This newsletter is about the acquisition of communications data by UK public authorities from telecommunications operators. It looks at the data that can be obtained under these authorisations, the procedure for obtaining these authorisations and the bulk version of this power.

Here are the key takeaways:

• Under the Investigatory Powers Act 2016, relevant public authorities can obtain authorisation for the acquisition of communications data from telecommunications operators. This includes the metadata of a communication rather than the content of communications, including internet connection records.

• A wide range of public authorities in the UK can obtain authorisations to obtain communications data. This includes not just MI5, MI6 and GCHQ (the security and intelligence agencies), but also, among others, the police, the National Crime Agency, the Competitions and Markets Authority, the Financial Conduct Authority and the Office of Communications.

• Data acquisition authorisations can be sought for the purposes of a specific investigation or a specific operation. The grounds on which authorisations may be granted include, among others, national security and preventing or detecting serious crime.

• Once granted, a data acquisition authorisation can be served on a telecommunications operator. The authorisation must therefore specify the operator concerned and the nature of the requirements to be imposed.

• Acquisition authorisations can also come in bulk form, of which is subject to the double lock mechanism. However, only the security and intelligence agencies can apply for these bulk acquisition warrants.

What are data acquisition authorisations?

Under the Investigatory Powers Act 2016 (IPA 2016), relevant public authorities can obtain authorisation for the acquisition of communications data from telecommunications operators. Some authorisations can be obtained from certain personnel within a relevant public authority, whereas other authorisations require independent authorisation from the Investigatory Powers Commissioner (IPC). Acquisition authorisations can come in bulk form, of which is subject to the double lock mechanism, but only the SIAs can apply for these bulk acquisition warrants.

Which public authorities can obtain data acquisition authorisations?

Under the IPA 2016, a "relevant public authority" includes a wide range of public authorities in the UK. This includes not just MI5, MI6 and GCHQ (the security and intelligence agencies, or the SIAs), but also, among others, the police, the National Crime Agency, the Competitions and Markets Authority, the Financial Conduct Authority and the Office of Communications.1

What is the procedure for obtaining data acquisition authorisations?

The IPA 2016 requires public authorities to have a "designated senior officer" (DSO), which somebody with a certain rank, office or position who are involved in the procedure for obtaining data acquisition authorisations.2 The required rank, office or position depends on the public authority in question. For example, the minimum rank in GCHQ for authorising the acquisition of communications data is a G8 Officer.3

The process for authorising the acquisition of communications data is as follows:

• The applicant - A person within a public authority involved in an investigation or operation makes an application for the acquisition of communications data that would aid that investigation or operation. The application must be made in writing or in a manner that produces a record of its having been applied.4

• The single point of contact - Applicants must consult a person within the relevant public authority who is acting as a single point of contact (SPoC) in relation to the making of applications.5 DSOs must also consult SPoCs before granting an authorisation. These SPoCs are “trained to facilitate the lawful acquisition of communications data and effective cooperation between a public authority, the Office for Communications Data Authorisations and telecommunications operators”.6

• The authorising individuals - Authorisation for the acquisition of communications data may be obtained in one of three ways:

  • Certain public authorities may only obtain authorisation from the IPC,7 including local authorities.8 These duties of the IPC are delegated, in accordance with the IPA 2016,9 to their staff who sit in a body known as the Office for Communications Data Authorisations (OCDA).10 The requirement for independent authorisation depends on the grounds on which an application for data acquisition is made and which public authority is making the application. For example, if the Department of Health and Social Care is applying for a data acquisition authorisation in the interests of public safety,11 independent authorisation from the OCDA will be required and the Department may obtain both entity data and events data. The OCDA will need to consider the necessity and proportionality of each application.12

  • Authorisations can be made by a DSO within a relevant public authority where the acquisition data is requested on certain grounds.13 That DSO will have to consider the necessity and proportionality of the application.14

  • If the OCDA or a DSO has authorised the acquisition of communications data for the purpose of identifying or confirming a source of journalistic information, then the approval of a Judicial Commissioner is also required.15

What data can be obtained under a data acquisition authorisation?

Acquisition authorisations permit the collection of communications data. As explained in my post on retention notices under the IPA 2016:

Retention notices can be used to obtain 'relevant communications data' from telecommunications operators.

"Communications data" effectively means the metadata of a communication. This includes information about things like the recipient, sender and timing of the communication. The IPA 2016 itself defines the specific pieces of metadata within the scope of communications data, namely entity data and events data:

• 'Entity data' means data about an entity which could be a person or a thing.

• 'Events data' means any data identifying or describing an event on, in or by means of a telecommunication system where the event consists of one or more entities engaging in a specific activity at a specific time.

Together, communications data means any data "generated, held or obtained in the provision, delivery and maintenance of communication services." This could include:

• Those involved in the communication (i.e., the sender and recipient)

• When the communication was made

• The duration of the communication

• The type and method of communication

• The telecommunication system used for the communication

• The location of the telecommunication system

For acquisition authorisations, certain DSOs are only permitted to authorise the obtaining of entity data whereas other DSOs of a higher rank, office or position are permitted to authorise the obtaining of both entity and events data. For instance, an inspector within the Metropolitan police force may authorise the acquisition of entity data only, whereas a superintendent may authorise the acquisition of both entity and events data.16

Communications data also includes what the IPA 2016 defines as 'internet connection records', which also explained in my post on data retention notices:

An internet connection record is a type of communications data that satisfies the following two conditions:

• It can be used to identify a communication that has been transmitted to a telecommunications service via a telecommunication system to obtain access to or run a computer file or program

• It comprises data generated or processed by a telecommunications operator in the process of supplying the telecommunications service to the sender of the communication (whether or not a person)

ICRs therefore consist of information that identifies an internet service that a person has been using. This could include a wide range of data, such as IP addresses or a customer account reference like an account number.

The websites a person has visited can also constitute an ICR. However, the definition of an ICR excludes certain elements of a person's web browsing history. For example, if a person visits 'https://www.thecybersolicitor.com/s/state-surveillance', the only part of this URL that would constitute 'communications data' for the purposes of the IPA 2016 includes the host name ('www.thecybersolicitor.com). The remainder of the URL, namely the resource ('/s/state-surveillance') would be classed as the content of a communication under the Act and therefore not fall within the definition of an ICR.

