Justice Committee

Meeting date: Tuesday, September 27, 2016

Official Report 476KB pdf

---

Investigatory Powers Bill

Item 4 is consideration of a legislative consent memorandum on the Investigatory Powers Bill. We will hear from Police Scotland and then from the Cabinet Secretary for Justice. I remind members that our consideration will inform a report to the Parliament on whether a legislative consent motion in relation to the bill should be agreed to. We will consider a draft report next week.

I welcome Assistant Chief Constable Steve Johnson and Detective Superintendent Brenda Smith, from Police Scotland, to the meeting. I invite questions from members.

I thank the witnesses for their attendance. There is always a balance to be struck between pursuit of an inquiry and intrusion into privacy. What options do you consider before you seek some of the authorisations that are available to you?

The quick answer is that we explore all the options that are available to us. We look for the most and least intrusive means of conducting the investigation, which can be anything from normal street patrols and street investigations, conducted by our uniformed officers, right the way through to covert inquiries that use surveillance units and so on. We try to explore all the options that are available to us.

If we do not use an option, it has probably been ruled out because we have deemed that it would frustrate the purpose of the inquiry or the investigation in the first instance. There is a range of investigative opportunities for us prior to resorting to the tactic that we are talking about.

Thank you. Can you explain what significance is afforded to collateral damage through intrusion into other individuals’ privacy when you make decisions about the pursuit of certain courses of action?

On collateral intrusion, one of my key aims as the authorising officer is being clear about the information or intelligence that we are seeking to identify in terms of the subject of the application. The officers then have to tell me where they believe that collateral intrusion will occur and at what level it will be. For example, if a subject who lives among a wider family goes to visit their mother and father, it would be deemed collateral intrusion if I gained information about the mother and father, because they are not the subject of the application. I seek to minimise that by saying that, if we know the times and dates when such visits take place, we will concentrate our activity on periods when we know that we can focus on the subject of the application rather than have other people involved. We ask the officers to be very specific and detailed, so that we can minimise collateral intrusion.

That is very reassuring, but nonetheless information will be acquired that is not necessarily pertinent to what you are pursuing. What happens about that?

I hand over to Brenda Smith to explain how we manage the deletion of that material.

In preparing the case for the subject, we prepare a background and do due diligence around that to understand whether the subject has family and who they are, whether they stay with each other and what their lifestyle and activities are so that we have a good understanding of what the individual does in terms of criminal activities. When we monitor that individual, we therefore have an understanding of what they do so that we can focus on certain aspects and times to minimise the collateral intrusion around that individual. For instance, if they were at home, we would monitor them only when they were at home. If we pick up collateral information on members of their family, we cannot unknow what we know but we do not continue with the information: we would not collect the information and we would not record it.

Do you make a recommendation to the authorising officer? Is that what you do when you scope the individual’s background?

Yes. We would document in the application process exactly what we had done regarding the individual’s background.

Have there ever been instances in which your recommendation has not been taken up?

No.

Never?

No.

Right.

I have a question about your relations with United Kingdom-wide agencies and the security services. Are you aware of their activities and have they sought authorisations that you yourself can seek?

If we are working together with those agencies, we consider who is the most appropriate agency to submit an application in terms of what they are seeking to achieve, whether it is in Scotland or in the broader UK. We work with those colleagues, and the principles of the Scottish crime campus are that we liaise with those other agencies that have the same powers as us so that we are not duplicating effort and are focusing in on individuals and not looking twice at the same people. That could not happen, given the way in which the application process happens, but we have a dialogue with those agencies as well.

Could they be the lead agency regarding investigation of crime in Scotland?

It very much depends on what the investigation is, but yes, absolutely. The National Crime Agency or the security services could lead in investigations. If they do, they consult us on the jobs that we are aware of. However, for those jobs that we are not aware of, they put in their applications via their own means.

So it is conceivable that there are operations on-going in Scotland that you are unaware of.

It is conceivable but, as I said, through the Scottish crime campus and the relationships that we have with those other agencies, we would normally be more likely to know about an operation than not.

Many thanks.

I want to probe how data is dealt with electronically and some of the implications around that, picking up in particular on what Ms Smith said earlier about not collecting or recording data when there is collateral intrusion. I just want to probe what that means. I assume that when collateral intrusion is involved in circumstances in which the data sought and received is electronic, it ends up in some form on police computers. Is that a reasonable assumption?

