Interception of Communications Code of Practice Pursuant to section 71 of the Regulation of Investigatory Powers Act 2000
Draft for public consultation February 2015
Contents Contents....................................................................................................................................... 2 1. General ................................................................................................................................ 4 2. Unlawful interception - criminal and civil offences ............................................................... 5 3. General rules on interception with a warrant ....................................................................... 6 Necessity and proportionality .......................................................................................... 6 Meaning of “telecommunications service” ....................................................................... 7 Implementation of warrants ............................................................................................. 7 Provision of reasonable assistance ................................................................................. 8 Provision of interception capability .................................................................................. 8 Duration of interception warrants..................................................................................... 9 Stored communications ................................................................................................... 9 4. Special rules on interception with a warrant ...................................................................... 11 Collateral intrusion......................................................................................................... 11 Confidential information ................................................................................................. 11 Communications subject to legal privilege .................................................................... 11 Communications involving confidential journalistic material, confidential personal information, communications between a Member of Parliament and another person on constituency business ................................................................................................... 13 5. Interception warrants (section 8(1)) ................................................................................... 15 Application for a section 8(1) warrant ............................................................................ 15 Authorisation of a section 8(1) warrant .......................................................................... 16 Urgent authorisation of a section 8(1) warrant .............................................................. 16 Format of a section 8(1) warrant ................................................................................... 16 Modification of section 8(1) warrant............................................................................... 17 Renewal of a section 8(1) warrant ................................................................................. 17 Warrant cancellation...................................................................................................... 18 Records ......................................................................................................................... 18 6. Interception warrants (section 8(4)) ................................................................................... 19 Section 8(4) interception in practice .............................................................................. 19 Definition of external communications ........................................................................... 19 Intercepting non-external communications under section 8(4) warrants ....................... 20 Application for a section 8(4) warrant ............................................................................ 20 Authorisation of a section 8(4) warrant .......................................................................... 21 Urgent authorisation of a section 8(4) warrant .............................................................. 22 Format of a section 8(4) warrant ................................................................................... 22 Modification of a section 8(4) warrant and/or certificate ................................................ 22 Renewal of a section 8(4) warrant ................................................................................. 23 Warrant cancellation...................................................................................................... 23 Records ......................................................................................................................... 23 7. Safeguards ........................................................................................................................ 25 The section 15 safeguards ............................................................................................ 25 Dissemination of intercepted material ........................................................................... 25 Copying ......................................................................................................................... 26 Storage .......................................................................................................................... 26 Destruction .................................................................................................................... 26 Personnel security ......................................................................................................... 27 The section 16 safeguards ............................................................................................ 27 8. Disclosure to ensure fairness in criminal proceedings ....................................................... 29 2
Exclusion of matters from legal proceedings ................................................................. 29 Disclosure to a prosecutor ............................................................................................. 29 Disclosure to a judge ..................................................................................................... 30 9. Interception without a warrant ............................................................................................ 31 Interception with the consent of both parties ................................................................. 31 Interception with the consent of one party ..................................................................... 31 Interception for the purposes of a communication service provider............................... 31 Lawful business practice ............................................................................................... 32 10. Oversight.............................................................................................................................. 33 11. Complaints ........................................................................................................................... 34
3
1. General 1.1
This code of practice relates to the powers and duties conferred or imposed under Chapter I of Part I of the Regulation of Investigatory Powers Act 2000 (“RIPA”). It provides guidance on the procedures that must be followed before interception of communications can take place under those provisions. This code of practice is primarily intended for use by those public authorities listed in section 6(2) of RIPA. It will also allow postal and telecommunication operators and other interested bodies to acquaint themselves with the procedures to be followed by those public authorities.
1.2
RIPA provides that all codes of practice issued under section 71 are admissible as evidence in criminal and civil proceedings. If any provision of this code appears relevant before any court or tribunal considering any such proceedings, or to the Investigatory Powers Tribunal, or to one of the Commissioners responsible for overseeing the powers conferred by RIPA, it must be taken into account.
1.3
This version of the code replaces all previous versions of the code.
4
2. Unlawful interception - criminal and civil offences 2.1
Interception is lawful only in the limited circumstances set out in section 1(5) of RIPA.
2.2
Section 1(1) of RIPA makes it a criminal offence for a person intentionally, and without lawful authority, to intercept in the United Kingdom (UK) any communication in the course of its transmission if that communication is sent via a public postal service or a public telecommunication system. The penalty for unlawful interception is up to two years‟ imprisonment or a fine up to the statutory maximum.
2.3
Section 1(1A) enables the Interception of Communications Commissioner to serve a monetary penalty notice imposing a fine of up to £50,000 if he or she is satisfied that: a person has unlawfully intercepted a communication at a place in the UK; the communication was intercepted in the course of its transmission by means of a public telecommunication system; the person was not, at the time of the interception, making an attempt to act in accordance with an interception warrant which might explain the interception concerned; the person has not committed an offence under section 1(1) of RIPA (intentional unlawful interception).
2.4
Guidance on the administration of these sanctions is available on the Commissioner‟s website: http://www.iocco-uk.info
2.5
Section 1(2) of RIPA makes it a crime for a person intentionally and without lawful authority to intercept in the UK any communication in the course of its transmission by means of a private telecommunication system, unless, as set out at section 1(6), the person has a right to control the operation or the use of the system, or has the express or implied consent of such a person to make the interception.
5
3. General rules on interception with a warrant 3.1
Interception has lawful authority where it takes place in accordance with a warrant issued under section 5 of RIPA. Chapter 9 of this code deals with the circumstances in which interception is permitted without a warrant.
3.2
There are a limited number of persons who can make an application for an interception warrant, or an application can be made on their behalf. These are: The Director-General of the Security Service. The Chief of the Secret Intelligence Service. The Director of the Government Communications Headquarters (GCHQ). The Director-General of the National Crime Agency (NCA handles interception on behalf of law enforcement bodies in England and Wales). The Chief Constable of the Police Service of Scotland. The Commissioner of the Police of the Metropolis (the Metropolitan Police Counter Terrorism Command handles interception on behalf of Counter Terrorism Units, Special Branches and some police force specialist units in England and Wales). The Chief Constable of the Police Service of Northern Ireland. The Commissioners of Her Majesty‟s Revenue & Customs (HMRC). The Chief of Defence Intelligence. A person who, for the purposes of any international mutual assistance agreement, is the competent authority of a country or territory outside the UK.
3.3
Any application made on behalf of one of the above must be made by a person holding office under the Crown.
3.4
All interception warrants are issued by the Secretary of State.1 Even where the urgency procedure is followed, the Secretary of State personally authorises the warrant, although it is signed by a senior official.
Necessity and proportionality 3.5
Obtaining a warrant under RIPA will only ensure that the interception authorised is a justifiable interference with an individual‟s rights under Article 8 (right to respect for private and family life) of the European Convention on Human Rights (ECHR) if it is necessary and proportionate for the interception to take place. RIPA recognises this by first requiring that the Secretary of State believes that the authorisation is necessary for one or more of the following statutory grounds: In the interests of national security; To prevent or detect serious crime;
1
Interception warrants may be issued on “serious crime” grounds by Scottish Ministers, by virtue of arrangements under the Scotland Act 1998. In this code references to the “Secretary of State” should be read as including Scottish Ministers where appropriate. The functions of the Scottish Ministers also cover renewal and cancellation arrangements.
6
To safeguard the economic well-being of the UK so far as those interests are also relevant to the interests of national security. 3.6
These purposes are set out in section 5(3) of RIPA. The Secretary of State must also believe that the interception is proportionate to what is sought to be achieved by that conduct. This involves balancing the intrusiveness of the interference against the need for it in operational terms. Interception of communications will not be proportionate if it is excessive in the circumstances of the case or if the information which is sought could reasonably be obtained by other means.
Meaning of “telecommunications service” 3.7
Section 2 of RIPA defines “telecommunication service” as any service that consists in the provision of access to, and of facilities for making use of, any telecommunication system. Section 2(8A) of RIPA makes clear that any service which consists in or includes facilitating the creation, management or storage of communications transmitted, or that may be transmitted, by means of such a system are included within the meaning of “telecommunications service”. Internet based services such as web-based email, messaging applications and cloud-based services are, therefore, covered by this definition. The definition of “telecommunications service” in RIPA is intentionally broad so that it remains relevant for new technologies.
Implementation of warrants 3.8
After a warrant has been issued it will be forwarded to the person to whom it is addressed - in practice the intercepting agency which submitted the application. Section 11 of RIPA then permits the intercepting agency to carry out the interception, or to require the assistance of other persons in giving effect to the warrant. A warrant may be served on any person who is required to provide assistance in relation to that warrant.
3.9
Where a copy of an interception warrant has been served on anyone providing a postal service or a public telecommunications service, or who has control of a telecommunication system in the UK, that person is under a duty to take all such steps for giving effect to the warrant as are notified to him or her by or on behalf of the person to whom the warrant is addressed. This applies to any company offering services to customers in the UK, irrespective of where the company is based. Section 11 also sets out the means by which that duty may be enforced.
3.10
Section 11(2B) of RIPA provides that service of a copy of a warrant on a person outside the UK may (in addition to electronic or other means of service) be effected in any of the following ways: By serving it at the person‟s principal office within the UK or, if the person does not have an office in the UK, at any place in the UK where the person carries on business or conducts activities; At an address in the UK specified by the person; By making it available for inspection at a place in the UK (if neither of the above two methods is reasonably practicable).
7
Provision of reasonable assistance 3.11
Any person providing a postal service or a public telecommunications service, or who has control of a telecommunications system in the UK, (referred to as communications service providers (CSPs) in this code) may be required to provide assistance in giving effect to an interception warrant. RIPA places a requirement on CSPs to take all such steps for giving effect to the warrant as are notified to them (section 11(4) of RIPA). But the steps which may be required are limited to those which it is reasonably practicable to take (section 11(5)). When considering this test, section 11(5)(a) specifies that regard must be had to any requirements or restrictions under the law of the country where the CSP is based that are relevant to the taking of those steps. It also makes clear the expectation that CSPs will seek to find ways to comply without giving rise to conflict of laws. What is reasonably practicable should be agreed after consultation between the CSP and the Government. If no agreement can be reached it will be for the Secretary of State to decide whether to press forward with civil proceedings. Criminal proceedings may also be instituted by, or with the consent of, the Director of Public Prosecutions.
3.12
Where the intercepting agency requires the assistance of a CSP in order to implement a warrant, it should provide the following to the CSP: A copy of the signed and dated warrant instrument; The schedule setting out the numbers, addresses or other factors identifying the communications to be intercepted by the CSP for warrants issued in accordance with section 8(1); A covering document from the intercepting agency (or the person acting on behalf of the agency) requiring the assistance of the CSP and specifying any other details regarding the means of interception and delivery as may be necessary. Contact details with respect to the intercepting agency will either be provided in this covering document or will be available in the handbook provided to all CSPs who maintain an interception capability.
Provision of interception capability 3.13
Persons who provide a public postal or telecommunications service, or plan to do so, may be required to provide a permanent interception capability (under section 12 of RIPA). The obligations the Secretary of State considers reasonable to impose on such persons to ensure they have a capability are set out in an order made by the Secretary of State and approved by Parliament2. Section 12(3A) of RIPA provides for the Secretary of State to serve a notice on a company located outside the UK but providing telecommunications services to customers within the UK, setting out the steps they must take to ensure they can meet these obligations. The Government must seek to consult with the CSP over the content of a notice before it is served.
3.14
Section 12(3B) of RIPA provides that where a notice is to be given to a person outside the UK, the notice may (in addition to electronic or other means of service) be given to the person: By delivering it to the person‟s principal office within the UK or, if the person does not have an office in the UK, to any place in the UK where the person carries on business or conducts activities; At an address in the UK specified by the person.
2
Regulation of Investigatory Powers (Maintenance of Interception Capability) Order 2002 - http://www.legislation.gov.uk/uksi/2002/1931
8
3.15
When served with a notice, a CSP, if it feels it unreasonable, may refer that notice to the Technical Advisory Board (TAB) to consider the reasonableness of the technical requirements that are being sought and the financial consequences. Details of how to submit a notice to the TAB will be provided either before or at the time the notice is served.
3.16
Any CSP obliged to maintain a permanent interception capability will be provided with a handbook which will contain the basic information they require to respond to requests for reasonable assistance for the interception of communications.
Duration of interception warrants 3.17
Interception warrants issued on serious crime grounds are valid for an initial period of three months. Interception warrants issued on national security/economic well-being of the UK grounds are valid for an initial period of six months. A warrant issued under the urgency procedure (on any grounds) is valid for five working days following the date of issue unless renewed by the Secretary of State.
3.18
Upon renewal, warrants issued on serious crime grounds are valid for a further period of three months. Warrants renewed on national security/ economic well-being of the UK grounds are valid for a further period of six months. These dates run from the date on the renewal instrument.
3.19
Where modifications to an interception warrant are made, the warrant expiry date remains unchanged. However, where the modification takes place under the urgency provisions, the modification instrument expires after five working days following the date of issue, unless it is renewed in line with the routine procedure.
3.20
Where a change in circumstance leads the intercepting agency to consider it no longer necessary, proportionate or practicable for a warrant to be in force, the agency must make a recommendation to the Secretary of State that it should be cancelled with immediate effect.
Stored communications 3.21
Section 2(7) of RIPA defines a communication in the course of its transmission as including any time when the communication is being stored on the communication system in such a way as to enable the intended recipient to collect it or otherwise have access to it. Making the contents of a communication stored in this way available to a person other than the sender or intended recipient therefore constitutes interception. A communication remains in the course of its transmission regardless of whether the communication has previously been read, viewed or listened to. A communication stored in this way remains in the course of its transmission.
3.22
Stored communications may also be accessed by means other than a warrant (see chapter 9). For example, if a communication has been stored on a communication system it may be obtained with lawful authority by means of an existing statutory power such as a production order (under the Police and Criminal Evidence Act 19843) or a search warrant. A production order is an order from a circuit judge 4, who must be
3
All references to the Police and Criminal Evidence Act 1984 shall be interpreted, insofar as the Code relates to activity in Northern Ireland, as referring to the Police and Criminal Evidence (Northern Ireland) Order 1989. 4
Or a County court judge in Northern Ireland.
9
satisfied that i) an indictable offence has been committed, ii) the person holds the material and iii) the material requested will be of substantial value to the investigation and iv) it is in the public interest that the material should be produced.
