Draft Communications Data Bill - Draft Communications Data Bill Joint Committee

Draft Communications Data Bill - Draft Communications Data Bill Joint Committee Contents

7 Cost and benefits

Overall cost of the legislation

254. The Impact Assessment published with the draft Bill states: "Total discounted economic costs over the 10 years starting from 2011/12 are estimated to be £1.8 billion. This represents the cost of the programme without allowing for inflation, Value Added Tax and depreciation." The main categories of cost are stated to be:

Current work with major UK telecommunication operators to implement data retention solutions resulting from the EUDRD;
Operational enhancements undertaken within the limits of current legislation with a particular focus on training investigators;
Risk reduction to help identify the technical and operational challenges in implementing a long-term solution; and
Strategic work to develop and implement the preferred option (2)[176] to address the challenge presented by new and emerging technologies, requiring new legislation.

255. No breakdown of the figure of £1.8 billion is given. At their first evidence session Home Office officials were asked for further details,[177] which they supplied in a confidential annex to their written evidence, and further elaborated in later oral evidence.[178]

256. The CSPs will incur costs mainly for retaining, securely storing, accessing and ultimately destroying communications data, but also for matters such as training. The Home Office gave a figure of £859m over 10 years for reimbursing the additional costs to the private sector. This is nearly half of the overall figure of £1.8 billion. However this figure must be highly suspect, because it was calculated with little or no input from the CSPs. Giving evidence in September, Mark Hughes for Vodafone said flatly: "We have never been consulted on cost."[179] Stephen Collins for Microsoft told us: "It is very hard to estimate what the costs will be when we do not know what we would be expected precisely to do under the secondary legislation on the code of practice ... the draft Bill talks about the level of security required. It is almost an absolute that the data must be securely stored—not "reasonably securely" but "securely": 100%. That creates an awful lot more cost as well…."[180] The witnesses for Facebook and Twitter agreed.

257. Nevertheless, in his subsequent evidence Charles Farr told us that, on the basis of the regular discussions the Home Office had with the UK CSPs on their costs in implementing the RIPA arrangements, "we know in quite a high level of detail what those costs comprise [and] we have already formed the basis of our calculations about the costs that the CSPs may incur in future. We have added in considerable optimism bias on top of that. I would not want you to conclude that we have plucked these figures out of thin air. They are based on existing costs which we have already established with the providers. It is still our view … that these figures accurately represent the likely cost going out to 2020."[181]The business case was being "refreshed", but he did not anticipate that it would come up with a figure higher than £1.8 billion.

258. Mr Farr repeated that this figure "builds in quite a lot of optimism bias". For Microsoft, Mr Collins had told us: "… the costs will increase. Even if we gave you a figure now, I would be willing to bet money that in 10 years' time that cost will have multiplied grotesquely."[182] The figure he was referring to was the cost to CSPs. We think he would be betting on a certainty. Future developments are entirely unpredictable. It is impossible to foresee what new communications providers or forms of communication may emerge, perhaps from overseas, that will suddenly become a significant player and incur recoverable costs. We expect the overall cost to the taxpayer over the next decade to exceed £1.8 billion by a considerable margin.

Covering the costs of CSPs

259. Clause 26 of the draft Bill provides that the Secretary of State must ensure that arrangements are in place to secure that CSPs receive "an appropriate contribution in respect of such of their relevant costs [i.e. the costs of performing activities permitted or required by the Bill] as the Secretary of State considers appropriate". The arrangements put in place may require an audit of any claim for costs. Additionally, the Secretary of State may determine whether or not contributions should be made to particular operators and the appropriate level of contribution (if any) in each case.

