36
IPCO Annual Report 2017
Legally privileged material30
5.26
The requesting agency must consider the likelihood of acquiring legally privileged material
(LPP), always analysing each individual action for which authorisation is sought. Some
applications cover more than one action. If, for instance, a vehicle tracking device and an
audio recording device are installed, only the latter creates the risk of capturing material
covered by LPP. Particularly with complex authorisations involving a range of actions, there
needs to be reassurance that this has been individually addressed, albeit the conclusions
can be expressed by way of a composite statement. We stress we have no concerns that
LPP is being improperly obtained.
Parties acting on GCHQ’s behalf
5.27
We identified a small number of examples of named individuals or entities acting on behalf
of GCHQ. These relationships need to be considered carefully, paying attention to the access
contractors have to GCHQ systems and the legal relationship between GCHQ and any primary
contractors and their sub-contractors.
5.28
We plan to scrutinise the use of contractors more closely in 2018.
Multiple deployments31
5.29
Property interference can be a single event or repeated during the period covered by the
authorisation. A vehicle location tracking device or beacon is likely to be continuous, whilst
a technical operation conducted at a range of locations to identify a communications device
will self evidently be of limited duration.
5.30
In a small number of instances, the applications by MI5 and SIS were unclear as to whether
the activity was to be a single event or repeated instances. It is critical that this is accurately
described because repeat deployments cannot take place if the submission indicates only
one occurrence.
5.31
The plans for the operation, including the likelihood of repeat deployments, should be clearly
set out in the application. The number and the dates of the deployments should be recorded
in cancellations.
Investigatory Powers Act changes
5.32
Under the IPA 2016, public authorities will need to obtain an equipment interference
warrant when they are interfering with any equipment for the purpose of obtaining
communications, equipment data or other information. This will prevent the use of other
powers to obtain stored communications and information from equipment where the
interference is in the UK and would otherwise constitute an offence under the Computer
Misuse Act 1990. Interference with equipment that is not for the purpose of acquiring
communications or equipment data, or other information, will still constitute ‘property
interference’ and will still be capable of authorisation under section 5 or 7 of ISA 1994
(UKIC) or Part 3 Of the PA 1997 (LEAs).
30 MI5
31 MI5 and SIS