IPCO Annual Report 2018
8.25
In 2018 GCHQ sought approval in every instance to use warranted bulk equipment
interference warrants for the full range of operational purposes. For bulk interception
GCHQ felt it appropriate to limit the operational purposes for a number of warrants.
8.26
This is consistent with the strategic nature of bulk intercept and bulk equipment
interference, reflects the broad range of targets that GCHQ may need to work against
under these warrants and is consistent with the relevant Codes of Practice. Sections 145
and 186 of the IPA provide for the modification of bulk interception and bulk equipment
interference warrants respectively. Under a modification agencies can add, vary or remove
an operational purpose as specified in the warrant as a purpose for which any intercepted
content or secondary data or EI material obtained may be selected for examination. During
2018 GCHQ did not modify any bulk interception or bulk equipment interference warrants
in this way.
8.27
The system used by GCHQ to effect selection for examination of product obtained under
their bulk interception and bulk equipment interference warrants require an operational
purpose to be recorded before access is granted to the product, along with a necessity and
proportionality justification.
Bulk Communications Data
8.28
Extant section 94 directions were replaced by bulk acquisition warrants commenced in
February 2019 and do not, therefore, form part of our report of GCHQ’s activities in 2018.
We reviewed all of the section 94 directions during our inspections and found them to
be of a high standard, including clear detail of the expected value from the proposed
action. We have previously provided a statistic for the percentage of end product reports
which include material acquired under section 94. In view of the transition to the IPA,
and an evolution of how intelligence is analysed and reported at GCHQ, we no longer
believe that this statistic is meaningful. There is no question of the ongoing value of bulk
communications data (BCD) to GCHQ’s operational output, but we are currently unable to
provide any statistics to quantify that value.
8.29
The Foreign Secretary requires GCHQ to carry out a review every six months and share
these reviews with the Foreign and Commonwealth Office (FCO). We scrutinised the
review documentation at GCHQ and were satisfied that all were comprehensive, containing
a summary of the data that had been retained and how the BCD was to be handled,
analysed and accessed. The reviews included the operational justification and legal
basis for continued retention and use and set out the value to relevant operations. The
reviews documented an assessment of the collateral intrusion and set out consideration
of the issues and consequences of alternative forms of acquisition and the potential
contingencies involved.
8.30
As at MI5, we review acquisition, retention, use and disclosure arrangements for all data
obtained under a section 94 notice. In 2018, we interviewed officers responsible for
authorising access, as well as analysts and staff responsible for auditing access to the data.
8.31
During our inspections, GCHQ and MI5 both demonstrated the value of BCD to recent
operations. The critical role of BCD to the range of activities conducted at GCHQ was well
articulated in the casework we inspected. We were satisfied that the submissions to the
Foreign Secretary explicitly set out why the acquisition, retention, access to and analysis
of the data was necessary to GCHQ’s statutory functions and specifically to the stated
operational requirements. We considered the nature of the requested data and the stated
53