Eric King—written evidence (IPB0106)

               The ability to live a private life is a human right and public good that enables our society and our democracy to function. Increasingly, that private life, including a person’s most intimate moments, is experienced, in one form or another, in the digital world.

               As a result of advancements in technology, in recent years, Britain’s security and intelligence agencies’ capability to acquire, process, and analyse information about a person’s private life, at scale, has dramatically expanded.

               Upholding privacy necessarily requires that surveillance must be restricted to only that which is strictly necessary and proportionate. Societies around the world have benefited greatly from technological constraints that have historically kept the more extreme ambitions of intelligence agencies in check; protecting that ability to live a private life.  Yet, slowly but surely, those technological constraints are being lifted.

               The question I invite the committee to consider, is not what can be done in the field of surveillance, given the available technology, or what the previous practice has been of our intelligence agencies, but, rather, what should now be done. Now that our society can no longer rely on technological constraints to protect us against unnecessary intrusions into our private communications, it is critical that legislation exists to guard against such unnecessary intrusions. It is my view that there has never been a more important moment to set strong limits, in both law and policy, on our intelligence agencies’ capabiltiies, to ensure they are only used where necessary and proportionate.

Executive Summary:

            Due to the short timeframe given to prepare evidence, and the length and complexity of the draft Bill, I regret I am unable to provide detailed comments on all issues. Instead, I have elected to provide the Committee with a factual background and high level recommendations on the “bulk” powers contained in the Bill, to inform the Committee’s consideration of how the powers in the draft Investigatory Powers Bill will be put to use in practice.

      The majority of powers contained in the Bill, including the most intrusive, have not been considered by Parliament before. Operational cases have not been made for the majority of these powers. It is essential that such operational cases are presented so as to allow this Committee, Parliament, and the public to properly scrutinise the necessity, proportionality  and likely effectiveness of the powers.

      The use of Bulk Interception to collect ~50 billion internet communications a day, from more than a quarter of all undersea cables coming in and out of the United Kingdom, in order to create "a web browsing profile for every visible user on the Internet” and subject those emails, videos, messages, and web searches to automated analysis for target development, is not a proportionate interference with civil liberties.

      The use of Equipment Interference to “exploit any phone anywhere, anytime” including targeting people “not of intelligence interest” is dangerous, and illiberal. The methods employed to undertake Bulk Equipment Interference with respect to equipment maintained by companies, and individuals who are not themselves national security threats and who are not suspected of any criminal wrong doing on an “industrial scale” is counter-productive to cyber security goals.

      Powers such as Bulk Communications Data Acquisition are not only disproportionate, they are ineffective; such a conclusion has already been reached in the United States, where bulk communications data acquisition programmes have been ended after two government reports concluded they were ineffective, while concurrently criticising the disproportionately intrusive nature of the power.

      There is a paucity of information surrounding Bulk Personal Datasets, making it difficult to assess the scope of the power.  They should be approached with great caution, as Bulk Personal Datasets may end up being the most intrusive and least-regulated power proposed in this draft Bill.

New powers and the lack of operational cases

The committee should not consider the majority of the powers in this draft Bill to be pre-existing. While almost all of the capabilities are currently in use by our intelligence agencies, they were authorised under secret interpretations of law, that Parliament had not consented to, nor were aware of, and their lawfulness is currently being considered by the Investigatory Powers Tribunal, the European Court of Human Rights and the Court of Justice of the European Union .

It was not until the February 2015 publication of the Equipment Interference Code of Practice[1] that computer hacking, or what the agencies internally call Computer Network Expoitation (CNE) became avowed. At the time of drafting, GCHQ maintains, in respect of ongoing litigation in the Investigatory Powers Tribunal, that Bulk Equipment Interference has still not been avowed.

It was not until the March 2015 publication of the Intelligence and Security Committee’s (ISC) report[2] that Bulk Interception, including that of large international undersea cables, was avowed. This is despite litigation having been conducted in the Investigatory Powers Tribunal for the preceding two years in which GCHQ invoked a Neither Confirm Nor Deny stance with respect to the existence of Bulk Interception capabilities.

            It was not until the March 2015 publication of the Intelligence and Security Committee’s report[3] earlier this year that Bulk Personal Datasets was avowed. As the ISC stated “…until publication of this Report, the capacity was not publicly acknowledged, and there had been no public or parliamentary consideration of the related privacy considerations and safeguards”

It was not until November 2015 that the Home Secretary herself avowed[4] the fact that MI5 had been using an obscure statutory provision contained within Telecommunications Act 1984 to collect domestic phone records in bulk and subject them to data mining, something that Government intends to continue pursuant to the draft Bill’s provisions on Bulk Acquisition Powers and Bulk Personal Datasets.