Are we talking about the intercept or the communications data aspect?

I accept that my question is a more general one that goes beyond the bounds of what we are dealing with today. I am trying to get some understanding of the operational processes around data, but my question is triggered by what is being said in relation to the Investigatory Powers Bill.

Any activity that we do is targeted against a specific individual or group of individuals, therefore the authority that we have in place is in relation to the authorised purpose—it may perhaps be murder, abduction, drug dealing and so on—against specific individuals. The activity is targeted initially, so should a set of circumstances arise whereby the person is not utilising whatever we are monitoring, that is picked up very quickly and, once it is picked up, the data is discarded. As I said, we cannot unknow what we know, but we do not take it further.

To be clear, we are being told that if data comes to your attention as a police force, it will not be entered into the indexes and case files, but it can nonetheless be present—apparently transiently—on the police force’s computer systems.

Okay—that is the point that I wanted to get to. I want to explore what you do under those circumstances. I have two questions. First, I want to explore how that data is removed from your computer systems—I accept that it has never reached case files or been indexed as such.

There are different types of data, because there are different types of intercepts and communications data. Intercept data, for instance, would be deleted straight away.

Before we proceed on that point, may I ask what that actually means? My background is technical, so you will forgive me. Deletion on a computer system in essence involves the removal of the electronic index but not necessarily the overwriting of the data, which might remain on a storage medium. Do you merely use the technology that is available to delete the index, thus leaving the data potentially to be recovered from another part of the storage medium?

The data would be deleted from the system.

Using the facilities of the system.

Yes.

The data is therefore not necessarily removed from the electronic medium that it is on; it merely ceases to be accessible.

No, it is deleted from the system.

Okay. I may come back to that.

I will ask my second question. I am sure that, as any professional users of technology would do, you back up your operating environments and all the data that is on the disks and other storage mediums that you have, thereby capturing to your back-up data operational data that you may have—in a different sense—deleted. How do you deal with the presence of data that may be in historic back-ups of your electronic system and that you wish to have deleted?

This is a highly technical area of business. In our systems, if we say that we have deleted the information, it is deleted in that it is not visible to the officers or myself, so we or Police Scotland are not able to use that data. I am not entirely clear about how the technology works and how the binary and all the widgets that sit behind it work, but our systems and processes in that regard are all inspected by the Interception of Communications Commissioner’s Office, which assesses how we manage that information and what systems we use to manage it. Our use of those systems has all been signed off.

Once we have deleted information, it is not available for any officers to see. I think that the suggestion is that it would be there for somebody to see if we have not deleted it. However, it has been deleted, it is not there for Police Scotland to use and we certainly would not use the back-up systems to try to find data that we had previously deleted.

I understand that and that is quite clear. However, the reason that back-up systems and back-up data files exist is so that, in certain operational circumstances, they can be restored.

Yes.

How do you prevent the restoration of data from back-up undoing the process of deletion that you had undertaken?

That is, again, very technical. I do not have that technical detail—

Perhaps you might answer after the committee meeting.

We can certainly reflect on that; if there is anything that Assistant Chief Constable Johnson wants to add to his evidence today, we would be happy to hear it. He has been given quite a forensic questioning on that particular subject.

10:30  

Is it possible to have some general information on your data retention policy, such as how long you keep things and how you see that being changed by the Investigatory Powers Bill?

There is no simple answer to that. In simple terms, if we acquire the data by lawful interception it is converted into a usable intelligence product; when it is deleted from our systems we have no other access to it.

Intelligence stays on our system—the Scottish intelligence database—for a period of time in line with that policy, which is for six years. However, that is not to say that it will be deleted at six years. If the data relates to a case that has been closed and completely dealt with, it is reviewed at that six-year point; if we can delete it, we do so. If the data relates to a cold case or a case that we have not solved, it is entirely appropriate that, at that six-year point, we take that review and say that we need to retain the data for a lawful purpose. We hold the data legitimately, but it would be wrong to delete it; if we did, it would not be available to the detectives who conduct the cold case reviews some years hence.

At the six-year point, we do those regular reviews and we extend for a period of time that the investigating officer feels is fit for purpose. We keep some things for life, but that depends on the appeals process for the whole life of that data. That is for very specific offences.

I remind members that in considering the LCM we are looking not at the whole provisions of the bill, but at the devolved aspects.

I want to ask about the warrant question regarding the interference of property. Where the police think that there is an urgent need for a warrant, under what circumstances would you consider not asking for judicial permission?

