“The particular significance of the use of CNE is that it addresses
difficulties for the Intelligence Agencies caused by the ever increasing use
of encryption by those whom the Agencies would wish to target for
interception.”86
2.47.
EI can give the SIAs access to a wide range of material, including the content of
communications as well as equipment data.87 Such material may well,
depending on the case, have been rendered impossible or very difficult to
intercept by end-to-end encryption. EI thus represents one answer to the “going
dark” problem to which I referred in AQOT 10.17-10.19, and of which I have seen
further evidence during the course of this Review, including in internal SIA
documents.
2.48.
EI is currently practised pursuant to authorisations under ISA 1994 ss 5 (inside
or outside the UK) and 7 (outside the UK): see AQOT 6.24-6.33 and 7.62-7.65.
In the absence of such legal authorisation, most CNE operations would amount
to offences under the Computer Misuse Act 1990.
2.49.
Interference with property or wireless telegraphy that is not for the purpose of
acquiring communications, equipment data or other information (for example,
disabling an alarm system to obtain covert access to a building) is not EI and
continues to fall within the definition of “property interference”, governed by ISA
1994 ss 5 and 7 or Part 3 of the Police Act 1997.88
2.50.
EI was avowed for the first time in February 2015, when the Government
published a draft Equipment Interference Code in response to a case brought by
Privacy International in the IPT.89 A much more detailed draft Code of Practice,
with specific provision for bulk EI, was published alongside the Bill in March
2016.
Thematic vs bulk EI
2.51.
It is important to understand the difference between targeted EI and bulk EI,
which because of the wide potential scope of the thematic EI power relates not
so much to the possible scope of a warrant as to the applicable safeguards. In
short summary:
(a) Targeted EI warrants (clause 93(2)) may be sought by an SIA Head but
also by the Chief of Defence Intelligence and by a Law Enforcement Chief
(e.g. the Chief Constable of a police force). There is no requirement for a
86
87
88
89
Privacy International v Secretary of State for Foreign and Commonwealth Affairs and GCHQ
[2016] UKIPTrib 14_85-CH, para 3.
Clause 93(2) (targeted EI) and clause 162(1)(b) (bulk EI).
Ibid., 2.6-2.7.
For the link, see Privacy International v Secretary of State for Foreign and Commonwealth
Affairs and GCHQ [2016] UKIPTrib 14_85-CH, para 11.
35