HL Deb 13 July 2000 vol 615 cc380-7

3.56 p.m.

The Parliamentary Under-Secretary of State, Home Office (Lord Bassam of Brighton)

My Lords, I beg to move that the Bill be now further considered on Report.

Moved, That the Bill be further considered on Report.—(Lord Bassam of Brighton.)

On Question, Motion agreed to.

Clause 48 [Effect of notice imposing disclosure requirement]:

Lord Lucas moved Amendment No. 55: Page 54, line 12, leave out ("and") and insert ("or").

The noble Lord said: My Lords, I am very much fortified by my success last night on a similar amendment similarly inspired by the notable Dr Charles Lindsey of Manchester University. I am trying yet again to convince the parliamentary draftsmen that they have their grammar wrong.

Clause 48(1) states, both the protected information and a means of obtaining access to the information and of putting it into an intelligible form".

"Both" qualifies two subjects, not three. In any event, the two latter points, a means of obtaining access to the information and of putting it into an intelligible form"; are not both necessary for the purposes of this clause. You need one or the other. I hope that this redrafting will appeal to the Government as it did last night. I beg to move.

Lord Bassam of Brighton

My Lords, I am, as ever, grateful to the noble Lord, Lord Lucas, for his tremendous concern for the English language and linguistic correctness, if I may so describe it. However, I am extremely puzzled by the amendment. My brief states: Resist … Purpose of amendment unclear. Imposes requirement to disclose plain text on persons who have no means of obtaining access to the information; or no means of putting it into intelligible form". I almost expected to see a reference to "intelligible life form".

Unfortunately, in attempting to correct the parliamentary draftsmen—as the noble Lord did so expertly yesterday—he has fallen into the trap of perhaps causing more problems than he has sought to solve. Subsection (1) of Clause 48 is the basic disclosure requirement. It requires persons to disclose a plain text version of the protected information. It also makes it clear that there is no legal obstacle to their using their own key to decrypt the information so that they are able to deliver the plain text. According to subsection (1), this requirement works only if three conditions are met. Effectively, by his amendment the noble Lord is asking whether we need all three conditions, and so it falls to me to explain them.

The first condition is that the person is in possession of the protected information—there is no argument between us on that. The second condition is that the person must have a means of obtaining access to that information. I think it is pretty obvious that the purpose is to make clear that a notice does not entitle the recipient to obtain access to the information. Noble Lords will recall that on Amendment No. 44 we explained precisely why we do not agree that there should be such a right. The third condition, in plain and simple terms, is that the person has the means of putting the information into intelligible form. I should be very surprised if the noble Lord intended that condition to be at all optional. A requirement to deliver plain text cannot properly work without all of these conditions being fully satisfied.

The noble Lord has rightly sought to correct an inadequacy in the drafting, but in so doing he has undermined the working principles behind the way in which we see the clause operating. Obviously I take the point about the drafting—perhaps we should look at that again—but I ask the noble Lord, having scored his instant hit yesterday after many years of trying, to withdraw his amendment.

4 p.m.

Lord Lucas

My Lords, I am not surprised. There are a couple of points that I still do not understand. If a person is in possession of the information, how can they be lacking a means of obtaining access to it in the way described by the noble Lord? Having listened to the noble Lord, would not it be sensible if the word "both" was left out?

I remain puzzled by the wording of the clause and the way it will work. But I shall not detain the House now; I shall study in Hansard what the noble Lord said. I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Lord Cope of Berkeley moved Amendment No. 56: Page 54, line 17, at end insert— ("( ) Where a person who has been given notice under section 47 believes that compliance with the notice will involve breaching a legal duty of confidentiality to another person, he may, within 24 hours of receipt of the notice, refer the notice to the Interception of Communications Commissioner who shall rule whether that person shall breach that other legal duty or whether the notice shall be withdrawn as disproportionate, having regard to the effects of the notice in either case.").