Very often we deal with situations—kidnapping or extortion is a good example—in which there are quickly collapsing timescales. In such situations, we would seek authority to try to preserve life under our article 2 responsibilities. Such circumstances—in which there is an immediate and imminent threat to life—are the only circumstances that I can see in which perhaps, rather than slow down to go through the whole judicial authority process, we would seek that activity to get the information and intelligence first-hand and then get the judicial oversight afterwards.

That is similar to what happens now. From the operational perspective, if a life is imminently under threat, I would seek to preserve that life. Those are the circumstances in which I would seek to use that power, but I would always want it checked up by judicial authority.

What is the timescale for informing the judicial commissioner that you have issued an emergency or urgent warrant?

Do you mean under the bill?

Yes.

The bill says as soon as possible, within three days.

My understanding is that the bill says that the judicial commissioner has to give his view on it within three days. I am asking how quickly you have to inform the judicial commissioner that you have issued an urgent warrant.

Obviously, that will be a new process between Scottish ministers, ourselves and the judicial commissioners; that is still to be determined at this point. They will be busy with other stuff; I would imagine that we would try to tell them as soon as possible.

From an operational perspective, as someone who will provide that authority as the authorising officer, I will seek that judicial approval as quickly as I can. We have a compelling reason to ask for that information—we have a life that is at risk. We will try very quickly to preserve that life, but the officers will have to put in the intelligence, about necessity and proportionality and due consideration, in order to meet that requirement. I will not try to stretch that out for the three days to see what data we can get. It is in my interest to get that information and intelligence as quickly as I can, while also lawfully holding the information and intelligence that I need.

How long do you envisage that taking? Minutes? Hours? Days?

I would love to think that if, at 2 o’clock in the morning, I am told that someone has been kidnapped and is being held at gunpoint in a house somewhere in Scotland, a judge would be available at half past 2, but that will probably not be the case. In that situation, I could see it taking hours before we got hold of a judge.

We would expect the judicial process to kick off within the first few hours. If it is during office hours, things can progress quickly. However, again, if it is 2 o’clock on a Saturday morning, it might be more difficult. From the perspective of Police Scotland, we will seek that authority as quickly as we can get it. What will slow the process down is the availability of a judge and the ability to carry out that second process.

Does the fact that the issue must be scrutinised within a three-day period lead you to think that you would look for more information before asking for approval for the urgent warrant, rather than just presenting it to a judicial commissioner?

I do not think that we would be asking for any more information than we already gather. We already have a thorough and in-depth process that involves reviews by an authorising officer and the cabinet secretary. These applications are already dealt with as the most serious intrusions that we can make into somebody’s privacy. I suggest that, for Police Scotland, little will change in relation to the process, particularly for an urgent application for a warrant. We might have limited information and intelligence, but we would still try to build the case in exactly the same way as we would over a longer period.

I want to ask a follow-up question on that point. If approval is not given for a warrant, given that you have already said that you cannot unknow what you know, is all the information that you have collected immediately and completely destroyed?

That data will have been lawfully obtained, and we would seek guidance from the new judicial commissioners about whether they wanted us to retain that data for inspection by them or delete the data there and then.

Could there ever be an instance in which information that you gather, even though the warrant has not been approved, could lead to another warrant being issued for something else?

It would depend on the circumstances. Intelligence is fluid, and you might obtain intelligence during that period that is relevant to something else. We are absolutely duty-bound to ensure the safety of the public, so we would react to that.

Would you need to go through the same process again of asking for judicial permission?

Yes.

There would have to be a second application based on the new intelligence. However, once an application is turned down or refused, everything stops at that point.

The judicial process in the bill will be new for us. Just now, the process involves the Scottish ministers. A lot of policy and process will have to be evened out.

You say that there will be a lot of new policy and a lot of changes. How confident are you that all the regulations surrounding the new policy will be properly fed down to the officers who will be using them?

I am absolutely confident. There is no issue with that. The officers who need to know about the regulations in order to do the job will be informed straight away, as soon as the regulations have been resolved.

Part of the problem that we have is that we are not dealing with the complete bill. Brenda Smith and I sit on the UK national groups—I am on the gold group, which will cascade the information down to all the officers and staff who are involved once the bill is complete. That group is chaired by Chief Constable Mick Creedon of the Derbyshire Constabulary. Brenda Smith sits on the tactical group, which will ensure that, in relation to the discrete areas of business—lawful interception, equipment interference and communications data—we can deliver the appropriate training to our officers, to ensure that their knowledge is up to date.

