Previous Section Back to Table of Contents Lords Hansard Home Page

Lord Lucas: The noble Lord, of course, makes a very good point with which I entirely agree. I hope I said that in my opening speech. But where the police are about to raid someone's premises, or an equivalent venture is about to be undertaken, it is very sensible that the police should take a Section 46 warrant with them so that they can pick up the key at the same time they pick up the information. If these subsections were directed at that, it is not believed that they would cause any difficulty.

What causes difficulty is what the wording would allow; for instance, that part of the Bill relating to the interception of communications and the application for a warrant in advance of the communications. A person may go to a bank and say, "This person may be sending messages to you using your public key, and we therefore need to have your private key to decrypt them. We expect the messages to come in over the next couple of weeks, so you must keep your public key the same". That would be an extremely damaging position for a bank. That is what industry and I--and, I hope, the Government--would, on contemplation, find unacceptable. It is limiting the scope and timescale of the measure. It would allow exactly what the noble Lord first described, but it would not put industry in a position where its security system could be opened up and kept open. That is very much the import behind my argument. I do not believe that that question has been answered, and unless the Minister has any further comments to make we shall return to the matter at a later stage of the Bill. Unless anyone else wishes to intervene, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Lord McNally had given notice of his intention to move Amendment No. 139WA:

The noble Lord said: Our concern remain the long-term key which is the open door and the one which undermines confidence both in business and in civil liberties. It is believed that we shall return to the matter, and therefore I shall not move my amendment.

[Amendment No. 139WA not moved.]

[Amendments Nos. 139XA to 139ZA not moved.]

28 Jun 2000 : Column 961

The Earl of Northesk moved Amendment No. 139A:

    Page 50, line 5, at end insert--

("( ) If any person with the appropriate permission under Schedule 1 believes on reasonable grounds--
(a) that any person is able to put the protected information into an intelligible form,
(b) that the imposition of a requirement to disclose the information in intelligible form, or to disclose the key to the protected information, is--
(i) necessary on grounds falling within subsection (3), or
(ii) likely to be of value for purposes connected with the exercise or performance by any public authority of any statutory power or statutory duty,
(c) that the imposition of such a requirement is proportionate, taking into account the full consequences of its disclosure, to what is sought to be achieved by its imposition,
(d) that the information in intelligible form, or the key, cannot reasonably be obtained by the person with the appropriate permission without the giving of a notice under this section,
the person with that permission may, by notice to the person whom he believes to be able to put the protected information into an intelligible form, require the disclosure of that information in an intelligible form, or, in the circumstances provided for in section 47, the disclosure of the key.").

The noble Earl said: At the outset, without a hint of criticism, I express both gratitude for and appreciation of the amendments the Government have tabled to this part of the Bill. They go some way towards meeting the concerns which have prompted me to table my own amendments in this group. My own view has always been that if we must have key disclosure, the correct methodology to apply is one where efforts to obtain plain text are properly exhausted before keys are sought.

Here I echo the complaint of the noble Lord, Lord Lucas, and promote the thought that recommitment of that part of the Bill should be actively and seriously considered. There has not been time fully to consider these amendments. The revised versions of the relevant clauses were received at approximately six o'clock this evening. I retain a host of reservations, but it may be that the Minister's explanations will ameliorate those.

Therefore, rather than launch into an exposition of my amendment, it seems to me that the most helpful and useful service I can offer the Committee is to invite the Minister to explain those of the Government. Realistically, they are the substantive business in the grouping. I cannot help feeling that that would make for a tidier debate and I trust that it meets with the approval of the Committee. I beg to move.

Lord Hylton: When the noble Lord, Lord Lucas, moved an earlier amendment, he went so far as to say that he thought the clause would be useless against serious crime. I apologise if I have overstated his remarks; I hope that I have not.

It would be helpful if the Government could say whether they agree or disagree with that position. If they disagree, can they say why?

28 Jun 2000 : Column 962

7 p.m.

Lord Bassam of Brighton: I thank the noble Earl, Lord Northesk, for his tactful intervention and helpful observations. I shall move through an analysis of our amendments and comment on all the Opposition amendments.

