50
IPCO Annual Report 2018
2018 on a non-statutory basis and our initial findings will be addressed in our 2019
Annual Report.
8.6
During 2018 we probed GCHQ’s work with contractors to supplement the Investigatory
Powers Tribunal’s (IPT’s) review of the lawfulness of GCHQ’s disclosure of bulk data to
industry partners. We inspected how GCHQ use industry partners, considering the range of
work in which contractors are involved and the lawful basis for this activity. We interviewed
a number of individuals involved in joint programmes of work and were satisfied with their
understanding of the legal requirements and safeguards around their work. We reviewed
the internal oversight mechanisms for industry contractors working both within GCHQ and
off-site and were satisfied that these were rigorous and mirrored those in place for GCHQ’s
own officers.
8.7
We were briefed on the physical and personnel security considerations and safeguards in
place at GCHQ and for off-site working. GCHQ impressed upon us that contractors working
within GCHQ are treated in the same way as permanent staff; all individuals are subject to
the same vetting, training, management and oversight. We concluded that the disclosure of
material to industry partners was necessary and appropriate, given the unique capabilities
that these partners offer, and that the level of oversight provided by GCHQ was adequate.
8.8
In some cases we reviewed in relation to GCHQ’s work with industry partners, however,
we were not satisfied that the internal documentation for the project provided a fullyauditable record of actions tasked, conducted and authorised. GCHQ has suggested that
this may reflect a lack of consistency of approach, rather than a failure to document
considerations. We will review this issue in more detail in our 2019 Annual Report.
8.9
We were satisfied on the basis of inspections in 2018 that GCHQ is generally managing
the sharing of intelligence with foreign partners appropriately, having inspected
the mechanisms used by GCHQ to record requests for data and to disclose data to
foreign partners.
Covert Human Intelligence Sources (CHIS)
8.10
In 2017, we asked GCHQ to adapt its covert human intelligence sources (CHIS) application
template to document more information on necessity, proportionality and intrusion
considerations. GCHQ worked with UKIC partners and have aligned their records, which
focus on articulating and justifying the level of collateral intrusion in particular. GCHQ
has also given consideration to how law enforcement bodies might authorise and record
similar operations. We were pleased to note that GCHQ’s response to this recommendation
comprised a broader and collaborative consideration of the underlying principles.
8.11
Because of the nature of their work, GCHQ conducts little agent activity under the
Regulations of Investigatory Powers Act 2000 (RIPA); that which they do is typically
online. Our inspection focused on the adequacy of training offered to the team and level
of oversight of their work within GCHQ. We were satisfied that the standard of training
was high and that officers had a good understanding of the relevant legal requirements.
However, we made a number of recommendations in relation to internal oversight of CHISrelated activity and in the future will expect GCHQ to demonstrate that authorising officers
have an in-depth and up-to-date understanding of casework that they oversee.