No alternatives
7.20.
A substantial part of bulk EI’s value lies in the very fact that its use is envisaged
when no alternatives are available. It is clear from GCHQ’s internal documents
(discussed below) that it sees EI, including at scale, as a capability crucial to its
future operations. It is being developed because (at least in part) interception has
been rendered less effective by the use of encryption.
7.21.
Liberty in its submission to the Review contends that the first and second
hypothetical examples in the Operational Case (A10/3-4) do not demonstrate
that the “population level” use of bulk EI powers overseas would have been
either necessary or proportionate. It argues that the third hypothetical example
(A10/5) provides insufficient detail for useful analysis.
7.22.
I accept that there is an artificiality in reliance upon hypothetical examples, and
that in any given situation there will be questions as to whether less intrusive and
equally effective methods could not have been used. But having discussed
these examples, and examined in some detail case studies in which the thematic
EI power was used, I conclude that there could in the future be situations in
which the availability of a bulk EI power will bring useful results not achievable by
other means.
Negative incidents and outcomes
7.23.
The IsComm’s first open report on EI will be published only in September 2016,
as noted at 3.20 above, and may be expected to record reported errors (as did
its confidential predecessors).
7.24.
As noted at 1.39 above, we always suspected that teething trouble and wrong
turns were likely to be experienced with new EI techniques. GCHQ disclosed to
the Review team an internal document which referred to “shortcomings” and a
lack of success in CNE techniques in one particular aspect of GCHQ’s work.
GCHQ provided an explanation of this reference. I was told that the use of CNE
had not been a success in this field because resources had been diverted from
that area of work; the same technology might well have been working
successfully in another field to which more time and money were devoted.
GCHQ managers accepted that the technology was new, and that, in certain
operations, the technology would require development in order to achieve the
desired result.
7.25.
The Review team was provided with examples of a number of incidents in which
CNE work had caused unintended consequences to targeted computers. In most
of these examples, a computer failure obvious to the user had occurred
(although the user would probably not have been aware of the cause). In one
107