108
A Democratic Licence to Operate
Board with an Advisory Council for Digital Technology and Engineering. The Advisory
Council would be a statutory and non-departmental public body established under new
legislation. Terms of reference for a new Advisory Council should be drawn up so as to
keep under review the domestic and international situation with respect to the evolution
of the Internet, digital technology and infrastructure, as well as:
•
•
•
•
•
Provide advice to relevant ministers, departments and agencies on
technical measures
Promote co-operation between the public and private sectors
Manage complaints from CSPs on notices and measures they consider unreasonable
Advance public education
Support research on technology and engineering.
Recommendation 7: The Advisory Council should be a resource for a new National
Intelligence and Surveillance Office (see Recommendation 17) and the ISC.
Bulk Data Collection and Retention
5.48
While the focus of much public concern relates to bulk data collection, the Panel believe
it is important to distinguish between the relative impact on privacy of the processes
of data collection, retention and analysis. Privacy issues need to be considered afresh
at each stage.
5.49
The Panel are persuaded by the argument that the SIAs in particular will always need
to conduct both targeted (that is, specifying the individuals or premises to be covered
by the warrant) and untargeted data collection (recognising that even untargeted
collection must be specifically aimed at achieving an authorised mission or intelligence
requirement). Targeted data collection will be needed when the agencies have identified
a subject or subjects of interest and require further information on them, if only to
confirm whether or not they pose a threat. Some degree of untargeted data collection,
involving the collection of data in bulk, may sometimes be required, especially given the
nature of modern communications.
5.50
The Panel accept that some critics will remain convinced that untargeted data collection
as a principle is unacceptable, and we recognise their concerns. At the same time, the
Panel believe that the ability of the SIAs to collect data in bulk may in some instances
be necessary when there is no viable alternative for them to identify potential and
unknown threats, particularly online. However, the Snowden disclosures show how such
data collection can be undertaken without public awareness or consent. Such awareness
and consent are crucial, as are robust oversight mechanisms to reassure the public
that capabilities are not being misused or abused. The Panel note that a number of
improvements can be made to the current system of oversight to improve confidence,
discussed in more detail below.