Surveillance by intelligence services – Volume II: field perspectives and legal update
the G 10 Commission, which decides whether the measures are permissible and necessary.122 The surveillance
order is valid for a renewable three-month period.
In 2015, the G 10 Act was further amended to increase
the surveillance powers of the intelligence services:
surveillance may now also be launched against
individuals suspected of having planned or committed
cybercrimes. The same amendment also provides that
the BND may monitor international telecommunication
to and from Germany to detect and respond
to international cybercrime.123
In the United Kingdom, the Investigatory Powers Act
2016 provides an updated framework for the use of
‘bulk’ investigatory powers to obtain communications
and communications data by the intelligence
and security services.
Promising practice
Requesting independent reviewer to
scrutinise surveillance powers
In the United Kingdom, while the Investigatory
Powers Act was debated in parliament, the Home
Office requested the Independent Reviewer of
Terrorism Legislation, then David Anderson QC, to
review the operational case for bulk powers. With
a point of view independent from government and
the ability to access secret national security information, the Independent Reviewer explained how
bulk powers are currently used by the intelligence
services; their importance to national security; the
safeguards in place; potential changes the Investigatory Powers Bill brings; and recommendations
for better adaptation of the intelligence collection
techniques to the new threats and technologies.
For further information, see Anderson, D. (2016)
The powers that can be used domestically cover the
retention and acquisition of electronic communications
data,124 and the retention and examination of bulk
personal datasets.125 For the purposes of this research,
obtaining communications should be understood as
‘obtaining the content of the communications’ whereas
obtaining of communications data should be understood
as ‘obtaining metadata’ within the meaning of the
122 Germany, G 10 Act, s. 15 (5).
123 Ibid. s. 5 (8).
124 United Kingdom, Investigatory Powers Act 2016, ss 158 –
175. Not yet into force and will be brought into force in due
course by means of regulations made by the Secretary of
State (See United Kingdom, Investigatory Powers Act 2016,
Explanatory Note).
125 Ibid. ss. 199 – 226. Not yet into force and will be brought
into force in due course by means of regulations made by
the Secretary of State (See United Kingdom, Investigatory
Powers Act 2016, Explanatory Note).
44
definition included in the proposal for an e-Privacy
Regulation (see box on EU legal terminology).
Note on terminology: EU law
‘Electronic communications metadata’
“‘[E]lectronic communications metadata’ means data
processed in an electronic communications network for
the purposes of transmitting, distributing or exchanging
electronic communications content; including data used
to trace and identify the source and destination of a communication, data on the location of the device generated
in the context of providing electronic communications
services, and the date, time, duration and the type of
communication.”
‘Electronic communications content’
“‘[E]lectronic communications content’ means the content exchanged by means of electronic communications
services, such as text, voice, videos, images, and sound.”
European Commission, Proposal for a Regulation of the European Parliament
and of the Council concerning the respect for private life and the protection
of personal data in electronic communications and repealing Directive
2002/58/EC (Regulation on Privacy and Electronic Communications),
COM (2017) 10 final, Brussels, 10 January 2017, Art 4 (3) (c) and Art. 4 (3) (b).
‘Bulk acquisition’ refers to the power of the intelligence
services to require a telecommunications operator to
retain communications data and disclose these to the
intelligence services, as well as to select for examination
the acquired communications data, as specified in
the warrant.126 Essentially, the telecommunications
providers transfer the “who”, “where”, “when”, “how”
and “with whom” of communications, but not what
was written or said. It includes information such as
the identity of a subscriber to a telephone service or
a detailed telephone bill. The bulk acquisition technique
can be applied domestically, but the intelligence
services may only collect communications data and
not the content of the communications.127 The bulk
acquisition power originally derives from section 94 of
the Telecommunications Act 1984.128 The NGO Privacy
International challenged the bulk acquisition powers
under this provision before the Investigatory Powers
Tribunal (IPT) – the specialist court of the United
Kingdom for surveillance matters. The IPT ruled that
until 4 November 2015 – when stricter safeguards were
introduced – the intelligence services were violating the
126 Ibid. s. 158 (6). Not yet into force and will be brought into
force in due course by means of regulations made by the
Secretary of State (See United Kingdom, Investigatory
Powers Act 2016, Explanatory Note).
127 Ibid. s. 158(6). Not yet into force and will be brought into
force in due course by means of regulations made by the
Secretary of State (See United Kingdom, Investigatory
Powers Act 2016, Explanatory Note).
128 For a description and assessment of the original bulk
acquisition powers, see United Kingdom, IOCCO (2016b).
See also United Kingdom, Investigatory Powers Tribunal,
[2016] UKIPTrib 15_110-CH, 8 September 2017, paras 14-17.