Part of the problem that we have at the moment is that we are all planning for something, but we do not know what the final version will look like. However, once we get to that point, we have systems in place to communicate the necessary information to the officers who are involved, starting from the acute end—those officers who normally apply for the data—and going right through the broader population of the police service in Scotland.

That is encouraging, given that communication is a perpetual problem in Police Scotland.

Liam McArthur has the next question.

As Mary Fee has covered the point that I was going to ask about, concerning the modification of warrants and the role of the judicial commissioners, I wanted to ask about something that Oliver Mundell raised earlier. However, I think that Mairi Evans wanted to comment on the back of the current line of questioning so it might be better if she has the next question.

No, it is fine. Mary Fee asked the question that I was going to ask.

I will go back to the area that Oliver Mundell explored, which related to the retention of data generally and the six-year timeframe that Assistant Chief Constable Johnson set out. Clearly, some cases, even complex ones, will be resolved well within that period. Towards the end of the informal briefing that we had a few weeks ago, we covered concerns about why the data is retained until that six-year point, even when a case has been closed. The concern is that data could be used as part of a fishing expedition for subsequent cases. I seek reassurance on that. Where cases have been resolved—perhaps the data has proved instrumental in leading to their conclusion—why does Police Scotland hold on to that data to the six-year point when there is no real reason for doing so?

Interestingly, we keep other information for those time periods—there is one policy for that. Even if the judicial process has been gone through, there is potential for appeal, so there is no hard-and-fast rule.

We do not carry out speculative searches relating to some point in the past—the data is held in relation to the case file.

In relation to LI, all the data is deleted and all that we have is, if you like, an interpretation of the data that is put on the Scottish intelligence database. The actual data that we get through the product—so the most sensitive area—is all deleted at that point. Communications data is linked with the case file and is subject to that review. Therefore, it will not be speculatively searched; it remains with the individual case. We take exactly the same approach to other information that we hold in relation to a case file, whether that is paper files or other traditional types of information that we hold.

From recollection, you talked about information that might be relevant to another case being subject to a separate application and drawn from that.

Oh, right.

I think that you understand why there is concern about contamination across different processes when information that has been gathered for one reason is deployed for other reasons in another case. The fairly arbitrary timeframe of six years is not proportionate to the case that was used to back up the original application. The data is simply held because six years is the arbitrary timeframe that you have agreed you are going to operate with, which does not seem entirely satisfactory.

I am not sure that the retention period is entirely arbitrary. History tells us that we are often asked for information relating to a case or that people, not just within Police Scotland, can review the case for other reasons beyond those dates. I can have a look at the retention policies and ensure that they meet scrutiny, but our retention policies are part of the inspection that is done by IOCCO, which is content with the policies at this stage. That is a separate view.

The way in which we retain the information could be something for the judicial commissioner to comment on in future. However, there is no nefarious activity by Police Scotland in relation to the data that we hold.

To follow that up, we have had a submission from the Equality and Human Rights Commission, which rightly points out that

“Intrusion into the privacy of persons who are not suspected of wrongdoing is unlawful unless absolutely necessary and proportionate”.

What specific tests are undertaken to ensure that such interception is “absolutely necessary and proportionate”?

The first test is necessity. There should be a legitimate aim, which is the prevention and detection of serious crime. Once that criterion is met, the authorising officer has responsibility for balancing that and considering the proportionality of the intrusion into the person’s private life given the legitimate aim that we are seeking to achieve of the prevention and detection of crime.

10:45  

Striking that balance is not a quick process; after all, each subject has different needs and elements that might impact on them. The size of the family is one issue—you asked about collateral intrusion. If we have a very focused and individual application in which there is little collateral intrusion—and we must remember that we are talking about a subject who is engaging in serious and organised crime, and potentially the most serious offences that we have, including human trafficking—the activity will be focused on those individuals and will provide intelligence on them. Therefore, the opportunity for collateral damage is minimised. You have already heard about the processes that we can put in place to ensure that, if collateral intrusion occurs, that information is deleted and is not held any longer.