The IPA “recognises the additional sensitivities associated with ICRs and restricts public authority access accordingly”.17 Accordingly, neither the OCDA nor a DSO can authorise the acquisition of communications data which is, or can be obtained by processing, an ICR.18 There are limited exceptions to this rule, which effectively pertain to when an ICR is used:

• To identify those who are using a service on the internet only where the service and the time of use are already known.19

• To identify the internet communications service being used by a known person or apparatus, including when and how it is used.20

• To identify the internet service being used, including when and how, by a known person or apparatus.21

• Obtain access to, or run, a computer file or program by a known person or apparatus involving, wholly or mainly, the making available or acquisition of material the possession of which is a crime.22

On what grounds can a data acquisition authorisation be sought?

Any acquisition authorisation can be sought if it necessary to obtain communicationa data for the purposes of:23

• A specific investigation or a specific operation

• Testing, maintaining or developing equipment, systems or other capabilities relating to the availability or obtaining of communications data

Either of those activities must be connected with one of the statutory grounds provided under the IPA 2016. The OCDA may authorise the acquisition of communications data on any of the following grounds:24

• In the interests of national security.

• For the purpose of preventing or detecting serious crime (where the communications data is wholly or partly events data) or, in any other case, for the purpose of preventing or detecting crime or of preventing disorder.25 Serious crime is defined as a criminal offence that involves conduct entailing the use of violence, results in substantial financial gain or is conduct by a large number of persons in pursuit of a common purpose.26

• In the interests of the economic well-being of the UK so far as those interests are also relevant to the interests of national security.

• In the interests of public safety.

• For the purposes of preventing death or injury or any damage to a person’s physical or mental health, or of mitigating any injury or damage to a person’s physical or mental health.

• To assist investigations into alleged miscarriages of justice.

• Where a person (P) has died or is unable to identify themselves because of a physical or mental condition, so as to assist in identifying P or to obtain information about P’s next of kin or other persons connected with P or about the reasons for P’s death or condition.

DSOs may authorise the acquisition of communications data on a much narrower set of grounds:

• In the interests of national security.

• For the purpose of preventing or detecting serious crime, i.e., a criminal offence that involves conduct entailing the use of violence, results in substantial financial gain or is conduct by a large number of persons in pursuit of a common purpose.27

• In the interests of the economic well-being of the UK so far as those interests are also relevant to the interests of national security.

However, the grounds on which an authorisation may be granted by a DSO are wider where an application is made by a public authority in an urgent case:

• For the purpose of preventing or detecting serious crime (where the communications data is wholly or partly events data) or, in any other case, for the purpose of preventing or detecting crime or of preventing disorder.33 Serious crime is defined as a criminal offence that involves conduct entailing the use of violence, results in substantial financial gain or is conduct by a large number of persons in pursuit of a common purpose.28

• In the interests of public safety.

• For the purposes of preventing death or injury or any damage to a person’s physical or mental health, or of mitigating any injury or damage to a person’s physical or mental health.

• To assist investigations into alleged miscarriages of justice.

• Where a person (P) has died or is unable to identify themselves because of a physical or mental condition, so as to assist in identifying P or to obtain information about P’s next of kin or other persons connected with P or about the reasons for P’s death or condition.

The DSO may only grant an authorisation in urgent cases if it considers that it is necessary and proportionate and there is an urgent need to obtain the data.29 An example of an urgent case is where there is “an immediate threat of loss or serious harm to human life”.30 However, that “any part of an investigation or operation is undertaken urgently must not be taken to mean that all requirements to obtain communications data in connection with that investigation of operation can be undertaken using the urgent process”.31 Therefore, the application must make clear why it is not possible to use the standard process in the particular circumstances of the case.32

What conduct can be permitted by a data acquisition authorisation?

Under an acquisition authorisation, a public authority may engage in any conduct which is for the purpose of obtaining communications data from any person relating to a telecommunication system.33 In particular, that authorised conduct may include any of the following:34

• The authorised officer obtains the communications data themselves.

• The authorised officer asks any person that the officer believes is, or may be, in possession of communications data or capable of obtaining it to obtain that data and disclose it to the public authority.

• The authorised officer serves an acquisition notice on a telecommunications operator that the officer believes is, or may be, in possession of the communications data and is capable of obtaining that data and disclosing it to the public authority.

In addition, an authorisation may:35

• Relate to data that may not exist at the time of the authorisation.

• Authorise a person other than the authorised officer to obtain and disclose communications data or carry out any other conduct that enables or facilitates the obtaining of communications data.

• Require a telecommunications operator to obtain or disclose communications data from a telecommunications service provided by another operator.

Who can be served with data acquisition notices?

As stated beforehand, an authorisation for the acquisition of communications data can authorise a public authority to obtain the data from a telecommunications operator. If so, the authorisation imposing such requirements on an operator must specify the operator concerned and the nature of the requirements to be imposed.36

An acquisition notice must then be provided to the telecommunications operator. That notice, of which must be given in writing or in a manner that produces a record of its having been given, must specify:37

• The office, rank or position held by the person within the public authority giving the notice

• The requirements being imposed

• The operator to whom the requirements are being imposed

Any notice given “should contain enough information to allow the telecommunications operator to comply with the requirements of the notice”.38 This includes a description of “the communications data to be obtained or disclosed under the notice specifying, where relevant, any historic or future date(s) and, where appropriate, time period(s)”.39 The notice should also “specify the manner in which the data should be disclosed and specify or describe the person(s) to whom the data is to be, or may be, disclosed or how to identify such person(s)”.40 Although, an operator will usually only ever be required to disclose data to the public authority, typically the SPoC.41 An authorisation notice is cancelled when the corresponding authorisation is cancelled.42

It is the duty of a telecommunications operator subject to an acquisition notice to comply with the requirements in the notice.43 In doing so, the operator must only obtain or disclose the amount of data needed in order to comply with the notice.44 Such duties are enforceable by the Secretary of State by civil proceedings.45 However, an operator is not required to take steps to comply with an acquisition notice that are not reasonably practicable to take.46

It is a criminal offence for telecommunications operator or its employees to disclose, without a reasonable excuse, the existence of an acquisition notice or its contents.47 The IPA 2016 does not specify what might constitute a “reasonable excuse” except for when the disclosure is made with the permission of the relevant public authority, of which can be contained in the notice itself.48

The Secretary of State must ensure that arrangements are in place for telecommunications operators to receive an appropriate contribution in respect of the cost of complying with an acquisition notice.49

What are bulk data acquisition warrants?

