Investigatory Powers Bill — House of Lords, 2016-10-17
Topic: Mixed Topics
Brian Paddick (Liberal Democrats, Centre to centre-left): My Lords, the effect of Amendment 118A, tabled in my name and that of my noble friend Lady Hamwee, would be to remove internet connection records from any notice requiring the retention of communications data by telecommunications operators It is important to look back over the history of internet connection records. The initial argument put forward by the Government and law enforcement agencies was that, with so many communications now being via the internet rather than via fixed line or cellular communication, it was essential to keep a record of every attempt to access the internet by everyone in the UK in the past 12 months, so that the same data that are currently available from an itemised phone bill—the who called who from where and when—would also be available if someone used the internet to communicate instead. If that is what ICRs were, and if ICRs provided that information, we might be more relaxed about them, but the parallel with itemised phone bills is clearly false. After the Joint Committee’s scrutiny of the Bill, the Government acknowledged that they wanted more than just the itemised phone bill data. They wanted to be able to see, for example, whether a suspected terrorist had accessed a travel agent’s website or a paedophile a particular file-sharing website Noble Lords will be relieved to hear that I do not intend to go over every objection to internet connection records—we would be here until the early hours if I did. Let us look just at itemised phone bill data. My internet connection records will show that about 10 different apps on my mobile phone that I can use to communicate with other people, including my Facebook app, my WhatsApp and iMessenger apps—which are end-to-end encrypted messaging apps—my Facebook Messenger app and my Twitter app, are all connected to the internet all the time. There will be no ICR data that tell law enforcement agencies where I was at a particular time, whom I was communicating with or whether I was communicating with anyone at all while these apps were connected to the internet If I was communicating with someone, the ICR data would contain no information about when I was communicating. Even if I was a simple soul and communicated using only WhatsApp, law enforcement would not be able to go to WhatsApp and say, "On this day and at this time, he was using WhatsApp. Who was he communicating with?" That is because the app is connected to the internet all the time and they would not be able to narrow it down to a particular date and time from the ICR data. They would have to ask for all my communications data over an extended period—an enormous volume of data that WhatsApp might consider a disproportionate request, save in the most serious cases Knowing someone’s internet connection records is just the start of the problems facing law enforcement agencies. I have another app on my phone. It is a virtual private network app. This app allows me to traffic all my connections to the internet through one secure server. If I engage it, my internet connection records will not show anything other than connection to the VPN server. Choose a VPN service provider whose server is in a non-co-operative foreign country and law enforcement will not be able to find out what connections have been made through the VPN server My point is that ICRs do not give law enforcement agencies the equivalent of itemised phone bill data. The agencies would have to go to each communications platform operator, most of whom are in the United States of America, and ask them for more information. They might not be inclined to give up those data except in very serious cases. If one simply used a VPN, law enforcement would not know to which operator to go to ask for more data. Even if it did, it would have to ask for vast quantities of data that would be difficult to process—and, in any event, the overseas operator would be likely to say that the request was disproportionate and refuse to hand over the data Noble Lords will notice that I keep emphasising law enforcement and serious cases. In cases of serious crime, including child sexual exploitation, GCHQ can assist law enforcement agencies. In a case affecting national security, agents representing MI5 have told me, face to face, that they do not need or want internet connection records; agents representing MI6 have told me face to face that they do not need or want internet connection record; and agents representing GCHQ have told me face to face that they do not need or want internet connection records If we strip away criminals who will soon get wise and use VPNs, if we strip away crimes that are not considered by US operators to be serious enough to hand over the data and if we strip away crimes that are so serious that GCHQ’s help can be sought—GCHQ can secure the necessary data without the need to store ICRs—we are left with very little. For that very little gain, everyone in the UK’s web histories will be stored for 12 months at enormous cost, and with enormous potential for intrusion into privacy and enormous risk of vast quantities of sensitive personal information being hacked into by criminals and hostile foreign Governments. The only valid conclusion anyone can come to in such circumstances is that the storage for 12 months of everyone’s ICRs is both unnecessary and disproportionate.