause 90 so as to permit only such warrants as could safely be issued without the extra safeguards associated with bulk.

b. New persons, premises or devices (without statutory limitation as to extent) may be added on the say-so of a senior official, without troubling either the Secretary of State (though she needs to be notified) or the Judicial Commissioner (who, curiously, does not): clause 30(5)(c). I adhere to my opinion that any such additions should be approved by the Judicial Commissioner.


6. Reference was made this morning to a passage in the recent report of the UN privacy rapporteur and to a Guardian letter signed by 250 lawyers. It seems to me that the letter makes a tenable case in relation to the requirements of EU and ECHR law, but not a decisive one. Those requirements – and their consistency as between the CJEU and ECtHR – are currently unclear, and will remain so at least until judgment has been handed down in Davis/Watson (CJEU) and Big Brother Watch / Liberty (ECtHR).

7. Without going into detail, ECtHR cases such as Weber v Germany (AQOT 5.32, on bulk) and Kennedy v UK (AQOT 5.42, upholding the current targeted interception regime despite the absence of an individualised reasonable suspicion requirement under RIPA) need to be considered alongside the other cases cited.

8. It may also be noted that in the most recent European case on this theme, Szabó and Vissy v Hungary (January 2016), the ECtHR stated at paragraph 68 of its judgment that "[i]t is a natural consequence of the forms taken by present-day terrorism that governments resort to cutting-edge technologies in pre-empting such attacks, including the massive monitoring of communications susceptible to containing indications of impending incidents", and went on – pragmatically – to identify the issue as whether this "progress" in the development of surveillance methods has been accompanied by a simultaneous development of legal safeguards. See, to similar effect, the Venice Commission report of April 2015: AQOT 14.44(b).

9. As to the necessity of bulk powers and the extent to which I came or did not come to a conclusion on this issue, the position is as set out in my supplementary written evidence to the Joint Bill Committee of January 2016, paras 4-9.


10. In AQOT I recommended "appropriately rigorous and rights-compliant procedures" for the purposes of authorising access by the security and intelligence agencies to:

a. content acquired pursuant to a bulk warrant, not relating to a person inside the UK; and

b. communications data acquired pursuant to a bulk warrant

(AQOT 14.89-14.90, Recommendation 80). Aware that the practicality of these procedures might differ as regards different agencies, and that some access (e.g. for the purposes of cyber-defence) might not be privacy-intrusive in any meaningful sense of the word, I did not seek to be more specific. It might however be questioned whether authorisation by line manager provides sufficient safeguard for access to all types of communications data (or secondary data) obtained pursuant to a bulk warrant of very wide scope.

11. Similar points were made in the March 2015 (6.38-6.39; Recommendation R) and February 2016 reports of the ISC, and the latter concern was highlighted in the speech of Dominic Grieve QC at second reading. The Committee may wish to consider whether enough has been done to provide safeguards for access to material recovered pursuant to a bulk warrant (other than content obtained by selectors referable to a person within the UK, for which a targeted warrant is properly required under clause 134(3)(d): cf my Recommendation 79).

12. Also notable in this regard is the provision for national security notices in clause 216 of the Bill, mirroring to some extent the old s94 of the Telecommunications Act 1984 in providing authority for the issue of a notice "requiring the operator to take such specified steps as the Secretary of State considers necessary in the interests of national security". The potential scope of a national security notice is broad, and the Committee may wish to consider whether the approval of a Judicial Commissioner should be required for the issue of such a notice.

13. Depending on the result of the Davis/Watson case, an expedited hearing in which has been listed before the CJEU for 12 April 2016, it is possible that prior independent authorisation will be required for a much wider range of applications for communications data than is currently envisaged. Given the provisional views of the Court of Appeal in that case I do not suggest that the Government should assume that it will be defeated: but the possibility needs to be recognised that judgment may be given before the parliamentary process is concluded, and that substantial amendment to the Bill will be required in consequence.

14. Irrespective of the result of Davis/Watson, there may be a case for requiring a higher degree of independent authorisation in relation to certain categories of communications data. I suggested that Judicial Commissioners be required to authorise novel and contentious applications (AQOT 14.86, Recommendations 70-71). The Committee will have its own view as to the appropriate mechanism for authorising access to Internet Connection Records.


15. I maintain the view expressed in AQOT – taken also by the RUSI panel – that it is unnecessary for police warrants, at least, to be authorised by the Secretary of State. She does not authorise other forms of police surveillance such as intrusive surveillance and CHIS, in respect of which the "political accountability" argument would be notionally at least as strong: under other parts of RIPA, RIP(S)A and the Police Act 1997, it is the Office of Surveillance Commissioners rather than the Secretary of State whose approval is required (AQOT 8.11-8.20). By authorising police warrants, which constitute 70% of the total, the Secretary of State inevitably reduces the time available for the careful consideration of national security warrants. In all democratic countries of whose systems I am aware, police warrants go straight to the judge for authorisation.

16. The potential of the dual lock system to inject extra process into the business of warrantry has perhaps tempted the authors of the Bill into an undesirable shortcut in relation to the modification of warrants. Rather than apply the dual lock with full rigour (or simply leave it to the judge), both elements of the dual lock may be abandoned altogether in favour of authorisation by a senior official, even in the case of major amendments such as the addition of a new person or premises (or many new persons or premises) to a targeted warrant: see 5(b) above.

17. On the basis that the dual lock will remain in the legislation, the opportunity was presented to me this morning to confirm my view that the Judicial Commissioners need to see all the material that was placed before the Secretary of State.

18. In that connection I should also like to confirm my view that the right of the Judicial Commissioners under the dual lock system should be clearly acknowledged:

a. to use standing counsel to act as amicus where appropriate in relation to applications for the approval of warrants (AQOT Recommendations 110-111), consistent with the culture of challenge that the Commission should aim to promote; and

b. to issue guidance and indeed redacted rulings (AQOT Recommendation 95).

Cf., on both points, my supplementary written evidence to the Joint Bill Committee of January 2016, para 3.


19. I have seen the written evidence produced yesterday by the Interception of Communications Commissioner’s Office, and would respectfully endorse, for the reasons given in that submission:

a. the desirability of constituting an Investigatory Powers Commission;

b. the desirability of better defining the categories of relevant error and the criteria for seriousness in clause 198 (error reporting); and

c. further scrutiny of the remaining national security or intelligence agency exceptions, for example in clause 67(3)(b) which makes the protection of a SPoC unnecessary when national security is at stake.

March 2016


Prepared 6th April 2016