Scope of bulk acquisition warrants

A bulk acquisition warrant authorises a person to secure by any conduct one or more of a series of specified activities that relate to the acquisition of communications data.50 Those specified activities include:51

• Requiring a telecommunications operator to obtain and disclose communications data to a public authority, including data which may not be in the possession of the operator if the operator is capable of obtaining such data. A bulk acquisition warrant may relate to data whether or not in existence at the time of the issuing of the warrant.52

• The selection for examination of communications data obtained under the warrant.

• The disclosure of communications data to the person to whom the warrant is addressed or to any person acting on the person’s behalf.

Furthermore, a bulk acquisition warrant can authorise any conduct that is necessary to undertake in order to do what is expressly required by the warrant. This includes conduct by a person in pursuance of a requirement under the warrant in order to provide assistance to the person to whom the warrant is addressed.53 However, the communications data that can be obtained under a bulk acquisition warrant is data relating to the acts and intentions of persons outside of the British Islands.54

Restrictions on bulk acquisition warrants

Only the head of an SIA can apply for a bulk acquisition warrant. That application must be made to the Secretary of State, and from there the application is subject to the double lock mechanism involving Judicial Commissioners.55

In addition to this, bulk acquisition warrants must also satisfy three other conditions:

• The examination of the communications data sought must be necessary for specified operational purposes.56 Those operational purposes must be sourced from a list of operational purposes maintained by the SIAs57 that is approved by the Secretary of State.58 The Prime Minister is also responsible for reviewing that list at least once a year.59

• The examination of the communications data for each operational purpose must be necessary on the relevant statutory grounds.60

• There must be satisfactory arrangements in place consisting of safeguards relating to the retention and disclosure of data.61

The relevant statutory grounds include:62

• In the interests of national security63

• For the purpose of preventing or detecting serious crime, i.e., a criminal offence that involves conduct entailing the use of violence, results in substantial financial gain or is conduct by a large number of persons in pursuit of a common purpose64

• In the interests of the economic well-being of the UK so far as those interests are also relevant to the interests of national security

The safeguards that must be in place for a bulk acquisition warrant relate to the copying, storage, dissemination and destruction of communications data in that such processing must be kept to the minimum necessary for the authorised purposes.65 Those “authorised purposes” include the grounds on which a bulk acquisition warrant is issued,66 but also include, for example, where such processing is necessary for facilitating the carrying out of any functions of the Judicial Commissioners or the Investigatory Powers Tribunal.67 Public authorities must ensure that “all copies, extracts and summaries of communications data obtained under a bulk acquisition warrant [are] handled and stored securely, so as to minimise loss or theft”.68 Only those with the appropriate security clearance should be able to access the data.69

Serving bulk acquisition warrants

Bulk acquisition warrants may also be served on telecommunications operators. Public authorities may act through, or together with, other persons so that such persons can provide assistance in giving effect to the warrant.70 This can be done by serving a copy of the warrant on the assisting person,71 of whom can be outside of the UK.72 It must be served in a way that the contents of the warrant are brought to the attention of the assisting person.73 In particular, the warrant “must specify the communications data to be obtained” and should also detail the steps “required to take to give effect to the warrant”.74 The specification of “any other details regarding the means of acquisition of the data and delivery” should also be included.75

An assisting person can be a telecommunications operator. That operator must take all the necessary steps to give effect to the warrant as instructed by the public authority.76 Such a duty may be enforced by the Secretary of State by civil proceedings,77 however the operator is not required to take any steps which it is not reasonably practicable for the operator to take.78

The Secretary of State must ensure that arrangements are in place for telecommunications operators to receive an appropriate contribution in respect of the cost of complying with a bulk acquisition warrant.79

A telecommunications operator served with a warrant must keep it confidential80 unless there is a reasonable excuse for disclosure, such as the permission of the Secretary of State.81 Non-compliance with this duty of confidentiality is a criminal offence.82

Operational case for the acquisition of communications data

Public authorities use communications data “to develop intelligence leads, to help them focus on individuals who may be a threat to national security, or to discount individuals seen in contact with those under investigation”.83 For example, in 2015, MI5 was able to use bulk communications data to identify a foreign national associated with ISIL who had visited the UK for a period of time.84 Through the analysis of that data, MI5 “identified a previously unknown telephone used by the individual and this enabled MI5 to understand the purpose of his travel and whether he had been involved in attack planning”.85

In addition, it can be used to “illuminate networks and associations between groups and plots”.86 In 2015, “intelligence indicated that a number of individuals had travelled to Europe in order to conduct attacks in European capital cities”.87 While the names of these individuals were unknown, “MI5 was able to use bulk acquisition data to identify one individual who had travelled to the UK and then on to another European country”.88

Overall, communications data can “help decide quickly, with minimal intrusion and cost, whether contacts of ‘subjects of interest’ are innocent and of no further interest, or are potential co-conspirators”.89 For GCHQ, bulk communications data is the primary way it discovers threats in the UK “together with communications data obtained through bulk interception”.90

This newsletter is about the retention notices that can be served on telecommunications operators by the UK government under the Investigatory Powers Act 2016. It looks at what these notices are, when they can be served, what data can be retained under these notices and other relevant requirements around this power.

Here are the key takeaways:

• Under …

Read more

Apple has commenced legal proceedings against the Home Office concerning its TCN. It brought its claim before the Investigatory Powers Tribunal (IPT), and the below post gives on overview of this court and its role in regulating UK state surveillance:

In this post, I cover the IPT's first decision on the Apple TCN case. In short, the IPT held that the proceedings against the Home Office regarding Apple's TCN should not be completely held in secret.

What was this latest IPT decision about?

This latest decision by the IPT is not about the legalities of the TCN itself. It is more to do with the management of the case.

In particular, it is about "the bare details of the case". This means "the fact or details of the claim, or the identities of the parties to the claim."1

The Home Office tried to argue that the publication of any of this information would "be damaging to national security."2 Therefore, not even the bare details of the case should be published.

