Surveillance “in accordance with the law”
right to private life (Article 8 of the ECHR).129 Anderson
provides an example of the use of bulk acquisition
powers by the Security Service MI5: a threat was made
by telephone against an overseas embassy in London.
The Security Service used bulk acquisition data to
identify the user of the telephone as a known hoaxer.130
Bulk personal datasets are sets of “information
that includes personal data relating to a number of
individuals”131 and “the nature of the set is such that
the majority of the individuals are not, and are unlikely
to become, of interest to the intelligence service in
the exercise of its functions”.132 In simple terms, bulk
personal datasets are sets of information about a large
number of individuals, the majority of whom will not be
of any interest to the intelligence services. However, the
intelligence services will only look at the data relating
to the minority who are of intelligence interest.133
The use of bulk personal datasets by the intelligence
services was disclosed for the first time in a 2015
report by the Intelligence and Security Committee of
Parliament.134 Privacy International challenged them
before the IPT and, as for the bulk acquisition powers,
the IPT found that the intelligence services violated the
right to private life until 12 March 2015, when stricter
safeguards were introduced.135 Anderson provides an
example of the use of bulk personal datasets following
the attacks in Paris and Brussels: the Secret Intelligence
Service (SIS) worked in partnership with MI5 and the
Government Communications Headquarters (GCHQ) to
identify individuals in so-called Islamic State of Iraq and
the Levant networks who posed a threat to the United
Kingdom. SIS used bulk personal datasets to identify
a number of such individuals.
The United Kingdom’s intelligence services, before
exercising one of the ‘bulk’ powers, must obtain
a warrant authorised by the Secretary of State and
approved by a Judicial Commissioner. The warrants
must specify the operational purposes for which any
communications data obtained under the warrant may
129 United Kingdom, Investigatory Powers Tribunal, [2016]
UKIPTrib 15_110-CH, 17 October 2016.
130 Anderson, D. (2016), p. 170.
131 United Kingdom, Investigatory Powers Act 2016, s 199 (1)
(a). Not yet into force and will be brought into force in due
course by means of regulations made by the Secretary of
State (See United Kingdom, Investigatory Powers Act 2016,
Explanatory Note).
132 Ibid. s. 199 (1)(b). Not yet into force and will be brought
into force in due course by means of regulations made by
the Secretary of State (See United Kingdom, Investigatory
Powers Act 2016, Explanatory Note).
133 Ibid. s. 212. Not yet into force and will be brought into
force in due course by means of regulations made by the
Secretary of State (See United Kingdom, Investigatory
Powers Act 2016, Explanatory Note).
134 United Kingdom, Intelligence and Security Committee of
Parliament (2015), Chapter 7.
135 United Kingdom, Investigatory Powers Tribunal, [2016]
UKIPTrib 15_110-CH, 17 October 2016.
be selected for examination. The acceptable purposes
for a warrant to be obtained are: national security;
prevention or detection of serious crime; and the
economic well-being of the United Kingdom, provided
that this is related to the interests of national security.136
Promising practice
Explaining surveillance laws in
codes of practice and on intelligence
services’ websites
In the United Kingdom, the government presented
publicly to Parliament plain language draft codes
of practice to explain each of the different forms
of investigatory powers. Following a consultation
process, they will be published in final form. In
addition, the Secret Intelligence Service (SIS),
the Security Service MI5 and GCHQprovide an
easy-to-read explanation of the intelligence
techniques’ legal framework on their respective
websites. They provide simple definitions of
bulk investigatory powers, allowing individuals
to better understand the law. This effort aims
to increase transparency on the work of the
intelligence services.
For further information, see the websites of the SIS, MI5 and
GCHQ
The 2015 FRA report presented the domestic general
surveillance of communications technique introduced
in 2015 in France.137 The law envisaged a potential
obligation on teIecommunications providers to detect
terrorist threats with the use of ‘algorithms’ on their
customers’ connection data.138 The CNCTR adopted
a detailed opinion specifying what should be understood
by ‘connection data’.139 For the purposes of this research,
it should be understood as ‘metadata’. In July 2016, the
CNCTR gave a classified opinion to the prime minister on
the planned general architecture of the algorithm.140 By
March 2017, the intelligence services had yet to ask the
CNCTR to give an opinion on their use of this surveillance
technique, meaning this surveillance technique had not
yet been used by that point.141
French law also provides for the use of ‘IMSI catchers’
by intelligence services. These are a type of technical
equipment that allows data to be collected, potentially
identifying users of mobile phones and the location
of devices via their SIM card numbers. The maximum
136 United Kingdom, Investigatory Powers Act, Chapters 1 -3.
137 FRA (2015a), pp. 23-24.
138 France, Interior Security Code (Code de la sécurité
interieure), Art. L. 851-3.
139 France, CNCTR (2016), p. 120 and following. See also France,
Interior Security Code (Code de la sécurité intérieure),
Art. R. 851-5.
140 France, CNCTR (2016), p. 40.
141 France, DPR & CNCTR (2017), p. 51.
45