10
4. Special rules on interception with a warrant Collateral intrusion 4.1
Consideration should be given to any interference with the privacy of individuals who are not the subject of the intended interception, especially where communications relating to religious, medical, journalistic or legally privileged material may be involved, or where communications between a Member of Parliament5 and another person on constituency business may be involved. An application for an interception warrant should state whether the interception is likely to give rise to a degree of collateral infringement of privacy. A person applying for an interception warrant must also consider measures, including the use of automated systems, to reduce the extent of collateral intrusion. Where it is possible to do so, the application should specify those measures. These circumstances and measures will be taken into account by the Secretary of State when considering a warrant application made under s.8(1) of RIPA. Should an interception operation reach the point where individuals other than the subject of the authorisation are identified as investigative targets in their own right, consideration should be given to applying for separate warrants covering those individuals.
Confidential information 4.2
Particular consideration should also be given in cases where the subject of the interception might reasonably assume a high degree of privacy, or where confidential information is involved. This includes where the communications relate to legally privileged material; where confidential journalistic material may be involved; where interception might involve communications between a medical professional or minister of religion and an individual relating to the latter‟s health or spiritual welfare; or where communications between a Member of Parliament and another person on constituency business may be involved.
4.3
Confidential journalistic material includes material acquired or created for the purposes of journalism and held subject to an undertaking to hold it in confidence, as well as communications resulting in information being acquired for the purposes of journalism and held subject to such an undertaking. See also paragraphs 4.19 and 4.21 - 4.24 for additional safeguards that should be applied in respect of confidential journalistic material.
Communications subject to legal privilege 4.4
Section 98 of the Police Act 1997 describes those matters that are subject to legal privilege in England and Wales. In Scotland, those matters subject to legal privilege contained in section 33 of the Criminal Law (Consolidation) (Scotland) Act 1995 should be adopted. With regard to Northern Ireland, Article 12 of the Police and Criminal Evidence (Northern Ireland) Order 1989 should be referred to.
4.5
Legal privilege does not apply to communications made with the intention of furthering a criminal purpose (whether the lawyer is acting unwittingly or culpably). Legally privileged communications will lose their protection if there are grounds to believe, for example, that
5
References to a Member of Parliament include references to a Member of the UK Parliament, the European Parliament, the Scottish Parliament, the Welsh Assembly and the Northern Ireland Assembly.
11
the professional legal adviser is intending to hold or use the information for a criminal purpose. But privilege is not lost if a professional legal adviser is properly advising a person who is suspected of having committed a criminal offence. The concept of legal privilege applies to the provision of professional legal advice by any individual, agency or organisation qualified to do so. 4.6
RIPA does not provide any special protection for legally privileged communications. Nevertheless, intercepting such communications is particularly sensitive and may give rise to issues under Article 6 (right to a fair trial) of the ECHR as well as engaging Article 8. The interception of communications subject to legal privilege is therefore subject to additional safeguards under this code. The guidance set out below may in part depend on whether matters subject to legal privilege have been obtained intentionally or incidentally to other material which has been sought.
4.7
In general, any application for a warrant which is likely to result in the interception of legally privileged communications should include, in addition to the reasons why it is considered necessary for the interception to take place, an assessment of how likely it is that communications which are subject to legal privilege will be intercepted. In addition, it should state whether the purpose (or one of the purposes) of the interception is to obtain privileged communications. Where the intention of the interception is not to acquire communications subject to legal privilege, but it is likely that such communications will nevertheless be acquired during interception, the application should identify the steps which will be taken to mitigate the risk of obtaining legally privileged information from those communications.
4.8
Where interception is intended to result in a person acquiring communications subject to legal privilege, a warrant will only be issued if the Secretary of State is satisfied that there are exceptional and compelling circumstances that make the warrant necessary. Such circumstances will arise only in a very restricted range of cases, such as where there is a threat to life or limb, or to national security, and the interception is reasonably regarded as likely to yield intelligence necessary to counter the threat.
4.9
Further, in considering any such application, the Secretary of State must believe that the proposed conduct is proportionate to what is sought to be achieved. In such circumstances, the Secretary of State will be able to impose additional conditions such as regular reporting arrangements, so as to be able to exercise his or her discretion on whether a warrant should continue to have effect.
4.10
Where there is a renewal application in respect of a warrant which has resulted in the obtaining of legally privileged material, that fact ought to be highlighted in the renewal application.
4.11
Where a lawyer is the subject of an interception, it is possible that a substantial proportion of the communications which will be intercepted will be between the lawyer and his or her client(s) and will be subject to legal privilege. Therefore, in any case where a lawyer is the subject of an interception, the Secretary of State should consider whether the special safeguards outlined in this chapter apply. Any case where a lawyer is the subject of an interception should also be notified to the Interception of Communications Commissioner during his or her next inspection and any material which has been retained should be made available to the Commissioner on request.
4.12
In addition to safeguards governing the handling and retention of intercept material as provided for in section 15 of RIPA, officials who examine intercepted communications should be alert to any intercept material which may be subject to legal privilege. Where 12
there is doubt as to whether the communications are subject to legal privilege, advice should be sought from a legal adviser within the relevant intercepting agency. Similar advice should also be sought where there is doubt over whether communications are not subject to legal privilege due to the “in furtherance of a criminal purpose” exception. 4.13
Other than in exceptional circumstances, material subject to legal privilege must not be acted on or further disseminated unless a legal adviser has been consulted on the lawfulness (including the necessity and proportionality) of such action or dissemination.
4.14
The retention of legally privileged material, or its dissemination to an outside body, should be accompanied by a clear warning that it is subject to legal privilege. It should be safeguarded by taking reasonable steps to remove the risk of it becoming available, or its contents becoming known, to any person whose possession of it might prejudice any criminal or civil proceedings to which the information relates. Neither the Crown Prosecution Service lawyer nor any other prosecuting authority lawyer with conduct of a prosecution should have sight of any communications subject to legal privilege, held by the relevant public authority, with any possible connection to the proceedings. In respect of civil proceedings, there can be no circumstances under which it is proper for any public authority to seek to rely on communications subject to legal privilege in order to gain a litigation advantage over another party in legal proceedings.
4.15
In order to safeguard against any risk of prejudice or accusation of abuse of process, public authorities must also take all reasonable steps to ensure that (so far as practicable) lawyers or policy officials with conduct of legal proceedings should not see legally privileged communications relating to those proceedings (whether the privilege is that of the other party to those proceedings or that of a third party). If such circumstances do arise, the public authority must seek independent advice from Counsel and, if there is assessed to be a risk that such material could yield a litigation advantage, the direction of the Court.
4.16
In those cases where communications which include legally privileged communications have been intercepted and retained, the matter should be reported to the Interception of Communications Commissioner as soon as reasonably practicable, as agreed with the Commissioner. Any material that is still being retained should be made available to him or her if requested, including detail of whether that material has been disseminated.
4.17
Material which has been identified as legally privileged should be retained only where it is necessary and proportionate to do so for one or more of the authorised purposes set out in section 15(4). It must be securely destroyed when its retention is no longer needed for those purposes. If such information is retained, it must be reviewed at reasonable intervals to confirm that the justification for its retention is still valid.
4.18
The safeguards set out in paragraphs 4.10 – 4.17 also apply to any s.8(4) material (see chapter 6) which is selected for examination and which is subject to legal privilege.
Communications involving confidential journalistic material, confidential personal information, communications between a Member of Parliament and another person on constituency business 4.19
Particular consideration must also be given to the interception of communications that involve confidential journalistic material, confidential personal information, or communications between a Member of Parliament and another person on constituency business. Confidential journalistic material is explained at paragraph 4.3. Confidential personal information is information held in confidence concerning an individual (whether 13
living or dead) who can be identified from it, and the material in question relates to his or her physical or mental health or to spiritual counselling. Such information can include both oral and written communications. Such information as described above is held in confidence if it is held is subject to an express or implied undertaking to hold it in confidence, or is subject to a restriction on disclosure or an obligation of confidentiality contained in existing legislation. For example, confidential personal information might include consultations between a health professional and a patient, or information from a patient‟s medical records. 4.20
Spiritual counselling is defined as conversations between an individual and a Minister of Religion acting in his or her official capacity, and where the individual being counselled is seeking, or the Minister is imparting, forgiveness, absolution or the resolution of conscience with the authority of the Divine Being(s) of their faith.
4.21
Where the intention is to acquire confidential personal information, the reasons should be clearly documented and the specific necessity and proportionality of doing so should be carefully considered. If the acquisition of confidential personal information is likely but not intended, any possible mitigation steps should be considered and, if none is available, consideration should be given to adopting special handling arrangements within the intercepting agency.
4.22
Material which has been identified as confidential information should be retained only where it is necessary and proportionate to do so for one or more of the authorised purposes set out in section 15(4). It must be securely destroyed when its retention is no longer needed for those purposes. If such information is retained, it must be reviewed at reasonable intervals to confirm that the justification for its retention is still valid.
4.23 Where confidential information is retained or disseminated to an outside body, reasonable steps should be taken to mark the information as confidential. Where there is any doubt as to the handling or dissemination of confidential information, advice should be sought from a legal adviser within the relevant intercepting agency and before any further dissemination of the material takes place. 4.24 Any case where confidential information is retained should be notified to the Interception of Communications Commissioner as soon as reasonably practicable, as agreed with the Commissioner. Any material which has been retained should be made available to the Commissioner on request. 4.25
The safeguards set out in paragraphs 4.21 – 4.24 also apply to any s.8(4) material (see chapter 6) which is selected for examination and which is confidential information.
14
5. Interception warrants (section 8(1)) 5.1
This section applies to the interception of communications by means of a warrant complying with section 8(l) of RIPA. This type of warrant may be issued in respect of the interception of communications carried on any postal service or telecommunications system as defined in section 2(l) of RIPA (including a private telecommunications system). Responsibility for the issuing of interception warrants rests with the Secretary of State.
Application for a section 8(1) warrant 5.2
An application for a warrant is made to the Secretary of State. Interception warrants, when issued, are addressed to the person who submitted the application. A copy may then be served on any person who may be able to provide assistance in giving effect to that warrant. Prior to submission to the Secretary of State, each application must be subject to a review within the agency seeking the warrant. This review involves scrutiny by more than one official, who will consider whether the application is for a purpose falling within section 5(3) of RIPA and whether the interception proposed is both necessary and proportionate. Each application, a copy of which must be retained by the intercepting agency, should contain the following information: Background to the operation in question; Person or premises to which the application relates (and how the person or premises feature in the operation); Description of the communications to be intercepted, details of the CSP(s) and an assessment of the feasibility of the interception operation where this is relevant;6 Description of the conduct to be authorised or the conduct it is necessary to undertake in order to carry out what is authorised or required by the warrant, and the obtaining of related communications data.7 This conduct may include the interception of other communications not specifically identified by the warrant as foreseen under section 5(6)(a); An explanation of why the interception is considered to be necessary under the provisions of section 5(3); Consideration of why the conduct to be authorised by the warrant is proportionate to what is sought to be achieved by that conduct; Consideration of any collateral intrusion and why that intrusion is justified in the circumstances; Whether the communications in question might affect religious, medical or journalistic confidentiality or legal privilege, or communications between a Member of Parliament and another person on constituency business; Where an application is urgent, the supporting justification; An assurance that all material intercepted will be handled in accordance with the safeguards required by section 15 of RIPA (see paragraph 7.2).
6
This assessment is normally based upon information provided by the relevant communications service provider. Section 20 of the Act defines related communications data as being that data (within the meaning of Part I Chapter II of the Act) as is obtained by, or in connection with, the interception (under warrant); and relates to the communication to the sender or recipient, or intended recipient of the communication. 7
15
Authorisation of a section 8(1) warrant 5.3
Before issuing a warrant under section 8(1), the Secretary of State must believe the warrant is necessary:8 in the interests of national security; for the purpose of preventing or detecting serious crime; or for the purpose of safeguarding the economic well-being of the UK, so far as those interests are also relevant to the interests of national security.
5.4
The Secretary of State will not issue a warrant on section 5(3)(c) grounds if this direct link between the economic well-being of the UK and national security is not established. Any application for a warrant on section 5(3)(c) grounds should therefore explain how, in the applicant‟s view, the economic well-being of the UK which is to be safeguarded is directly related to national security on the facts of the case.
5.5
The Secretary of State must also consider that the conduct authorised by the warrant is proportionate to what it seeks to achieve (section 5(2)(b)). In considering necessity and proportionality, the Secretary of State must take into account whether the information sought could reasonably be obtained by other means (section 5(4)).
Urgent authorisation of a section 8(1) warrant 5.6
RIPA makes provision (section 7(l)(b)) for cases in which an interception warrant is required urgently, yet the Secretary of State is not available to sign the warrant. In these cases the Secretary of State will still personally authorise the interception but the warrant is signed by a senior official, following discussion of the case between officials and the Secretary of State. RIPA restricts issuing warrants in this way to urgent cases where the Secretary of State has expressly authorised the issue of the warrant (section 7(2)(a)), and requires the warrant to contain a statement to that effect (section 7(4)(a)). A warrant issued under the urgency procedure lasts for five working days following the day of issue unless renewed by the Secretary of State. If it is renewed it expires after three months in the case of serious crime, or six months in the case of national security or economic wellbeing, in the same way as other non-urgent section 8(1) warrants.
Format of a section 8(1) warrant 5.7
Each warrant comprises two sections: a warrant instrument signed by the Secretary of State listing the subject of the interception or set of premises - a copy of which each CSP will receive - and a schedule or set of schedules listing the communications to be intercepted. Only the schedule relevant to the communications that can be intercepted by the specified CSP may be provided to that CSP.
5.8
The warrant instrument should include: The name or description of the interception subject or of a set of premises in relation to which the interception is to take place; A warrant reference number; and The persons who may subsequently modify the scheduled part of the warrant in an urgent case (if authorised in accordance with section 10(8) of RIPA).
8
A single warrant can be justified on more than one of the grounds listed.
16
5.9
The scheduled part of the warrant will comprise one or more schedules. Each schedule should contain: The name of the communication service provider, or the other person who is to take action; A warrant reference number; and A means of identifying the communications to be intercepted.9
Modification of section 8(1) warrant 5.10
Interception warrants may be modified under the provisions of section 10 of RIPA. The unscheduled part of a warrant may only be modified by the Secretary of State or, in an urgent case, by a senior official with the express authorisation of the Secretary of State. In these cases, a statement of that fact must be endorsed on the modifying instrument, and the modification ceases to have effect after five working days following the date of issue unless it is renewed by the Secretary of State. The modification will then expire upon the expiry date of the warrant.
