2016-06-06 Official correspondence reveals lack of scrutiny of MI5’s data collection (Census, Lockheed Martin, Privacy of Personal Info)

The campaign group argues that the letters demonstrate the relationship between government agencies and the independent organisation that is supposed to oversee and regulate their activities has been too “cosy”.

The correspondence has been disclosed in the course of legal action between PI and the government at the investigatory powers tribunal (IPT) which is due to be heard in full this year. The IPT deals with complaints about the intelligence services and surveillance by public bodies. GCHQ is alleged to be illegally collecting “bulk personal datasets” from the phone and internet records of millions of people who have no ties to terrorism and are not suspected of any crime.

The letters were sent by Home Office legal advisers, GCHQ and Sir Swinton Thomas, who was the interception of communications commissioner. The organisation is now called the Interception of Communications Commissioner’s Office (IOCCO).

In May 2004, a Home Office legal adviser wrote to Thomas backing an MI5 proposal that collecting bulk data from communication service providers for its “database project” be authorised under section 94 of the 1984 Telecommunications Act because, at that stage, there were no human rights implications or breach of privacy concerns. Using that act would not require a notice to be put before parliament because it could be used secretively on the grounds that “disclosure of the direction would be against the interests of national security”.

Thomas wrote back the following month, expressing reservations about such clandestine authorisation. He proposed that it would be better to use the more modern and exacting Regulation of Investigatory Powers Act 2000 (Ripa), which involves more open legal procedures and safeguards.

The Home Office responded, saying that, although Ripa might be engaged, it did not think that meant it must be used. The letter continued: “The only practical difference between the two sets of provisions is if [Ripa] were used, a new notice would need to be issued every month … involving a fresh consideration of the necessity and proportionality issues. This would not be the case under section 94 [of the Telecommunications Act].”

Thomas backed down, replying that, “on reconsideration”, use of Ripa was not mandatory. He added: “I am also impressed by the considerable and, if possible to be avoided, inconvenience in following the [Ripa] procedure in the database procedures.”

GCHQ wrote to Thomas in October that year after he had visited its Cheltenham headquarters. “Huges volumes of data are acquired (about 40m bits of data a day),” it informed him. “In the interests of security and commercial confidentiality, GCHQ prefers to keep all the telephony material together in one database … to disguise its source, as the origin of some of the material is extremely sensitive.”

GCHQ also asked whether access to communications data for its databases would be lawful under the Telecommunications Act rather than the more burdensome Ripa.

Thomas said it was not a straightforward problem but eventually acquiesced, saying: “I have, therefore, reached the conclusion, not without some difficulty, that the present system for retrieval [under the Telecommunications Act] is lawful. As you say, adhering to the spirit of the legislation is important.”

The debate goes some way to explain official thinking on the legal distinction between anonymised bulk data collection and a second stage of interception where material may be matched to individuals.

The latest revelation follows an earlier release of confidential documents by PI last month that showed how GCHQ, MI5 and MI6 obtain personal data from public and private organisations, including financial institutions, the NHS, electronic petitions record databases and others.

Privacy International said the letters exemplified the “total failure” of oversight.

Caroline Wilson Palow, the organisation’s general counsel, said: “The documents demonstrate the government’s troubling history of over-reaching in order to expand its surveillance powers while minimising safeguards.

“This discussion, between lawyers for MI5 and GCHQ and the interception of communications commissioner, is also an illuminating example of how oversight can go wrong when it lacks sufficient transparency, resources and advocates for the individuals whose privacy may be violated.

“We think the commissioner’s conclusions were incorrect, permitting GCHQ to acquire communications data in bulk under a broad and secret interpretation of a power to which few safeguards attach. Indeed, the commissioner even agrees with GCHQ and MI5 that collecting our communications data from service providers would not be an interference with our privacy – a position that would likely come as a surprise to most of us and is in direct conflict with recent court decisions.”

Sir Stanley Burnton, the interception commissioner at IOCCO, said: “We have recently concluded our comprehensive review of section 94 [Telecommunications Act] directions which have been issued by secretaries of state from various government departments since the late 1990s, after taking this additional oversight on at the request of the prime minister in 2015.

“Our review has been very challenging because all the section 94 directions are subject to statutory secrecy provisions which limit severely what we are able to say publicly about them. Nevertheless, our review report sets out an extensive series of recommendations which must be implemented in order to clarify and bring consistency to the procedures in place, remedy the lack of record-keeping requirements and codified processes and ensure that we are able to undertake this additional oversight and audit of the giving and use of section 94 directions properly. Our report is due to be published at the end of June or early July.”

“We welcome and support Privacy International’s proposal for oversight bodies to be supported by public interest advocates and their calls for further transparency in these matters.”

•  2015-02-25 The public debate on Bill C-51 (Secret Police) should include context, the comprehensive SURVEILLANCE that is already in place