The noble Lord said: My Lords, this amendment has been brought forward because of the concerns of bankers and others in London that a conflict may arise in their obligations as a result of the Bill. The concern has been expressed to me by a number of organisations and companies that the provisions of the Bill may conflict with both their ordinary legitimate business arrangements so far as concerns commercial confidentiality and with the legal obligations they owe to their customers world-wide. After all, a key— which is what this clause is all about—that can be used to decrypt one message may also be capable of decrypting other messages which are nothing to do with the crime or possible terrorism—whatever it is that is being investigated—for which the key has been requested.

In these circumstances, they are extremely concerned, first, that they may face enormous legal challenges and, secondly, that their business will emigrate overseas. Any perception—and perception matters here quite as much as the reality—by customers and financial institutions that doing business in this country, in London or elsewhere, would be less secure because the confidentiality of encrypted messages was not protected as thoroughly as elsewhere could have a significant adverse impact on this country as a place to do business, particularly e-business, and on London's attractiveness as a financial centre.

Of course, to some degree it is a question of comparison of perceptions; that is one of the disadvantages of the Government's proud boast that they are in the lead in taking powers to tap the Internet in this way. That is why we have attempted in Amendment No. 56 to suggest what might happen when an organisation, a company or a person has been given a notice under Clause 47. If they believe that to comply with the notice will be to breach a legal duty of confidentiality to someone else, they should have somewhere to go—in the amendment we suggest the commissioner—to decide which of the legal obligations they should honour.

Where they are placed in the dilemma of whether to dishonour the legal obligations they have entered into with their customers or to disobey the legal notice with which they have been served, it seems to us that the commissioner—the judicial figure—would be the right person to decide which of those legal obligations should be carried out having regard to the importance of the case, the importance of the investigation, the importance of the key and so on, on the one hand, and the effects on the business of giving way and obeying the notice on the other.

We have suggested 24 hours as the time within which the recipients of the notice should be allowed to appeal. The danger will be immediately obvious to them, but while an appeal was running it would hold up the authorities—the police or whoever wanted the key—and they should not be allowed an infinite time for that. We think that 24 hours is a fairly minimal time but that is the suggestion in the amendment. We have not necessarily found a perfect solution but the amendment draws attention to a very real and potentially very damaging problem. I beg to move.

Viscount Goschen

My Lords, my noble friend's amendment is a welcome initiative to highlight one of the central concerns that industry has about the Bill. Of course, in the matter of encryption keys and the disclosure of those keys to public authorities, the potential effect goes far wider than those businesses which are actively involved in e-commerce; it goes to all businesses, particularly those of an international nature.

A provision whereby members of staff or the directors of a firm are put into a position of jeopardy and run the risk of breaching confidentiality undertakings with clients and other people with whom they have interaction is one of the central areas of difficulty over the Bill. My noble friend Lord Cope has suggested one solution—which I am sure would add a significant degree of comfort—but he has also indicated that he is not necessarily wedded to every detail of the amendment. So there is a good opportunity for the Government to come forward and say how they propose to address the situation.

I caution the Minister against saying "Don't worry. There is no difficulty. This is pure perception". The first point is that there are a number of people and bodies that would not agree with that point of view; the second point is that, even if the Government were very confident of their argument, there is still a significant problem of perception. The Minister cannot possibly be in a position to understand all the intricate contractual obligations that business might have made with customers in these circumstances. I suggest that it would be very difficult for the Minister to brush those aside.

There is a real opportunity here for the Government to be constructive and give some additional comfort to industry. My noble friend has highlighted a significant point. I hope that the Government will take this opportunity.

Baroness Thornton

My Lords, I listened to the debates both yesterday and today. Several noble Lords made contributions on the basis of how industry perceives the problem. I am worried about that. Clearly, future investment depends on how people perceive the framework around this issue. Noble Lords opposite say that the way in which industry perceives the matter is a justification for not making the kind of effort proposed in the legislation. But perhaps industry's perceptions are wrong and the issue that noble Lords should tackle is industry's perceptions. There has been a huge amount of lobbying from the Internet industry. Perhaps noble Lords should ask questions of the Internet industry. Perhaps they should say, "You perceive that there are these problems, these threats and so on that discourage people from investing. But what do you think are the answers to these issues?".

