associated with current targets.5 An example falling outside the scope of the Bill
is the police power to access CCTV footage of a busy street over a given period,
whether filmed by a public authority or a business, for the purposes of
investigating or prosecuting a reported crime.
1.6.
In the context of the powers contained in the Bill – “the interception of
communications, equipment interference and the acquisition and retention of
communications data, bulk personal datasets and other information”6 – the
exercise of a bulk power implies the collection and retention of large quantities of
data which can subsequently be accessed by the authorities. On this broad
definition, the characterisation of a power as a bulk power does not depend on
whether data is collected and stored by the Government or by a private
company.7 Applying that definition, the Bill could be said to contain bulk powers
other than the four I have been asked to look at: see 2.5 below.
5
6
7
8
9
10
1.7.
But the Bill (and this Review’s terms of reference) proceed on a narrower
definition of bulk powers, limited to those powers which provide for data in bulk to
be acquired by the Government itself. On that narrower basis, powers to require
(for example) providers of telephone and internet services to collect and retain
their customers’ data in bulk do not qualify as bulk powers, even when
intelligence or law enforcement have the power to acquire that data.8
1.8.
The narrower definition is mirrored in US practice. Thus, the National Academy
of Sciences in its Report of 2015 distinguishes the bulk collection of signals
intelligence by the US government from the government’s use of “bulk data held
by other parties”, which it looks upon as a possible substitute for bulk collection
rather than a form of bulk collection in itself.9 Others take a similar approach.10
The italicised phrase is taken from the working definition of bulk collection used by the US
National Academy of Sciences in its influential report, “Bulk collection of signals intelligence:
technical options” (Washington DC, 2015) [the NAS Report]. Liberty adopted a similar broad
definition of bulk in its submission to the Review of 31 July 2016, paras 10-11. The NAS
Report commented (at p. 2) that “There is no precise definition of bulk collection, but rather a
continuum, with no bright line separating bulk from targeted.”: for an illustration, see 2.19(a)
below.
Long title to the Bill.
The point is illustrated by the filtering arrangements provided for in clauses 63-65 of the Bill,
which will permit public authorities to make complex queries of databases held by multiple
service providers, thus emulating at least to some extent the ability of SIAs to interrogate a
single, aggregated database enabled through the bulk acquisition power.
See also the Government’s “Operational Case for Bulk Powers” (March 2016: see 1.14 below),
which at 2.1 answers the question “What are bulk powers?” by exclusive reference to
techniques used by the Agencies to acquire information in large volumes.
NAS Report, section 4.3, p. 57.
Thus, the USA FREEDOM Act ended the central holding of bulk telephone records under FISA
s215, but established a new system for government access to call detail records held by
service providers: Privacy and Civil Liberties Oversight Board [PCLOB], Recommendations
Assessment Report, 5 February 2016, p.3. Only the former programme is considered by the
PCLOB to involve bulk collection.
3