IPCO Annual Report 2017
–– a summary of the data that had been retained, and how the BCD was to be handled
and analysed;
–– an assessment of the value and operational advantages that access to this data would
provide for the relevant operations and investigations;
–– the operational justification and legal basis for continued retention and use;
–– the process for members of staff within the agency to access the BCD;
–– an assessment of the collateral intrusion by the intelligence agency in possession of,
and having access to, the BCD;
–– an update on the ongoing IPT case; (see later reference in this Chapter)
–– confirmation of ongoing liaison with the CSP which was the subject of the s.94
direction; and
–– consideration of the issues and consequences of alternative forms of acquisition
and the potential contingencies involved.
Access to the bulk communications data retained by the agency
9.25
The last IOCCO annual report described that distinct processes have developed in MI5 and
GCHQ to access bulk communications data, both of which include consideration of the
principles of necessity and proportionality as set out below. The different procedures mean
it is not possible to provide comparable statistical information about access to, and use of,
bulk communications data.
9.26
GCHQ treats all operational data gathered from a variety of different sources in the same
way. Where there is an operational requirement to access operational data which will
include bulk communications data, an analyst must justify why the access and examination
of the data are necessary and proportionate. This is a three-stage process which covers
(i) why the search is necessary for one of the authorised purposes, for example, in the
interests of national security; (ii) an internal cross-reference number which equates to the
specific intelligence requirement and priority for the search; and iii) the necessity and
proportionality justification for accessing the data.
9.27
During inspections into the selection of bulk communications data for examination by
analysts at GCHQ, our inspectors review the breadth and depth of the internal procedures
and audit a number of individual requests made by analysts. They have been satisfied that,
in the individual requests examined, the analysts had justified properly why it was necessary
and proportionate to access the communications data.
9.28
Previous IOCCO reports53 commented on the process at GCHQ for selecting and examining
intercepted material and related communications data.54 The process for selecting and
examining bulk communications data is essentially the same. We draw, therefore, the same
conclusion as in previous years, namely that although the selection procedure is carried
out carefully and conscientiously, the process relies mainly on the professional judgment
of analysts, their training and management oversight.
53 See for example Paragraphs 6.37 to 6.40 of the March 2015 Report.
54 See section 20 of the Regulation of Investigatory Powers Act 2000 for definitions of ‘intercepted material’ and ‘related communications
data’ http://www.legislation.gov.uk/ukpga/2000/23/section/20.
65