Report of the Independent Surveillance Review
23
established protocols. As already noted, under existing legislation a distinction is
made between content data and communications data; access to the latter is generally
considered less intrusive under current law, though still requiring the tests of lawfulness,
necessity and proportionality to be demonstrated to the authorising officer, a designated
person within their organisation, to obtain access. Access to content data is typically
granted under a warrant, currently signed by a secretary of state and subject to ex post
oversight by a commissioner.
1.64
Scarcity of resources and the need to prioritise investigations plays an important part
in how data can be analysed by the SIAs and law-enforcement agencies. The ISR Panel
were informed by these agencies that the acquisition of bulk data is seen as a means
to a specific end, rather than an end in itself. For example, if no initial sources or leads
are available, then broad data collection might be undertaken, regarding which contextspecific questions would be asked, such as the type of communication device used within
a geographic area at a specific time, in order to establish potential leads.66 The data is
then filtered down as much as possible before a human analyst examines it.
1.65
Other search ‘selectors’ can be applied to narrow the field of data, such as a particular
e-mail address, requested from the bulk data set; the agencies operate a process of
continually trying to discard false positives and non-threats. The operative process is
to narrow down the data funnel to provide useful information and leads.67 Analysts
are not permitted to trawl through data on ‘fishing expeditions’ as arbitrary intrusion
would be unlawful.68
The Value of Data
1.66
Modern, democratic governments obtain large quantities of data under their mandate
to run public services. There is widespread recognition that data must be collected
to enable government to govern and in order to ensure the effective management of
public services and resources, and that such services are accurately targeted where they
are most needed.
1.67
UK citizens have passed much personal data onto the government on a formal basis
every ten years since the Population Act (also known as the Census Act) of 1800. In
a similar way to the census, the government can use digital information to improve
government services (including analysing economic trends, formulating policy and
allocating resources to certain activities or geographic areas). The government can also
draw on data collected by other organisations.69 Big-data approaches have been used
by all types of public-sector bodies – whether national ones, such as the NHS, trying to
66.
67.
68.
69.
ISR visit to GCHQ, December 2014.
ISR visit to GCHQ, December 2014.
ISC, Privacy and Security, p. 45.
Katalysis, ‘An Open National Address Gazetteer’, Department for Business, Innovation and
Skills, 2014.