for example “where the purpose of the operation is target discovery and the
security and intelligence agencies do not know in advance the identity of the new
subjects of interest who threaten the security of the UK and its citizens”.229
7.4.
All the SIAs saw EI as of growing importance across the full range of threats to
the UK, driven by the increasing use of encryption and diversity of
communications methods. GCHQ described CNE (the principal component of
EI) as enabling the state “to obtain the valuable intelligence it needs to protect its
citizens from individuals involved in terrorist attack planning, kidnapping,
espionage or serious organised crime” (Annex 7). GCHQ managers stated that
they did not expect bulk EI to form a large part of GCHQ’s work but thought that
it would underpin other work, and would be used in the first instance before
targeting was possible.
7.5.
MI6 considered that it was likely to become “increasingly dependent” on GCHQ’s
use of bulk EI to identify threats to the UK, to develop its understanding of those
threats and to disrupt them, particularly in the context of counter-terrorism and
cyber (Annex 6).
7.6.
It was emphasised that bulk EI operations will be designed to bring back the
minimum amount of information required to rule out devices not of intelligence
interest. That would often imply a “light touch” operation targeted at least in the
first instance on equipment data (the EI equivalent of secondary data). This
would allow more targeted approaches to be made.
7.7.
I was told however that the power to obtain content was also likely to be useful in
certain circumstances:230
(a) It was possible that the “seed” information which GCHQ has about targets
could relate to information defined as content under the Bill: for example, a
particular video or the use of a particular combination of elements. If the
spread of encryption means that bulk interception cannot be used for this
purpose, bulk EI may have to take its place.
(b) Once an initial engagement or series of engagements had identified devices
of interest, malware could be written or implants designed so as to obtain
content from those devices.
229
230
Operational Case, March 2016, 8.5-8.7. An illustration of the different situations in which
targeted thematic EI and bulk EI would be required was set out at 8.8 of the Operational Case,
and is reproduced at A10/6.
Clause 162(1)(b)(i),
104