Accordingly, on 28 February, the Home Office "sought an order that the bare details of the case should be private, including by them not appearing on the Tribunal's website, until further order of the Tribunal."3 The Tribunal listed a hearing for this order to take place on 14 March 2025, with the only information being publicised being the case number and the name of the judges.

But the Home Office wanted this hearing to also be entirely in secret, and therefore to not list it publicly. It argued that this "was necessary to prevent damage to national security."4

But the Tribunal disagreed with the Home Office. It stated that not publishing any details about the hearing regarding whether the main case should be held in secret would have been "a truly extraordinary step" requiring "a correspondingly compelling justification."5 It further stated that whilst it was not impossible for there to be circumstances in which not publishing any details about a case may be justified on national security grounds, this case was not one of them:

It was not shown that publicly listing a hearing, without publishing the names of the parties or the nature of the case, would create any real risk of damage to the public interest or prejudice to the interests of national security.6

Accordingly, on 10 March, the IPT's website published the hearing to take place on 14 March, "giving the case number and the names of the judges, but not giving the names of the parties."7

For this hearing on the 14 March, which is what the IPT's latest decision is about, the UK government relied on a witness statement from the Head of Investigatory Powers Unit, part of the Homeland Security Group within the Home Office. In that statement, it was explained that national security would be damaged if "the fact, substance or parties to [the] proceedings be made public."8

What are the relevant rules for this?

In my post providing an overview of the IPT, I covered the rules that enable it to hold different kinds of hearings. This includes the ability to carry out hearings wholly or partly in private.

This ability hinges on the duty imposed on the IPT under Rule 7(1) of the Investigatory Powers Tribunal Rules 2018, which reads:

The Tribunal must carry out their functions in such a way as to secure that information is not disclosed to an extent, or in a manner, that is contrary to the public interest or prejudicial to national security...

But in fulfilling this duty, the Tribunal has to balance national security with the principle of open justice. This "fundamental common law constitutional principle...applies to all courts and tribunals exercising the state's judicial power", including the IPT.9

Such a principle normally requires the names of parties to a case to be made public. And this principle can only be departed from (e.g., anonymising the names of the parties) "when, and to the extent that, it is established on clear and cogent evidence that it is strictly necessary" to do so.10

An example of this could be cases concerning national security matters:

The executive is entitled to take precautionary approach when assessing risks to national security. Courts and tribunals must accord particular weight to such assessments made by the executive. Those assessments should usually be accepted, unless they are shown to be irrational or otherwise vitiated by a public law error.11

The IPT's verdict

The central question for the IPT in this case was "whether publication of the bare details of the case would be prejudicial to national security."12 On this, the Tribunal found that this would not be the case.

While the IPT is not permitted to substitute its view of what is or is not damaging to national security with that of the government's, courts a still "entitled to intervene on rationality grounds if a decision involves a serious logical or methodological error."13

Accordingly, the IPT did not believe that "the revelation of the bare details of the case would be damaging to the public interest or prejudicial to national security."14 The reasoning for this is set out in its private judgment, which of course is not public.15 The Home Office's attempt to keep proceedings on Apple's TCN secret were therefore rejected.16

Pulling back the veil of national security

This decision by the IPT is an example of UK court's pulling back what I call the veil of national security:

There are two key elements to the veil of national security:

1. Secrecy

2. Exclusivity

The first key element is about national security matters being protected from public eyes and therefore barred from public discussion. Such secrecy applies to information about national security threats, the methods used to combat them, and anything else that is relevant to these operations.

Secrecy is maintained by the 'neither confirm nor deny' (NCND) policy. This is a principle that the government will not confirm nor deny the accuracy of information related to national security matters if doing so would damage national security.

When invoked, the government will not respond to questions, claims or allegations about its national security work. This policy has been used in Parliamentary debate and in court proceedings.

The second key element is about matters of national security being solely reserved for the government and its agencies. This means that it is not for the courts or the legislature to decide which threats to prioritise and how they should be addressed.

Exclusivity is maintained by the separation of powers. This is a long-standing public law principle that the institutions of the state (the executive, the legislature and the judiciary) should be functionally independent.

This means that none of these institutions should be able to exercise the powers of the other. Only the executive can execute national security policy, only the legislature can pass national security laws, and only the judiciary can provide legal judgments on national security law and policy.

The rationale for secrecy and exclusivity is the operational efficacy of national security. Both elements contribute to this efficacy in different ways.

Secrecy prevents adversaries from learning about the measures used against them by the state and adapting their behaviour accordingly. Exclusivity ensures that national security decisions are made by agencies with the relevant information, resources and expertise.

These ideas were explored in the Zamora Case in 1916. This case concerned whether an order could be made by the government to requisition a neutral ship carrying contraband (copper) during wartime.

It was determined that such an order was illegal. But even in making this judgement, the House of Lords made reference the veil of national security.

On secrecy, it was asserted that matters of national security should not be “made the subject of evidence in a Court of law or otherwise discussed in public.” On exclusivity, it was asserted that “those responsible for the national security must be the sole judges of what the national security requires.”

Justifications have therefore been made for the veil of national security. It ultimately provides agencies like GCHQ and MI5 the opportunity to do their job effectively.

But another consequence of the veil is that it makes it more difficult to determine what national security actually is. It can distort what constitutes a national security threat and how they should be addressed.

This in turn complicates the scrutiny and accountability of government agencies responsible for executing national security operations. It is hard to critique the work of these agencies when their internal workings are largely inaccessible.

This is clearly demonstrated in the GCHQ Case in 1985. This case looked at the decision by the government, made without consultation, prohibiting GCHQ employees from being members of trade unions.

While motivated by the disruptive industrial action that had already taken place at the agency, the House of Lords found the government’s decision would normally be illegal. However, it was ultimately concluded that the decision should be permitted.

The reason for this had to do with national security. Not only was it for the government to balance national security with fairness, but that sometimes government power “must take precedence over those of the individual.”

The government was given the benefit of the doubt that it was in a better position to determine whether trade union membership was a genuine threat to national security. Therefore, if the government says it is such a threat, then it is not for a court to conclude otherwise.

Such a situation can put human rights in jeopardy. How can we know if the infringement of our rights is necessary and proportionate if we lack the opportunity to assess the potentially infringing decision by the state?