Prior to those avowals, there was no official suggestion - either from Government, the agencies themselves or intelligence oversight bodies - that such activities were being undertaken. Indeed, efforts of some oversight bodies[5] to inform the public further were frustrated by the agencies’ insistence in keeping the capabilities secret.

Any suggestion that such secrecy was justified on the basis of an overriding need to obscure the capabilities of the security agencies from those who might potentially be subject to such capabilities, in order to prevent the circumvention or avoidance of surveillance, is clearly refuted by the inclusion, in great detail, of such powers in the present draft Bill.

            Due to the lack of avowals and the obfuscated language of existing legal frameworks, no piece of legislation expressly references any of the above capabilities with sufficient clarity for them to be have appropriately considered by Parliament.  As such it is not until this draft Bill that Parliament has ever been given the opportunity to debate the necessity of, or the operational case for, many of the most intrusive powers in this Bill.

Perhaps what is most striking about the fact is the clear absence of any operational case for the majority of the powers in this Bill. This absence is particularly peculiar given that the operational case, if there were to be one, should have been relatively easy to put together. This is because many of the most intrusive capabilities are already in use by the agencies and have been for a long time, regardless of the non-existence of strong statutory footing.

As a result, there should be more than a decade’s worth of practice to draw from to show the effectiveness of such capabilities, to highlight examples of successes of some powers and failures of others, and provide analysis of the unique impact certain programmes and techniques have had.

Perhaps one reason why there is such a lack of an operational case being made is that, despite the extraordinary scale of intrusion, the agencies cannot prove that bulk powers have had a discernible impact.

Conclusion and recommendation

            Operational cases should be publicly made for all bulk powers contained in the draft Bill to allow Parliament and the public to properly scrutinise the necessity, proportionality  and likely effectiveness of the powers.

Bulk Interception

             Although Britain has a long history of gaining access to communications via the interception of undersea cables, the volume of communications that is being intercepted and analysed under TEMPORA is orders of magnitude greater, and as a result, entirely different, from anything undertaken in GCHQ's history.

             Despite statements by the Home Secretary in 2008 explaining that the Government had “no plans for an enormous database which will contain the content of your emails, the texts that you send or the chats you have on the phone or online,”[6] it is now known that such a database had indeed been built, and was growing daily.

             Two years earlier, in 2007, a process of modernisation had taken place at GCHQ resulting in a twenty-fold increase in GCHQ’s capability[7]. More than 50 billion pieces of internet and phone content were being intercepted, processed and analysed every day. An enormous database with the content of emails, texts, and telephone calls did indeed exist. By 2009 GCHQ’s access to undersea cables had increased by a further 7000%.

             I have summarised the rapid expansion of GCHQ’s Bulk Interception capacity in Annex A.

             Today, this un-targeted collection is used to drive different programmes to achieve extraordinary levels of intrusion at a previously unimaginable scale.

             One programme, KARMA POLICE, used the communications captured in bulk to provide the agency with "a web browsing profile for every visible user on the Internet.”[8] This is not mere passive collection and storage of private communications, but an active attempt to build detailed profiles, akin to a physical dossier or file on everyone on the internet, based on individuals' web searches and browsing history. As extraordinary as it sounds, nevertheless, this was the stated goal of the GCHQ programme.

             The volume of data collected is enormous and so most of the material cannot be reviewed by a person. At such a scale, it is impossible to immediately determine what will be of interest to GCHQ, nor is it possible to immediately filter out the private communications of perfectly innocent people who are not suspected of anything. Instead, GCHQ treats every piece of information intercepted as potentially suspicious, pieces it back together, and subjects it to intrusive processing, filtering, and analysis. GCHQ then mines the data for correlations and patterns, suspicious words or phrases, relationships or connections using powerful computers, building profiles on people automatically.

             In this way, the private communications of everyone who is caught up in this net are the subject of experimentation in an attempt to determine how suspicious a certain person, about whom nothing previous was known, may or may not be. Emails between close friends, phone calls between family members, internet searches about medical conditions, and the browsing of news websites for political views will all be examined and graded.

