8. ASSESSMENT: BULK PERSONAL DATASETS
Claimed utility
8.1.
All three SIAs retain and use BPDs, though GCHQ uses them to a lesser extent
than MI6 and MI5. The Operational Case describes BPDs as “an essential tool”
for the SIAs, without which “the security and intelligence agencies would be
significantly less effective in protecting the UK against threats such as terrorism,
cyber threats or espionage”.
8.2.
The case for the utility of BPDs is spelled out in the Operational Case as follows:
“BPD enables the security and intelligence agencies to focus their efforts on
individuals who threaten our national security or may be of other intelligence
interest, by helping to identify such individuals without using more intrusive
investigative techniques. It helps to establish links between subjects of
interest or better understand a subject of interest’s behaviour. BPD also
assists with the verification of information obtained through other sources (for
example agents) during the course of an investigation or intelligence
operation.
…
Using BPD also enables the security and intelligence agencies to use their
resources more proportionately because it helps them exclude potential
suspects from more intrusive investigations.”234
8.3.
MI5 told the Review that it used BPD “to quickly develop fragmentary intelligence
into a real world identity”, to understand adversaries and the links between them,
and to inform disruptive action. It emphasised the importance of BPD (and bulk
acquisition) for ruling out individuals whose privacy might otherwise have been
intruded into (a point also made in this context by GCHQ: Annex 7), commenting
that “without bulk capabilities, MI5 simply could not effectively process and
respond to the volumes of incoming leads” (Annex 5).
8.4.
For MI6, BPDs “often form the backbone of investigative work” (Annex 6). In
particular, BPDs:
(a) enable MI6 to “take a piece of fragmentary information and make a positive
identification of a person of intelligence interest who could not otherwise be
identified”, and
(b) “help [MI6] to better understand the risks surrounding its activities in order to
protect the people it works with all over the world”.
It described BPDs as “equally important across all operational areas covered by
[MI6] including counter-terrorism, counter-proliferation, cyber, serious crime and
234
Operational Case, March 2016, 10.4 and 10.6.
111