Such a position is clearly not tenable. This is therefore why, over time, the veil has had to be pulled back gradually.

In this IPT decision, the IPT appeared willing to question the logic of the government's assertion that national security would be damaged by publishing details about the case. The exclusivity and secrecy of the national security veil did not protect the government on this occasion. But we await to see what role the veil might play when the IPT considers Apple's TCN itself.

This post provides an overview of the IPT, including its jurisdiction, its procedures and its powers.

What is the Investigatory Powers Tribunal?

Under the Human Rights Act 1998 (HRA 1998), a person who claims that a public authority has infringed their rights may bring proceedings against that authority in the appropriate court or tribunal.1

To this effect, the IPT has jurisdiction to hear cases against the security and intelligence agencies (SIAs), and certain other public authorities, to determine whether such authorities have acted lawfully using their surveillance powers.2

What is the jurisdiction of the IPT?

There are two ways in which UK state surveillance can be challenged before the IPT:

1. Challenging surveillance legislation itself

2. The actual conduct of the SIAs under that legislation

The latter type of challenge is one that is exclusively reserved for the Tribunal to decide on as it has the appropriate jurisdiction and powers to investigate such claims. With this special status, the Tribunal van validate the claims brought to it in terms of the validity of the specific use of surveillance powers by UK public authorities.

The European Court of Human Rights (ECtHR) has commended the Tribunal for the "elucidatory role" that it plays in litigation against the SIAs. It acts as a fact-finder and information filter to formulate an accurate starting point for the ECtHR to base its decisions.3 This prevents the Court from having to assess the legalities of surveillance powers in a "factual vacuum" when cases eventually come it.4 The IPT can confirm the activities and operations of the SIAs with the ECtHR then deciding definitively on whether those activities or operations comply with the requirements of the European Convention on Human Rights.

Certain decisions of the IPT are capable of being reviewed by the UK senior courts. In R (Privacy International) v IPT & Others, the Supreme Court held that the High Court has jurisdiction to hear appeals against the rulings of the IPT where the appeal is based on an error of law made by the Tribunal in its decision.5

Who can lodge complaints with the IPT and how?

Human rights complaints can be submitted directly to the IPT by completing the requisite form,6 of which is available on its website. In that form, the complainant must state, among other things, the SIAs that the complaint relates to and a description of the nature of the claim, including the details of the right that is alleged to have been infringed, and the complainant's interest.7 Other complaints can be lodged with the Tribunal too,8 including, among other things, the conduct required under a national security or technical capability notice.9

While the nature of surveillance powers are covert, and therefore it may not always be possible for a complainant to know when they have been subject to such powers, this will not necessarily frustrate the complainant's ability to lodge their claim. As held by the ECtHR, "an individual might, under certain conditions, claim to be the victim of a violation occasioned by the mere existence of secret measures or of legislation permitting secret measures, without having to allege that such measures had been in fact applied to him."10

Accordingly, the IPT has held that an individual "may claim to be a victim of a violation occassione by the mere existence of secret measures or of legislation permitting secret measures only if he is able to show that, due to this personal situation, he is potentially at risk of being subjected to such measures."11 This may be the case even if the basis of a claim is hypothetical (see further below for more on this).

What are the information powers of the IPT?

The IPT is subject to a duty to investigate claims that are submitted to it,12 though it is required to dismiss claims that it considers frivolous or vexatious.13

Such investigations can be made with the assistance of a Judicial Commissioner or the Investigatory Powers Commissioner and require public authorities to disclose all such documents and information as may be required to vet a claim lodged with the IPT.14

Additionally, there is a duty on public authorities and all government personnel to disclose or provide to the IPT all documents and information that the Tribunal may require to exercise its jurisdiction.15 This means that no information can be withheld from the IPT on national security grounds or for other public interest reasons.16 However, this must be balanced with the Tribunal's duty to secure that information is not disclosed in a way that is contrary to the public interest or prejudicial to national security.17

How are hearings held by the IPT?

The IPT is equipped with special powers that allow it to conduct in-depth examinations of the work of the SIAs. With these powers, the IPT has developed two practices regarding how it hears cases brought to it:

• Holding hearings on the basis of assumed or hypothetical facts

• Holding hearings wholly or partly in private

Hearings on the basis of assumed or hypothetical facts

The IPT is permitted to presume that a set of facts presented by a claimant are true to decide whether those facts constitute lawful conduct. An example of this took place in Privacy International v Secretary of State for Foreign and Commonwealth Affairs & Others (2016). This case concerned the lawfulness of GCHQ's use of computer network exploitation (essentially computer hacking) as a means to obtain intelligence. You can read my previous commentary of such surveillance operations by GCHQ here

But regarding the procedural aspects of the case, given that GCHQ did not admit to the use of computer hacking, the IPT proceeded on the presumption that GCHQ did carry out such activity. In doing so, the Tribunal was able to reach conclusions on the basis that computer hacking did take place against the claimants and determine whether such conduct was lawful.18

This practice allows the IPT to balance national security with the rights of the claimants and principles of open justice. This is particularly the case where SIAs invoke the 'Neither Confirm Nor Deny' (NCND) policy whereby the SIAs provide no comment on their surveillance capabilities or operations. In Liberty v GCHQ, the UK SIAs, while admitting to their involvement in the PRISM surveillance programme revealed by Edward Snowden in 2013, relied on NCND in relation to the other information on the surveillance activities of the UK and US that formed part of the Snowden documents.19 Nevertheless, the IPT took the approach of presuming the activities alleged by the claimants in that case to be true and provided their conclusions on that basis.20

Hearings wholly or partly in private

The IPT is under not duty to hold an oral hearing.21 But its powers do enable it to hold 'closed' hearings.

It is through these closed hearings that the SIAs can submit evidence regarding their operations that would be too sensitive or confidential to discuss in open court.22 Whilst this departs from the principle of open justice,23 such arrangements form part of the Tribunal's duty to secure that information is not disclosed in a way that is contrary to the public interest or prejudicial to national security, the prevention or detection of serious crime, the economic well-being of the UK or the continued discharge of the functions of the SIAs.24

The IPT also has the ability to hold hearings where the complainant is absent.25 However, the SIAs can be requested to give reasons for the withholding of any information from the complainant.26 After considering such representations, the IPT can direct the SIAs to disclose documents or information to the complainant or provide a gist or summary of the documents or information.27

What are the remedial powers of the IPT?

