Investigatory Powers Commissioner’s Annual Report 2019
considered CHIS activity. Previously, we were concerned that some WPAs showed a lack of
understanding of when a member of the public or other informant should be considered a
CHIS. We test the knowledge of staff, irrespective of the existence of active authorisations,
to check that no incidents of ‘status drift’ have occurred or are likely to occur. In all cases,
WPAs need to have clear and unambiguous policies setting out how routine work, such as
asking a member of the public to make a ‘test purchase’ of an unlawful item or conducting
an investigation online, can evolve such that it would be appropriate to consider a CHIS
authorisation. We commonly encouraged the continued education of staff to ensure
that processes and procedures were up to date and that any changes in legislation were
reflected within internal policy documents. Additionally, we have reminded several WPAs
to consider whether they have a duty of care towards any individual that provides them
with information on which they might later act. We inspect records of information obtained
from these informants and have advised that these should be well kept, even where there
is no CHIS authorisation in place or planned.
Surveillance
13.8
During our inspections, we focus attention on the use of the internet and social media
by WPAs. Many WPAs have embraced the considerable opportunities presented by the
internet to respond to the emerging threats posed by cyber-enabled and cyber-dependent
crime. The Environment Agency, for example, has produced a fourfold increase in the
number of directed surveillance authorisations to enable online investigative research to
tackle illegal waste disposal. The results of these enquiries have been very impressive,
providing significant evidential and intelligence material.
Figure 12: Surveillance authorisations, 2017 to 201939
1,400
1,200
1,000
1,122
1,171
933
800
600
400
200
0
13.9
2017
2018
2019
Our inspections have also highlighted the importance of keeping guidance up-to-date, in
line with the revised Codes of Practice (CoP) and the legislative changes brought into force
by the Investigatory Powers Act 2016 (IPA). The new CoP provides guidance on the use of
the internet and social media which, if properly applied, should ensure that such resources
are used in a controlled, auditable and well understood manner. However, it is also
39 In addition, the BBC granted 23 authorisations in relation to 328 addresses for the detection of television
receivers pursuant to the RIPA (BBC) Order 2001. The 2001 Order treats TV detection as “surveillance not
otherwise covered” by RIPA and instead provides a bespoke authorisation process.
99