Scale of use
7.8.
The Review team was told that about 50% of Internet traffic was now encrypted,
and 100% of emails from major email providers. It was not possible, nor would it
be desirable, for GCHQ to decrypt all such traffic, so alternative methods of
obtaining information had to be sought.
7.9.
Thematic EI is currently used by GCHQ and to a lesser extent by MI5 and MI6.231
Bulk EI is not currently used at all: though the Bill allows all SIAs to use it, it is
envisaged that, like bulk interception, it will be practised only by GCHQ.
7.10.
Currently around one in five GCHQ intelligence reports is based on material
obtained from targeted EI.232 Data obtained from targeted EI provided roughly a
fifth of GCHQ’s intelligence, and more than a third of higher grade intelligence.
Case studies (Annex 10)
7.11.
The case studies relating to bulk EI are set out at Annex 10, but are necessarily
very limited in view of the fact that GCHQ has not yet used the power.
7.12.
The Review team was introduced to two real-life case studies (A10/1-2) in which
an EI warrant was obtained under ISA 1994, in circumstances in which, were the
Bill in force, a thematic targeted warrant would be sought. Both involved the
identification of extremists in Syria who could pose a threat to the UK, or to UK
nationals – as potential hostages – in Syria. Both involved target identification
and subsequent development, and both involved only the obtaining of systems
data.
7.13.
The Review team saw internal GCHQ material in which further explanations
were given of situations in which content might be obtained through bulk EI.
7.14.
I also considered the hypothetical examples of the use of bulk EI set out in the
Operational Case, concerning respectively counter-terrorism, counterproliferation, cyber-defence and the difference between thematic and bulk EI
(A10/3-6). They do not have the value of real examples, but help to explain the
type of future operation in which GCHQ might plausibly propose to use bulk EI.
231
232
Police forces are also to be given the power, if duly authorised, to use targeted EI (including
targeted thematic EI) under Part 5 of the Bill: clauses 100, 101.
As recorded in Privacy International v The Secretary of State for Foreign and Commonwealth
Affairs [2016] UKIPTrib 14_85-CH, para 5(ii).
105