Investigatory Powers Bill

Written Evidence submitted by Ray McClure (IPB 48)

1. Introduction.

My name is Ray McClure, the uncle of Fusilier Lee Rigby who was brutally murdered on the streets of London on 22nd May 2013. I am the eldest brother of Lee's father Phillip. Occupationally, I am a retired IT professional with over 30 years experience in Financial Service IT systems.

I gave verbal evidence on the 24th March and the following are a copy of my notes, outlining why I feel this bill is necessary, I hope they add clarity to my views.

1.1. My views on the Investigatory Powers Bill.

We live in a data driven on-line world and legislation needs to be fit for purpose in this new era, sadly current legislation is not. The government report into Lee's Murder, stated that overseas internet companies do not comply with UK warrants, and that they are not bound by UK legislation. It also highlighted the significant problems faced from the fact that the services and the data are hosted overseas.

David Anderson's excellent report "A Question of Trust" explained the need and tabled recommendations to change legislation.

Sadly since Lee's murder things have got worse. Recent cases in the USA highlight the growing problem include Microsoft denying US warrants to access a drug dealers emails because the data is held in the "cloud" and not in the USA, and Apple denying the FBI warrant to access the phone data of a terrorist who killed 14, citing privacy! These actions are building no go areas for law enforcement and protecting evil. Where you protect evil, evil will thrive.

I am therefore supportive of this bill.

1.2. Where I stand.

My sympathy lies with the victims and their families, and this week especially with the victims and the families of the Brussels attacks. It is our wish that no family suffers the loss of a loved one through terrorism. We should all do what we can, and support the forces of law and order, to help eliminate this evil.

The UN resolution called on all nations to "redouble and coordinate efforts to prevent and suppress terrorist attacks" using all necessary measures. All companies should do so as well.

2. "Report on the intelligence relating to the murder of Fusilier Lee Rigby"

2.1. This report highlighted the failings of both the security forces and others. While I have confidence that the security forces have learnt lessons from this my biggest remaining concern is around the actions of the internet companies.

2.2. In the section titled "WHAT WAS MISSED: CONTACT WITH FOXTROT". In section 401. where it highlights that "some overseas CSPs do not comply with UK RIPA warrants,442 as they do not consider themselves bound by UK legislation. Therefore, MI5 cannot use its usual process in such circumstances.".

2.3. In section 457. the report highlights "The number of different forms of communication now available presents the Agencies with significant challenges in terms of their ability to detect and prevent terrorist threats to the UK. However, the real problem arises from the fact that most of these services and applications are hosted overseas."

2.4. The report states "CSPs based in the US have, for the most part, refused to recognise UK legislation requiring them to provide the content of communications on their networks: they do not consider themselves to be bound by the legal obligations set out in RIPA, as UK CSPs do, and may find themselves subject to legal or civil action if they share information with the UK authorities."

2.5. The report states "The considerable difficulty that the Agencies face in accessing the content of online communications, both in the UK and overseas, from providers which are based in the US – such as Apple, Facebook, Google, Microsoft, Twitter and Yahoo – is therefore of great concern."

2.6. While it is beyond doubt that the attack was planned and aided by internet activity, companies should accept they have a responsibility to notify the relevant authorities when an automatic trigger indicating terrorism is activated and allow the authorities, whether US or UK, to take the next step.

2.7. The conclusions I have reached

2.7.1. If forces of law and order are to have access to the necessary data then the data must be collected and held in the UK, where legally issued warrant can be executed and enforced. This bill enables this.

2.7.2. US based Internet companies by refusing to recognise and comply with UK warrants are providing no go areas for law enforcement and obstructing justice. We must give our security forces and police the capability to obtain this information. This bill does that.

3. Human Rights

3.1. The right to life article 2 protects the right of every person to his or her life. Under which a states has a A positive duty to prevent foreseeable loss of life.

Terrorism is a foreseeable cause of loss of life and everything must be done prevent it.

3.2. Article 8 provides a right to respect for one’s "private and family life, his home and his correspondence", subject to certain restrictions that are "in accordance with law" and "necessary in a democratic society".

Privacy is not an absolute right. It is for parliament to define the restrictions and set them in law not for companies like Apple etc. Their role is to obey the law.

3.3. Life vs Privacy

The loss of a life can not be replaced, the small loss of some privacy does not cost lives. That said it is my belief that this bill does not erode privacy but clarifies and updates the existing confusing laws.

Liberty last year said to the security committee that "the loss of a few lives was a price worth paying for privacy" - they are wrong. A life lost can not be replaced. Their words show how little they value life, and do their organisation no credit.

4. Terrorism does not just happen

4.1. Before the attacks they are planned, targets researched, equipment acquired. The pre attack stages present opportunities to prevent the attacks and interception of intelligence is necessary to achieve this.

4.2. In the case of Lee Rigby the planning of the attack started at least 5 months prior to the attack. Opportunities were missed, but the disclosure of the lack of cooperation between internet companies and the law enforcement agencies was a real shocker, Had they reported suspicious activity then perhaps the attack could have been prevented.

4.3. Attacks are coordinated, 7/7, the Paris attacks and now the Brussels attacks all hitting multiple targets, require communications between the elements. Security services need to be able to intercept these communications and act on them to prevent attacks. If they are unable to do this then public safety is at risk.

