Investigatory Powers (Codes of Practice) Regulations 2018 — House of Lords, 2018-02-01
Topic: Law and Crime
Susan Williams (Conservative, Centre-right): My Lords, I am pleased to be given the opportunity today to debate these important regulations, which are all being made under the Investigatory Powers Act 2016 That legislation brings together powers available to our law enforcement and security and intelligence agencies to obtain communications and data about communications. I make it quite clear that these powers are vital to the protection of our citizens. They ensure that our agencies are able to bring to justice serious criminals, including terrorists and paedophiles; they enable plots that threaten our national security to be investigated effectively; and they make sure that our agencies can locate and safeguard vulnerable and missing people. The Act also ensures that these important powers are subject to rigorous safeguards and oversight. It has introduced a double lock, such that any decision to use the most intrusive powers in the Act must be approved by a judge, and it has created a powerful new Investigatory Powers Commissioner to oversee the use of these powers. That post is held by Lord Justice Fulford, who, as noble Lords will be aware, brings a wealth of experience in the judiciary and expertise in matters of law that will be crucial in carrying out this vital role The Act received Royal Assent in November 2016 following comprehensive scrutiny in this House as well as in the other place. The detail of that scrutiny has ensured that the Act provides a world-leading legal framework regulating the exercise of these crucial powers. The regulations that we are debating today form an important part of that legal framework and are all intrinsically linked to the Act’s implementation I make it clear that the regulations do not, of course, create any new powers. However, they ensure that a number of important powers in the Act can be exercised and they set out how a number of those provisions will be used. Collectively, they also create additional safeguards on top of the already rigorous controls that are contained in the Act itself We debate four sets of regulations today. First is the Investigatory Powers (Technical Capability) Regulations 2018. These regulations set out the obligations that may be imposed on a telecommunications or postal operator in a "technical capability notice". Such a notice will require the relevant operator to maintain the necessary capabilities and infrastructure to ensure that when a warrant or authorisation is served on or given to them, they are able to provide assistance in giving effect to it quickly and in a secure manner The Act itself makes it clear that a telecommunications operator may be required, as part of maintaining a technical capability, to retain the ability to remove electronic protection from communications that they have themselves applied. The regulations do not change this position. They simply set out that such an obligation could be included in a technical capability notice, as well as making it clear that the obligation itself may only require any steps to be taken to remove encryption that are reasonably practicable The use of technical capability notices is subject to very strong controls and safeguards set out in the primary legislation. The Secretary of State may decide to give a notice only where it is necessary and proportionate and that decision must be approved by a judicial commissioner. In addition, before giving a technical capability notice the Secretary of State must consult the operator to whom it is to be given and must also take into account a number of factors, including the technical feasibility and likely cost of the operator complying with it. Further, before the notice is given, the Secretary of State must also consider the public interest in the security and integrity of telecommunications systems The Act also ensures that telecommunications operators have an effective right of redress where they have been given a technical capability notice or, indeed, a national security notice or data retention notice. Specifically, the Act makes it clear that the relevant operator may seek a review of that notice by the Secretary of State. When conducting such a review, the Secretary of State must consult the Technical Advisory Board—a non-departmental public body—as to the technical feasibility and cost of the notice, as well as a judicial commissioner in relation to its necessity and proportionality The second set of regulations that we debate today, the Investigatory Powers (Review of Notices and Technical Advisory Board) Regulations 2018, set out the circumstances in which such a review may take place and how the Technical Advisory Board must be constituted The third set of regulations is the Investigatory Powers (Codes of Practice) Regulations 2018. This instrument brings into force five codes of practice under the Act. The codes relate to the interception of communications; equipment interference; the bulk acquisition of communications data; national security notices; and the intelligence services’ retention and use of bulk personal datasets Each of the five codes sets out processes and safeguards governing the use of these vital powers. They give detail on how the relevant powers should be used, including examples of best practice. They provide additional clarity and will ensure the highest standards of professionalism and compliance with the Act’s provisions The codes are primarily intended to guide those public authorities that are able to exercise powers under the Act, as well as telecommunications operators that might be required to provide assistance in giving effect to its provisions. They provide detailed information on the processes for applying to use each of the powers, as well as in relation to the renewal, modification and cancellation of warrants and authorisations. They set out detailed safeguards in relation to the obtaining, retention, handling and destruction of information obtained in the exercise of the Act’s provisions, and they include detailed requirements on public authorities in relation to record-keeping and error reporting to aid the Investigatory Powers Commissioner in carrying out his oversight functions. The codes are detailed and comprehensive, and together include more than 400 pages of guidance and best practice, ensuring that the use of these important powers is subject to the most stringent safeguards The final set of regulations that we are debating today is the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-Keeping Purposes) Regulations 2018. As under pre-existing law, the Act makes it a criminal offence to intercept communications in the absence of lawful authority. It also makes it clear that lawful authority includes interception by businesses or other bodies where it is a legitimate practice. These regulations set out what conduct that includes. Such activities might be, for example, call centres recording telephone calls for training purposes, companies scanning their computer networks to detect cyberattacks or businesses ensuring that their systems are not being used for unauthorised purposes. These regulations simply ensure that companies can undertake these important routine activities without falling foul of the offence of unlawful interception. In summary, the regulations we are debating today relate to provisions already set out in primary legislation and ensure that the provisions can be implemented effectively. They make it clear how a number of powers in the Act will operate and establish additional safeguards to the already rigorous controls set out in the primary legislation itself. I commend the regulations to the House.