The group of amendments covers a big question: when should the authorities be permitted to require that a decryption key be disclosed rather than simply the plain text of protected material? The associated issue is whether a party in receipt of a notice should be able to choose which key to disclose, if there is more than one which can carry out the necessary decryption. That is an important, but nevertheless secondary, question.

I recognise that this is a crucial issue, especially for industry. We have received a number of representations on the issue from the British Chambers of Commerce and the Institute of Directors. We have tried to allay their concerns by explaining just what the Bill actually states and what it seeks to achieve. We have also received helpful correspondence not least from the British Bankers' Association setting out its understanding of the way in which Part III of the Bill works. In the light of those representations, we have decided to recast these provisions. I fully accept that Members of the Committee will have to retreat and take time to study them in order to understand their impact more precisely.

In recognition of the views of industry, we made wide changes to Clause 47 in another place to add an extra test if keys are to be required. That was welcomed and Members of the Committee have proposed further changes. We have suggested our own amendments, which take account of the views of industry and cover the majority of points raised by the Committee.

Before addressing these changes, I should clarify one existing point on the keys versus plain text issue. In the Bill as drafted, there is already an extra test if keys are to be demanded. Imposing a direction that a key be disclosed is limited by Clause 47(4) to occasions where it is believed that there are "special" circumstances of the case making that necessary; and that imposing such a requirement is believed to be proportionate to what is sought to be achieved by so doing. I hope that that is clear: plain text first; extra test if keys are required. That is the important message which we must get over. If a key is required, the choice of which key to disclose, if there is more than one, rests with the recipient of the notice. The definition of "key" in Clause 52(1) applies. It could be a session key, a short-term key or a long-term key. The choice rests with the recipient of the notice and that is the important qualification which must be widely understood.

That is the position now. But, as I have said, parts of industry have voiced some concerns and asked whether we could find a way of giving greater prominence in the Bill to the disclosure of plain text and clarifying the issue over the choice of keys. Your Lordships' amendments in this group address those very points. We have listened to the genuine views we

28 Jun 2000 : Column 963

have received and have sought to rework Clauses 46 and 47 ourselves. The government amendments before the Committee are the result of that reworking.

The amendments we have tabled in the group seek to recast Part III in terms of our preference for plain text rather than keys; and to leave it up to the recipient of a notice to decide how to comply with a disclosure requirement. It is on trust.

We believe that the changes will be welcomed. We were certainly told by industry that such amendments would offer reassurance. Amendment No. 139D begins by recasting Clause 46 as a,

    "disclosure requirement in respect of the protected information".

The existing necessary and proportionate tests for the use of the power remain with the reasonableness test amended to reflect the new structure, to which Amendment No. 141B refers.

Amendments Nos. 114A, 114D, 114F and 153B follow suit by making reference to "disclosures" rather than to "keys". Amendment No. 158B inserts a new clause which, again, represents a restructuring to underline the preference for plain text. The remaining government amendments in the group--namely, Nos. 159C, 161A, 171A, 183A to 183C, 195B and 225A--are consequential changes arising out of the recasting of Clause 46.

The point is that we have listened to industry's concerns and recast Clause 46 to provide reassurance. Disclosing the plain text of material will normally suffice and it is up to the recipient of a notice to decide how to discharge the disclosure requirement. The issue is disclosure, not key.

I believe that our amendments sweep up the majority of the concerns expressed by Members of the Committee, but a couple are left. These, too, cover some important points and provide me with an opportunity to clarify the Government's thinking.

As I see it, these remaining amendments are, first, Amendment No. 158C, which would mean that a requirement to disclose a key could be given only by a Secretary of State or judge where there are exceptional circumstances to the case. Amendment No. 164A would do something similar by replacing the existing Clause 47 and would impose further restrictions on the circumstances when a key--as opposed to the plain text--may be demanded. Amendment No. 163 seeks to widen the considerations which must be taken into account in deciding whether it is proportionate to demand a key.

