58
A Democratic Licence to Operate
3.49
Communications data is more important now than it has ever been for agencies with
investigatory powers, but content is becoming increasingly difficult to access because
of the growth in sophisticated encryption. Encryption reduces access to content, rather
than access to communications data, by rendering it inaccessible without a key. When
the service provider that holds the key is located within another jurisdiction, access
becomes even harder.
3.50
The use by the agencies of bulk personal data sets (described earlier in Chapter II) was
recently avowed by the ISC. These data sets are used primarily to validate and enhance
existing intelligence. They may be data sets that only the government and its agencies
have authorisation to access (such as electoral rolls, or the passport database). These
data sets may not remain useful for very long and their utility is reviewed regularly; if
there is no reasonable and legitimate reason for keeping the data set, it will be disposed
of. These data sets are processed in the UK and are therefore subject to the DPA 1998
(though this contains exemptions for national-security purposes) and subject to statutory
oversight by the Intelligence Services Commissioner.
Encryption
3.51
The issues and complications for intelligence and law enforcement surrounding
encryption are clearly articulated in David Anderson’s recent report and highlight the
conflicting opinions of privacy advocates and security officials.25
3.52
As discussed in Chapter I, encryption is an integral part of Internet communications, and
is necessary to ensure that, for example, online transactions remain secure. There are
benefits and risks involved with end-to-end encryption (whereby the data can only be
decrypted by the receiver and not by the CSP or any other intermediary). The degree to
which data is encrypted has consequences for policing and national security, however.
3.53
In the private sector, CSPs have begun to introduce end-to-end encryption more
extensively, particularly in the US market. This presents the police and SIAs with a
significant challenge if they are looking to monitor the communications of individuals
who pose a risk to collective security. They are increasingly concerned by the fact that
many of the subjects of interest – including those in the highest-priority investigations
– are able to use means of communication to which they no longer have access. It is
this lack of detailed intelligence available on a small number of high-priority targets
that is the prime concern, rather than broader intelligence available on a large number
of low-priority targets. As noted by Anderson, the agencies ‘struggle with the growth
of encryption and the diversification of the communications market’, and argue that ‘if
they cannot maintain their capabilities, threats will go undetected and opportunities to
disrupt the ill-intentioned will not be identified’.26
25. See Chapter 4 (Technology) in Anderson Report, 4.44-4.71.
26. Ibid., p. 195.