5.11
Scheduled parts of a warrant may be modified by the Secretary of State, or by a senior official10 acting upon his or her behalf. A modification to the scheduled part of the warrant may include the addition of a new schedule relating to a CSP on whom a copy of the warrant has not been previously served. Modifications made in this way expire at the same time as the warrant expires. There also exists a duty to modify a warrant by deleting a communication identifier if it is no longer relevant. When a modification is sought to delete a number or other communication identifier, the relevant CSP must be advised and interception suspended before the modification instrument is signed.
5.12
The person to whom the warrant is addressed or a senior official within the same agency may modify the scheduled part of the warrant if the warrant was issued or renewed on national security grounds. Where the warrant specifically authorises it, the scheduled part of the warrant may also be amended in an urgent case by the person to whom a warrant is addressed or a subordinate person (identified in the warrant) within the same agency
5.13
Modifications of this kind are valid for five working days following the date of issue unless the modification instrument is endorsed by a senior official acting on behalf of the Secretary of State. Where the modification is endorsed in this way, the modification expires upon the expiry date of the warrant.
Renewal of a section 8(1) warrant 5.14
The Secretary of State may renew a warrant at any point before its expiry date. Applications for renewals must be made to the Secretary of State and should contain an update of the matters outlined in paragraph 5.2 above. In particular, the applicant should give an assessment of the value of interception to the operation to date and explain why it is considered that interception continues to be necessary for one or more of the purposes in section 5(3), and why it is considered that interception continues to be proportionate.
9
This may include addresses, numbers, apparatus or other factors, or combination of factors, that are to be used for identifying communications (section 8(2) of the Act). 10
The official to whom the warrant is addressed, or any of his subordinates, may only modify the scheduled parts of the warrant in the circumstances referred to in paragraph 5.12.
17
5.15
Where the Secretary of State is satisfied that the interception continues to meet the requirements of RIPA the Secretary of State may renew the warrant.
5.16
A copy of the warrant renewal instrument will be forwarded to all relevant CSPs on whom a copy of the original warrant instrument and a schedule have been served, providing they are still actively assisting. A warrant renewal instrument will include the reference number of the warrant or warrants being renewed under this single instrument.
Warrant cancellation 5.17
The Secretary of State is under a duty to cancel an interception warrant if, at any time before its expiry date, the Secretary of State is satisfied that the warrant is no longer necessary on grounds falling within section 5(3) of RIPA. Intercepting agencies will therefore need to keep their warrants under continuous review. In practice, the responsibility to cancel a warrant will be exercised by an appropriate official on behalf of the Secretary of State.
5.18
The cancellation instrument should be addressed to the person to whom the warrant was issued (the intercepting agency) and should include the reference number of the warrant and the description of the person or premises specified in the warrant. A copy of the cancellation instrument should be sent to those CSPs who have held a copy of the warrant instrument and accompanying schedule during the preceding twelve months.
Records 5.19
The oversight regime allows the Interception of Communications Commissioner to inspect the warrant application upon which the Secretary of State‟s decision was based, and the applicant may be required to justify the content. Each intercepting agency should keep the following to be made available for scrutiny by the Commissioner as he or she may require: all applications made for warrants complying with section 8(1) and applications made for the renewal of such warrants; all warrants, and renewals and copies of schedule modifications (if any); where any application is refused, the grounds for refusal as given by the Secretary of State; and the dates on which interception started and stopped.
5.20
Records should also be kept of the arrangements by which the requirements of section 15(2) (minimisation of copying and distribution of intercepted material) and section 15(3) (destruction of intercepted material) are to be met. For further details see the section on “Safeguards”.
5.21
The term “intercepted material” is used throughout to include copies, extracts or summaries made from the intercepted material as well as the intercepted material itself.
18
6. Interception warrants (section 8(4)) 6.1
This section applies to the interception of external communications by means of a warrant complying with section 8(4) of RIPA.
6.2
In contrast to section 8(1), a section 8(4) warrant instrument need not name or describe the interception subject or a set of premises in relation to which the interception is to take place. Neither does section 8(4) impose an express limit on the number of external communications which may be intercepted. For example, if the requirements of sections 8(4) and (5) are met, then the interception of all communications transmitted on a particular route or cable, or carried by a particular CSP, could, in principle, be lawfully authorised. This reflects the fact that section 8(4) interception is an intelligence gathering capability, whereas section 8(1) interception is primarily an investigative tool that is used once a particular subject for interception has been identified.
6.3
Responsibility for the issuing of interception warrants under section 8(4) of RIPA rests with the Secretary of State. When the Secretary of State issues a warrant of this kind, it must be accompanied by a certificate. The certificate ensures that a selection process is applied to the intercepted material so that only material described in the certificate is made available for human examination. If the intercepted material cannot be selected to be read, looked at or listened to with due regard to proportionality and the terms of the certificate, then it cannot be read, looked at or listened to by anyone.
Section 8(4) interception in practice 6.4
A section 8(4) warrant authorises the interception of external communications. Where a section 8(4) warrant results in the acquisition of large volumes of communications, the intercepting agency will ordinarily apply a filtering process to automatically discard communications that are unlikely to be of intelligence value. Authorised persons within the intercepting agency may then apply search criteria to select communications that are likely to be of intelligence value in accordance with the terms of the Secretary of State's certificate. Before a particular communication may be accessed by an authorised person within the intercepting agency, the person must provide an explanation of why it is necessary for one of the reasons set out in the certificate accompanying the warrant issued by the Secretary of State, and is proportionate in the particular circumstances. This process is subject to internal audit and external oversight by the Interception of Communications Commissioner. Where the Secretary of State is satisfied that it is necessary, he or she may authorise the selection of communications of an individual who is known to be in the British Islands. In the absence of such an authorisation, an authorised person must not select such communications.11
Definition of external communications 6.5
External communications are defined by RIPA to be those which are sent or received outside the British Islands. They include those which are both sent and received outside the British Islands, whether or not they pass through the British Islands in the course of their transmission. They do not include communications both sent and received in the British Islands, even if they pass outside the British Islands en route. For example, an email from a person in London to a person in Birmingham will be an internal, not external communication for the purposes of section 20 of RIPA, whether or not it is routed via IP
11
Section 16(2) of RIPA provides that in the absence of such an authorisation an authorised person must not select communications for examination by factors referable to an individual known to be in the British Islands and with the purpose of identifying material contained in communications sent by or intended for such an individual.
19
addresses outside the British Islands, because the sender and intended recipient are within the British Islands.
Intercepting non-external communications under section 8(4) warrants 6.6
Section 5(6)(a) of RIPA makes clear that the conduct authorised by a section 8(4) warrant may, in principle, include the interception of communications which are not external communications to the extent this is necessary in order to intercept the external communications to which the warrant relates.
6.7
When conducting interception under a section 8(4) warrant, an intercepting agency must use its knowledge of the way in which international communications are routed, combined with regular surveys of relevant communications links, to identify those individual communications bearers that are most likely to contain external communications that will meet the descriptions of material certified by the Secretary of State under section 8(4). It must also conduct the interception in ways that limit the collection of non-external communications to the minimum level compatible with the objective of intercepting wanted external communications.
Application for a section 8(4) warrant 6.8
An application for a warrant is made to the Secretary of State. Interception warrants, when issued, are addressed to the person who submitted the application. The purpose of such a warrant will typically reflect one or more of the intelligence priorities set by the Joint Intelligence Committee (“JIC”)12.
6.9
Prior to submission, each application is subject to a review within the agency making the application. This involves scrutiny by more than one official, who will consider whether the application is for a purpose falling within section 5(3) of RIPA and whether the interception proposed is both necessary and proportionate.
6.10
Each application, a copy of which must be retained by the applicant, should contain the following information: Background to the operation in question: o Description of the communications to be intercepted, details of the CSP(s) and an assessment of the feasibility of the operation where this is relevant;13 and o Description of the conduct to be authorised, which must be restricted to the interception of external communications, or the conduct (including the interception of other communications not specifically identified by the warrant as foreseen under section 5(6)(a) of RIPA) it is necessary to undertake in order to carry out what is authorised or required by the warrant, and the obtaining of related communications data.14 The certificate that will regulate examination of intercepted material; An explanation of why the interception is considered to be necessary for one or more of the section 5(3) purposes;
12
The Joint Intelligence Committee is part of the Cabinet Office and is under the authority of the Secretary of State. One of the JIC‟s functions is to set, subject to Ministerial approval, the requirements and priorities for intelligence gathering by the Intelligence Services. 13
This assessment is normally based upon information provided by the relevant communications service provider.
20
A consideration of why the conduct to be authorised by the warrant is proportionate to what is sought to be achieved by that conduct; Where an application is urgent, supporting justification; An assurance that intercepted material will be read, looked at or listened to only so far as it is certified and it meets the conditions of sections 16(2)-16(6) of RIPA; and An assurance that all material intercepted will be handled in accordance with the safeguards required by sections 15 and 16 of RIPA (see paragraphs 7.2 and 7.10 respectively).
Authorisation of a section 8(4) warrant 6.11
Before issuing a warrant under section 8(4), the Secretary of State must believe the warrant is necessary: in the interests of national security; for the purpose of preventing or detecting serious crime; or for the purpose of safeguarding the economic well-being of the UK so far as those interests are also relevant to the interests of national security.
6.12
The power to issue an interception warrant for the purpose of safeguarding the economic well-being of the UK (as provided for by section 5(3)(c) of RIPA), may only be exercised where it appears to the Secretary of State that the circumstances are relevant to the interests of national security. The Secretary of State will not issue a warrant on section 5(3)(c) grounds if the direct link between the economic well-being of the UK and national security is not established. Any application for a warrant on section 5(3)(c) grounds should therefore identify the circumstances that are relevant to the interests of national security.
6.13
The Secretary of State must also consider that the conduct authorised by the warrant is proportionate to what it seeks to achieve (section 5(2)(b)). In considering necessity and proportionality, the Secretary of State must take into account whether the information sought could reasonably be obtained by other means (section 5(4)).
6.14
When the Secretary of State issues a warrant of this kind, it must be accompanied by a certificate in which the Secretary of State certifies that he or she considers examination of the intercepted material to be necessary for one or more of the section 5(3) purposes. The purpose of the statutory certificate is to ensure that a selection process is applied to intercepted material so that only material described in the certificate is made available for human examination. Any certificate must broadly reflect the Priorities for Intelligence Collection set by the JIC for the guidance of the intelligence agencies. For example, a certificate might provide for the examination of material providing intelligence on terrorism (as defined in the Terrorism Act 2000) or on controlled drugs (as defined by the Misuse of Drugs Act 1971). The Interception of Communications Commissioner must review any changes to the descriptions of material specified in a certificate.
6.15
The Secretary of State has a duty to ensure that arrangements are in force for securing that only that material which has been certified as necessary for examination for a section 5(3) purpose, and which meets the conditions set out in section 16(2) to section 16(6) is, in fact, read, looked at or listened to. The Interception of Communications Commissioner is under a duty to review the adequacy of those arrangements.
21
Urgent authorisation of a section 8(4) warrant 6.16
RIPA makes provision (section 7(l)(b)) for cases in which an interception warrant is required urgently, yet the Secretary of State is not available to sign the warrant. In these cases the Secretary of State will still personally authorise the interception but the warrant is signed by a senior official, following discussion of the case between officials and the Secretary of State. RIPA restricts issue of warrants in this way to urgent cases where the Secretary of State has personally expressly authorised the issue of the warrant (section 7(2)(a)), and requires the warrant to contain a statement to that effect (section 7(4)(a)).
6.17
A warrant issued under the urgency procedure lasts for five working days following the date of issue unless renewed by the Secretary of State, in which case it expires after three months in the case of serious crime or six months in the case of national security or economic well-being, in the same way as other section 8(4) warrants.
Format of a section 8(4) warrant 6.18
Each warrant is addressed to the person who submitted the application. A copy may then be served upon such providers of communications services as he or she believes will be able to assist in implementing the interception. CSPs will not normally receive a copy of the certificate. The warrant should include the following: A description of the communications to be intercepted; The warrant reference number; and The persons who may subsequently modify the certificate applicable to the warrant in an urgent case (if authorised in accordance with section 10(7) of RIPA).
Modification of a section 8(4) warrant and/or certificate 6.19
Interception warrants and certificates may be modified under the provisions of section 10 of RIPA. A warrant may only be modified by the Secretary of State or, in an urgent case, by a senior official with the express authorisation of the Secretary of State. In these cases a statement of that fact must be endorsed on the modifying instrument, and the modification ceases to have effect after five working days following the date of issue unless it is endorsed by the Secretary of State.
6.20
A certificate must be modified by the Secretary of State, except in an urgent case where a certificate may be modified by a senior official provided that the official holds a position in which he or she is expressly authorised by provisions contained in the certificate to modify the certificate on the Secretary of State‟s behalf, or the Secretary of State has expressly authorised the modification and a statement of that fact is endorsed on the modifying instrument. In the latter case, the modification ceases to have effect after five working days following the date of issue unless it is endorsed by the Secretary of State.
6.21
Where the Secretary of State is satisfied that it is necessary, a certificate may be modified to authorise the selection of communications of an individual in the British Islands.15 An individual‟s location should be assessed using all available information. If it
15
Section 16(3) of RIPA provides that a certificate may be modified to authorise the selection of communications sent ot received outside the British Islands according to a factor (for example name, email address or passport number) which is referable to an individual who is known for the time being to be in the British Islands and where the purpose is the identification of material contained in communications sent by that individual or intended for him.
22
is not possible, using that information to determine definitively where the individual is located, an informed assessment should be made, in good faith, as to the individual‟s location. If an individual is strongly suspected to be in the UK,.the arrangements set out in this paragraph will apply.
Renewal of a section 8(4) warrant 6.22
The Secretary of State may renew a warrant at any point before its expiry date. Applications for renewals are made to the Secretary of State and contain an update of the matters outlined in paragraph 6.9 above. In particular, the applicant must give an assessment of the value of interception to date and explain why it is considered that interception continues to be necessary for one or more of the purposes in section 5(3), and why it is considered that interception continues to be proportionate
6.23
Where the Secretary of State is satisfied that the interception continues to meet the requirements of RIPA, the Secretary of State may renew the warrant. Where the warrant is issued on serious crime grounds, the renewed warrant is valid for a further three months. Where it is issued on national security/ economic well-being grounds the renewed warrant is valid for six months. These dates run from the date of signature on the renewal instrument.