260. This replaces a much simpler provision in RIPA for the making of "appropriate contributions" to the costs incurred by CSPs in complying with notices under section 22(4) of RIPA. At present the "appropriate contributions" have been 100%, as Mark Hughes confirmed on behalf of Vodafone: "In my experience, appropriate contributions have always been 100% of our costs. We are covered in this whether we are developing the capability that we have been asked to or whether it is for the operating expenditure, year on year, based on our stores of our disclosures." But, he added, "one of the things that we would like to see in future years … is that 100% being written down and more enshrined in the legislation."[183] This anxiety was shared by all the CSPs, all of which wanted the obligation to give them full cost recovery to be on the face of the Bill.[184]

261. Mr Farr told us that he has sought to allay the concerns of the CSPs: "As you know, under the existing provisions we cover the costs incurred by CSPs in meeting the obligations set out in the legislation. We have said, and told CSPs last week in another meeting, that we would continue that commitment through and beyond this legislation."[185] He added: "The intention is to cover their costs…. We have said right the way along that the principle of this Bill is to have co-operation, consultation, and that must include a sensible discussion about costs where they are not immediately apparent." He stipulated that the costs should be "reasonable". Clause 26(4) allows claims for costs to be audited. If, subject to these two provisos, it is the intention of the Government (as we think it should be, if they wish to enjoy the continued cooperation of the CSPs) to reimburse in full the costs they necessarily incur in complying with the legislation, we think this undertaking should be on the face of the Bill.

262. We are concerned that the Home Office's cost estimates are not robust. They were prepared without consultation with the telecommunications industry on which they largely depend, and they project forward 10 years to a time where the communications landscape may be very different. Given successive governments' poor records of bringing IT projects in on budget, and the general lack of detail about how the powers under the Bill will be used, there is a reasonable fear that this legislation will cost considerably more than the current estimates.

263. The Government's commitment to reimburse CSPs the necessary cost to them of complying with the requirements which would be imposed on them by this legislation should appear on the face of the Bill.

Benefits

264. The Home Office's impact assessment estimates the benefits from the draft Bill in the ten years to 2020/21 at £5.0 to £6.2 billion. With a cost estimate of £1.8 billion, this gives an estimate of net benefits between £3.2 and £4.4 billion. The Home Office explained that this is regarded as "cautious", and: "Only benefits that can be ascribed a monetary value with confidence are considered in the business case. These are revenue loss prevented; assets seized; lives saved; children safeguarded; and paedophile rings disrupted."[186]

265. The monetary value ascribed to revenue loss prevented including tax fraud is £2,008 million, and £627 million is the benefit from facilitating seizure of criminal assets. Donald Toon from HMRC told us that in 2011 the use of communications data was "directly related to about £850 million of protected revenue".[187] We have no means of knowing how accurate these estimates will be, spread over the coming ten years, but we have no reason to doubt that very considerable sums will be saved under these two headings—though whether the sums saved will exceed the cost of the legislation must be a matter for speculation. But we are also asked to accept that a monetary value of £86 million can be ascribed "with confidence" under the heading "children safeguarded or protected from sexual abuse", or £171 million for "high risk child sexual offenders networks disrupted or dismantled". Certainly these would be very valuable achievements, but we fail to understand how they can be ascribed a detailed monetary value in this context.

266. This is demonstrated most clearly in the figures we are asked to accept for "saving and safeguarding lives: £2,084-£3,334 millions". These figures are reached as follows. On the advice of the police and others involved it is assumed that lives are saved in between 25% and 40% of threat to life cases. This would give an estimate of 1,265 to 2,020 lives saved over the next ten years. Each life is given a value of £1,792,398—a figure derived from a Home Office publication which places a financial value on crime, including homicide, taking account of factors such as the cost to the criminal justice system and the cost of lost output.[188] Mr Farr described it as "a Treasury figure used in a number of different scenarios across government."[189]

267. It may be that, for some purposes, it is useful to be able to ascribe a monetary value to a life saved. We fail to understand what relevance this can have in the impact assessment for a draft Bill. The figures are used to attempt to show that the taxpayer, by spending £1.8 billion over ten years, will recoup perhaps three times that amount, when this is not the case. To suggest that these estimates can be used to calculate a net benefit from enactment of the draft Bill at between £3.2 and £4.4 billion is simply fanciful and misleading.

