IPCO Annual Report 2017
System faults
14.58
Errors within the disclosure system of a CSP can self-evidently have a significant adverse
impact on investigations.
14.59
On inspection, we observed a wide range of problems caused by faults in the relevant
systems, including corrupted billing information and installation addresses; reliance on
incorrect time zones; and changes to the format of time zones occurring without notification.
Events of this kind can lead to serious adverse consequences.
The need to notify errors in accordance with the code of practice para 6.19 (3)
14.60
On occasion, errors are reported for the first time months, or even years, after they occurred.
14.61
Under the current code of practice for the Acquisition and Disclosure of Communications
Data, when a reportable error occurs, the relevant public authority must establish the facts
and report them to IPCO within no more than five working days.65
14.62
The cases involving late reporting shared the common feature that the data acquisition was
undertaken by one public authority but the relevant executive action was taken by another
authority. A lack of any feedback to the SPoC office which initially acquired the data could
result in other ‘packages’ of data being acted on as a result of incorrect communications
data. The public authorities involved in the cases we investigated have addressed this issue
by making their legal departments aware of paragraph 6.19 of the Code. IPCO is currently
ensuring that all other relevant public authorities are made aware of this obligation.
14.63
Whenever a serious error occurs, the IPCO investigation provides the IPC with sufficient
information to make a determination as to whether to inform the affected individual of their
right to make a complaint to the Investigatory Powers Tribunal (IPT).
14.64
Since 2013, 135 IPCO or IOCCO investigations have resulted in 23 substantive
recommendations.
Bulk communications data
14.65
There is no statutory requirement under section 94 of the Telecommunications Act 1984
to report an error when acquiring or accessing bulk communications data. No errors have
been reported in the relevant period as regards the acquisition of bulk communications
data by means of a section 94 direction.
14.66
MI5 has, however, developed and implemented an internal policy process to report instances
when data that is retained as a consequence of a section 94 direction is subsequently
accessed in error. In 2017 MI5 reported 17 errors in this context.
14.67
A breakdown of the causes of the errors is as follows:
• 5 were caused by the investigator or analyst acquiring data on an incorrect
communications address or identifier;
65 ‘When a reportable error has been made, the public authority which made the error, or established the error had been made, must
establish the facts and report the error to the authority’s senior responsible officer and then to the IOCCO within no more than five
working days or the error being discovered. All errors should be reported as they arise...’ Para 6.19 Acquisition and Disclosure of
Communications Data Code Of Practice (2015)
101