Judgment Approved by the court for handing down.
Privacy International v Investigatory Powers Tribunal
Lord Justice Bean and Mrs Justice Farbey:
1.
This is the judgment of the court to which we have both contributed.
2.
The Claimant applies for judicial review of the judgment of the Investigatory Powers
Tribunal (“the Tribunal”) dated 12 February 2016. It invites the court to quash the
judgment and to grant relief in the form of a declaration as to the scope of section 5 of
the Intelligence Services Act 1994 (“the 1994 Act”). The question raised in the claim
relates particularly to computer network exploitation (“CNE”), colloquially known as
computer hacking. The question posed in the Statement of Facts and Grounds is: “Does
section 5 of [the 1994 Act] permit the issue of a ‘thematic’ computer hacking warrant
authorising acts in respect of an entire class of people or an entire class of such acts?”
3.
We heard submissions from Mr Ben Jaffey QC (with Mr Tom Cleaver) on behalf of the
Claimant and Sir James Eadie QC (with Mr Richard O’Brien) on behalf of the Interested
Parties. We repeat the thanks that we gave at the hearing for their excellent oral and
written advocacy.
4.
The three UK intelligence agencies (“the Agencies”) are the Security Service, generally
known as MI5; the Secret Intelligence Service, generally known as MI6; and
Government Communication Headquarters (“GCHQ”). Before 1989, the functions and
indeed the existence of the Agencies were not officially acknowledged: this was a
somewhat artificial state of affairs since, for example, in the mid-1980s GCHQ featured
twice in litigation which reached the House of Lords (Waite v Government
Communication Headquarters [1983] 2 AC 714; Council of Civil Service Unions v
Minister of the Civil Service [1985] AC 374). The activities of the Agencies were not
the subject of statutory regulation.
5.
By section 1(1) of the Security Service Act 1989, Parliament acknowledged the
existence of the Security Service. At the same time, its functions were placed on a
statutory footing as being the protection of national security, the safeguarding of the
economic well-being of the United Kingdom, and the support of law enforcement
agencies in the prevention and detection of serious crime (section 1(3)).
6.
The Secret Intelligence Service was acknowledged by the 1994 Act. Its function was
established as obtaining and providing information relating to the actions or intentions
of persons abroad for national security and other reasons (section 1). GCHQ was
acknowledged by section 3(1). Its function is, so far as relevant to the present case, to
monitor or interfere with electromagnetic, acoustic and other emissions and any
equipment producing such emissions. This function is exercisable only in the interests
of national security, the economic well-being of the United Kingdom, and the support
of the prevention or detection of serious crime (section 3(2)).
7.
CNE is a set of techniques through which an individual or organisation gains covert
and remote access to equipment (including both networked and mobile computer
devices) typically with a view to obtaining information from it. CNE can be a critical
tool in investigations into the full range of threats to the United Kingdom such as
terrorism, serious and organised crime, and other national security threats. As the
Tribunal observed at para 3 of their judgment: “[t]he particular significance of the use
of CNE is that it addresses difficulties for the Intelligence Agencies caused by the ever
increasing use of encryption by those whom the Agencies would wish to target for