268. The use of figures in this way points to a further absurdity. We are asked to believe that access to a further 10% of communications data over and above the 75% already available would save perhaps a further 150 lives a year. Logically, it should follow that the communications data currently available is saving around 1,000 lives a year, but the Home Secretary told us that the figure was "1,000 to 2,000 lives being saved" over the 10 year period. None of our witnesses could provide specific evidence of significant numbers of lives saved to date.[190]

269. The figure for estimated benefits is even less reliable than that for costs, and the estimated net benefit figure is fanciful and misleading. It ought not to be used to influence Parliament in deciding on the relative advantages and disadvantages of this legislation. Whatever the benefits of the Bill, they are unlikely to be financial.

270. A new cost benefit analysis should be presented alongside any redrafted Bill. It should be based on the wider consultation and narrower powers; it should contain significantly more detail than the current impact assessment; it should separate monetary benefits from other unquantifiable benefits such as potential lives saved; and it should refer to past evidence.

The disadvantages to United Kingdom business

271. There are disadvantages to business other than the purely financial, and the London Internet Exchange (LINX) made a number of points which are troubling some of the CSPs.[191] They said, and we agree, that:

"All the UK's best and brightest prospects for economic growth depend on access to the best and most innovative Internet services. The Internet sector therefore has an enormous wealth multiplier factor, especially for a high-value high-skill internationally trading economy like ours. Accordingly, any action that undermines the positive effect of the Internet sector could have serious economic consequences, with implications well beyond the companies directly affected themselves."

272. While LINX welcome the Government's commitment to reimburse financial costs directly attributable to the legislation, they point out that there are other costs which will inevitably be unrecoverable. Costs of hardware for the construction of substantial new systems, data storage facilities, and access, search and retrieval mechanisms, would be recoverable, but what of the incalculable, and hence irrecoverable, opportunity cost, as senior executives and the most talented technical staff are diverted into delivering these requirements and away from commercial goals? Other costs which are not direct financial costs might include performance degradations, reductions in network and service resilience, or the inability to offer a particular service to customers when other, foreign, operators were not so constrained. Such costs would not be recoverable as direct financial costs under the draft Bill, and they would make the telecommunications operator that incurred them less attractive to its customers and users.

273. LINX's conclusion is that UK-based operators will find themselves at a competitive disadvantage. Foreign operators would have a significant incentive to avoid exposing themselves to the possibility of incurring such irrecoverable costs, by avoiding establishing themselves in the United Kingdom. They might also make it more likely that communications service providers based outside the United Kingdom will prevent their service from being accessed from within the United Kingdom.

274. The Internet Service Providers' Association, made a similar point:

"The Draft Bill has the potential to put the UK at a competitive disadvantage and destabilise the market, with the UK seen as a less attractive and more onerous place to do business digitally, affecting both inward investment and services being made available. In challenging economic times we question whether this should be a government priority."

We sympathise with these views.

275. We believe that the Government, in imposing obligations on CSPs, should bear in mind the importance of preserving their competitiveness, and minimising damage to the reputation of the United Kingdom as an attractive base for conducting business.

276. The Government should also pay particular attention to the problems of any smaller companies it may think of targeting. We heard evidence from Trefor Davies, the Chief Technology Officer of Timico Ltd. As he told us, they are not a small company; they have about £40 million turnover, and a couple of hundred staff of whom maybe 40 are engineers, but the real core of the team who would have to work on compliance with new legislation is only six people: network engineers, systems engineers, and applications engineers. "The biggest problem we would have as a business is the amount of effort that we would have to put in, in the first place, to setting [the filter] up ... Smaller ISPs may only have six or 10 engineers to do what we do with 40 or 50 engineers, but it would still take the same amount of effort, so the smaller the ISP the more disruption and harm it makes."[192]

277. Before imposing any obligations on smaller CSPs, the Government should consider whether these are strictly necessary, bearing in mind the real burden this may impose on resources. They should discuss with the company how they can best cooperate to cause the least disruption to the business.

176 i.e. new legislation Back

177 QQ 73-77 Back

178 QQ 882-910 Back

179 Q 472 Back

180 QQ 653-654 Back

181 Q 883 Back

182 Q 654 Back

183 Q 450 Back

184 See e.g. the written evidence of Everything Everywhere, of ISPA (paragraph 18), and of BT (paragraph 7). Back

185 Q 850 Back

186 Paragraph 105 Back

187 Q 128 Back