The IPT is empowered to make orders quashing or cancelling a warrant or authorisation if it finds against public authorities.28 Before making any such orders, the Tribunal must allow the parties to the case to make representations.29

The IPT has emphasised how its remedial powers are discretionary, just as relief in public law is discretionary. Accordingly, the IPT will not grant a quashing order if it deems it not necessary in the circumstances and other effective remedies will suffice.30

This discretion is also used when determining the specifics of any orders granted. In Liberty v GCHQ, the IPT found that Amnesty International's emails had been retained for longer than was permitted under GCHQ's internal policies. The agency was therefore ordered to to destroy these communications but also deliver a copy to the then Interception of Communications Commissioner31 to be retained for five years in case it was needed for any legal proceedings or inquiry.32

In early February, the Washington Post reported that the UK security officials have "demanded that Apple create a back door allowing them to retrieve all the content any Apple user worldwide has uploaded to the cloud."

Issued in January, the order from the UK government requires the tech company to provide full access to encrypted material rather than access to a specific account. The Washington Post described this demand as unprecedented in major democracies.

The order is aimed at the ability for Apple users to encrypt backups uploaded to iCloud. These backups contain a copy of various data held on a users' device, including copies of messaging data from iMessage.

According to the Washington Post report, Apple is likely to stop offering this service to UK users instead of breaking its security promise to users. However, such a concession "would not fulfill the U.K. demand for backdoor access to the service in other countries, including the United States," according to the Washington Post.

This post provides a breakdown of the legalities of this request.

How is the UK able to order Apple to do this?

The Investigatory Powers Act 2016

The relevant law here is the Investigatory Powers Act 2016 (IPA 2016). This is the principal piece of legislation regulating state surveillance in the UK.

It stipulates rules for the use of various surveillance powers by government agencies like MI5, MI6 and GCHQ. It makes provision for seven different types of powers:

• Interception of communications

• Retention of communications data

• Acquisition of communications data

• Equipment interference

• Bulk personal datasets

• Technical capability notices

• National security notices

The IPA 2016 specifies the nature, scope and limits of these powers. Supplementing the Act are codes of practice that provide more detail on the practical application of the powers.

One important feature of the IPA 2016 is what is known as the 'double lock' mechanism. This is a system of review for the approval of warrants, notices and authorisations permitting the use of surveillance powers by government agencies.

Judicial commissioners (JCs), persons who have held high judicial office in the UK, are tasked with carrying out this review process.1 For each warrant, notice or authorisation, they must look at the conduct being permitted and determine whether it is both necessary for and proportionate to the objective being pursued.

Before these warrants, notices or authorisations are reviewed by the JCs, the government agency applying for them must also consider the conduct to be necessary and proportionate. These considerations by the JCs and government agencies make up the double lock mechanism.

Accordingly, the double lock mechanism ensures that the use of surveillance powers by government agencies is compliant with human rights law. This is an important aspect of the IPA 2016 that was missing from previous versions of UK state surveillance law.

Technical capability notices

Under the IPA 2016, a technical capability notice (TCN) is an instruction given by the government to a telecommunications operator to assist with the execution of surveillance powers.

These notices are used to facilitate the surveillance operations of government agencies when using their powers under the IPA 2016.2 This could be in relation to interception warrants, data acquisition authorisations, bulk acquisition warrants or equipment interference warrants.

TCNs can therefore contain a range of obligations that a telecommunications operator must fulfil. These include:3

• Providing facilities or services of a specified description

• Obligations relating to apparatus owned or operated by an operator

• The removal by an operator of electronic protection applied by or on behalf of that operator to any communications or data

• Obligations relating to the security of any telecommunications service provided by an operator

• Obligations relating to the handling or disclosure of information

The IPA 2016 has a very wide definition of 'telecommunications operators'. It effectively covers a wide range of entities providing communications services, including public networks, online storage providers and messaging applications.4

There are four key rules that government agencies must follow when issuing TCNs:

1. The obligations contained in a TCN must be necessary for and proportionate to the objective pursued, which is ensuring that the telecommunications operator can provide assistance to the government agency executing its surveillance powers.5

2. TCNs must be reviewed by a JC for their necessity and proportionality under the double lock mechanism.

3. TCNs relating to interception and equipment interference warrants cannot be imposed on telecommunications operators that do not provide a service to more than 10,000 users.6

4. TCNs cannot be issued to telecommunications operators solely providing banking, insurance, investment or other financial services.7

Additionally, the government must also consult the telecommunications operator before serving them with a TCN. In doing so, the following factors must be taken into account:8

• The likely benefits of the TCN

• The likely number of users (if known) of the service provided by the operator

• The technical feasibility of complying the TCN

• The likely cost of complying with the TCN

• Any other effect of the TCN

Finally, operators served with a TCN must keep it secret from the public.9 Permission is needed from the government before revealing anything about its existence or contents.

What Apple data does the order target?

Given that TCNs are secret, the UK has not published the one it has issued to Apple. Also, the Home Office has neither confirmed or denied the existence of the TCN.

But according to the Washington Post, the TCN requires "blanket capability to view fully encrypted material, not merely assistance in cracking a specific account." In particular, the TCN is focused on Apple's Advanced Data Protection (ADP) system for iCloud.

ADP is an optional setting that allows users to encrypt their iCloud data, including backups, photos, notes and other information. Apple states that ADP uses 'end-to-end encryption', meaning that Apple itself does not possess a copy of the cryptographic keys to decrypt the data uploaded its servers.

However, if users do not turn ADP on, then any data stored in iCloud is subject to Apple's standard security measures. This means that although the data are still protected by encryption, it is not protected by E2EE and Apple will hold a copy of the cryptographic keys that it can use to decrypt the data.

Apple states that by holding a copy of the keys, it can assist users with data recovery. This could be helpful if a user forgets their password or loses their phone and is trying to access the data stored in their iCloud account.

However, as cryptographer Matthew Green points out in his blog post, the downside of this is that Apple holding a copy of the keys does introduce more vulnerabilities relative to E2EE:

Two different types of “bad guys” can walk through the hole created by this vulnerability: one type includes hackers and criminals, including sophisticated state-sponsored cyber-intrusion groups. The other is national governments: typically, law enforcement and national intelligence agencies.

