to identify and maintain coverage of these individuals in order to know whether they are
actively planning terrorism operations.
In 2013, analysis of secondary data, obtained under bulk interception warrants,
uncovered a previously unknown email account in contact with a Syria-based extremist
suspected of involvement in planning attacks against the West. Further analysis of
secondary data revealed that the user of this newly discovered email account was
attempting to hide his true intentions. Bulk interception allowed GCHQ to maintain
coverage of his activities despite these attempts.
Analysis of the content of the communications revealed that he was leaving Syria and
travelling to Europe for the next stage of his attack planning. This information was
passed to the authorities of the country to which he had travelled. They took steps to
disrupt his activities.
The Review team was shown some of the intelligence reports created in 2014 as links
with the suspect were developed. The team was given details which showed that it is
very unlikely that the individual would have been identified without the use of bulk
interception.
Case study A8/6
GCHQ
Action
Support of military operations
The Review team was told that, during the Afghanistan campaign, UK military forces
were deployed on multiple occasions to counter insurgent and terrorist activity. Their
tasks included the rescue of UK nationals. Such operations could depend upon
intelligence from bulk interception to locate the targets and assess the right moment for
military intervention.
In one case, around 50 members of GCHQ provided 24/7 support to teams on the
ground in an operation to find and rescue a number of individuals who had been taken
captive. Analysis of secondary data acquired through bulk interception enabled GCHQ to
gather intelligence about the armed group, and then quickly to deploy more intrusive
techniques in order to gain insight into the group’s intent. This work enabled GCHQ to
locate the group, monitor it and establish the group’s links with known terrorist networks.
Within 72 hours of the kidnapping, the hostages had been located. Analysis of the
content of the communications of the kidnappers, obtained through bulk interception,
indicated that the hostages’ lives were in imminent danger. This information was passed
161