Investigatory Powers Commissioner’s Annual Report 2019
Covert human intelligence sources (CHIS)
10.6
CHIS operations play a small but important role in support of GCHQ’s functions. All the CHIS
activity authorised under the Regulation of Investigatory Powers Act 2000 (RIPA) by GCHQ
is carried out by officers online. We examined a small number of CHIS cases this year and
found them to be necessary and proportionate.
10.7
We made several recommendations following our 2018 inspection. These were
predominantly regarding the role of the Authorising Officer (AO). We also made a
recommendation, similar to that made at MI5 (paragraph 8.8), that authorisations which
relate to officers carrying out activity online should relate to the planned activity rather
than the persona or profile, which could be used by multiple officers to interact with
several individuals online. GCHQ have developed new authorisation forms and engaged
external training providers. Training for officers and controllers has been included in a
formal ‘learning path’ and GCHQ has written a new CHIS policy handbook for its staff. As
a result of these changes, the welfare of the online operatives is now more formalised by
means of psychological assessments, workshops and surgeries, but further work is still
required to ensure that detailed, operative specific risk assessments are completed in
every case.
10.8
Taken together we believe that these measures should address the shortcomings
previously identified and provide a solid foundation for CHIS activity. However, delays
in implementation meant that none of the intended improvements were evident in the
records examined this year. Given the ongoing improvements, we did not make additional
recommendations, but have offered to support internal training courses in the future.
10.9
At our most recent inspection, GCHQ were unable to locate and produce some of the
supporting records around case management and welfare that we asked to see. We have
asked GCHQ to improve their housekeeping and ensure that they are able to present the
required documents at future inspections.
Juvenile CHIS
10.10
We are satisfied that GCHQ has policies in place regarding the recruitment and running of
juvenile CHIS.
Surveillance
10.11
GCHQ uses directed surveillance to conduct online activity and examine communications
devices which might have been remotely interfered with by hostile actors. A device can be
examined with the owner’s consent, or where it is necessary to examine communications
on the device, with the additional consent of one of the parties to any communication and
a directed surveillance authorisation under RIPA (see section 44(2) IPA). We have discussed
the legal framework for this activity with GCHQ and have found their records in relation
to these operations and activities to be of a generally high standard. Nevertheless, GCHQ
reported 3 errors relating to surveillance in 2019. These errors stemmed from a lack of
understanding of when an authorisation is required and of the need for unambiguous
consent from the recipient or sender of messages when one-party consent procedures are
relied on. GCHQ recognise these issues and we expect to see a reduction in errors in 2020.
10.12
Although some of the online activity authorised was broadly drawn, we found all
authorised to be necessary and proportionate. We have observed that broadly drawn
applications require those working on them to place a greater emphasis on necessity and
63