9.
i)
Both parties accepted at this hearing the effect of this Tribunal’s
conclusions in what have become known as Liberty/Privacy (No.1)
[2015] 3 AER 142 and (No.2) [2015] 3 AER 212. It was common
ground that all the material decisions of the ECtHR were fully
canvassed in Liberty/Privacy (No.1) and their effect set out in that
Judgment. The consequence was that there was a great deal less need
to refer to the underlying ECtHR Judgments themselves in the hearing
before us, and it was common ground that the only material ECtHR
decision since Liberty/Privacy is R.E. v United Kingdom
(Application No.62498/11), Judgment 27 October 2015, to which we
were referred by both sides.
ii)
As in Liberty/Privacy, emphasis was placed by the Respondents on
the existence of oversight of the security arrangements and procedures
by the Intelligence and Security Committee of Parliament (“ISC”) and
by the Commissioners. In this case the relevant Commissioner is the
Intelligence Services Commissioner, Sir Mark Waller, on whose
Reports both sides relied. As is to be expected, and will be referred to
below, Sir Mark’s responsibility included drawing attention to areas
which, upon his inspection of the Intelligence Services, he felt could be
improved; but there is no doubt, by reference to those Reports, that it
continues to be his view, as expressed in his 2013 Report, that
“GCHQ’s staff continue to conduct themselves with the highest level of
integrity and legal compliance”. The ISC’s latest report of 12 March
2015 is to similar effect.
It was agreed for the purpose of the List of Issues (at paragraph 6) that CNE
might be used by GCHQ so as to involve the following:
a)
The obtaining of information from a particular device, server
or network.
That constituted part of the Respondents’ avowals, and consequently was no
longer subject to NCND. As to the balance of the original paragraph 6 of the
List of Issues:
b)
The creation, modification or deletion of information on a
device, server or network.
It was accepted at paragraph 46 of Mr Martin’s First Statement that CNE
could theoretically change the material on a computer, e.g. by way of an
implant. In the light of that, coupled with the acceptance generally by GCHQ
that it carries out CNE activities, GCHQ accepts that it has avowed the
creation (to the extent that the placing of an implant on a device amounts to
the creation of information) and modification of information on a device and
this is no longer subject to NCND. In addition, whilst GCHQ accepts that
creating or modifying information on a server or network could lawfully
occur, this is neither confirmed nor denied.
But apart from that, sub-paragraph (b) is neither confirmed nor denied.