Presentation to Human Rights Lawyers Association on Investigatory Powers Act implications of Big Brother Watch v UK, 25 October 2018.

1. BBW v UK
IP Act implications
Graham Smith
@cyberleagle
Human Rights Lawyers Association
25 October 2018

2. Strasbourg: three concrete issues with RIPA
● End to end selection safeguards
● Related Communications Data
● Journalistic privilege

3. 1. End to end selection safeguards

4. "In a bulk interception regime … the safeguards
applicable at the filtering and selecting for examination
stage must necessarily be more robust.
Therefore … the Court is not persuaded that the
safeguards governing the selection of bearers for
interception and the selection of intercepted material for
examination are sufficiently robust to provide adequate
guarantees against abuse. Of greatest concern, however,
is the absence of robust independent oversight of the
selectors and search criteria used to filter intercepted
communications.

5. Selection for examination
Page 5
© Bird & Bird LLP 2018
Bulk interception (Bulk Powers Review 2.13 – 2.18, Interception Code of Practice 6.6)
Interception/
Collection
• (1) Selection of
bearers
• (2) Extraction
Some filtering
• Negative
(exclusion)
• Positive
(inclusion)?
Selection for
examination (automated
(6.71)? manual?)
• Simple queries (e.g.
strong selectors)
• Complex queries (e.g.
combined weaker
selectors)
Examination
• Read, look, listen
to by a person
Buffer
Strong
selectors
Near
real-time
e.g. e-mail
addresses
Store Queries
The strong selector process
BPR 2.19(a), ISC March 2015 61-64
Pattern
analysis
Anomaly
detection
Seeded,
unseeded
analytics
Contact
chaining
Query
Focused
Datasets?

6. Selection for examination
IP Act changes
● Bulk warrant approval by Judicial Commissioner
● Does this mean N&P review of end to end conduct?
● If so, how closely reviewed?

7. 2. RIPA: Related Communications Data
IP Act: Secondary Data

8. ".. while the Court does not doubt that related communications data
is an essential tool for the intelligence services in the fight against
terrorism and serious crime, it does not consider that the authorities
have struck a fair balance between the competing public and private
interests by exempting it in its entirety from the safeguards
applicable to the searching and examining of content.
While the Court does not suggest that related communications data
should only be accessible for the purposes of determining whether
or not an individual is in the British Islands, … there should
nevertheless be sufficient safeguards in place to ensure that the
exemption of related communications data from the requirements
of section 16 of RIPA is limited to the extent necessary to determine
whether an individual is, for the time being, in the British Islands.”

9. RIPA: Related Communications Data
IP Act: Secondary Data
Page 9
© Bird & Bird LLP 2018
Intelligence and Security Committee Report, March 2015

10. RIPA: Related Communications Data
Page 10
© Bird & Bird LLP 2018

11. RIPA: Related Communications Data
Page 11
© Bird & Bird LLP 2018
Use of RCD
1. External
comms
purpose
drops away
2. British
Islands
selection
restriction
doesn't apply
to RCD
3. Statutory
purposes +
N&P

12. RIPA: Related Communications Data
Page 12
© Bird & Bird LLP 2018
Liberty, Privacy International et al v GCHQ et al
Investigatory Powers Tribunal, 5 Dec 2014

13. RIPA: Related Communications Data
Page 13
© Bird & Bird LLP 2018

14. ".. while the Court does not doubt that related communications data
is an essential tool for the intelligence services in the fight against
terrorism and serious crime, it does not consider that the authorities
have struck a fair balance between the competing public and private
interests by exempting it in its entirety from the safeguards
applicable to the searching and examining of content.
While the Court does not suggest that related communications data
should only be accessible for the purposes of determining whether
or not an individual is in the British Islands, … there should
nevertheless be sufficient safeguards in place to ensure that the
exemption of related communications data from the requirements
of section 16 of RIPA is limited to the extent necessary to determine
whether an individual is, for the time being, in the British Islands.”

15. IP Act: Secondary Data
Page 15
© Bird & Bird LLP 2018

16. IP Act: Secondary Data
Page 16
© Bird & Bird LLP 2018
Use of SD
1. Overseas-
related
purpose
drops away
2. British
Islands
targeted
examination
warrant
doesn't apply
to SD
3. Statutory
purposes +
operational
purposes +
N&P +
warrant
approval

17. IP Act: Extracting secondary data from content
● Systems data?
● Identifying data?
● Code of Practice example: “data associated with a photograph, such as the
date and location it was taken…”
● Explanatory Note example: “the location of a meeting in a calendar
appointment”
Page 17
© Bird & Bird LLP 2018

18. 3. Journalistic privilege

19. Bulk interception - RIPA
“In the Article 10 context, it is of particular concern that there are
no requirements … either
● Circumscribing the intelligence services’ power to search for
confidential journalistic or other material (for example, by using a
journalist’s email address as a selector), or
● requiring analysts, in selecting material for examination, to give any
particular consideration to whether such material is or may be
involved.
Consequently, it would appear that analysts could search and
examine without restriction both the content and the related
communications data of these intercepted communications.” [493]
Page 19
© Bird & Bird LLP 2018

20. Communications data acquisition - RIPA
Not in accordance with law for Article 10 purposes:
"[Code of Practice requirements to use PACE] only apply where the
purpose of the application is to determine a source; they do not,
therefore, apply in every case where there is a request for the
communications data of a journalist, or where such collateral
intrusion is likely."
Furthermore, no special provisions restricting access to a
journalist's communications data to the purpose of combating
serious crime. [499]
Page 20
© Bird & Bird LLP 2018

21. IP Act issues?
Bulk interception/equipment interference
● Purpose-related provisions for targeted examination
warrants
● Warrants don't apply to examination of secondary data
● Not related to search and selection
● Collateral interference?
Bulk communications data acquisition
● Code of Practice only
Ordinary communications data acquisition
● Purpose-related requirement to apply to Judicial
Commissioner
● Collateral interference?
● OCDA?
Page 21
© Bird & Bird LLP 2018

22. Graham Smith
graham.smith@twobirds.com
@cyberleagle
Bird & Bird is an international legal practice comprising Bird & Bird LLP and its affiliated and associated businesses.
Bird & Bird LLP is a limited liability partnership, registered in England and Wales with registered number OC340318 and is authorised and regulated by the
Solicitors Regulation Authority. Its registered office and principal place of business is at 15 Fetter Lane, London EC4A 1JP. A list of members of Bird & Bird LLP and
of any non-members who are designated as partners, and of their respective professional qualifications, is open to inspection at that address.
twobirds.com
Thank you