62
Investigatory Powers Commissioner ’s Annual Report 2019
10. Government
Communications
Headquarters (GCHQ)
Overview
10.1
We conducted a series of inspections at GCHQ and received briefings on key areas of their
work during the course of 2019. These discussions, and our oversight, focused on the
transition to the new legislation for GCHQ’s more technical work and we were grateful
for the involvement of the Technology Advisory Panel (TAP) in this. Because of GCHQ’s
functions, there is a greater focus on technically complex activity and bulk collection,
as is reflected in this chapter, and GCHQ has taken a leading role in discussions with
the Investigatory Powers Commissioner’s Office (IPCO) and government stakeholders
throughout the year to ensure that these are well managed and well understood by
overseers, including our Judicial Commissioners (JCs).
Findings
10.2
The Investigatory Powers Act 2016 (IPA) has formalised provisions for conducting operations
in bulk. A key question for us is whether the bulk powers are balanced appropriately with
targeted powers and we felt on examination that this was well considered and well handled
by GCHQ. Overall, we were satisfied that operations conducted under the bulk warrants
were necessary and proportionate, but the quality of applications for internal approval
was variable and we observed that there was room for improvement in the way that such
applications were set out.
10.3
In our 2018 report, we noted that a higher number of GCHQ’s equipment interference (EI)
operations were relying on bulk equipment interference (BEI) warrants than had previously
been envisaged. This continued to be the case during 2019, when GCHQ successfully
applied for new BEI warrants relating to work that was previously authorised through
different mechanisms. GCHQ also has plans to apply for a small number of BEI warrants in
2020. We will be engaging with GCHQ at an early stage to determine how best to provide
ex post facto oversight of these new bulk warrants.
10.4
We found that the critical role of bulk communications data (BCD) to the range of activities
conducted at GCHQ was well articulated in the casework we inspected. We considered
the nature of the requested data and the stated intelligence requirements and were
satisfied that the documentation demonstrated that their approach was necessary
and proportionate.
10.5
Our inspections of covert human intelligence sources (CHIS) and directed surveillance at
GCHQ also found a good level of compliance, but we saw only partial improvement against
previous recommendations. Following our 2019 inspection, GCHQ will provide an action
plan for improvement to CHIS and directed surveillance applications (DSA) processes. This
activity comprises a small but important part of GCHQ’s covert activity online.