48
Investigatory Powers Commissioner’s Annual Report 2019
implemented in their entirety in the shortest reasonable timeframe…the historical lack of
compliance with the law is of such gravity that IPCO will need to be satisfied to a greater
degree than usual that it is “fit for purpose”.
TE1: follow-up inspections
8.49
In the light of the IPC’s comments above, we conducted further inspections of TE1 in April,
June and September 2019. Each of these inspections examined the progress made by MI5
in delivering its remediation measures to reduce the level of compliance risk associated
with TE1. In total, we spent 48 days at MI5 investigating the issues in depth and the IPC and
his Deputy were closely involved throughout.
8.50
Throughout this period, MI5 devoted very substantial resources both to the programme of
work to fix the compliance problems in TE1 and to facilitate our inspections. MI5’s candid
and open approach throughout all four inspections gave us a good degree of confidence in
the conclusions reached at the end of our investigation, which are set out below.
8.51
Having regard to the relevant requirements of the IPA, in particular the “minimisation
requirements” and the safeguards for legally privileged material, we are now satisfied that
MI5’s remediation work in TE1 has secured compliance with the required standards. Where
possible, technical “fixes” have been implemented to enforce compliance requirements.
MI5 should continue to look for, and implement, technical improvements wherever this is
reasonably practicable.
8.52
Where technical changes to TE1 have not been possible, MI5 has introduced a range of
manual processes to ensure its staff use TE1 in a compliant way. The most important
aspects of this manual approach are a set of centrally agreed business processes governing
how warranted data must be handled in TE1, backed up by regular assurance reviews
conducted within individual business areas. It is critical that MI5 continues to maintain
these new processes and to provide sufficient resources for them to function effectively. If
MI5 identifies an increase in non-compliant behaviours in TE1, we would expect this to be
brought to IPCO’s attention as soon as possible.
TE1: MI5’s institutional knowledge and disclosures to IPCO
8.53
In his determination of 3 April, the IPC commented as follows:
It is clear that for warranted material in [TE1] there has been an unquantifiable but
serious failure to handle warranted data in compliance with the IPA for a considerable
period of time, and probably since IPCO first became operational. Assurances that have
been made to the Secretary of State and the Judicial Commissioners of such compliance
were, in hindsight, wrong and should never have been made. Warrants have been
granted and judicially approved on an incomplete understanding of the true factual
position. Indeed, I am concerned that on this important subject we were incompletely
briefed during the Commissioners’ induction programme…To date, therefore, MI5’s
retention of the warranted material in [TE1] cannot be shown to have been held lawfully
and the failure to report these matters timeously to IPCO is a matter of grave concern.
8.54
As mentioned earlier, this issue is now the subject of litigation before the Investigatory
Powers Tribunal. Given the detailed information we have collated on TE1 since this was first
brought to our attention, we are prepared to provide any assistance required of us by the
Investigatory Powers Tribunal or other body in the future.