Case study A8/2
GCHQ/MI5
Target development/pattern analysis
Counter-terrorism
Summarised in A Question of Trust Annex 9 Case Study 3
This case study relates to events in 2009. After the disruption of a UK terrorist cell,
GCHQ and MI5 continued to investigate the potential overseas links of that cell as a high
priority.
GCHQ staff told the Review team that analysis of secondary data obtained through bulk
interception warrants proved critical to the discovery of a new UK-based terrorist plot.
GCHQ undertook complex analysis of this data to look for patterns of behaviour
indicative of operational planning. They identified an email address that was in contact
with a UK-based individual. Analysis of the communications data and content of these
emails revealed more members of the UK network and details of the attack plot. The UK
individual was subsequently arrested along with a number of associates. Without bulk
data, GCHQ would not have found the email addresses which led to the identification of
the UK-based operative.
Case study A8/3
GCHQ/MI5 and partner agencies
Identify/triage/target discovery and development
Counter-terrorism
Following terrorist attacks in France, GCHQ provided support to both MI5 and European
partners in identifying targets and prioritising leads. GCHQ triaged around 1600
international leads (in the form of telephone numbers, email addresses or other
identifiers) in the days following the attacks. It was necessary quickly to determine
whether there was any further attack planning or to rule out the possibility of further
attacks.
GCHQ used both secondary data and content obtained through bulk interception
warrants to identify those leads that should be prioritised for further investigation by
intelligence and law enforcement partners.
Without bulk data, this triage work would have taken much longer and GCHQ would
have needed to make targeted requests in relation to each potential lead. In most cases,
they would have had to relay these requests to overseas CSPs through foreign partners.
This approach would potentially have taken many months and would inevitably have led
159