intentions and plans of individuals in a way that could not be achieved with only
communications data.202 Thus:
(a) A8/4 and 8-13 involved the selection for examination of intercepted
communications data alone.
(b) A8/1-3 and 5-7 involved the examination of both communications data
and content obtained through bulk interception. In some of these
instances (e.g. A8/6-7), content was intercepted after the relevant
telephone or email address had been identified through the interrogation
of bulk secondary data.
5.19.
No case study shown to the Review team involved the use of bulk interception of
content alone. GCHQ told me that “secondary data will almost always have been
crucial in ensuring that content was available to the analyst to report”.
Alternative methods
5.20.
During the presentation by GCHQ of the case studies, members of the Review
team questioned the decision in each case to use bulk interception and explored
alternatives.
5.21.
Potential alternatives inevitably varied with the nature of each case but the
Review team looked in particular at targeted interception and the use of human
sources. In cyber-crime, the use of commercial cyber-defence products was
considered.203
Targeted interception
5.22.
In the case of bulk interception based on a strong selector (described in para.
2.19(a) above), it might appear that a targeted warrant would be a viable
alternative; the selector is after all already known.
5.23.
A similar point could be made in those instances in which the relevant device or
email address had first been identified through the interrogation of bulk
secondary data (A8/6-7). The interception of content was authorised under the
terms of the bulk interception warrant used to obtain the secondary data; but we
pressed GCHQ on why, having obtained the secondary data, it could not have
applied for a targeted warrant to obtain content.204
202
203
204
For example, in the Afghan hostage case study (A8/6), there would have been no way to know
that the hostages were in imminent danger using communications data alone.
Liberty suggested (Submission of 31 July 2016, para 30) that targeted EI could be another
alternative. But even if the target is known, the conditions for the use of targeted EI will not
always be satisfied.
Cf. AQOT, Recommendation 80(a).
84