6.24
In those circumstances where the assistance of CSPs has been sought, a copy of the warrant renewal instrument will be forwarded to all those on whom a copy of the original warrant instrument has been served, providing they are still actively assisting. A renewal instrument will include the reference number of the warrant or warrants being renewed under this single instrument.
Warrant cancellation 6.25
The Secretary of State must cancel an interception warrant if, at any time before its expiry date, he or she is satisfied that the warrant is no longer necessary on grounds falling within section 5(3) of RIPA. Intercepting agencies will therefore need to keep their warrants under continuous review. In practice, the responsibility to cancel a warrant will be exercised by an appropriate official on behalf of the Secretary of State.
6.26
The cancellation instrument will be addressed to the person to whom the warrant was issued (the intercepting agency). A copy of the cancellation instrument should be sent to those CSPs, if any, who have given effect to the warrant during the preceding twelve months.
Records 6.27
The oversight regime allows the Interception of Communications Commissioner to inspect the warrant application upon which the Secretary of State‟s decision is based, and the interception agency may be required to justify the content. Each intercepting agency should keep the following to be made available for scrutiny by the Commissioner as he or she may require: all applications made for warrants complying with section 8(4), and applications made for the renewal of such warrants; all warrants and certificates, and copies of renewal and modification instruments (if any);
23
where any application is refused, the grounds for refusal as given by the Secretary of State; the dates on which interception started and stopped. 6.28
Records should also be kept of the arrangements for securing that only material which has been certified for examination for a purpose under section 5(3) and which meets the conditions set out in section 16(2) – 16(6) of RIPA in accordance with section 15 of RIPA is, in fact, read looked at or listened to. Records should be kept of the arrangements by which the requirements of section 15(2) (minimisation of copying and distribution of intercepted material) and section 15(3) (destruction of intercepted material) are to be met. For further details see the chapter on “Safeguards”.
24
7. Safeguards 7.1
All material intercepted under the authority of a warrant complying with section 8(1) or section 8(4) of RIPA and any related communications data16 must be handled in accordance with safeguards which the Secretary of State has approved in conformity with the duty imposed on him or her by RIPA. These safeguards are made available to the Interception of Communications Commissioner, and they must meet the requirements of section 15 of RIPA which are set out below. In addition, the safeguards in section 16 of RIPA apply to warrants complying with section 8(4). Any breach of these safeguards must be reported to the Interception of Communications Commissioner. The intercepting agencies must keep their internal safeguards under periodic review to ensure that they remain up-to-date and effective. During the course of such periodic reviews, the agencies must consider whether more of their internal arrangements might safely and usefully be put into the public domain.
The section 15 safeguards 7.2
Section 15 of RIPA requires that disclosure, copying and retention of intercepted material is limited to the minimum necessary for the authorised purposes. Section 15(4) of RIPA provides that something is necessary for the authorised purposes if the intercepted material: continues to be, or is likely to become, necessary for any of the purposes set out in section 5(3) – namely, in the interests of national security, for the purpose of preventing or detecting serious crime, or for the purpose, in circumstances appearing to the Secretary of State to be relevant to the interests of national security, of safeguarding the economic wellbeing of the UK17; is necessary for facilitating the carrying out of the functions of the Secretary of State under Chapter I of Part I of RIPA; is necessary for facilitating the carrying out of any functions of the Interception of Communications Commissioner or the Tribunal; is necessary to ensure that a person conducting a criminal prosecution has the information needed to determine what is required of him or her by his or her duty to secure the fairness of the prosecution; or is necessary for the performance of any duty imposed by the Public Record Acts.
Dissemination of intercepted material 7.3
The number of persons to whom any of the intercepted material is disclosed, and the extent of disclosure, is limited to the minimum that is necessary for the authorised purposes set out in section 15(4) of RIPA. This obligation applies equally to disclosure to additional persons within an agency, and to disclosure outside the agency. It is enforced by prohibiting disclosure to persons who have not been appropriately vetted and also by the need-to-know principle: intercepted material must not be disclosed to any person unless that person‟s duties, which must relate to one of the authorised purposes, are such that he or she needs to know about the intercepted material to carry out those
16
References in this code to „intercepted material‟ include for the purposes of section 15 any related communications data. Further information regarding the use of related communications data is to be found in the Acquisition and Disclosure of Communications Data Code of Practice. 17
Intercepted material and related communications data obtained for one purpose can, where it is necessary and proportionate to do so, be disclosed, copied and retained for another.
25
duties. In the same way, only so much of the intercepted material may be disclosed as the recipient needs. For example, if a summary of the intercepted material will suffice, no more than that should be disclosed. 7.4
The obligations apply not just to the original interceptor, but also to anyone to whom the intercepted material is subsequently disclosed. In some cases this will be achieved by requiring the latter to obtain the originator‟s permission before disclosing the intercepted material further. In others, explicit safeguards are applied to secondary recipients.
Copying 7.5
Intercepted material may only be copied to the extent necessary for the authorised purposes set out in section 15(4) of RIPA. Copies include not only direct copies of the whole of the intercepted material, but also extracts and summaries which identify themselves as the product of an interception, and any record referring to an interception which includes the identities of the persons to or by whom the intercepted material was sent. The restrictions are implemented by requiring special treatment of such copies, extracts and summaries that are made by recording their making, distribution and destruction.
Storage 7.6
Intercepted material, and all copies, extracts and summaries of it, must be handled and stored securely, so as to minimise the risk of loss or theft. It must be held so as to be inaccessible to persons without the required level of vetting. This requirement to store intercept product securely applies to all those who are responsible for handling it, including CSPs. The details of what such a requirement will mean in practice for CSPs will be set out in the discussions they have with the Government before a Section 12 Notice is served (see paragraph 3.13).
Destruction 7.7
Intercepted material, and all copies, extracts and summaries which can be identified as the product of an interception, must be marked for deletion and securely destroyed as soon as possible once it is no longer needed for any of the authorised purposes. If such intercepted material is retained, it should be reviewed at appropriate intervals to confirm that the justification for its retention is still valid under section 15(3) of RIPA.
7.8
Where an intercepting agency receives unanalysed intercepted material and related communications data from interception under a section 8(4) warrant, the agency must specify (or require to be determined on a system by system basis) maximum retention periods for different categories of the data which reflect its nature and intrusiveness. The specified periods should normally be no longer than two years, and should be agreed with the Interception of Communications Commissioner. Data may only be retained for longer than the applicable maximum retention periods if prior authorisation is obtained from a senior official within the particular intercepting agency on the basis that continued retention of the data has been assessed to be necessary and proportionate. If continued retention of any such data is thereafter assessed to no longer meet the tests of necessity and proportionality, it must be deleted. So far as possible, all retention periods should be implemented by a process of automated deletion, which is triggered once the applicable maximum retention period has been reached for the data at issue.
26
Personnel security 7.9
All persons who may have access to intercepted material or need to see any reporting in relation to it must be appropriately vetted. On an annual basis, managers must identify any concerns that may lead to the vetting of individual members of staff being reconsidered. The vetting of each individual member of staff must also be periodically reviewed. Where it is necessary for an officer of one agency to disclose intercepted material to another, it is the former‟s responsibility to ensure that the recipient has the necessary clearance.
The section 16 safeguards 7.10
Section 16 provides for additional safeguards in relation to intercepted material gathered under section 8(4) warrants, requiring that the safeguards: ensure that intercepted material is read, looked at or listened to by any person only to the extent that the intercepted material is certified; and regulate the use of selection factors that refer to the communications of individuals known to be currently in the British Islands.
7.11
In addition, any individual selection of intercepted material must be proportionate in the particular circumstances (given section 6(1) of the Human Rights Act 1998).
7.12
The certificate ensures that a selection process is applied to material intercepted under section 8(4) warrants so that only material described in the certificate is made available for human examination (in the sense of being read, looked at or listened to). No official is permitted to gain access to the data other than as permitted by the certificate.
7.13
In general, automated systems must, where technically possible, be used to effect the selection in accordance with section 16(1) of RIPA. As an exception, a certificate may permit intercepted material to be accessed by a limited number of specifically authorised staff without having been processed or filtered by the automated systems. Such access may only be permitted to the extent necessary to determine whether the material falls within the main categories to be selected under the certificate, or to ensure that the methodology being used remains up to date and effective. Such checking must itself be necessary on the grounds specified in section 5(3) of RIPA. Once those functions have been fulfilled, any copies made of the material for those purposes must be destroyed in accordance with section 15(3) of RIPA. Such checking by officials must be kept to an absolute minimum; whenever possible, automated selection techniques should be used instead. Checking will be kept under review by the Interception of Communications Commissioner during his or her inspections.
7.14
Material gathered under a section 8(4) warrant should be read, looked at or listened to only by authorised persons who receive regular mandatory training regarding the provisions of RIPA and specifically the operation of section 16 and the requirements of necessity and proportionality. These requirements and procedures must be set out in internal guidance provided to all authorised persons and the attention of all authorised persons must be specifically directed to the statutory safeguards. All authorised persons must be appropriately vetted (see paragraph 7.9 for further information).
27
7.15
Prior to an authorised person being able to read, look at or listen to material, a record18 should be created setting out why access to the material is required consistent with, and pursuant to, section 16 and the applicable certificate, and why such access is proportionate. Save where the material or automated systems are being checked as described in paragraph 7.13, the record must indicate by reference to specific factors, the material to which access is being sought and systems should, to the extent possible, prevent access to the material unless such a record has been created. The record should include any circumstances that are likely to give rise to a degree of collateral infringement of privacy, and any measures taken to reduce the extent of the collateral intrusion. All records must be retained for the purposes of subsequent examination or audit.
7.16
Access to the material as described in paragraph 7.15 must be limited to a defined period of time, although access may be renewed. If access is renewed, the record must be updated with the reason for the renewal. Systems must be in place to ensure that if a request for renewal is not made within that period, then no further access will be granted. When access to the material is no longer sought, the reason for this must also be explained in the record.
7.17
Periodic audits should be carried out to ensure that the requirements set out in section 16 of RIPA and Chapter 3 of this code are being met. These audits must include checks to ensure that the records requesting access to material to be read, looked at, or listened to have been correctly compiled, and specifically, that the material requested falls within matters certified by the Secretary of State. Any mistakes or procedural deficiencies should be notified to management, and remedial measures undertaken. Any serious deficiencies should be brought to the attention of senior management and any breaches of safeguards (as noted in paragraph 7.1) must be reported to the Interception of Communications Commissioner. All intelligence reports generated by the authorised persons must be subject to a quality control audit.
7.18
In order to meet the requirements of RIPA described in paragraph 6.3 above, where a selection factor refers to an individual known to be for the time being in the British Islands, and has as its purpose or one of its purposes, the identification of material contained in communications sent by or intended for him or her, a submission must be made to the Secretary of State, or to a senior official in an urgent case, giving an explanation of why an amendment to the section 8(4) certificate in relation to such an individual is necessary for a purpose falling within section 5(3) of RIPA and is proportionate in relation to any conduct authorised under section 8(4) of RIPA.
7.19
The Secretary of State must ensure that the safeguards are in force before any interception under section 8(4) warrants can begin. The Interception of Communications Commissioner is under a duty to review the adequacy of the safeguards.
18
Any such record should be made available to the Commissioner on request for purposes of oversight.
28
8. Disclosure to ensure fairness in criminal proceedings 8.1
Section 15(3) of RIPA contains the general rule that intercepted material must be destroyed as soon as its retention is no longer necessary for a purpose authorised under RIPA. Section 15(4) specifies the authorised purposes for which retention is necessary.
8.2
This part of the code applies to the handling of intercepted material in the context of criminal proceedings where the material has been retained for one of the purposes authorised in section 15(4) of RIPA. For those who would ordinarily have had responsibility under the Criminal Procedure and Investigations Act 1996 to provide disclosure in criminal proceedings, this includes those rare situations where destruction of intercepted material has not taken place in accordance with section 15(3) and where that material is still in existence after the commencement of a criminal prosecution. (In these circumstances, retention will have been considered necessary to ensure that a person conducting a criminal prosecution has the information he or she needs to discharge his or her duty of ensuring its fairness (section 15(4)(d)).
Exclusion of matters from legal proceedings 8.3
The general rule is that neither the possibility of interception, nor intercepted material itself, plays any part in legal proceedings. This rule is set out in section 17 of RIPA, which excludes evidence, questioning, assertion or disclosure in legal proceedings likely to reveal the existence (or the absence) of a warrant issued under this Act (or the Interception of Communications Act 1985). This rule means that the intercepted material cannot be used either by the prosecution or the defence. This preserves “equality of arms” which is a requirement under Article 6 of the ECHR.
8.4
Section 18 contains a number of tightly-drawn exceptions to this rule. This part of the code deals only with the exception in subsections (7) to (11).
Disclosure to a prosecutor 8.5
Section 18(7)(a) provides that intercepted material obtained by means of a warrant and which continues to be available may, for a strictly limited purpose, be disclosed to a person conducting a criminal prosecution.
8.6
This may only be done for the purpose of enabling the prosecutor to determine what is required of him or her by his or her duty to secure the fairness of the prosecution. The prosecutor may not use intercepted material to which he or she is given access under section 18(7)(a) to mount a cross-examination, or to do anything other than ensure the fairness of the proceedings.
8.7
The exception does not mean that intercepted material should be retained against a remote possibility that it might be relevant to future proceedings. The normal expectation is still for the intercepted material to be destroyed in accordance with the general safeguards provided by section 15. The exceptions only come into play if such material has, in fact, been retained for an authorised purpose. Because the authorised purpose given in section 5(3)(b) (“for the purpose of preventing or detecting serious crime”) does not extend to gathering evidence for the purpose of a prosecution, material intercepted for this purpose may not have survived to the prosecution stage, as it will have been 29
destroyed in accordance with the section 15(3) safeguards. There is, in these circumstances, no need to consider disclosure to a prosecutor if, in fact, no intercepted material remains in existence. 8.8
Section 18(7)(a) recognises the duty on prosecutors, acknowledged by common law, to review all available material to make sure that the prosecution is not proceeding unfairly. „Available material‟ will only ever include intercepted material at this stage if the conscious decision has been made to retain it for an authorised purpose.
