operations (A8/2,11) during my work on A Question of Trust201, and Cathryn
McGahey QC had detailed knowledge of one of these (A8/2) from previous work.
5.13.
A8/5 and A8/10 had featured in the Operational Case: the Review team was also
given (A8/8) an example of the cyber-defence work described in more general
terms as a case study in the Operational Case.
5.14.
In addition, GCHQ provided samples of intelligence reports which were graded
as being highly valuable and which contained intelligence obtained through bulk
interception of content.
5.15.
The case studies illustrated the use of bulk interception in a wide range of fields,
including counter-terrorism in the UK and overseas (A8/1-5), cyber-defence
(A8/8-9), child sexual exploitation (A8/10-11) and organised crime (A8/12-13).
We were also given extensive detail of GCHQ’s work to support military
operations (A8/6-7).
5.16.
The case studies illustrated the value of bulk interception in target discovery and
development (e.g. A8/2,3). A8/2 involved the analysis of patterns of behaviour to
identify terrorists. A8/3 showed the use of bulk interception at substantial scale;
both communications data and content obtained through bulk interception were
used to triage some 1,600 leads provided to the SIAs in the wake of attacks in
France.
5.17.
However, the predominant use of bulk interception, at least in the examples
given to the Review team, was as the basis for action, frequently with other SIAs
or the police. For example:
(a) GCHQ used bulk interception of communications data to identify individuals
planning a terrorist attack against the UK; the intelligence was passed to the
police, who were able to prevent an attack from taking place (A8/1).
(b) The use of intelligence gained through bulk interception as a basis for urgent
action was illustrated starkly in the case of a kidnapping in Afghanistan
(A8/6). Bulk interception of communications data led to hostages being
located within 72 hours of their abduction; bulk interception of content
revealed an immediate threat to the life of the hostages, and to an urgent
(and successful) military rescue mission.
5.18.
201
The case studies indicate that, whilst substantially more use is made of
communications data than of content, content is often crucial to uncovering the
AQOT Annex 9 Case Study 5
83