(e) A set of slides used to present BPD strategy in September 2015 set out a
number of uses to which BPDs were put: to resolve the identities of subjects
of interest [SOIs] and establish their whereabouts; to identify activity of
interest; to provide assurance on defined investigative questions; to identify
SOI access of interest (e.g. to establish whether a target was working in a
particular sector); to establish disruption opportunities; to establish
investigative opportunities; to identify contacts of SOIs and to identify and
protect targets of SOIs.
(f) An internal paper of June 2016, setting out the strategy to 2018 for a
department within MI5, pointed to the use of BPDs in providing “buildingblock” intelligence that would progress investigations in an efficient and
focused way; targeting the activities of foreign actors; providing ongoing
verification of agent reporting; and enabling defensive capabilities to protect
UK Government information from unauthorised disclosure by others.
8.32.
The Review team has also had the opportunity to inspect the “retention forms”
that are completed at each of the Agencies when their staff seek authorisation to
retain a particular BPD. Each form sets out the perceived usefulness of the BPD
in question and the frequency with which it is used, provides an assessment of
its value and also (in the case of MI5 and GCHQ, though not MI6) gives specific
examples of operations in which the BPD was used.
Conclusion
8.33.
I have no hesitation in concluding that BPDs are of great utility to the SIAs. The
case studies that I examined provided unequivocal evidence of their value. Their
principal utility lies in the identification and development of targets, although the
use of BPDs may also enable swift action to be taken to counter a threat.
8.34.
BPDs are already used elsewhere, in the private as well as the public sector,
with increasing sophistication. Their utility to the SIAs has been acknowledged
by successive IsComms and by the ISC: 3.87(d) above. As I concluded in
AQOT 8.106: “It may be legitimately be asked, if activity of a particular kind, is
widespread in the private sector, why it should not also be permitted (subject to
proper supervision) to public authorities”.239
8.35.
239
BPDs are used by the SIAs for many purposes: for example, to identify potential
terrorists and potential agents, to prevent imminent travel, and to enable the
SIAs to prioritise work. It will often be possible, in a given instance, to identify an
alternative technique that could have been used.
However many such
alternatives would be slower, less comprehensive or more intrusive. The value
See, generally, AQOT 8.65-8.106 for a discussion of private sector use of personal data and its
implications for the use of investigatory powers by the state.
117