8.9
If intercepted material does continue to be available at the prosecution stage, once this information has come to the attention of its holder, the prosecutor should be informed that a warrant has been issued under section 5 and that material of possible relevance to the case has been intercepted.
8.10
Having had access to the material, the prosecutor may conclude that the material affects the fairness of the proceedings. In these circumstances, he or she will decide how the prosecution, if it proceeds, should be presented.
Disclosure to a judge 8.11
Section 18(7)(b) recognises that there may be cases where the prosecutor, having seen intercepted material under subsection (7)(a), will need to consult the trial Judge. Accordingly, it provides for the Judge to be given access to intercepted material, where there are exceptional circumstances making that disclosure essential in the interests of justice.
8.12
This access will be achieved by the prosecutor inviting the judge to make an order for disclosure to him or her alone, under this subsection. This is an exceptional procedure; normally, the prosecutor‟s functions under subsection (7)(a) will not fall to be reviewed by the judge. To comply with section 17(l), any consideration given to, or exercise of, this power must be carried out without notice to the defence. The purpose of this power is to ensure that the trial is conducted fairly.
8.13
The judge may, having considered the intercepted material disclosed to him or her, direct the prosecution to make an admission of fact. The admission will be abstracted from the interception; but, in accordance with the requirements of section 17(l), it must not reveal the fact of interception. This is likely to be a very unusual step. RIPA only allows it where the judge considers it essential in the interests of justice.
8.14
Nothing in these provisions allows intercepted material, or the fact of interception, to be disclosed to the defence.
30
9. Interception without a warrant 9.1
Lawful interception can only take place if the conduct has lawful authority (as set out in section 1(5) of RIPA). Section 1(5) of RIPA permits interception without a warrant in the following circumstances: where it is authorised by or under sections 3 or 4 of RIPA (see below); or where it takes place, in relation to any stored communication, under some other statutory power being exercised for the purpose of obtaining information or of taking possession of any document or other property. This includes, for example, the obtaining of a production order under Schedule 1 to the Police and Criminal Evidence Act 1984 for stored communications to be produced.
9.2
Interception in accordance with a warrant under section 5 of RIPA is dealt with under chapters 3, 4, 5 and 6 of this code. Interception without lawful authority may be a criminal offence (see paragraph 2.2 of this code).
9.3
There is no prohibition in RIPA on the evidential use of any material that is obtained as a result of lawful interception which takes place without a warrant, pursuant to sections 3 or 4 of RIPA, or pursuant to some other statutory power. The matter may still, however, be regulated by the exclusionary rules of evidence to be found in the common law, section 78 of the Police and Criminal Evidence Act 1984, and/or pursuant to the Human Rights Act 1998.
Interception with the consent of both parties 9.4
Section 3(1) of RIPA authorises the interception of a communication if both the person sending the communication and the intended recipient(s) have given their consent.
Interception with the consent of one party 9.5
Section 3(2) of RIPA authorises the interception of a communication if either the sender or intended recipient of the communication has consented to its interception, and directed surveillance by means of that interception has been authorised under Part II of RIPA or authorised under The Regulation of Investigatory Powers (Scotland) Act 2000 (RIPSA). Further details can be found in chapter 2 of the Covert Surveillance and Property Interference Code of Practice and in chapter 3 of the Covert Human Intelligence Sources Code of Practice19, or their RIPSA equivalents.
Interception for the purposes of a communication service provider 9.6
19
Section 3(3) of RIPA permits a communication service provider, or a person acting upon their behalf, to carry out interception for purposes connected with the operation of that service, or for purposes connected with the enforcement of any enactment relating to the use of the communication service.
http://www.gov.uk/government/publications/covert-surveillance-and-covert-human-intelligence-sources-codes-of-practice
31
Lawful business practice 9.7
Section 4(2) of RIPA enables the Secretary of State to make regulations setting out those circumstances where it is lawful to intercept communications for the purpose of carrying on a business. These regulations apply equally to public authorities. These Lawful Business Practice Regulations can be found on the legislation.gov.uk website: http://www.legislation.gov.uk/uksi/2000/2699
32
10. Oversight 10.1
RIPA provides for an Interception of Communications Commissioner, whose remit is to provide independent oversight of the use of the powers contained within the warranted interception regime under Chapter I of Part I of RIPA.
10.2
The Commissioner carries out biannual inspections of each of the nine interception agencies. The primary objectives of the inspections are to ensure that the Commissioner has the information he or she requires to carry out his or her functions under section 57 of RIPA and produce his or her report under section 58 of RIPA. This may include inspection or consideration of: The systems in place for the interception of communications; The relevant records kept by the intercepting agency; The lawfulness of the interception carried out; and Any errors and the systems designed to prevent such errors.
10.3
Any person who exercises the powers in RIPA Part 1 Chapter 1 must report to the Commissioner any action that is believed to be contrary to the provisions of RIPA or any inadequate discharge of section 15 safeguards. He or she must also comply with any request made by the Commissioner to provide any such information as the Commissioner requires for the purpose of enabling him or her to discharge his or her functions.
33
11. Complaints 11.1
RIPA establishes an independent Tribunal, the Investigatory Powers Tribunal. The Tribunal is made up of senior members of the judiciary and the legal profession and is independent of the Government. The Tribunal has full powers to investigate and determine complaints against public authority use of covert powers and human rights claims against the intelligence agencies. It may decide any case within its jurisdiction.
11.2
This code does not cover the exercise of the Tribunal‟s functions. Details of the relevant complaints procedure are available on the IPT website at: http://www.ipt-uk.com or can be obtained from the following address: The Investigatory Powers Tribunal PO Box 33220 London SWIH 9ZQ 0207 035 3711
34
Equipment Interference Code of Practice Pursuant to section 71 of the Regulation of Investigatory Powers Act 2000
Draft for public consultation February 2015
CONTENTS CONTENTS ................................................................................................................................. 2 1.
Introduction .......................................................................................................................... 4 Definitions ....................................................................................................................... 4 Background ..................................................................................................................... 4 Equipment interference to which this code applies .......................................................... 5 Effect of the code ............................................................................................................ 5 Basis for lawful equipment interference activity ............................................................... 5 Application of section 5 of the 1994 Act .......................................................................... 6
2.
General rules on warrants ................................................................................................... 8 Necessity and proportionality .......................................................................................... 8 Collateral intrusion........................................................................................................... 9 Reviewing warrants ......................................................................................................... 9 General best practices .................................................................................................... 9
3.
Legally privileged and confidential information .................................................................. 11 Overview ....................................................................................................................... 11 Information subject to legal privilege: introduction ......................................................... 11 Tests to be applied when authorising equipment interference likely or intended to result in the acquisition of knowledge of matters subject to legal privilege.............................. 12 The use and handling of matters subject to legal privilege ............................................ 12 Confidential information ................................................................................................. 14
4.
Procedures for authorising equipment interference under section 5 .................................. 16 General basis for lawful activity ..................................................................................... 16 Application for an equipment interference warrant ........................................................ 16 Issuing of section 5 warrants ......................................................................................... 17 Urgent authorisation of a section 5 warrant ................................................................... 17 Renewals of warrants .................................................................................................... 18 Cancellations of warrants .............................................................................................. 18 Retrieval of equipment .................................................................................................. 18
5.
Keeping of records ............................................................................................................ 19 Centrally retrievable records of warrants ....................................................................... 19
6.
Handling of information and safeguards ............................................................................ 20 Overview ....................................................................................................................... 20 Use of information as evidence ..................................................................................... 20 Handling information obtained by equipment interference ............................................ 20 Dissemination of information ......................................................................................... 21 Copying ......................................................................................................................... 21 Storage .......................................................................................................................... 21 Destruction .................................................................................................................... 21 Personnel security ......................................................................................................... 21
7.
Application of the code to equipment interference pursuant to section 7 of the 1994 Act .. 23 Application of the code to other equipment interference ............................................... 23 General basis for lawful activity ..................................................................................... 23 Authorisations for equipment interference under section 7 ........................................... 24 Urgent authorisation of a section 7 authorisation .......................................................... 24 Other authorisations and internal approvals .................................................................. 24 Renewals of authorisations ........................................................................................... 25 Cancellations of authorisations...................................................................................... 25 2
8.
Oversight by Intelligence Services Commissioner ............................................................. 26
9.
Complaints......................................................................................................................... 27
10. Glossary ............................................................................................................................... 28 11. Annex A ............................................................................................................................... 30
3
1. Introduction Definitions In this code: “1989 Act” means the Security Service Act 1989; “1994 Act” means the Intelligence Services Act 1994; “1998 Act” means the Human Rights Act 1998; “2000 Act” means the Regulation of Investigatory Powers Act 2000; terms in italics (at first use) are defined in the Glossary at the end of this code.
Background 1.1
This code of practice provides guidance on the use by the Intelligence Services of section 5 of the Intelligence Services Act 1994 to authorise equipment interference to which the code applies. It provides guidance on the procedures that must be followed before equipment interference can take place under that provision, and on the processing, retention, destruction and disclosure of any information obtained by means of the interference.
1.2
This code is issued pursuant to section 71 of the 2000 Act, which provides that the Secretary of State shall issue one or more codes of practice in relation to the powers and duties in section 5 of the 1994 Act. To the extent that the guidance provided by this code with respect to equipment interference under section 5 of the 1994 Act overlaps with the guidance provided by the Covert Surveillance and Property Interference Revised Code of Practice issued in 2014, this code takes precedence. The Intelligence Services must continue to comply with the 2014 Code in all other respects.
1.3
The heads of the Intelligence Services are also under a duty to ensure that arrangements are in force to secure: (i) that no information is obtained by the Intelligence Services except so far as necessary for the proper discharge of their functions1; and (ii) that no information is disclosed except so far as is necessary for those functions, for the purpose of any criminal proceedings, and, in the case of the Secret Intelligence Service (“SIS”) and the Security Service, for the other purposes specified2. The arrangements must include provision with respect to the disclosure of information obtained by virtue of sections 5 and 7, and any information so obtained must be subject to the arrangements 3.
1.4
There is no power for the Secretary of State to issue codes of practice in relation to the powers and duties in section 7 of the 1994 Act. However, SIS and the Government Communications Headquarters (“GCHQ”) must as a matter of policy (and without prejudice as to whether section 6 of the 1998 Act applies) comply with the provisions of this code in any case where equipment interference is to be, or has been, authorised pursuant to section 7 of the 1994 Act in relation to equipment located outside the British Islands4.
1
See paragraph 1.9. See section 2(2)(a) of the 1989 Act and sections 2(2)(a) and 4(2)(a) of the 1994 Act. 3 See sections 5(2)(c) and 7(3)(c) of the 1994 Act. 4 Applications for authorisations under section 7 may only be made by SIS and GCHQ. 2
4
1.5
This code is publicly available and should be readily accessible by members of any of the Intelligence Services seeking to use the 1994 Act to authorise equipment interference to which this code applies.
Equipment interference to which this code applies 1.6
This code applies to (i) any interference5 (whether remotely or otherwise) by the Intelligence Services, or persons acting on their behalf or in their support, with equipment6 producing electromagnetic, acoustic and other emissions, and (ii) information derived from any such interference, which is to be authorised under section 5 of the 1994 Act, in order to do any or all of the following: a) b) c) d)
obtain information from the equipment in pursuit of intelligence requirements; obtain information concerning the ownership, nature and use of the equipment in pursuit of intelligence requirements; locate and examine, remove, modify or substitute equipment hardware or software which is capable of yielding information of the type described in a) and b); enable and facilitate surveillance activity by means of the equipment.
“Information” may include communications content, and communications data as defined in section 21 of the 2000 Act. 1.7
The section 5 warrant process must be complied with in order properly and effectively to deal with any risk of civil or criminal liability arising from the interferences with equipment specified at sub-paragraphs (a) to (d) of paragraph 1.6 above. A section 5 warrant provides the Intelligence Services with specific legal authorisation removing criminal and civil liability arising from any such interferences. For the purposes of this code, any activity by the Intelligence Services or persons acting on their behalf or in their support falling within paragraph 1.6 which is (or is to be) authorised under section 5 of the 1994 Act will be referred to as equipment interference.
Effect of the code 1.8
The 2000 Act provides that all codes of practice in force under section 71 of the 2000 Act are admissible as evidence in criminal and civil proceedings. If any provision of this code appears relevant to any court or tribunal considering any such proceedings, or to the Investigatory Powers Tribunal established under the 2000 Act, or to one of the Commissioners carrying out any of their functions under the 2000 Act, it must be taken into account. The Intelligence Services may also be required to justify, with regard to this code, the use of section 5 warrants in general or the failure to apply for or use such warrants where appropriate.
Basis for lawful equipment interference activity 1.9
Equipment interference is conducted in accordance with the statutory functions of each Intelligence Service: In the case of the Security Service, the 1989 Act provides that the Service’s functions are the protection of national security, the safeguarding of the economic well-being of
5
“Interference” for these purposes excludes any interference which takes place with the consent of a person having the right to control the operation or the use of the equipment. 6 “Equipment” may include, but is not limited to, computers, servers, routers, laptops, mobile phones and other devices. 5
the United Kingdom against threats posed by the actions or intentions of persons outside the British Islands and the provision of support to the police and other law enforcement authorities in the prevention and detection of serious crime; For SIS, the 1994 Act provides that its functions are to obtain and provide information relating to the actions or intentions of persons outside the British Islands and to perform other tasks relating to the actions or intentions of such persons in the interests of national security, with particular reference to the defence and foreign policies of Her Majesty’s Government in the United Kingdom, or in the interests of the economic well-being of the United Kingdom or in support of the prevention or detection of serious crime; In the case of GCHQ, the 1994 Act provides, as relevant, that its functions are to monitor or interfere with electromagnetic, acoustic and other emissions and any equipment producing such emissions and to obtain and provide information derived from or related to such emissions or equipment and from encrypted material in the interests of national security, with particular reference to the defence and foreign policies of Her Majesty’s Government in the United Kingdom, or in the interests of the economic well-being of the United Kingdom in relation to the actions or intentions of persons outside the British Islands, or in support of the prevention or detection of serious crime. 1.10
The Human Rights Act 1998 gives effect in UK law to the rights set out in the European Convention on Human Rights (ECHR). Some of these rights are absolute, such as the prohibition on torture, while others are qualified, which means that it is permissible for public authorities to interfere with those rights if certain conditions are satisfied.