Right from the point at which the application is made, we focus on the individuals in question, and I will decide the balance to strike between the intrusion into their rights and their private and family life and looking at the sort of on-going criminal activity in which they are engaged and the harm that they are causing the community. In the vast majority of cases, it is all about striking a balance between an individual’s article 8 rights and my article 2 duties with regard to preservation of life. The sad fact is that a lot of these applications relate to people who are involved in human trafficking, the importation and supply of class A drugs and so on. On average, there are two drugs-related deaths a day in Scotland. I have to balance that consideration against the intrusion into the rights of people who we know are, to some degree, importing class A drugs and new psychoactive substances; in other words, I have to balance the intrusion into their article 8 rights to privacy with trying to keep safe the people of Scotland, two of whom are, on average, dying drugs-related deaths each day.

That balancing picture and the information for it are there: I do not use old data to balance the competing demands. I use current data and I understand that it will come under scrutiny by the Scottish Government and the judiciary. Indeed, I welcome that scrutiny, because it is not right for me to have carte blanche in intruding on people’s privacy. I take that work seriously.

I understand the point about competing rights and hear the clear message that the necessary and proportionate test is always carried out before a warrant is granted.

That concludes our questions. I thank ACC Johnson and Detective Superintendent Smith for attending this morning, and I suspend the meeting to allow the cabinet secretary and the other witnesses to take their places.

10:47 Meeting suspended.  

10:49 On resuming—  

I welcome Michael Matheson, the Cabinet Secretary for Justice. This is the cabinet secretary’s first formal appearance before the committee—he has met us privately. He is accompanied by officials from the Scottish Government: Graeme Waugh is from the defence, security and cyber resilience division; and Lauri Mitchell is from the directorate for legal services. For the record, Lauri is my niece—I have not seen her for months; she never writes, she never calls. [Laughter.] You are doubly welcome, Lauri.

In the past few days, the committee has received two letters from the cabinet secretary that address recent developments in relation to the Investigatory Powers Bill. We have published those letters on the committee’s web pages.

Cabinet secretary, do you want to make opening remarks on the LCM?

Thank you. I promise to keep my remarks brief.

The Scottish Government has made it clear that we fully support law enforcement agencies and the security and intelligence agencies having access to the powers that they require, as long as those powers are proportionate and are subject to the appropriate safeguards and oversight.

The areas of the bill that are subject to the LCM are about maintaining the status quo, clarifying the existing law and putting in place an enhanced oversight regime in the form of an investigatory powers commissioner, supported by a number of judicial commissioners, who will all be serving or retired senior judges.

I am aware that concerns have been expressed about aspects of bulk powers. I share some of those concerns. However, those are reserved powers and are matters for the UK Government and the UK Parliament; they are not matters that the Scottish ministers or the Scottish Parliament can determine.

I provided further information to the committee yesterday on the technical advisory panel, provision for which is being included in the bill to implement the recommendation that David Anderson QC made in his review of the bill’s bulk powers.

It is unfortunate that UK Government amendments on matters that extend to Scotland continue to come forward at this late stage of the bill’s progress, but I am sure that the committee appreciates that the bill is complex. Despite the timing issues, which are beyond our control, I have been keen to ensure that committee members have all the information that they require to aid their understanding of the matters that are subject to the LCM.

I am happy to answer questions from members.

Cabinet secretary, I share the concerns about bulk powers that you expressed in your letter. I know that that is not what we are addressing today, but the powers will have an operational effect in Scotland.

David Anderson concluded:

“there is a distinct (though not yet proven) operational case for bulk equipment interference”.

Is that where your reservations come from?

In part. That is why we reserved our position until David Anderson had carried out his review. His specific recommendation was that a technical advisory panel be established, to advise and inform the new commissioner on action that can be taken and to address on-going technological advances that will reduce some of the potential risks associated with bulk powers.

It was right to reserve our position until David Anderson’s review had been carried out, and his recommendation is welcome. As I said in my letter, I am keen that the technical advisory panel should be able to advise the Scottish ministers on the matters that I described, and the engagement that we have had so far with the Home Office on taking such an approach forward has been productive and helpful.

Thank you.

I asked Assistant Chief Constable Johnson, who was on the previous panel of witnesses, about the potential for UK-wide organisations, the security services and others such as the National Crime Agency to be involved in operations in Scotland that Police Scotland was unaware of. He talked about the level of co-operation and acknowledged that it could be the same. Do you have any concerns about the roles or functions that those bodies might fulfil in Scotland? Are you concerned that you or the Lord Advocate could be bypassed?

