A new report by the UK’s top Independent Reviewer of Terrorism Legislation, David Anderson, says that bulk interception and acquisition of Internet and communications data is of ‘vital utility’ to security and intelligence agencies.
The position of Independent Reviewer of Terrorism Legislation is an appointed position. As Mr. Anderson, Queen’s Counsel (“QC”) writes, “I am an independent Q.C. and not part of the government machine. I am tasked with reviewing the operation of the United Kingdom’s anti-terrorism laws. Where I am critical, I recommend change. My reports and recommendations are submitted to ministers and laid before Parliament.”
The report is based on a review of the proposed Investigatory Powers Bill, and is informed by what some are calling unprecedented access to case studies and intelligence reports, and statements, from MI5, MI6, and GCHQ, as well as “the questioning of some 85 intelligence officials, including on whether other methods could have achieved the same results.”
The 195-page Report of the Bulk Powers Review, which was commissioned by the new British Prime Minister, Teresa May, back when she was Home Secretary (in fact it was she who appointed Anderson as IRTL, when she was still Home Secretary), was issued this week, and presented to Parliament by the new Prime Minister. Britain’s Parliament, which has already been scrutinizing the proposed Investigatory Powers Bill, will now have Anderson’s report to consider when taking the Bill up again in September.
The Investigatory Powers Bill (IPB) looks at both restating existing powers and adding new powers, relating to both targeted and bulk interception of communications, bulk collection of communications data, and bulk interception and collection of Internet data.
A Bill to make provision about the interception of communications, equipment interference and the acquisition and retention of communications data, bulk personal datasets and other information; to make provision about the treatment of material held as a result of such interception, equipment interference or acquisition or retention; to establish the Investigatory Powers Commissioner and other Judicial Commissioners and make provision about them and other oversight arrangements; to make further provision about investigatory powers and national security; to amend sections 3 and 5 of the Intelligence Services Act 1994; and for connected purposes.
The BBC explains the primary aspects of the IPB thusly:
- Bulk interception: The tapping of internet cables by GCHQ to target suspects outside the UK. The review says this is of “vital utility” to the security and intelligence agencies, citing the case of a kidnapping in Afghanistan that would have led to the killing of hostages, if spies had not used these powers.
- Bulk acquisition of communications data: The gathering of data about communications but not the content of it. Only disclosed publicly in November last year, for MI5 it has “contributed significantly” to the disruption of terrorist operations, Mr Anderson’s report said.
- Bulk personal data sets: Databases of personal information, which could include everything from the electoral register to supermarket loyalty schemes, which the security services acquire openly or covertly.
Anderson also addressed a proposed and heretofore untested power of bulk equipment interference (“EI”) – i.e. the hacking of cell phones and other devices, saying that in principle he backed it, but had reservations.
Says Anderson, in the report, “..I conclude (as, after full consideration, did the Chair of the ISC [Ed. note: Intelligence and Security Committee of Parliament])… that an operational case for bulk EI has been made out in principle, and that there are likely to be real-world instances in which no effective alternative is available. While it is likely to be of use in particular for the recovery of equipment data, its capacity to recover content may also be of value. But very considerable caution is required, in view of: (a) the fact that EI can recover data that has never been sent anywhere; and (b) the untried nature of the power…”
In a statement on the matter, Prime Minister May said “Mr Anderson’s report demonstrates how the bulk powers contained in the Investigatory Powers Bill are of crucial importance to our security and intelligence agencies. These powers often provide the only means by which our agencies are able to protect the British public from the most serious threats that we face. It is vital that we retain them, while ensuring their use is subject to robust safeguards and world-leading oversight which are enshrined in the IP Bill.”
In his conclusion to and recommendations in the report, Anderson sums up by saying that:
“I have reflected on whether there might be scope for recommending the ‘trimming’ of some of the bulk powers, for example by describing types of conduct that should never be authorised, or by seeking to limit the downstream use that may be made of collected material. But particularly at this late stage of the parliamentary process, I have not thought it appropriate to start down that path. Technology and terminology will inevitably change faster than the ability of legislators to keep up. The scheme of the Bill, which it is not my business to disrupt, is of broad future-proofed powers, detailed codes of practice and strong and vigorous safeguards. If the new law is to have any hope of accommodating the evolution of technology over the next 10 or 15 years, it needs to avoid the trap of an excessively prescriptive and technically-defined approach.
I do however venture to make one major recommendation, again prompted by the speed with which technology can change. It is as follows:
The Bill should be amended to provide for a Technology Advisory Panel, appointed by and reporting to the IPC, to advise the IPC and the Secretary of State on the impact of changing technology on the exercise of investigatory powers and on the availability and development of techniques to use those powers while minimising interference with privacy.”
You can read the David Anderson’s Report of the Bulk Powers Review here.
You can read David Anderson’s own comments on the report here.