Let me take those in turn. Amendments Nos. 158C and 164 would both place further restrictions on the circumstances when a requirement to disclose a key might be imposed. I believe that both would prove too restrictive in practice. Both set the test that there must be "exceptional" circumstances to a particular case.

As we indicated in another place, we gave very considerable thought to putting in such a test ourselves, but we concluded that in practice that might prove to be too restrictive, with the potential to undermine the effectiveness of the power.

28 Jun 2000 : Column 964

That matter was debated at the Report stage in another place, but perhaps I may explain it again. In the case of decryption requests made to legitimate businesses, a requirement to disclose a key, where the plain text is available, would certainly, it seems to me, be most unusual. The difficulty for the law enforcement agencies surrounds the use of the power against those suspected of involvement in criminality. In these cases--where there may be doubt about the bona fides of the person being served with a notice--requests for keys may perhaps be more frequent. The future is uncertain and we cannot know how often this might arise. But Clause 47(4), as drafted, limits the power to demand a key; and the case must be a special one. We believe that that is the most appropriate test.

The limbs at paragraphs (b) and (c) and the timing point at subsection (2) of Amendment No. 164 are exactly the kind of considerations that will need to be gone through with the existing Clause 47. However, we believe that the cumulative effect of the way that the amendment works is too restrictive.

In resisting the amendments, it may be helpful if I clarify again our thinking on keys. We have narrowed down on the face of the Bill the circumstances in which a key can be required to be disclosed. We have imposed an extra test and that has been welcomed. Members of the Committee may ask legitimately what kind of case we might consider to be special.

As I indicated elsewhere, we shall cover that issue in the code of practice, which should be available before Report. However, I believe that it may be useful if I offer some illustrative examples. First, trust, to which I have referred already, becomes an issue when there is doubt about the bona fides of the person or body being asked to provide the plain text. In a criminal investigation, for example, law enforcement agencies will need to be sure that the plain text of protected material is the correct text, otherwise doubts could easily be cast in court during a future prosecution on the veracity of the information.

The second example relates to timeliness. In some surveillance operations which involve interception, for example, it may be imperative for the ongoing decryption of protected material to take place in real time, or as close to that as possible. Potentially, delays could be life-threatening, and I am sure that we can imagine circumstances in which that may be the case. If whoever has the key to protected material cannot carry out the decryption quickly enough in time-critical operations, but the authorities can, it may be considered necessary to ask for a key. I believe that that example is clear.

I should stress that in certain cases there may be technical solutions to these problems; for example, where they affect the timeliness issue. However, the fact is that in some cases solutions--technical or otherwise--may not be available. Therefore, the Bill needs to have the flexibility to allow for keys to be requested, but only where special circumstances make that necessary and where it is proportionate to the aim of imposing such a requirement. I believe that that is an important balancing point.

28 Jun 2000 : Column 965

Therefore, as are other parts of the Bill, Clause 47 is a reflection of the delicate balancing exercise that we are trying to effect in this area. I believe that in many ways we are trying to deal with a future danger. It is difficult, but we believe it to be entirely right that we do so. I would also argue that no responsible government could or should seek to do otherwise. I believe that it would be foolish of government to ignore that.

We made changes to Clause 47 in another place because we are seeking genuinely to strike the right balance between providing effective powers and allaying industry and civil liberties reservations about the Bill. I believe that the current tests for requiring the disclosure of a key strike the right balance and that these amendments would tip that balance in the wrong direction.

I believe that I may not have addressed fully Amendment No. 163 in my comments on the government changes. That amendment seeks to spell out one of the considerations which must be taken into account in deciding whether it is proportionate to demand a key. I understand the concerns of noble Lords but believe the amendment to be entirely unnecessary. The considerations that they seek are implicit in the proportionality test which is already in the Bill in Clause 47(4)(b). Why are keys needed? They are needed in order to put particular protected data into intelligible form; that is, to turn particular encrypted text into plain text. That is, after all, the whole purpose of the power.