In relation to the security and intelligence services?

And the National Crime Agency.

In order to be directly involved in operational matters in Scotland, the National Crime Agency requires consent from the Lord Advocate. There is a clear process for its role in Scotland. Given the nature of the National Crime Agency’s jurisdiction, it requires the express consent of the Lord Advocate to its engagement in relation to criminal activities in Scotland.

As you will appreciate, the vast majority of the work that is undertaken by the security and intelligence services is primarily focused on issues of national security. As a result, any authorisations that they require for their work in that area, including within Scotland, would be matters for the Home Secretary. However, where they are engaged in work with Police Scotland to prevent or detect serious crime, they require the authorisation of Scottish ministers when it comes to interception. The additional measures around bulk powers and the way in which information can be interrogated will also require authorisation from Scottish ministers. I think that extending some of the responsibilities of Scottish ministers in that area will helpfully provide us with greater oversight of some of the activity that the security and intelligence services could be involved in relating to the prevention and detection of serious crime.

Do you see any benefit in UK oversight rather than specifically Scottish oversight?

Do you mean in relation to national security matters?

No—I mean in relation to the investigatory powers commissioner and their UK-wide remit.

We have a three-commissioner system at the moment, so moving to a single commissioner is the logical step in drawing together all that expertise into a single body. I think that that is the right approach, and operating on a UK basis at present is probably the best approach, given the nature of the reserved matters that are dealt with in the Investigatory Powers Bill.

I probed the police witnesses on the previous panel about some of the technological issues around how they deal with data that comes to their notice but which is outwith what they are allowed to have and keep. I was satisfied—although I could not say whether my committee colleagues were—that the police had appropriate procedures in place to ensure that that data did not enter into consideration in criminal files and so forth.

However, I was left with one technical issue that perhaps might be for Mr Waugh to deal with, or perhaps even to take away. Most computer managers undertake whole-system back-ups to ensure that they can restore whole systems in the case of destruction. What about the unwinding of deletions, so that data becomes available again? What processes will be in place to ensure that that does not happen?

I will ask a second question, just to get it out of the way. The technological advisory panel will clearly be a source of considerable expertise on a whole range of issues. Will the deliberations and knowledge that come out of that panel be made more widely available to Government departments that are involved in legal enforcement in a range of areas in relation to which, quite outside the Regulation of Investigatory Powers Act 2000, similar issues arise? Is there an opportunity that arises from what is happening with RIPA?

On the first point, I bow to your IT knowledge, which is greater than mine and, I suspect, greater even than Graeme Waugh’s. I understand the point that you make about the potential to unwind deleted details on the system. Graeme Waugh may wish to say something about that, but it may be something on which we would have to come back to the committee with further technical information, if that would be helpful.

If I have given you the impression that I know anything about such technical matters, I can only apologise. We can certainly look into the matter further with Police Scotland and come back to the committee on that point.

11:00  

I do not think that we will get too much further on that.

I am not trying to be technical—I am looking for procedural issues.

We will come back to you on that specific point.

Your second point was about the technological advisory panel. The potential that you described exists. We have RIPA and the Regulation of Investigatory Powers (Scotland) Act 2000, which a range of bodies in Scotland use to exercise powers. For example, the 2000 act can be applied to tackle environmental crimes through the use of covert means for the purposes of building up intelligence and evidence. It can also be used by local authorities to deal with various issues, including domestic disturbances. Those aspects are governed by the regulations around that process.

It would be helpful for the technological advisory panel to be able to advise Scottish ministers. It has a very specific remit, part of which is to look at whether, as technology advances and develops, there are ways in which Police Scotland can undertake the type of work that we have discussed while minimising even further the risks of unintended or unnecessary intrusion. Having access to that information could assist us in informing public bodies in Scotland, along with Police Scotland, about some of those alternative technologies as they develop and come forward.

The simple answer to your question is yes, and that is one of the primary reasons why I would like the panel’s remit to extend to advising Scottish ministers.

Good morning, cabinet secretary. As you—and John Finnie—did earlier, I put on record my serious misgivings about aspects of the bill, particularly in relation to bulk data. However, I will focus on the areas that we are required to look at with regard to the LCM.

There has been a fair bit of discussion about the collateral impact of such surveillance. What reassurances can you give the committee that the impact on those who are not the target of any investigation but who may be affected by some of the provisions in the bill will be minimised, and that, where information or data is gathered, that will be dealt with appropriately, presumably by deletion in whatever form Stewart Stevenson thinks is appropriate and final?