5. Evil

Evil comes in many forms not just terrorism, including pedophiles, drugs, hackers, stalking, murder, etc., the use of surveillance and the provision of this bill will help against all of these as well as the fight against terrorism.

6. Surveillance

6.1. Surveillance is not all evil, the public accepts surveillance. For example CCTV cameras in shops and on the high street are commonplace, and are accepted by the public. We know they are there to prevent crime and when a crime is committed, they gather evidence which is used to prosecute the guilty. We see positive use of surveillance on TV programs such as crimewatch. They help to make society safer.

6.2. The internet is biggest high street in the world, a place of shopping, entertainment and social gathering, it needs to be a safe environment. Like the high street it needs surveillance to prevent crime and to gather evidence to prosecute those guilty of criminal acts. Public safety does not begin and end with the device used to access the internet, it needs to be wider.

7. Comparison between Banking and IT

7.1. Banks require public trust and security they must validate their customers, monitor and report suspicious transactions (e.g. Anti Money Laundering), they cooperate with law enforcement. The banking industry is heavily regulated and needs to be because it handles customers information and finances.

7.2. By contrast the internet has little or no validation, there is no approval necessary to set up and run a internet site, there is little or no monitoring and reporting of suspicious transactions and content, they make it easy to set up sites to promote and publish evil. Through their actions they are making life more difficult for law enforcement.

7.3. If internet companies reported suspicious transactions and prevented those who abuse the internet from setting up sites and peddling evil then perhaps less surveillance would be necessary, however internet companies seem to be more interested in locking out law and order rather than fighting evil and the causes of evil, making this bill necessary.

8. Apple and Privacy

8.1. Apple’s stance makes no sense. By refusing to action legally issued warrants they are protecting criminals and creating a no go environment to law and order.

8.2. Where you protect evil, Evil thrives.

8.2.1. The Manhattan District Attorney alone was unable to execute 111 search warrants for smartphones over the last year because they were running on Apple's operating system.

8.2.2. FBI and the San Bernardino terrorist, 14 killed, Apple’s action is allowing accomplices to possibly escape justice.

8.2.3. Are these the actions of a responsible company?

8.3. Yes privacy is important, but so is public safety, justice and law and order. The right to life must take priority over the right to privacy. The European Convention on Human Rights recognises this and privacy is not an absolute and is subject to restrictions. Apple and other technology companies must accept they have a responsibility to help law and order.

9. Microsoft vs US Government

9.1. Warrant issued to gain access to a drug dealers emails stored on hotmail
Microsoft fighting it because emails are not held on US soil, - cloud based storage in this case actually held in Ireland they also claim that emails are the customer's’ personal documents and a US warrant does not carry the authority needed to compel the company to hand them over. So far they have lost two court cases but they still fight the warrants.

9.2. Lessons to be drawn.

9.2.1. Data held in the cloud is legally problematic to access and there is probably jurisdiction issues.

9.2.2. Microsoft’s actions are protecting a drug dealer and hindering the justice. Why? Surely it is in the interests of public safety to fight the illegal drugs trade.
Where you protect evil, Evil thrives.

10. The need for balance

10.1. Snowden effect.

After 9/11 security forces went to far and were exposed by Snowden

After Snowden, internet companies and the public reacted and took a view against the security forces, treating them as the enemy. The real enemy are the terrorists and criminals which threaten public safety and society.

Trust in the security was lost. I read on the BBC that over 50 terrorist attacks have been prevented since 7/7. Our security forces should be applauded for this but instead large numbers of the public do not trust them.

10.2. Encryption is essential - the banking system can not operate without encryption, it provides security. Encryption is not an excuse to prevent access by law and order forces. Smart phones are great devices, but they must not be exempt from legal searches by law enforcement. Banks have to provide unencrypted account and transaction details when a warrant is issued why should the internet companies be different?

10.3. There needs to be balance, between the needs of security and law and order and the needs of personal privacy. Yes, encryption is necessary but where a legally issued warrant has been granted then companies must obey and give access to the unencrypted information required. There must be no, no go areas to law enforcement.

10.4. There needs to be public trust. The Public fear big brother state. Where the police and security forces lack trust public safety suffers. Both the Police and the Security forces need to build more public trust.

11. Assisting

11.1. Serious Crime Act 2007 allows for people who assist another to commit an offence to be prosecuted.

11.2. Why is no legal action taken against companies that assist criminal activity?

11.3. If a person hosted a meeting involving known criminals they can be charged and prosecuted for assisting. Today, meetings are held online, in chat rooms etc. I see no difference in hosting a meeting in a home to hosting conversations on-line. If they are used for criminal intent then the hosting party should fear prosecution.

12. Warrants.

The issuing of warrant should be by the judiciary and not politicians.

In conclusion everyone, individuals and companies, has a duty to support the forces of law and order; Parliament has a responsibility to ensure laws are fit for purpose and that our law enforcement organisations are properly equipped and enabled to carry out their duty in these difficult times; and the security forces and the police have a responsibility to use their powers effectively to protect public safety by deterring and preventing crime and where crimes are committed to ensure evidence is gathered and presented to the courts for administering justice. It is only by working together will evil be defeated.

April 2016


Prepared 6th April 2016