2.78.
We received detailed briefings and demonstrations concerning the use of BPDs
at both MI5 and MI6. We were introduced to the principal technical
developments since 2005, inspected the complete list of BPDs that is currently in
use, and questioned the SIAs about how those BPDs were obtained (in some
cases, by means that would otherwise be unlawful, pursuant to ISA s7).
2.79.
BPDs are still largely held by individual SIAs, though copies may be provided to
other SIAs via the legal gateway provisions in SSA 1989 and ISA 1994, and
individual officers may access data held by a different SIA on an ad hoc basis
when authorised to do so. MI6 and MI5 currently have a greater reliance on
BPDs than GCHQ. There is a cross-SIA mandate to work more collaboratively
across the SIAs in sharing BPDs. The searching of BPDs is performed in a way
that is analogous to commercial techniques.
2.80.
The SIAs do not claim to employ searching techniques any more advanced than
those available commercially: indeed I was told that they see themselves as
“catching up with the commercial sector”. The examples that we were shown
appeared relatively straightforward, and were not indicative of the use of BPDs to
predict in the highly sophisticated manner attributed to some private sector
operatives. But any critical evaluation of the power needs to assume that SIAs
have, or will acquire, the capability to make such use of BPDs as the most
advanced current and future techniques allow.
Safeguards on BPDs
2.81.
The internal SIA controls on the acquisition and use of BPDs, which include sixmonthly reviews of each Agency’s holdings, were summarised in the 2015 ISC
Report113 and the 2015 IsComm Report.114 More detail will be given in the
forthcoming annual report of the IsComm, to be published in September 2016.
2.82.
The 2015 ISC Report criticised the absence of “restrictions on the acquisition,
storage, retention, sharing and destruction of [BPDs]”, and considered that
oversight by the IsComm should be put on a statutory footing.
2.83.
Those concerns have been largely met in the draft Bill and Code of Practice: the
latest external safeguards on the use of BPDs are set out in the draft Code of
Practice and summarised in the Operational Case (10.11-10.17). In summary:
(a) There is a new requirement to obtain warrants to retain and use BPDs,
lasting six months and subject to the same “double lock” (Secretary of State
and Judicial Commissioner) as warrants for bulk interception and bulk EI
(clauses 183-186).
113
114
2015 ISC Report, paras 161-163.
Report of the IsComm for 2014, June 2015, pp. 35-38.
44