That leads into the concerns that we have around some aspects of the bill’s powers and how they may operate. Scottish ministers will deal with the aspects regarding information that has been obtained through the use of the bill’s powers. If Police Scotland wishes to examine some of the information relating to a targeted individual, it will require authorisation from Scottish ministers and judicial oversight. We will deal with that element.

At present, the issue of collateral intrusion is considered at the time of an application for an interception warrant—we will look at how the impact can be minimised. You have heard from Police Scotland about the procedures that it has in place. If it obtains information during any type of interception activity that does not relate to the subject of the warrant, it has a process in place for dealing with that information and for deleting and discarding it. That aspect is considered at the very outset when Police Scotland applies for the warrant in the first place.

We will consider the issue when an application comes to the Scottish Government officials who deal with such matters, and it will be presented to me. Actions will have been taken in order to minimise the risks. Trying to minimise the effect is already part of the existing process.

I go back to my point about the technological advisory panel. As technology develops and advances, there might be scope to reduce this sort of thing even more, and it would be useful to have access to that advice as and when it develops.

With regard to the judicial approval of warrants or, I suppose, the modification of warrants, an issue that has been raised with us is that there might well be instances, as at present, in which Police Scotland feels that it has to act very speedily and there is limited opportunity to gain prior approval. We all understand why such circumstances might arise, but what is not entirely clear is the length of time that is likely to be necessary to gain that approval and, in those instances in which approval is not subsequently granted, either in whole or in part, for the actions, what the consequences are for the investigation and any data that has already been accumulated as a result of Police Scotland’s actions.

It depends on the type of warrant that has been applied for. Let us say that Police Scotland were to apply for an interception warrant, which requires to come to Scottish ministers—and which, under the new system, will also have to be considered by a judicial commissioner—on an urgent matter such as a threat to life in which swift action needs to be taken; Police Scotland would still require ministerial authorisation before that could be taken forward, and we have a process whereby if, at 2 o’clock in the morning, the police required an interception warrant to deal with an urgent incident that was developing, they could contact a senior Scottish Government official, who would then come to me for authorisation. The paper trail that goes with that request catches up with it as quickly as possible. There is a process for dealing with urgent applications, but they still require ministerial authorisation.

The new element is the judicial commissioner’s role. As you will be aware, the legislation stipulates a three-day period for the judicial commissioner to consider the matter. This is a new process that has been created, and some practical measures will need to be taken to ensure that with any urgent requests we are able to get access to one of the judicial commissioners in Scotland as quickly as that can happen. The three-day period is almost a backstop, because the principle is that things will operate as quickly as possible. Nevertheless, notwithstanding the ability to access a judicial commissioner within a couple of hours, ministerial authorisation is still required on interception matters.

Other types of warrants such as those dealing with equipment or property interference do not require ministerial authorisation. Equipment interference requires authorisation from the judicial commissioner after consideration by a senior officer, very often the chief constable or, I believe, at least someone above the rank of superintendent who is authorised to consider these matters. After that, the judicial commissioner’s authorisation would have to be sought, too. As for matters relating to property interference, they are dealt with by senior officers in the police service, and there is no—and never has been any—judicial authorisation element in that respect. Such matters have always been dealt with internally.

Picking up on the concern raised by Mr McArthur, I think that if the police had to urgently exercise some form of equipment interference, they would have to seek judicial authorisation. If they were not able to get it in the timeframe that they needed to get it in, they would have to get it retrospectively. Again, though, we would be talking about instances in which there was a threat to life—say, the abduction of a child or individual—in which events might be very fast moving and the police had to move quickly to get information that could be followed up. Afterwards, the judicial commissioner would consider the information that the police had gained. If they have approved the warrant, that is fine; if they have not, they have has a role in determining what happens to the information. Therefore, there is a safeguard.

It is about trying to create a system that is agile enough to respond to rapidly developing operational matters and which can also provide us with the right type of oversight to pick up on certain matters when necessary.

That is helpful. Clearly, given what ACC Johnson said earlier in evidence, there is concern about activities happening at 2 o’clock in the morning, which I hope both Police Scotland and the Scottish Government are staffed to deal with.

We have an on-call system.

I am sure that you do.

