c) The carrying out of intrusive surveillance.
This is neither confirmed nor denied, although GCHQ has accepted that the
use of CNE techniques may be intrusive.
d)
The use of CNE in such a way that it creates a
potential
security
vulnerability
in
software
or
hardware, on a server or on a network.
This is not avowed. However it has been accepted that any CNE operations
which are carried out by GCHQ are conducted in such a way as to minimise
the risk of leaving target devices open to exploitation by others (see paragraph
39 of Mr Martin’s First Statement).
e)
The use of CNE in respect of numerous devices, servers or
networks, without having first identified any particular device
or person as being of intelligence interest.
This has been characterised as ‘bulk CNE’. The Respondents agree that this
could arise pursuant to the powers of GCHQ within the scope of a s.7
authorisation, but neither admit nor deny that it has ever occurred, and Mr
Martin in his third witness statement says that it is “simply not correct to
assert that GCHQ is using CNE on an indiscriminate and disproportionate
scale”.
f) The use of CNE to weaken software or hardware at its source, prior
to its deployment to users.
This is neither confirmed nor denied.
g) The obtaining of information for the purpose of maintaining or
further developing the intelligence services’ CNE capabilities.
This is neither confirmed nor denied.
10.
The List of Issues, shorn of its paragraph 6 in which the above matters (a) to
(g) were canvassed, appears as Appendix I to this Judgment. We turn to
address those issues below, although not quite in the same format.
11.
The value of these proceedings in open court before us has been to our mind
again emphasised, whatever the outcome, by virtue of the full inter partes
consideration of such issues, and in particular:
i)
The knock-on effect that the very existence of these proceedings has
clearly had. We have already noted the fact that the publication of the
draft E I Code was on 6 February 2015, revealing for the first time in
public the use by GCHQ of CNE and the procedures under which it is