1.11
Amongst the qualified rights is a person’s right to respect for their private and family life, home and correspondence, as provided for by Article 8 of the ECHR. It is Article 8 that is most likely to be engaged when the Intelligence Services seek to obtain personal information about a person by means of equipment interference. Such conduct may also engage Article 1 of the First Protocol (right to peaceful enjoyment of possessions7).
1.12
By section 6(1) of the 1998 Act, it is unlawful for a public authority to act in a way which is incompatible with a Convention right. Each of the Intelligence Services is a public authority for this purpose. When undertaking any activity that interferes with ECHR rights, the Intelligence Services must therefore (among other things) act proportionately. Section 5 of the 1994 Act provides a statutory framework under which equipment interference can be authorised and conducted compatibly with ECHR rights.
1.13
So far as any information obtained by means of an equipment interference warrant is concerned, the heads of each of the Intelligence Services must also ensure that there are satisfactory arrangements in force under the 1994 Act or the 1989 Act in respect of the disclosure of that information, and that any information obtained under the warrant will be subject to those arrangements. Compliance with these arrangements will ensure that the Intelligence Services remain within the law and properly discharge their functions.
Application of section 5 of the 1994 Act 1.14
7
The 1994 Act applies to each of the Intelligence Services in a slightly different way:
For example, hardware or software. 6
SIS and GCHQ may not be issued with a section 5 warrant for action in support of the prevention or detection of serious crime which relates to equipment in the British Islands8; The Security Service may only be issued with a section 5 warrant for action in support of the prevention or detection of serious crime which relates to equipment in the British Islands if certain conditions are satisfied9. 1.15
8 9
The procedures for authorising equipment interference under section 5 (and any associated interferences) are explained further in chapter 4.
See section 5(3) of the 1994 Act. See section 5(3B) of the 1994 Act. 7
2. General rules on warrants Overview 2.1
A warrant under section 5 of the 1994 Act will, providing the statutory tests are met, remove criminal and civil liability arising from equipment interference operations.
2.2
Responsibility for issuing warrants under section 5 rests with the Secretary of State. Applications for warrants may be made by any of the Intelligence Services.
2.3
In any case where an equipment interference operation also enables or facilitates separate covert surveillance likely to result in the obtaining of private information about a person, a directed or intrusive surveillance authorisation may be required under Part 2 of the 2000 Act (see the Covert Surveillance and Property Interference Code of Practice).
Necessity and proportionality 2.4
The 1994 Act provides that the Secretary of State issuing the warrant must believe that the activities to be authorised are necessary for one or more statutory purposes10.
2.5
If the activities are deemed necessary for any of the purposes specified, the Secretary of State must also believe that they are proportionate to what is sought to be achieved by carrying them out.
2.6
Any assessment of proportionality involves balancing the seriousness of the intrusion into the privacy or property of the subject of the operation (or any other person who may be affected) against the need for the activity in investigative, operational or capability terms. The warrant will not be proportionate if it is excessive in the overall circumstances of the case. Each action authorised should bring an expected benefit to the investigation or operation and should not be disproportionate or arbitrary. The fact that there is a potential threat to national security (for example) may not alone render the most intrusive actions proportionate. No interference should be considered proportionate if the information which is sought could reasonably be obtained by other less intrusive means.
2.7
The following elements of proportionality should therefore be considered: balancing the size and scope of the proposed interference against what is sought to be achieved; explaining how and why the methods to be adopted will cause the least possible intrusion on the subject and others; considering whether the activity is an appropriate use of the legislation and a reasonable way, having considered all reasonable alternatives, of obtaining the necessary result; evidencing, as far as reasonably practicable, what other methods have been considered and why they were not implemented.
2.8
10
It is important that all those involved in undertaking equipment interference operations under the 1994 Act are fully aware of the extent and limits of the action that may be taken under the warrant in question.
These statutory purposes are specified in section 5 of the 1994 Act. They are detailed in Chapter 4. 8
Collateral intrusion 2.9
Any application for a section 5 warrant should also take into account the risk of obtaining private information about persons who are not subjects of the equipment interference activity (collateral intrusion).
2.10
Measures should be taken, wherever practicable, to avoid or minimise unnecessary intrusion into the privacy of those who are not the intended subjects of the equipment interference activity. Where such collateral intrusion is unavoidable, the activities may still be authorised, provided this intrusion is considered proportionate to what is sought to be achieved.
2.11
All applications should therefore include an assessment of the risk of collateral intrusion and details of any measures taken to limit this, to enable the Secretary of State fully to consider the proportionality of the proposed actions.
2.12
Where it is proposed to conduct equipment interference activity specifically against individuals who are not intelligence targets in their own right, interference with the equipment of such individuals should not be considered as collateral intrusion but rather as intended intrusion. Any such equipment interference activity should be carefully considered against the necessity and proportionality criteria as described above.
Reviewing warrants 2.13
Regular reviews of all warrants should be undertaken to assess the need for the equipment interference activity to continue. The results of a review should be retained for at least three years (see Chapter 5). Particular attention should be given to the need to review warrants frequently where the equipment interference involves a high level of intrusion into private life or significant collateral intrusion, or confidential information is likely to be obtained.
2.14
In each case, unless specified by the Secretary of State, the frequency of reviews should be determined by the member of the Intelligence Services who made the application. This should be as frequently as is considered necessary and practicable.
2.15
In the event that there are any significant and substantive changes to the nature of the interference and/or the identity of the equipment during the currency of the warrant, the Intelligence Services should consider whether it is necessary to apply for a fresh section 5 warrant.
General best practices 2.16
The following guidelines should be considered as best working practices by the Intelligence Services with regard to all applications for warrants covered by this code: applications should avoid any repetition of information; information contained in applications should be limited to that required by the 1994 Act; where warrants are issued under urgency procedures (see Chapter 4), a record detailing the actions authorised and the reasons why the urgency procedures were used should be recorded by the applicant and authorising officer as a priority. There is then no requirement subsequently to submit a full written application; 9
where it is foreseen that other agencies will be involved in carrying out the operation, these agencies should be detailed in the application; and warrants should not generally be sought for activities already authorised following an application by the same or a different public authority. 2.17
Furthermore, it is considered good practice that within each of the Intelligence Services, a designated senior official should be responsible for: the integrity of the process in place within the Intelligence Service to authorise equipment interference; compliance with the 1994 Act and this code; engagement with the Intelligence Services Commissioner when he conducts his inspections; and where necessary, overseeing the implementation of any post inspection action plans recommended or approved by the Commissioner.
10
3. Legally privileged and confidential information Overview 3.1
The 1994 Act does not provide any special protection for 'confidential information'. Nevertheless, particular consideration should be given in cases where the subject of the operation might reasonably assume a high degree of privacy, or where confidential information is involved. Confidential information includes communications subject to legal privilege, communications between a Member of Parliament and another person on constituency business, confidential personal information, or confidential journalistic material. So, for example, particular consideration should be given where, through equipment interference comprising the obtaining of information, it is likely that knowledge will be acquired of communications between a minister of religion and an individual relating to the latter's spiritual welfare, or between a Member of Parliament and a constituent relating to constituency business, or wherever matters of medical or journalistic confidentiality or legal privilege may be involved. References to a Member of Parliament include references to a Member of the UK Parliament, the European Parliament, the Scottish Parliament, the Welsh Assembly and the Northern Ireland Assembly.
Information subject to legal privilege: introduction 3.2
Section 98 of the Police Act 1997 describes those matters that are subject to legal privilege in England and Wales. In relation to Scotland, those matters subject to legal privilege contained in section 33 of the Criminal Law (Consolidation) (Scotland) Act 1995 should be adopted. With regard to Northern Ireland, Article 12 of the Police and Criminal Evidence (Northern Ireland) Order 1989 should be referred to.
3.3
Legal privilege does not apply to communications or items held with the intention of furthering a criminal purpose (whether the lawyer is acting unwittingly or culpably). Legally privileged communications or items will lose their protection if there are grounds to believe, for example, that the professional legal adviser is intending to hold or use the information for a criminal purpose. But privilege is not lost if a professional legal adviser is properly advising a person who is suspected of having committed a criminal offence. The concept of legal privilege applies to the provision of professional legal advice by any individual, agency or organisation qualified to do so.
3.4
Although the 1994 Act does not provide any special protection for legally privileged material, the acquisition of knowledge of matters subject to legal privilege is particularly sensitive and may give rise to issues under Article 6 (right to a fair trial) of the ECHR as well as engaging Article 8. The acquisition of knowledge of matters subject to legal privilege is therefore subject to additional safeguards under this code.
11
Tests to be applied when authorising equipment interference likely or intended to result in the acquisition of knowledge of matters subject to legal privilege 3.5
All applications for equipment interference that may result in the acquisition of knowledge of matters subject to legal privilege should state whether the interference is intended to obtain knowledge of matters subject to legal privilege (as described in paragraph 3.2).
3.6
If the equipment interference is not intended to result in the acquisition of knowledge of matters subject to legal privilege, but it is likely that such knowledge will nevertheless be acquired during the operation, the application should identify the steps which will be taken to mitigate the risk of acquiring it. If the risk cannot be removed entirely, the application should explain what steps will be taken to ensure that any knowledge of matters subject to legal privilege which is obtained is not used in law enforcement investigations or criminal prosecutions.
3.7
Where equipment interference is likely or intended to result in the acquisition of knowledge of matters subject to legal privilege, a warrant will only be issued if the Secretary of State is satisfied that there are exceptional and compelling circumstances that make the warrant necessary: Where the equipment interference is not intended to result in the acquisition of knowledge of matters subject to legal privilege, such exceptional and compelling circumstances may arise in the interests of national security or the economic wellbeing of the UK, or for the purpose of preventing or detecting serious crime; Where the equipment interference is intended to result in the acquisition of knowledge of matters subject to legal privilege, such circumstances will arise only in a very restricted range of cases, such as where there is a threat to life or limb, or to national security, and the equipment interference is reasonably regarded as likely to yield intelligence necessary to counter the threat.
3.8
Further, in considering any equipment interference likely or intended to result in the acquisition of knowledge of matters subject to legal privilege, the Secretary of State must be satisfied that the proposed equipment interference is proportionate to what is sought to be achieved.
The use and handling of matters subject to legal privilege 3.9
Matters subject to legal privilege are particularly sensitive and equipment interference which acquires such material may give rise to issues under Article 6 of the ECHR as well as engaging Article 8.
3.10
Where the Intelligence Services deliberately acquire knowledge of matters subject to legal privilege, they may use that knowledge to counter the threat which led them to acquire it, but it will not be admissible in court. The Intelligence Services should ensure that knowledge of matters subject to legal privilege, whether or not it is acquired deliberately, is kept separate from law enforcement investigations or criminal prosecutions.
3.11
In cases likely to result in the acquisition of knowledge of matters subject to legal privilege, the Secretary of State may require regular reporting so as to be able to decide whether the warrant should continue to have effect.
12
3.12
Where there is a renewal application in respect of a warrant which has resulted in the obtaining of legally privileged material that fact ought to be highlighted in the renewal application.
3.13
A substantial proportion of the communications between a lawyer and his client(s) may be subject to legal privilege. Therefore, in any case where a lawyer is the subject of an investigation or operation, the Secretary of State should consider whether the special safeguards outlined in this chapter apply. The case should also be notified to the Intelligence Services Commissioner during his next inspection and any legally privileged material which has been retained from any such investigation or operation should be made available to the Commissioner on request.
3.14
Caseworkers who examine information obtained by equipment interference should be alert to any material which may be subject to legal privilege. Where there is doubt as to whether the information is subject to legal privilege, or as to the handling and dissemination of such information, advice should be sought from a legal adviser within the relevant Intelligence Service. Similar advice should also be sought where there is doubt over whether information is not subject to legal privilege due to the "in furtherance of a criminal purpose" exception.
3.15
Other than in exceptional circumstances, no information subject to legal privilege must be acted on or further disseminated unless a legal adviser has been consulted on the lawfulness (including the necessity and proportionality) of such action or dissemination.
3.16
The retention of legally privileged material, or its dissemination to an outside body, should be accompanied by a clear warning that it is subject to legal privilege. It should be safeguarded by taking reasonable steps to remove the risk of it becoming available, or its contents becoming known, to any person whose possession of it might prejudice any criminal or civil proceedings to which the information relates. Neither the Crown Prosecution Service lawyer nor any other prosecuting authority lawyer with conduct of a prosecution should have sight of any legally privileged material, held by the relevant Intelligence Service, with any possible connection to the proceedings. In respect of civil proceedings, there can be no circumstances under which it is proper for any of the Intelligence Services to seek to rely on legally privileged material in order to gain a litigation advantage over another party in legal proceedings.
3.17
In order to safeguard against any risk of prejudice or accusation of abuse of process, the Intelligence Services must also take all reasonable steps to ensure that (as far as practicable) lawyers or policy officials with conduct of legal proceedings should not see legally privileged material relating to those proceedings (whether the privilege is that of the other party to those proceedings or that of a third party). If such circumstances do arise, the relevant Intelligence Service must seek independent advice from Counsel and, if there is assessed to be a risk that such material could yield a litigation advantage, the direction of the Court.
3.18
In those cases where legally privileged material has been acquired and retained, the matter should be reported to the Intelligence Services Commissioner as soon as reasonably practicable, as agreed with the Commissioner. Any material that is still being retained should be made available to him or her if requested, including detail of whether that material has been disseminated.
3.19
Material which has been identified as legally privileged should be retained only where it is necessary and proportionate to do so in accordance with the statutory functions of each of the Intelligence Services or where otherwise required by law. It must be securely 13
destroyed when its retention is no longer needed for those purposes. If such information is retained, it must be reviewed at reasonable intervals to confirm that the justification for its retention is still valid.
Confidential information 3.20
Particular consideration must also be given to cases that involve confidential personal information, confidential constituent information and confidential journalistic material.
3.21
Confidential personal information is information held in confidence concerning an individual (whether living or dead) who can be identified from it, and the material in question relates to his physical or mental health or to spiritual counselling 11. Such information can include both oral and written communications. Such information as described above is held in confidence if it is held subject to an express or implied undertaking to hold it in confidence or is subject to a restriction on disclosure or an obligation of confidentiality contained in existing legislation. For example, confidential personal information might include consultations between a health professional and a patient, or information from a patient's medical records.