I suspect that the process that you described covers the vast majority of those instances where, as you said, there needs to be agility to respond to fast-moving events. The concern is that it begins to look almost like a rubber-stamping exercise. The process of ministerial approval and/or judicial oversight is about putting in place a challenge function; ACC Johnson was very candid in saying that that is as it should be and that there should not be a carte blanche. Even in a fast-moving situation and even when Police Scotland assesses a risk as severe, whether life threatening or whatever else, there still needs to be the reassurance that where either ministers or those exercising judicial oversight have concerns about actions taken by Police Scotland, that will have an effect and there will be consequences for the actions that were taken leading up to that point of decision by ministers or those exercising judicial oversight.

It is worth keeping in mind that the process also has oversight from the investigatory powers commissioner, who will be able to come in and inspect matters. The commissioner will be able to look at the process in a way that is a bit like the way in which IOCCO inspects Police Scotland’s processes and those of the Government, and how we handle them. I meet IOCCO to discuss our approach and it reports on those issues.

There is also a retrospective aspect to inspection and ensuring that, where authorisations have been given, no one can view that as a rubber-stamping process. I assure you that I do not act as a rubber stamp when warrants come before me. The legislation is very clear that the tests of necessity and proportionality have to be met in order to justify any form of interception, because it involves considerable intrusion into someone’s private life. The bill is very clear about that as well.

From our perspective, an application for authorisation that comes to the Government team will be considered carefully and, if we do not think that it has been undertaken properly and there is sufficient information to justify a decision that it meets the tests of necessity and proportionality, it will be refused on that basis and sent back. When my officials have considered an application, it is then put to me for consideration as well. If I am not satisfied with it, it will be refused. I have no doubt that the additional measure of judicial oversight will involve the information being considered in the same way.

The authorisation process for dealing with what are incredibly serious matters should in no way be viewed as a rubber-stamping exercise, because it involves a very detailed process. When it comes to dealing with urgent matters, the process is more rapid; nevertheless, the tests of necessity and proportionality as set out in the legislation still have to be met in those circumstances. We should remember that the interception of communications can be illegal and a criminal act under the present legislation, and that will remain the case under the bill.

I offer the reassurance that it is a robust process that is applied rigorously. We seek to make sure that the safeguards in the existing legislation are properly and fully met, and that will also be the case with the new legislation. Additional reassurance is provided by the role that IOCCO has, and the role that the new investigatory powers commissioner will have, in having oversight of how such matters are handled.

11:15  

I want to ask about the letter that you sent to the committee yesterday about the amendments to the bill that are to be tabled by the UK Government. I understand that you and your officials are involved in dialogue on that. In your letter, you say:

“In the unlikely event that the amendment were drafted in such a way that contradicted the information that the Government are giving to the Parliament then we would reject such an amendment”.

Is that just a catch-all that is always put in, or are there genuine concerns about contradictions to which that amendment could give rise that the committee should be aware of?

We have seen the drafting instructions to parliamentary counsel on the amendment that the UK Government intends to table, but we have not seen the finalised amendment.

We have gone back to the UK Government with the suggestion that the technology advisory panel should be able to advise the Scottish ministers. If it is to advise the Scottish ministers, the Scottish ministers would have to be consulted on the appointment of the panel. We are having those discussions with the Home Office at the moment. It is possible that the Home Office could decide not to implement David Anderson’s recommendation. Given that the issue was one of those that we had concerns about and on which we had reserved our position, it would seem reasonable for us to say that we are happy with how things are progressing but that we will be in a position to give our consent only once we have seen the final amendment. If the Home Office were to change its position, it would seem reasonable for me to come back to the committee to advise it of that change in approach.

What would the contradiction involve? Would it arise if David Anderson’s recommendation were not taken forward en bloc, or would you reject the amendment only if the Scottish ministers were not involved?

No. The issue is just to do with the technology advisory panel.

The whole thing.

Yes. It is about the recommendation on the advisory role of the panel.

That would be unlikely to happen, given that the UK Government is lodging amendments on that subject.

It is highly unlikely. In addition, the UK Government has expressed publicly its position on the matter. We are being cautious purely because we have not seen the final draft of the amendment in question. If the position were to change, we would have a view on that. We want to have the opportunity to come back to the committee in the event that there is a change in the position.

That concludes our questioning. I thank the cabinet secretary and his officials for attending.

I suspend the meeting to allow the cabinet secretary and his officials to leave.

11:17 Meeting suspended.  

11:23 On resuming—