bulk acquisition does not exist. The data may be readily obtained and swiftly
analysed.
6.20.
The case studies also indicate that bulk acquisition data is used by MI5 to enable
it to focus and prioritise targeted techniques. Case study 4 provides an
illustration: bulk acquisition was used to identify an individual in contact with a
senior Islamist extremist. More intrusive, targeted techniques were then used
against that individual in order to assess the threat, if any, posed to the UK.
6.21.
I understand that GCHQ merges the bulk acquisition data in its possession with
bulk interception data, and that GCHQ analysts conducting searches will not
necessarily be aware of the source of the information that they obtain. A8/1 was
the only example provided by GCHQ of its use of bulk acquisition.
Alternative methods
6.22.
The Review team questioned MI5 staff about the availability of alternatives, both
by reference to the case studies and more generally. We considered, in
particular, the use of the DRIPA power (2.33 above), to be replaced by similar
provisions of the Bill under which CSPs can be required to retain
communications data (Part 4) which may then be the object of targeted requests
(Part 3).
The DRIPA power
6.23.
The DRIPA power allows for targeted access to similar records to those obtained
by means of bulk acquisition. But those records are held by individual CSPs. We
were told that a major advantage offered to the SIAs by bulk acquisition is the
fact that data from a number of sources is aggregated.
6.24.
That comment appeared to be confirmed by internal MI5 documents:
(a) The author of one such document noted that complex analysis on the
aggregated system would be considerably more complex, and would take
far longer.
(b) A further document recorded that “one of the most valuable assets of [MI5’s
bulk acquisition capability] is the speed with which it is possible to retrieve
[information] when necessary for the progress of an investigation.”
The speed advantage can be very significant in practice. For some operations
(the London and Glasgow attacks being a strong example: A9/10) it is vital.
6.25.
An additional advantage of aggregation accrues to GCHQ, which aggregates
bulk acquisition and interception data.
97