IPCO Annual Report 2018
Bulk communications data (BCD)
6.27
The last IPCO Annual Report described the processes by which MI5 and the Government
Communications Headquarters (GCHQ) access bulk communications data (BCD), both
of which include consideration of the principles of necessity and proportionality. The
procedures and operational requirements within the agencies differ and mean it is not
possible to provide comparable statistical information about access to, and use of, BCD.
6.28
There were some existing section 94 Directions in 2018 which related to MI5.25
These directions have been replaced by bulk acquisition warrantry relating to UK
telecommunication operators, which commenced in October 2018. Because this area
is subject to the double lock, the focus of our inspections has therefore changed to
scrutinising the acquisition, retention, use and disclosure of warranted data. We also
examine the procedures in place to access and examine the data. We interviewed those
in charge of intelligence operations, senior managers authorising access, analysts in
operational teams and those who manage and carry out audits of the access.
6.29
During our inspections at MI5, we concluded that the submissions to the Secretary of
State were highly detailed, explained clearly why the acquisition, retention, access to
and analysis of BCD was required in the interests of national security, and set out the
intelligence requirements they were seeking to address. The submissions included
extensive detail as to how the BCD would address operational requirements, the expected
value of the intelligence derived from it and why there was no viable alternative to the
proposed acquisition of BCD.
6.30
The Home Secretary’s direction required MI5 to carry out a review every six months and
share findings with the Home Office. We scrutinised the review documentation at MI5;
we were satisfied that the six-monthly reviews for all existing section 94 directions were
comprehensive, containing a summary of the data that had been retained and how the
BCD was to be handled, analysed and accessed. The reviews included the operational
justification and legal basis for continued retention and use and set out the value to
relevant operations. The reviews documented an assessment of the collateral intrusion
that occurred as a result of MI5 having possession of, and access to, the BCD and set out
consideration of the issues and consequences of alternative forms of acquisition and the
potential contingencies involved.
6.31
Until 8 October 2018, the MI5 process for accessing BCD, acquired and retained by the
agency as a consequence of section 94 directions, substantially mirrored that set out in
Chapter 2 Part 1 RIPA and the CoP for the Acquisition and Disclosure of Communications
Data. That process required the investigator or analyst to set out in an application why it
was necessary and proportionate to access the data. A designated person of appropriate
seniority in the organisation then considered whether to give authority for access to the
data MI5 retained. Overall, we concluded that MI5’s applications were of a high standard
and satisfied the principles of necessity and proportionality.
6.32
This process changed substantially once bulk acquisition warrants were introduced in
October. The applicant is now required to complete an application prior to submitting
the search query, selecting the operational purpose and recording why the proposed
examination is necessary.
25 Previously, the Secretary of State issued directions to communications service providers under section 94 of the Telecommunications
Act 1984, which enabled the intelligence agencies, specifically MI5 and GCHQ, to obtain communications data in bulk. The IPA
repeals this power and replaces it with bulk acquisition warrants.
39