However, in deciding whether to require that a key be disclosed in a particular case, the person who authorises the power will need to address the question of proportionality in its widest sense. That includes considering what kind of key it is, what other information it gives access to, its commercial value and so on. We would be reluctant to accept the amendment lest it implies that other equally important considerations are somehow not relevant. However, I believe that there is nothing much between us on this issue. We must all remember that Clause 47 imposes an extra proportionality test; one is contained earlier in Clause 46(2)(c).

Importantly, the safeguards provisions set out in Clause 52 also have an impact here. Clause 51(2) requires measures to be in place to restrict the uses to which keys may be put. Where keys are obtained, the authority concerned will not be permitted immediately to decrypt all manner of other communications or data belonging to the individual or organisation which provides the key. It would be unlawful for it to do so. As set out in Clause 46, there must be separate lawful authority to obtain the protected material in the first place.

Perhaps I may suggest that we now consider the new situation. At present, if the police request electronic data from a bank, they will, for example, apply for an order under the Police and Criminal Evidence Act 1984 and serve it on the bank concerned. In return, the bank discloses the data together with a statement attesting to its bona fides. The police do not insist on

28 Jun 2000 : Column 966

accessing the bank's computers in order to discover whether they are telling the truth. They rely on the bank's integrity and, where necessary, use them as witnesses. We envisage a similar scenario with regard to encrypted material. The exception to that might be where a bank itself was suspected of involvement in criminality.

We have tabled amendments in order to meet industry concerns. I hope that they are welcome. If particular issues remain, we shall of course be happy to examine them to see whether we can offer further reassurance and remain consistent with our overall aims. In the meantime, I beg to move the government amendment in this group and, in the light of what I have said, ask Members of the Committee to withdraw their amendments.

7.15 p.m.

Lord Cope of Berkeley: As others have said, and as the Minister acknowledged, this important set of government amendments was tabled at the last minute. I should add at once that I believe it to be helpful to the Committee that the amendments were tabled. I do not criticise the noble Lord for deciding to do so at the last minute. At least we know the direction in which the Government's mind is moving, and, in fact, they have moved quite firmly in that direction. At the same time, I am sure the Minister will appreciate that it has made it difficult not only for the Committee but for others outside--to some extent, even more so for others outside--to read through the detail of the Government's amendment and to assess exactly what they are doing and whether it is sufficient.

I should like to put on record that we have been much helped--at least, I have been much helped--by the ever-helpful Foundation for Information Policy Research, which earlier today put on the web a copy of how these clauses will appear if all the Government's amendments are agreed to. That makes for much easier reading than going backwards and forwards between the amendments. Not for the first time, the foundation has been of great help to us in assessing the way in which the clauses will affect the situation.

The series of amendments tabled in my name and that of the noble Lord, Lord McNally, attempt to achieve something similar to that intended by the Government; that is, to put plain text in the front line and to allow applications for a key only when absolutely necessary. I accept at once that Clause 47, as it now is, contains the reservations to which the Minister referred. There is a difference in the wording and the Minister drew attention to that. Basically, the Government's wording continues to say that there need to be "special" circumstances, whereas we say that such circumstances should be "exceptional". That is a distinction, but I do not consider it to be as large a distinction as in some cases one might be led to believe.

However, a point on which I should like to be clear--I must admit that I am not clear about it at present--is ultimately who authorises the attempt to obtain the key as opposed to the plain text in a particular situation. As far as I can see, the person

28 Jun 2000 : Column 967

giving the notice does not have permission to insist on the key. Only the judge or the Secretary of State can order that the requirement can be complied with only by the disclosure of the key. That is the effect of the government amendments and those that the noble Lord, Lord McNally, and I have tabled. Given the drafting of Clause 47, the Government clearly agree on the importance of placing the production of keys in a significantly different framework from the production of plain text.

There are some other detailed points relating to the amendments, but I have dealt with the most important issue. If the Minister could give us an assurance along the lines that I have asked for, it would help us to accept the clause. He may say that it is obvious from the clause as written, but it is not obvious to me.

Next Section Back to Table of Contents Lords Hansard Home Page