7. ASSESSMENT: BULK EQUIPMENT INTERFERENCE
Claimed utility
7.1.
Bulk EI is unique among the powers under review in that it has not yet been
used. The entire debate about its utility is thus focused on the SIAs’ assessment
of future developments in technology, on extrapolation from the use made of
other powers, and on hypothetical case studies.
7.2.
The Operational Case (8.1-8.2) locates EI, including bulk EI, in the context of
diminishing returns from interception owing to technical developments such as
end-to-end encryption228 and the increasing anonymisation of network devices,
making it harder to distinguish between target and non-target devices without at
least some initial analysis of the data held on them:
“Terrorists, serious criminals and hostile states have embraced technological
advancements, including the widespread use of encryption, and the growth of
the internet to hide from sight and to plan their attacks. As a result of this, the
security and intelligence agencies can no longer rely solely on interception
and are faced with an increasingly partial and fragmented intelligence picture,
even when investigating known threats. If the security and intelligence
agencies are to be able to maintain the same understanding of threats and be
able to disrupt them, they need to use other, and complementary, techniques
which will provide comparable pieces of the intelligence jigsaw.
Bulk EI describes a set of techniques to obtain information from devices that
is necessary for the identification of subjects of interest who pose a threat to
the UK’s national security, in circumstances where the information is not
available through the use of other methods. Bulk EI enables the security and
intelligence agencies to overcome techniques used by subjects of interest to
hide their identities or their communications.”
7.3.
Bulk EI is distinguished from targeted thematic EI not on the basis of its scope
(since both may take place “at scale”, covering “a large geographical area” or
involving “the collection of a large volume of data”) but on the basis that there will
be cases in which
“the Secretary of State and the Judicial Commissioner is not .. able to assess
the necessity and proportionality to a sufficient degree at the time of issuing
the warrant”,
228
Google announced in February 2016 that 77% of requests received by Google servers from
computers around the world were encrypted, up from 52% in 2013. MI5 told us that the
majority of the top 40 online activities relevant to their intelligence operations are now
encrypted.
103