For example, yesterday, I visited the website of the organisation run by Mr Caspar Bowden. I looked at the organisations that are involved in his campaigning and the work that he has done on the Bill. I noticed that not a single childcare organisation or organisation involved with the education of the young and their relationship to the Internet is involved in his campaign. That is very worrying indeed. Does industry gain its perception from those who do not reflect the users about whom we are concerned—the children, the young and those who are vulnerable? I ask noble Lords to address the issue of the perception problem of which they have made so much in the past few days.

Lord Lucas

My Lords, with the amendment we come to what I see as the one remaining major difficulty with the Bill. How can a reputable international business be sure that its keys, or such keys as it keeps in this country, will be properly treated? When thinking where to place one's jewels in a safety deposit box, one might hesitate before choosing Harrods. All the systems, safeguards, contracts and guarantees can be in place, yet perhaps there remains an element of mistrust. That is what the Bill, as it stands, introduces into the thinking processes of international businesses. When an international business is faced with deciding where to place its centre of business, which is where the keys will be stored, generated and maintained, will it choose a country where those keys at all times remain in its possession and under its control, or will the keys be kept where a chief of police with a particularly pressing problem can unlock the whole security system?

The noble Baroness has drawn attention—

Baroness Thornton

My Lords, does it not rather depend on what one is doing?

Lord Lucas

Yes, indeed, my Lords. The noble Baroness has drawn attention to some very important problems. We cannot put structures in place which make it difficult or impossible for the police to deal with real crime and real criminals. But what we likewise must do is change the perception of business, in terms of an accurate perception of the risks which the Bill poses for the safety and the sanctity of its encryption structure, which is what it uses to protect its business and what it uses to guarantee its dealings with other people. We have to find a better way of dealing with that problem than is in the Bill at the moment.

The amendment addresses one possibility. For example, if Barclays Bank is faced with a raid on its keys, it can appeal to an interception commissioner. It can say, "This is entirely out of proportion. They ought to be satisfied with plain text". It gives a chance for a business to keep control of its keys. We shall come later to Amendments Nos. 62 and 63 and to other amendments which deal with other ways of achieving this purpose.

We do not want to see all the dangers and difficulties portrayed so graphically yesterday by the noble Lord, Lord Stevenson. We do not want to produce in the minds of international lawyers, who I suspect will be the people making these decisions, when they are questioning whether a business should put its headquarters in England, The Netherlands, Germany or Switzerland, the thought that they should cross out England because they cannot be sure of the safety of their key structure. We must avoid that kind of position; otherwise, as the noble Lord, Lord Stevenson, said, we will loose by stealth, without anybody knowing it, our core international e-business. That will be followed, as surely as night follows day, by the administrative infrastructure of those businesses moving out of this country.

It may be that this is not the right way of achieving our purpose. It may be that this amendment offers too many opportunities for the criminal to impose a day's delay and to use it. But we must in the course of today at least find some way to make it absolutely clear that a reputable organisation running a large international business will never lose control of its keys, will always be in a position of being able to maintain its security, and that it is absolutely clear to the most cynical of foreign lawyers that that is the case.

4.15 p.m.

The Earl of Northesk

My Lords, I rise to support the amendment. Perhaps I may say to the noble Baroness, Lady Thornton, that this matter is not only one of perception; to a certain extent it is all fact. To try to illustrate the point, I should like to quote from someone called George Hall, Director of Corporate Affairs at ICL. He had just announced a 10-year, £350 million contract to supply—the irony is lost on me—the Home Office's IT services and support. Yesterday he said: We trade in many countries and most are not going down this road because the governments there realise they need to encourage the growth of e-business. There is a strong industry view that this legislation casts doubt on the UK Government's commitment to e-business". That is a factual response: QED, my Lords.

Lord Bach

My Lords, I delayed rising to my feet because I thought we would probably hear something from the Liberal Democrat Benches on this important issue. Obviously, we shall not.

I am grateful to noble Lords for having had a proper, decent debate on this important amendment, which stands in the name of the noble Lord, Lord Cope of Berkeley. The amendment would mean that if a recipient of a Clause 47 notice believed that complying with it would breach a confidentiality agreement, he or she could refer the matter to the interception commissioner for a ruling on whether the notice should be withdrawn.

