authorised under section 7. In the event that any
equipment located overseas is brought to the British
Islands during the currency of the section 7
authorisation, and the act is one that is capable of
being authorised by a warrant under section 5, the
interference is covered by a 'grace period' of 5
working days (see section 7(10) to 7(14)). This
period should be used either to obtain a warrant
under section 5 or to cease the interference (unless
the equipment is removed from the British Islands
before the end of the period).”
David Anderson in his Report refers to this paragraph of the E I Code, and
comments, at paragraph 6.33:
“It does not elaborate on what factors should be
taken into account in the course of that
‘consideration’.”
61.
As for the latter point (ii), Mr Eadie submits, and we accept, that, provided
that the matter is indeed considered, as is required by paragraph 7.4, such an
issue is simply one of the matters which are required to be brought before a
Secretary of State, pursuant to his obligation to consider alternative and/or less
intrusive measures, rather than, as Mr Jaffey submitted, that this is part of an
attempt to circumvent the statutory scheme under s.8(4).
62.
Both aspects of Mr Jaffey’s complaints appear to have been taken up in the IP
Bill. Under the heading “BULK POWERS” in the accompanying Guide, it is
stated, at paragraph 42, that where the content of a UK person’s data, acquired
under bulk interception and bulk equipment interference powers, is to be
examined, a targeted interception or equipment interference warrant will need
to be obtained. As for the question of presence in the British Islands, it is
specifically provided in draft clause 147, within the Chapter dealing with
“Bulk Equipment Interference Warrants”, namely by clause 147(4), that there
is to be a similar safeguard to that in s.16 of RIPA in relation to the selection
of material for examination referable to an individual known to be in the
British Islands at the time.
63.
It seems to us clear that these criticisms are likely primarily to relate to Bulk
CNE carried out, if it is carried out at all, pursuant to a s.7 authorisation (hence
paragraph 7.4 of the E I Code). Mr Jaffey’s own example was of the hacking
of a large internet service provider in a foreign country, and the diversion of
all of the data to GCHQ, instead of intercepting that material “over a pipe”
which might be encrypted, so as to render access by ordinary bulk interception
difficult if not impossible. As with Issue 5, Mr Jaffey specifically accepted
(Day 2/46) that, if Bulk CNE were taking place, and if, prior to any changes
such as discussed above, there were to be insufficient safeguards in place, that
does not render the whole CNE scheme unlawful. As with Issue 5, we reserve
for consideration, on particular facts and when questions of jurisdiction are
examined, whether an individual complainant might be able to mount a claim.