Since Apple’s servers hold the decryption key, the company can be asked (or their servers can be hacked) to provide a complete backup copy of your phone at any moment. Notably, since this all happens on the server side, you’ll never even know it happened. Every night your phone sends up a copy of its contents, and then you just have to hope that nobody else obtains them.

What about data protection law?

Ordinarily, the automated or structured processing of personal data is subject to the UK GDPR.10 However, many of the data protection obligations imposed by this regulation do not apply to processing carried out in the context of national security.

Such an exemption can be found in the Data Protection Act 2018 (DPA 2018). Section 26(1)(a) of the DPA 2018 states that certain provisions of the UK GDPR do not apply if the exemption from such provisions is necessary for the purpose of safeguarding national security.

The exempted provisions in this case include, among others:

• The data protection principles (except for lawfulness and therefore also Article 6 on the lawfulness of processing and Article 9 on special categories data)

• Data subject rights

• Notification of data breaches to the Information Commissioner and data subjects

• International data transfers

This exemption could apply to any data controller, even if they are not a government department or other public body. The national security exemption could therefore even apply to a private company like Apple.11

A Minister of the Crown can certify that a national security exemption from certain data protection law provisions is required in relation to certain personal data or processing where such are necessary for safeguarding national security.12 Under the DPA 2018, a 'Minister of the Crown' means a member of the Cabinet or the Attorney General or the Advocate General for Scotland.13

So in Apple's case, if a national security certificate was issued along with the TCN, it would exempt the company from certain data protection obligations with respect to the iCloud data sought by the UK government.

What about human rights law?

Last year I wrote a post about an important decision from the European Court of Human Rights (ECtHR) which held that data acquisition orders requiring the decryption of communications protected by E2EE are unlawful.14 This was on three main grounds:

1. Weakening E2EE would make all users of the service implementing E2EE more vulnerable, therefore impacting those who pose no threat or are otherwise of no interest to government agencies.

2. Creating backdoors opens the possibility for indiscriminate surveillance of personal electronic communications.

3. Such backdoors could also be exploited by criminal networks for nefarious purposes.

Since the TCN has not been publicly disclosed, and since Apple cannot reveal its existence or contents, we do not know if the data acquisition is in relation to iCloud data protected by E2EE or protected by Apple's standard encryption measures with which the company could decrypt the data. If the latter, then it would not require the weakening of E2EE and (potentially) escape the criticisms highlighted by the ECtHR.

However, if the order relates to data protected by E2EE, then this would appear to fall foul of the Court's stipulations: orders for the weakening or removal of E2EE constitute an unlawful interference with the right to privacy under Article 8 of the European Convention on Human Rights.

So what can Apple do next?

Apple could fight back.

The IPA 2016 does include a procedure for challenging TCNs. Under this procedure, Apple could challenge the TCN if its obligations are unreasonable.15 It can refer it back to the government for review, requiring JCs and technical experts to consider the pros and cons of the TCN, resulting in either its variation, revocation or replacement.

Failing this, Apple could commence judicial review proceedings contending that the TCN contains obligations that are incompatible with the Human Rights Act 1998.16 Under s.7(1)(a) of the Human Rights Act 1998, a person who claims that a public authority has infringed their rights may bring proceedings against that authority in the appropriate court of tribunal. To this effect, the Investigatory Powers Tribunal has jurisdiction to hear cases against the security and intelligence agencies, and certain other public authorities, to determine whether such authorities have complied with the 1998 Act when using their surveillance powers.17

This newsletter is the first in a series covering the history of British signals intelligence (SIGINT). It looks at how SIGINT emerged, its initial development during the Second Boer War and the success it had during WWI.

Here are the key takeaways:

• SIGINT may have significantly matured during WWI, but it did not begin at that point. SIGINT was a practice starting to develop during the 1850s, and was first put to the test during the Second Boer War between 1899 and 1902.

• SIGINT operations during the Boer War were not that advanced. However, it provided a glimpse into the value of such intelligence, and this combined with the growth of radio encouraged Britain to grow its SIGINT capabilities.

• By the time WWI came around in 1914, Britain was well-positioned to deploy its SIGINT operations. The advantages it gave the British during the conflict was fairly consistent, and saw its intelligence community grow very quickly.

• The most important contribution British SIGINT made to WWI was the interception and decoding of the infamous Zimmermann telegram. This act, which revealed German plans to engage in submarine warfare in the North Atlantic and its proposal to Mexico for a military alliance, would bring the US into the war and help secure an Allied victory.

• WWI proved crucial for the development of British SIGINT in numerous ways. This includes the utilisation of cable networks and the private sector, the establishment of MI5 and MI6, the advancements in both interception and codebreaking, and the importance of capturing codebooks to enable the deciphering of encrypted messages.

What is SIGINT?

Simply put, signals intelligence (SIGINT) is the practice of extracting information from intercepted communications.

A more sophisticated definition is provided in s.3(1)(a) of the Intelligence Services Act 1994, which spells out the function of the Government Communications Headquarters (GCHQ) as the agency responsible for British SIGINT. That provision states that the function of GCHQ is to:

...to monitor, make use of or interfere with electromagnetic, acoustic and other emissions and any equipment producing such emissions and to obtain and provide information derived from or related to such emissions or equipment and from encrypted material...

Today, much of SIGINT is obtained via cyberspace. Because of this, almost everyone with access to the internet could be subject to SIGINT operations by GCHQ and other intelligence agencies around the world. The proliferation of the internet and the communications it conveys has led to a perception of mass surveillance, whereby the state is able to tap into and collect any communications or information that it wants, whenever it wants, however it wants and from whoever and wherever without limitations or constraints. The prospect of such mass surveillance received particularly widespread attention in 2013 after the Snowden revelations.

Why write about the history of SIGINT?

The Snowden revelations are what got me interested in the data rights space. It highlighted the importance of the happenings in the intersection between technology, the law and society. In other words, it highlighted to me how technological development has a significant impact on our wider society, and it is important to understand the risks that arise from this and how we deal with those risks to ensure a healthy and well-functioning society.

However, I felt that the Snowden revelations put a lot of focus on the regulation of SIGINT and how our security and intelligence agencies (SIAs) carry this out. And rightfully so of course - the revelations exposed the unlawful intelligence operations of the US and UK SIAs, in particular the NSA and GCHQ respectively, which eventually led to an improved legal framework (though it is far from perfect).