That is a difficult issue. We discussed it in Committee. Obviously we appreciate that the noble Lords, Lord Cope and Lord Lucas, expressed some continued reservations then about the position. We have received some representations from industry about the question of potential breach of confidentiality arrangements and we have sought to explain the position to them. We do not believe—indeed the noble Lord, Lord Cope, and other speakers have suggested that this may not be the exact or right solution—that the suggestion proposed in the amendment about referring any case to the interception commissioner where there is doubt about breaching a confidentiality agreement would be workable. The interception commissioner would not be the right person for such a referral in all cases. It does not seem to us right that the commissioner should be the one who has to decide whether confidentiality should outweigh the reasons for seeking access to the information. That is part of the proportionality exercise, and properly one for the person authorising the notice and the person giving it.

I should add two other points which may offer some comfort. First, we do not think that the commissioners should have a formal role here. But their oversight function will be crucially important, especially perhaps in the early years of these provisions, in ensuring that the proportionality tests are properly applied. Secondly, there is always access to the tribunal. The tribunal will hear cases under the Human Rights Act concerning these powers. It will also hear ordinary complaints. It will have power to grant interim remedies, following an amendment we made in another place to Clause 65(6).

As we said in Committee, we have looked at the possibility of reflecting the secure position of persons acting in obedience to disclosure notices served under the Bill. Our reassurance, again for the record, is that we believe a contractual term will be unenforceable if it puts someone in breach for meeting a statutory requirement and we expect the criminal law will be construed similarly. We have looked at other relevant legislation—for example, the Drug Trafficking Act 1994—to see whether there is a precedent for offering some protection on the face of the Bill. But the Drug Trafficking Act situation is different from that under this Bill. That Act deals with a person acting on a subjective suspicion. Under this Bill, the person obeying the Clause 47 notice is obeying a statutory requirement which unequivocally applies to their situation. In short, there is no doubt as to the lawfulness of what the person who obeys a notice is doing.

I have to be even more circumspect about litigation in another jurisdiction, on a contract governed by foreign law. I can, however, confirm what the Minister of State said in another place. He said that a person's duty of confidentiality to another, however it arises, will always be compromised to a greater or lesser extent by national rules requiring the disclosure of information. In this respect, Part III of the Bill does no more than the many disclosure requirements approved by Parliament over the years.

There are difficult issues here. The representations we have received on this point have largely come from industry. But we have continually said in discussing the Bill that, for legitimate businesses not themselves suspected of criminality, the disclosure of plain text rather than keys must be the expected norm. This information is no more than information to which a variety of authorities have lawful access now under a variety of statutory powers. That is the reality.

Perhaps I may make two other brief points. We shall come shortly to government Amendment No. 70, which specifically requires that a person asking for a key must consider how much more data may be revealed than is strictly required. That offers some reassurance on the issue. We shall come to that amendment later. Even later than that we shall come to Amendment No. 87, which stands in the names of the noble Viscount, Lord Goschen, and the noble Lord, Lord Cope. While I do not want to reveal everything at this stage about how the Government will respond to that amendment, it may be that the noble Viscount and the noble Lord will receive some good news. In the light of what I have had to say, I hope that the noble Lord will feel able to withdraw the amendment.

Lord Cope of Berkeley

My Lords, I am grateful to the Minister for his response to the amendment. I hope that it will help to reassure those outside the House who are concerned about this matter. Perhaps I may make a brief point in response to the noble Baroness, Lady Thornton. She was concerned that in moving amendments we may sometimes over-emphasise perception. But we have always emphasised, too, that such perceptions are based on the reality of the situation as it stands before us. That is why perceptions are difficult to change. One of the organisations that has said it is considering moving overseas as a result of the Bill is Poptel, the large Internet service provider. On its website it lists its clients as including the British Association for Study & Prevention of Child Abuse and Neglect. I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Lord Bach

My Lords, I beg to move that further consideration on Report be now adjourned.

Moved accordingly, and, on Question, Motion agreed to.