3.22
Confidential constituent information is information relating to communications between a Member of Parliament and a constituent in respect of constituency business. Again, such information is held in confidence if it is held subject to an express or implied undertaking to hold it in confidence or it is subject to a restriction on disclosure or an obligation of confidentiality contained in existing legislation.
3.23
Confidential journalistic material includes material acquired or created for the purposes of journalism and held subject to an undertaking to hold it in confidence, as well as communications resulting in information being acquired for the purposes of journalism and held subject to such an undertaking.
3.24
Where the intention is to acquire confidential information, the reasons should be clearly documented and the specific necessity and proportionality of doing so should be carefully considered. If the acquisition of confidential information is likely but not intended, any possible mitigation steps should be considered and, if none is available, consideration should be given to adopting special handling arrangements within the relevant Intelligence Service.
3.25
Material which has been identified as confidential information should be retained only where it is necessary and proportionate to do so in accordance with the statutory functions of each of the Intelligence Services or where otherwise required by law. It must be securely destroyed when its retention is no longer needed for those purposes. If such information is retained, it must be reviewed at reasonable intervals to confirm that the justification for its retention is still valid
3.26
Where confidential information is retained or disseminated to an outside body, reasonable steps should be taken to mark the information as confidential. Where there is any doubt as to the handling and dissemination of confidential information, advice should be sought from a legal adviser within the relevant Intelligence Service before any further dissemination of the material takes place.
11
Spiritual counselling means conversations between an individual and a Minister of Religion acting in his or her official capacity, and where the individual being counselled is seeking or the Minister is imparting forgiveness, absolution or the resolution of conscience with the authority of the Divine Beings(s) of their faith. 14
3.27
Any case where confidential information is retained should be reported to the Intelligence Services Commissioner as soon as reasonably practicable, as agreed with the Commissioner and any material which has been retained should be made available to the Commissioner on request.
.
15
4. Procedures for authorising equipment interference under section 5 General basis for lawful activity 4.1
Subject to paragraph 4.4, a warrant under section 5 of the 1994 Act should be sought wherever members of the Intelligence Services, or persons acting on their behalf or in their support, conduct equipment interference in relation to equipment located in the British Islands that would be otherwise unlawful.
4.2
If the equipment is located outside the British Islands, and the interference would be otherwise unlawful, the Security Service should seek a warrant under section 5 of the 1994 Act. In the case of SIS and GCHQ, an authorisation under section 7 may be obtained instead of a warrant under section 512 (see chapter 8).
4.3
An application for a section 5 warrant must usually13 be made by a member of the Security Service, SIS or GCHQ for the taking of action in relation to that Intelligence Service. In addition, the Security Service may make an application for a warrant to act on behalf of SIS and GCHQ.
4.4
SIS and GCHQ may not be issued with a warrant for action in support of the prevention or detection of serious crime which relates to equipment in the British Islands. The Security Service may only be issued with a warrant for action in support of the prevention or detection of serious crime which relates to equipment in the British Islands if it authorises the taking of action in relation to conduct which would constitute one or more offences and: It involves the use of violence, results in substantial financial gain or is conduct by a large number of persons in pursuit of a common purpose; or a person aged twenty-one or over with no previous convictions could reasonably be expected to be sentenced to three years’ imprisonment or more.
4.5
In some cases an equipment interference operation may also enable or facilitate separate covert surveillance likely to result in the obtaining of private information about a person. A directed or intrusive surveillance authorisation may need to be obtained under Part 2 of the 2000 Act in such cases (see the Covert Surveillance and Property Interference Revised Code of Practice). Operations involving covert surveillance and equipment interference may be authorised as a combined warrant, although the criteria for authorisation of each activity must be considered separately.
Application for an equipment interference warrant 4.6
An application for the issue or renewal of a section 5 warrant is made to the Secretary of State. Each application should contain the following information:
12
This includes cases where the act is done in the British Islands, but is intended to be done in relation to apparatus that is or is believed to be outside the British Islands, or in relation to anything appearing to originate from such apparatus: section 7(9). See also section 7(10) to (12). 13 Where two Intelligence Services are conducting equipment interference as part of a joint operation only one authorisation is required. 16
the identity or identities, where known, of those who possess or use the equipment that is to be subject to the interference; sufficient information to identify the equipment which will be affected by the interference; the nature and extent of the proposed interference, including any interference with information derived from or related to the equipment; what the operation is expected to deliver and why it could not be obtained by other less intrusive means; details of any collateral intrusion, including the identity of individuals and/or categories of people, where known, who are likely to be affected. whether confidential or legally privileged material may be obtained. If the equipment interference is not intended to result in the acquisition of knowledge of matters subject to legal privilege or confidential personal information, but it is likely that such knowledge will nevertheless be acquired during the operation, the application should identify all steps which will be taken to mitigate the risk of acquiring it; details of any offence suspected or committed where relevant; how the authorisation criteria (as set out at paragraph 4.7 below) are met; what measures will be put in place to ensure proportionality is maintained (e.g. filtering, disregarding personal information); where an application is urgent, the supporting justification; any action which may be necessary to install, modify or remove software on the equipment; in case of a renewal, the results obtained so far, or a full explanation of the failure to obtain any results.
Issuing of section 5 warrants 4.7
Before issuing a warrant, the Secretary of State must: think it necessary for the action to be taken for the purpose of assisting the relevant Intelligence Service in carrying out its functions; be satisfied that the taking of the action is proportionate to what the action seeks to achieve; take into account, in deciding whether a warrant is necessary and proportionate, whether the information which it is thought necessary to obtain by the conduct authorised by the warrant could reasonably be obtained by other means; and be satisfied that there are satisfactory arrangements in force under the 1994 Act or the 1989 Act in respect of disclosure of any information obtained by means of the warrant, and that information obtained will be subject to those arrangements.
Urgent authorisation of a section 5 warrant 4.8
Section 6 of the 1994 Act makes provision for cases in which a warrant is required urgently, yet the Secretary of State is not available to issue the warrant. In these cases the Secretary of State will still personally authorise the equipment interference but the warrant is signed by a senior official, following discussion of the case between the senior official and the Secretary of State.
4.9
The 1994 Act restricts issue of warrants in this way to urgent cases where the Secretary of State has expressly authorised the issue of the warrant, and requires the warrant to contain a statement to that effect.
17
Renewals of warrants 4.10
A warrant, unless renewed, ceases to have effect at the end of the period of six months beginning with the day on which it was issued (if the warrant was issued under the hand of the Secretary of State) or at the end of the period ending with the fifth working day following the day on which it was issued (in any other case).
4.11
If at any time before the day on which a warrant would cease to have effect the Secretary of State considers it necessary for the warrant to continue to have effect for the purpose for which it was issued, the Secretary of State may by an instrument under his hand renew it for a period of six months beginning with the day it would otherwise cease to have effect.
Cancellations of warrants 4.12
The Secretary of State must cancel a warrant if he is satisfied that the action authorised by it is no longer necessary.
4.13
The person who made the application to the Secretary of State must apply for its cancellation, if he is satisfied that the warrant no longer meets the criteria upon which it was authorised.
Retrieval of equipment 4.14
Because of the time it can take to remove the means of interference it may also be necessary to renew an equipment interference warrant in order to complete the removal. Applications to the Secretary of State for renewal should state why the operation is being or has been closed down, why it has not been possible to remove the means of interference and any relevant timescales for removal.
18
5. Keeping of records Centrally retrievable records of warrants 5.1
The following information relating to all section 5 warrants for equipment interference should be centrally retrievable for at least three years: the date when a warrant is given; the details of what equipment interference has occurred; the result of periodic reviews of the warrants; the date of every renewal; and the date when any instruction was given by the Secretary of State to cease the equipment interference.
19
6. Handling of information and safeguards Overview 6.1
This chapter provides further guidance on the processing, retention, disclosure deletion and destruction of any information obtained by the Intelligence Services pursuant to an equipment interference warrant. This information may include communications content and communications data as defined in section 21 of the 2000 Act.
6.2
The Intelligence Services must ensure that their actions when handling information obtained by means of equipment interference comply with the legal framework set out in the 1989 and 1994 Acts (including the arrangements in force under these Acts14), the Data Protection Act 1998 and this code, so that any interference with privacy is justified in accordance with Article 8(2) of the European Convention on Human Rights. Compliance with this legal framework will ensure that the handling of information obtained by equipment interference continues to be lawful, justified and strictly controlled, and is subject to robust and effective safeguards against abuse.
Use of information as evidence 6.3
Subject to the provisions in chapter 3 of this code, information obtained through equipment interference may be used as evidence in criminal proceedings. The admissibility of evidence is governed primarily by the common law, the Civil Procedure Rules, section 78 of the Police and Criminal Evidence Act 198415 and the 1998 Act.
Handling information obtained by equipment interference 6.4
Paragraphs 6.6 to 6.11 provide guidance as to the safeguards which must be applied by the Intelligence Services to the processing, retention, disclosure and destruction of all information obtained by equipment interference16. Each of the Intelligence Services must ensure that there are internal arrangements in force, approved by the Secretary of State, for securing that these requirements are satisfied in relation to all information obtained by equipment interference.
6.5
These arrangements should be made available to the Intelligence Services Commissioner. The arrangements must ensure that the disclosure, copying and retention of information obtained by means of an equipment interference warrant is limited to the minimum necessary for the proper discharge of the Intelligence Services’ functions or for the additional limited purposes set out in section 2(2)(a) of the 1989 Act and sections 2(2)(a) and 4(2)(a) of the 1994 Act. Breaches of these handling arrangements must be reported to the Intelligence Services Commissioner as agreed with him.
14
All information obtained by equipment interference must be handled in accordance with arrangements made under section 2(2)(a) of the 1989 Act and sections 2(2)(a) and 4(2)(a) of the 1994 Act (and pursuant to sections 5(2)(c) and 7(3)(c) of the 1994 Act). 15 And section 76 of the Police and Criminal Evidence (Northern Ireland) Order 1989. 16 The application of these safeguards to all information obtained by equipment interference is without prejudice as to whether section 6 of the 1998 Act requires the application of these safeguards to information other than communications content and associated communications data. 20
Dissemination of information 6.6
The number of persons to whom any of the information is disclosed, and the extent of disclosure, must be limited to the minimum necessary for the proper discharge of the Intelligence Services’ functions or for the additional limited purposes described in paragraph 6.5. This obligation applies equally to disclosure to additional persons within an Intelligence Service, and to disclosure outside the service. It is enforced by prohibiting disclosure to persons who do not hold the required security clearance, and also by the need-to-know principle: information obtained by equipment interference must not be disclosed to any person unless that person’s duties are such that he needs to know about the information to carry out those duties. In the same way only so much of the information may be disclosed as the recipient needs; for example if a summary of the information will suffice, no more than that should be disclosed.
6.7
The obligations apply not just to the Intelligence Service that obtained the information, but also to anyone to whom the information is subsequently disclosed. In some cases this may be achieved by requiring the latter to obtain the originator’s permission before disclosing the information further. In others, explicit safeguards may be applied to secondary recipients.
Copying 6.8
Information obtained by equipment interference may only be copied to the extent necessary for the proper discharge of the Intelligence Services’ functions or for the additional limited purposes described in paragraph 6.5. Copies include not only direct copies of the whole of the information, but also extracts and summaries which identify themselves as the product of an equipment interference operation. The restrictions must be implemented by recording the making, distribution and destruction of any such copies, extracts and summaries that identify themselves as the product of an equipment interference operation.
Storage 6.9
Information obtained by equipment interference, and all copies, extracts and summaries of it, must be handled and stored securely, so as to minimise the risk of loss or theft. It must be held so as to be inaccessible to persons without the required level of security clearance. This requirement to store such information securely applies to all those who are responsible for the handling of the information.
Destruction 6.10
Communications content, communications data and other information obtained by equipment interference, and all copies, extracts and summaries thereof, must be marked for deletion and securely destroyed as soon as they are no longer needed for the functions or purposes set out in paragraph 6.5. If such information is retained, it should be reviewed at appropriate intervals to confirm that the justification for its retention is still valid.
Personnel security 6.11
In accordance with the need-to-know principle, each of the Intelligence Services must ensure that information obtained by equipment interference is only disclosed to persons as necessary for the proper performance of the Intelligence Services’ statutory functions. 21
Persons viewing such product will usually require the relevant level of security clearance. Where it is necessary for an officer to disclose information outside the service, it is that officer's responsibility to ensure that the recipient has the necessary level of clearance.
22
7. Application of the code to equipment interference pursuant to section 7 of the 1994 Act Application of the code to other equipment interference 7.1
SIS and GCHQ must as a matter of policy17 apply the provisions of this code in any case where equipment interference is to be, or has been, authorised pursuant to section 7 of the 1994 Act in relation to equipment located outside the British Islands.
7.2
This chapter provides specific additional guidance on certain aspects of the process for authorising equipment interference pursuant to section 7 of the 1994 Act. Save as specified below, GCHQ and SIS must comply with all other provisions of this code in relation to equipment interference under section 7. In particular, GCHQ and SIS must apply all the same procedures and safeguards when conducting equipment interference authorised pursuant to section 7 as they do in relation to equipment interference authorised under section 5.
General basis for lawful activity 7.3
An authorisation under section 7 of the 1994 Act may be sought wherever members of SIS or GCHQ, or persons acting on their behalf or in their support, conduct equipment interference in relation to equipment located outside the British Islands that would otherwise be unlawful. This includes cases where the act is done in the British Islands, but is intended to be done in relation to apparatus that is or is believed to be outside the British Islands, or in relation to anything appearing to originate from such apparatus18.
7.4
If a member of SIS or GCHQ wishes to interfere with equipment located overseas but the subject of the operation is known to be in the British Islands, consideration should be given as to whether a section 8(1) interception warrant or a section 16(3) certification (in relation to one or more extant section 8(4) warrants) under the 2000 Act should be obtained in advance of commencing the operation authorised under section 7. In the event that any equipment located overseas is brought to the British Islands during the currency of the section 7 authorisation, and the act is one that is capable of being authorised by a warrant under section 5, the interference is covered by a 'grace period' of 5 working days (see section 7(10) to 7(14)). This period should be used either to obtain a warrant under section 5 or to cease the interference (unless the equipment is removed from the British Islands before the end of the period).
7.5
An application for a section 7 authorisation should usually19 be made by a member of SIS or GCHQ for the taking of action in relation to that service. Responsibility for issuing authorisations under section 7 rests with the Secretary of State.