But an aspect of the debate that I think was missing was the importance of SIGINT and why it even exists in the first place. This does make sense in way, since the SIAs enjoy a great deal of secrecy and exclusivity regarding their work. Cf. from What even is national security?:

There are two key elements to the veil of national security:

1. Secrecy

2. Exclusivity

The first key element is about national security matters being protected from public eyes and therefore barred from public discussion. Such secrecy applies to information about national security threats, the methods used to combat them, and anything else that is relevant to these operations.

Secrecy is maintained by the 'neither confirm nor deny' (NCND) policy. This is a principle that the government will not confirm nor deny the accuracy of information related to national security matters if doing so would damage national security.

When invoked, the government will not respond to questions, claims or allegations about its national security work. This policy has been used in Parliamentary debate and in court proceedings.

The second key element is about matters of national security being solely reserved for the government and its agencies. This means that it is not for the courts or the legislature to decide which threats to prioritise and how they should be addressed.

Exclusivity is maintained by the separation of powers. This is a long-standing public law principle that the institutions of the state (the executive, the legislature and the judiciary) should be functionally independent.

This means that none of these institutions should be able to exercise the powers of the other. Only the executive can execute national security policy, only the legislature can pass national security laws, and only the judiciary can provide legal judgments on national security law and policy.

The rationale for secrecy and exclusivity is the operational efficacy of national security. Both elements contribute to this efficacy in different ways.

Secrecy prevents adversaries from learning about the measures used against them by the state and adapting their behaviour accordingly. Exclusivity ensures that national security decisions are made by agencies with the relevant information, resources and expertise.

These ideas were explored in the Zamora Case in 1916. This case concerned whether an order could be made by the government to requisition a neutral ship carrying contraband (copper) during wartime.

It was determined that such an order was illegal. But even in making this judgement, the House of Lords made reference the veil of national security.

On secrecy, it was asserted that matters of national security should not be “made the subject of evidence in a Court of law or otherwise discussed in public.” On exclusivity, it was asserted that “those responsible for the national security must be the sole judges of what the national security requires.”

Justifications have therefore been made for the veil of national security. It ultimately provides agencies like GCHQ and MI5 the opportunity to do their job effectively.

But another consequence of the veil is that it makes it more difficult to determine what national security actually is. It can distort what constitutes a national security threat and how they should be addressed.

This in turn complicates the scrutiny and accountability of government agencies responsible for executing national security operations. It is hard to critique the work of these agencies when their internal workings are largely inaccessible.

This has driven me to better understand the work of the SIAs, and in particular the work of GCHQ as the agency responsible for British SIGINT. I have always thought that a better understanding of this would provide a sound foundation to develop appropriate legislation covering such activity. By looking at the historical evolution of British SIGINT in particular, we can see how the capabilities of SIGINT have changed over time and the associated policy implications this has had.

Accordingly, this series aims to explore that historical evolution, starting with this post which covers the beginnings of British SIGINT in the 1850s and its eventual maturation during WWI. I will do so with the help of several books on the subject, including but not limited to:

• Richard J. Aldrich and Rory Cormac, The Black Door: Spies, Secret Intelligence and British Ministers (William Collins 2016)

• Paul F Scott, The National Security Constitution (Hart Publishing 2018)

• John Ferris, Behind the Enigma: The Authorised History of GCHQ, Britain’s Secret Cyber-Intelligence Agency (Bloomsbury 2020)

• David Khan, Seizing the Enigma: The Race to Break the German U-Boat Codes, 1939-1943 (Frontline Books 2023)

Read more

This newsletter is about the rules that apply to intelligence sharing arrangements between UK public authorities and foreign authorities under the Investigatory Powers Act 2016. It looks at how the Act regulates intelligence requests made to and by foreign authorities, as well as requests made directly to UK telecommunications operators by foreign …

Read more

In his book The Coming Wave: AI, Power and the 21st Century, Suleyman identifies several factors that drive this trend. These include:1

• Competition. Technological innovation is required to gain an advantage over others, and this applies to c…

Read more

This newsletter is about the power of UK public authorities to intercept communications under the Investigatory Powers Act 2016. It looks the conduct that can be permitted under an interception warrant, the kind of data that can be obtained and the rules and restrictions that apply to such activity.

Here are the key takeaways:

• Interception warrants a…

Read more

TL;DR

This newsletter is about the the proposed amendments to the UK's Investigatory Powers Act 2016. It looks at the provisions concerning technical capability notices and the implications this may have for end-to-end encryption.

Here are the key takeaways:

• The Investigatory Powers Act 2016 is the principal piece of legislation regulati…

Read more

TL;DR

This newsletter is about national security in the context of UK state surveillance. It looks at its definition, its key constituent elements and the evolution of its legal treatment over time.

Here are the key takeaways:

• National security is essentially about the state protecting is people from threats. However, the term 'national …

Read more

Read more

On 8 January 2021, the High Court delivered its judgment on Privacy International v IPT & Others (2021), a case concerning computer hacking operations carried out by GCHQ. This ruling specifically focused on the scope of property interference warrants under section 5 of the Intelligence Services Act 1994 (ISA 1994). GCHQ applies for these warrants as pa…

Read more

On 14 August, President Trump issued an Executive Order (EO) giving ByteDance 90 days to divest the US operations of Tik Tok, its highly popular social media platform. The EO retrospectively invalidates the 2017 acquisition of Music.ly (the predecessor to Tik Tok), and requires ByteDance, along with its subsidiaries and Chinese investors, to cease owner…

Read more

Many years ago, the most precious property one could own was their private papers. At least this was the notion exhibited in one of the landmark cases in public law, that of Entick v Carrington.

In that 18th century case, the Earl of Halifax, a member of the King’s Privy Council, issued a warrant authorising the King’s messengers to enter the premises of…

Read more

Last month, the Investigatory Powers Act 2016, commonly known as the ‘Snoopers Charter’, passed some hurdles but stumbled at others after the High Court gave the first judgment on the statute since it came into force.¹ Thus, the UK’s surveillance laws remain, at least for now, somewhat incompatible with the requirements of EU law. Such a judgment will n…

Read more