7.6
An authorisation under section 7 may be specific to a particular operation or user, or may relate to a broader class of operations. Where an authorisation relating to a broader class of operations has been given by the Secretary of State under section 7, internal
17
And without prejudice as to arguments regarding the applicability of the ECHR. See section 7(9). 19 Where two Intelligence Services are conducting equipment interference as part of a joint operation only one authorisation is required. 18
23
approval to conduct operations under that authorisation in respect of equipment interference must be sought from a designated senior official (see paragraphs 7.11 to 7.14).
Authorisations for equipment interference under section 7 7.7
An application for the giving or renewal of a section 7 authorisation is made to the Secretary of State. Each application should contain the same information, as far as is reasonably practicable in the circumstances, as an application for a section 5 equipment interference warrant.
7.8
Before giving the authorisation, the Secretary of State must be satisfied that: the equipment interference, or the operation in the course of which the equipment interference will take place, will be necessary for the proper discharge of a function of SIS or GCHQ; there are satisfactory arrangements in force to secure that nothing will be done beyond what is necessary for the discharge of SIS or GCHQ's functions and that the nature and likely consequences of any acts done in reliance on the authorisation will be reasonable having regard to the purposes for which they are carried out; there are satisfactory arrangements in force under the 1994 Act in respect of disclosure of any information obtained by means of the authorisation, and that any information so obtained will be subject to those arrangements.
Urgent authorisation of a section 7 authorisation 7.9
Section 7(5) of the 1994 Act makes provision for cases in which an authorisation is required urgently, yet the Secretary of State is not available to give the authorisation. In these cases the Secretary of State will still personally authorise the equipment interference but the authorisation is signed by a senior official, following discussion of the case between the senior official and the Secretary of State.
7.10
The 1994 Act restricts issue of authorisations in this way to urgent cases where the Secretary of State has expressly authorised the giving of the authorisation, and requires the authorisation to contain a statement to that effect.
Other authorisations and internal approvals 7.11
An authorisation under section 7 may relate to a broad class of operations. Authorisations of this nature are referred to specifically in section 7(4)(a) of the 1994 Act which provides that the Secretary of State may give an authorisation which inter alia relates to "acts of a description specified in the authorisation". The legal threshold for giving such an authorisation is the same as for a specific authorisation.
7.12
Where an authorisation relating to a broader class of operations has been given by the Secretary of State under section 7, internal approval to conduct operations under that authorisation in respect of equipment interference must be sought from a designated senior official. In any case where the equipment interference may result in the acquisition of confidential information, authorisation must be sought from an Annex A approving officer. Where knowledge of matters subject to legal privilege may be acquired, the Annex A approving officer must apply the tests set out at paragraph 3.4 to 3.7 (and "Secretary of State" should be read as "Annex A approving officer" for these purposes). 24
7.13
The application for approval must set out the necessity, justification, proportionality and risks of the particular operation, and should contain the same information, as and where appropriate, as an application for a section 5 equipment interference warrant. Before granting the internal approval, the designated senior official or Annex A approving officer must be satisfied that the operation is necessary for the proper discharge of the functions of the Intelligence Service, and that the taking of the action is proportionate to what the action seeks to achieve. The designated senior official or Annex A approving officer must consult the Foreign and Commonwealth Office or seek the endorsement of the Secretary of State for any particularly sensitive operations.
7.14
All internal approvals must be subject to periodic review at least once every 6 months to ensure the operations continue to be necessary and proportionate. The approvals for particularly sensitive operations should be reviewed more frequently, depending on the merits of the case.
Renewals of authorisations 7.15
A section 7 authorisation, unless renewed, ceases to have effect at the end of the period of six months beginning with the day on which it was given (if the authorisation was given under the hand of the Secretary of State) or at the end of the period ending with the fifth working day following the day on which it was given (in any other case).
7.16
If at any time before the day on which an authorisation would cease to have effect the Secretary of State considers it necessary for the authorisation to continue to have effect for the purpose for which it was given, the Secretary of State may by an instrument under his hand renew it for a period of six months beginning with the day it would otherwise cease to have effect.
Cancellations of authorisations 7.17
20
The Secretary of State must cancel an authorisation if he is satisfied that any act authorised by it is no longer necessary20.
See section 7(8). 25
8. Oversight by Intelligence Services Commissioner 8.1
The Intelligence Services Commissioner provides independent oversight of the use by the Intelligence Services of the powers contained within the 1994 Act. This code does not cover the exercise of any of the Commissioner’s functions.
8.2
It is the duty of any member of the Intelligence Services who uses these powers to comply with any request made by the Commissioner to disclose or provide any information he requires for the purpose of enabling him to carry out his functions. Such persons must also report any action that is believed to be contrary to the provisions of the 1994 Act to the Commissioner.
26
9. Complaints 9.1
The 2000 Act establishes an independent Tribunal (the Investigatory Powers Tribunal). This Tribunal will be made up of designated senior members of the judiciary and the legal profession and is independent of the Government. The Tribunal has full powers to investigate and decide any case within its jurisdiction. This Code does not cover the exercise of the Tribunal’s functions.
9.2
Details of the relevant complaints procedure are available on the Tribunal’s website at: http://www.ipt-uk.com or can be obtained from the following address: Investigatory Powers Tribunal PO Box 33220 London SW1H 9ZQ 020 7035 3711
27
10. Glossary Confidential information
Confidential personal information (such as medical records or spiritual counselling), confidential journalistic material, confidential discussions between Members of Parliament and their constituents, or matters subject to legal privilege. See Chapter 3 for a full explanation.
Designated senior official
“Designated senior official” means a person holding at least the grade of Deputy Director with SIS or GCHQ and who has been designated for the purpose in question by (as relevant) the Chief of the SIS or the Director of GCHQ or their nominated deputies.
Equipment interference
Any interference (whether remotely or otherwise) by the Intelligence Services, or persons acting on their behalf of in their support, with equipment producing electromagnetic, acoustic and other emissions, or information derived from or related to such equipment, which is to be authorised under section 5 of the 1994 Act, in order to do any or all of the following: a) obtain information from the equipment in pursuit of intelligence requirements; b) obtain information concerning the ownership, nature and use of the equipment with a view to meeting intelligence requirements; c) locate and examine, remove, modify or substitute equipment hardware or software which is capable of yielding information of the type described in a) and b); d) enable and facilitate surveillance activity by means of the equipment; “Information” may include communications content, and communications data as defined in section 21 of the 2000 Act.
Intelligence Services
The Security Service, SIS and GCHQ.
Internal approval
Internal approval given by a designated senior official to conduct operations under an authorisation relating to a broader class of operations given by the Secretary of State under section 7 of the 1994 Act.
28
Legal privilege
Matters subject to legal privilege are defined (as relevant) in section 98 of the Police Act 1997, section 33 of the Criminal Law (Consolidation) (Scotland) Act 1995 and Article 12 of the Police and Criminal Evidence (Northern Ireland) Order 1989. This includes certain communications between professional legal advisers and their clients or persons representing the client.
Public authority
Any public organisation, including the Intelligence Services.
Secretary of State
Any Secretary of State (in practice this will generally be the Home Secretary in the case of the Security Service, and the Foreign Secretary in the case of SIS and GCHQ).
29
11. Annex A Authorisation levels when knowledge of confidential information is likely to be acquired
Intelligence Service
Authorisation level
The Security Service
Deputy Director General
The Secret Intelligence Service
A Director of the Secret Intelligence Service
The Government Communications Headquarters
A Director of the Government Communications Headquarters
30
Regulation of Investigatory Powers Act 2000 Consultation: Equipment Interference and Interception of Communications Codes of Practice 6 February 2015
Ministerial Foreword The abilities to read or listen to a suspect’s communications or to interfere with his or her computer equipment are among the most important, sensitive, and closely scrutinised powers available to the state. As the threat to the UK from terrorism, espionage and organised crime has diversified, these powers have become more important. Those who mean us harm use internet-based communications to plan, direct and – increasingly – execute their plots. Terrorists, paedophiles and serious criminals are increasingly sophisticated in their use of technology and they are going further in their efforts to evade detection. It is vital that the police and their partners in the Security and Intelligence Agencies are able to stop them. There are limits on what can be said in public about this work. But it is imperative that the Government is as open as it can be about these capabilities and how they are used. The public and Parliament needs to have confidence that there is a robust statutory framework for the use of such intrusive investigative powers and that there is a strong system of safeguards in place. The revised and updated draft Interception of Communications Code of Practice published today provides more information than ever on the safeguards that apply to the security and law enforcement agencies’ work to identify and disrupt threats. And it provides further detail on the protections afforded to the most sensitive communications (such as those between lawyer and client) that may be intercepted. The new draft Equipment Interference Code of Practice details the safeguards applied to different investigative techniques, including the use of computer network exploitation, to identify, track and disrupt the most sophisticated targets. It makes clear the role of the Secretary of State in authorising the use of such intrusive techniques only where it is necessary and proportionate to do so. This new draft Code reflects the approach in the existing and published guidance in the Covert Surveillance and Property Interference Revised Code of Practice. In order to continue to keep us safe, the Security and Intelligence Agencies need the full range of investigatory tools at their disposal. But the public needs to know that these powers are used appropriately and are subject to stringent oversight. We look forward to receiving your responses.
James Brokenshire MP Minister of State for Immigration and Security
2
Why are we consulting? This consultation contains proposals to update the Interception of Communications Code of Practice and to publish a new Equipment Interference Code of Practice. The Regulation of Investigatory Powers Act 2000 (RIPA) requires the Secretary of State to prepare and publish a draft of these Codes and to consider any representations made about those drafts. This consultation fulfils that requirement.
Scope of the consultation Topic of this consultation:
This consultation is on the draft Interception of Communications Code of Practice and the draft Equipment Interference Code of Practice.
Scope of this consultation:
This consultation seeks representations on the draft Codes of Practice.
Geographical scope:
UK wide.
Basic Information To:
Representations are invited from Parliament, professional bodies, interest groups and the wider public.
Duration:
6 weeks, closing on 20 March 2015.
Enquiries and responses:
Enquiries and responses should be sent to
[email protected] Please indicate in your response whether you are content for it to be published, with or without attributing it to you/ your organisation.
After the consultation:
Following the consultation period, responses will be analysed and the draft Codes revised accordingly. They will then be laid before Parliament for approval.
Background Getting to this stage:
We consulted the law enforcement and intelligence community, the Interception of Communications Commissioner (who oversees the operation of Part 1 of the Regulation of Investigatory Powers Act 2000) and the Intelligence Services Commissioner (who oversees the operation of sections 5 to 7 of the Intelligence Services Act 1994).
3
Introduction The ability to intercept the communications of those who mean us harm is a vital tool in the fight against terrorism and serious crime. Since 2010, the majority of the MI5’s top priority UK counter-terrorism investigations have used intercept capabilities in some form to identify, understand or disrupt plots seeking to harm the UK and its citizens. Interception is among the most intrusive powers available to law enforcement and the security agencies. For that reason it is subject to strict safeguards in the Regulation of Investigatory Powers Act 2000 (RIPA). Interception warrants are issued and renewed by the Secretary of State, for a small number of agencies and for a limited range of purposes. RIPA also provides for independent oversight by the Interception of Communications Commissioner and an impartial route of redress, through the Investigatory Powers Tribunal. Increasingly, terrorists and serious criminals are using sophisticated techniques to communicate covertly and evade detection. That requires the Security and Intelligence Agencies in particular to make use of new and innovative capabilities to identify and disrupt them. The Security Services Act 1989 and the Intelligence Services Act 1994 (ISA) provide the legislative basis for the Security and Intelligence Agencies (SIA) - the Security Service (MI5), the Secret Intelligence Service (SIS) and Government Communications Headquarters (GCHQ) - to interfere with computers and communications devices. Warrants may only be issued by the Secretary of State where they consider the activities to be authorised are necessary and proportionate. The use of the powers is subject to independent oversight by the Intelligence Services Commissioner. Interception of Communications This Code of Practice regulates the powers and duties conferred or imposed under Chapter 1 of Part 1 of RIPA, which provides for the interception of communications. It also provides guidance on the procedures that must be followed before interception under a warrant may take place. The extant interception Code was brought into force in 2002. This Government is committed to making publicly available significantly more information about the safeguards that underpin the interception of external communications under section 8(4) of RIPA. These are not new safeguards – the Security and Intelligence Agencies have always had robust internal arrangements, which are overseen by the Interception of Communications Commissioner – but we are now able to put more detail into the public domain than we ever have before. The key changes reflected in the revised draft Code of Practice are: Additional information on the safeguards that exist for the interception and handling of external communications under section 8(4) RIPA.
4
Further information around the protections afforded to legally privileged material and other confidential material. This makes explicit the robust safeguards that ensure such communications are not misused. Minor changes to reflect the following provisions in the Data Retention and Investigatory Powers Act 2014 (DRIPA): o Extra-territoriality. The Code provides guidance on service of warrants and notices on communication service providers outside the UK. o Telecommunication services. The Code reflects the clarification of the existing definition of “telecommunications service” in RIPA which makes clear that internet based services are included. Changes to reflect developments in the law since 2002, including: o Amendments to reflect the introduction of the Regulation of Investigatory Powers (Monetary Penalty Notices and Consents for Interceptions) Regulations, which came into force in June 2011 and which provided for a new offence of unintentional interception; and o Clarification, in view of recent court judgments, of the treatment of stored communications, specifically with regard to unauthorised accessing of voicemails.
Equipment Interference The draft Equipment Interference Code of Practice applies to the activities of the Security and Intelligence Agencies in the UK and overseas. The draft Code explains when the Security and Intelligence Agencies can lawfully interfere with electronic equipment, such as computers, and the rules and safeguards that govern the use of any information obtained by these means. It sets out the procedures that must be followed before such interference can take place, the processing, retention, destruction and disclosure of any information obtained by means of the interference, and the independent oversight provided by the Intelligence Services Commissioner. As equipment interference is essentially a type of property interference, the draft Code is similar to the existing published guidance in the Covert Surveillance and Property Interference Revised Code of Practice regarding the process for authorising equipment interference, record keeping, oversight and complaints. The draft Code also mirrors the handling safeguards for intercepted material in the Interception Code of Practice and introduces guidance relating to the authorisation of equipment interference outside the UK under section 7 of the Intelligence Services Act 1994. Responses to this consultation, or a summary of such responses, may be published (with the permission of the respondent) in the interest of ensuring an informed and transparent debate.
5