             It is no surprise that this has happened. Indeed, it is a predictable consequence of an agency with an engineering mindset, focussed on an important mission, and pushing the limits of what is possible, in secret.  However, collection at this scale cannot be justified.

             Technological limits, and financial constraints were previously keeping the agencies in check; today, they simply do not exist. With more funds being made available, and technology obliterating obstacles to surveillance, we must look to law to place limits. Regrettably, this draft Bill places no meaningful constraints on this capability. Instead, it provides GCHQ with the renewed mandate to scale even further, expanding its collection and analysis to new highs.

             While in 2009, a quarter of all undersea cables that land in the United Kingdom were being analysed by GCHQ, as the technology becomes more affordable, that proportion will only increase. GCHQ already has plans to grow TEMPORA capabilities at multiple processing centres based within the UK and overseas.[9]

             This draft Bill must set hard limits to constrain that practice, and to ensure only that which is necessary and proportionate is undertaken.

Conclusion and recommendations

             Due to historic secrecy around the capability, the operational case for why Bulk Interception powers are necessary has never been made. In my view, given the extraordinary reach and depth of intrusion into innocent people’s private communications, and the striking absence  of a detailed operational case, Bulk Interception capabilities in the form they are currently used are not a proportionate activity and should be prohibited.

             Although I make the above recommendation in the strongest terms, if Bulk Interception powers are retained in the draft Bill, the following minimum safeguards must be introduced into the legislation:

             Only the targeting of communications relating to specific identifiable targets, using ‘hard selectors’ should be permitted. The use of ‘soft selectors’ or ‘about’ selectors should be prohibited.

            The use of Bulk Interception for the purpose of target development, or to “search for traces of activity by individuals who may not yet be known to the agencies” should be prohibited.

             The automatic creation of detailed profiles tying communications captured in Bulk to individuals not considered a national security threat, or suspected of any crime should be prohibited.

             A policy must be published that sets out a procedure for determining bearer selection.

Bulk Equipment Interference

Bulk Equipment Interference is a newly coined term pertaining to a wide range of capabilities including what the Agencies call Computer Network Exploitation (CNE), but which is more commonly known as hacking. CNE is the most intrusive and dangerous capability the Agencies possess.

At Annex B, I provide detail about the scale of the deployment of CNE capabilities, their unintended consequences and further recommendations.

GCHQ regularly hacks companies who are not themselves threats to national security, nor suspected of involvement of any wrongdoing. They did so with respect to Belgium’s largest telecommunications provider, Belgacom, incurring the company £12 million[10]  in clean up costs, with the aim of using Belgacom as a launch pad for further attacks. GCHQ hacked into the internal computer network of Dutch SIM-card company Gemalto, stealing encryption keys used to protect the privacy of cellphone communications across the globe. A plethora of German companies including Deutsche Telekom AG[11], Netcologne, Stellar, Cetel, and IABG[12] have all been targeted by GCHQ in recent years.

The agencies do this to help enable other missions, and future attacks; attacking these companies is merely a means to an end. In my opinion, attacking these companies is neither necessary nor proportionate. Britain should be working with its allies, not attacking them. Undertaking these activities only encourages a race to the bottom, and places British companies at greater risk. There is nothing in the draft Bill that would limit the scope or scale of these attacks.

Unintended consequences are common. Whole countries communications infrastructure have been accidentally taken-off line by CNE operation gone wrong. Even malware used in highly targeted attacks, such as those used in Stuxnet targeting Iranian nuclear facilities, inadvertently spread, and are still being found damaging corporate networks.

Worse still, to undertake these attacks, agencies exploit, or implant security vulnerabilities in technology. By stockpiling these vulnerabilities and using them offensively as part of attacks, GCHQ are preventing preventing potentially millions of individuals and companies from being protected.

Rather than these being used in a targeted manner, only in extremis, GCHQ intend to deploy this capability in bulk. This is improper and reckless.

Conclusion and recommendations

            No detailed operational case has been made for these powers, nor is there any publicly available analysis of the implications or risks of deploying Equipment Interference with respect to a range of factors, including for the UK’s cyber security.  It is my view that the the use of Bulk Equipment Interference should be prohibited.

            Although I make the above recommendation in the strongest terms, if Equipment Interference powers are retained in the draft Bill, the following minimum safeguards must be introduced into the legislation:

                         The UK government should fully support and not undermine cyber-security efforts, including not in any way subverting, undermining, weakening, making or keeping vulnerable generally available software and hardware.

                         The targeting of companies or “individuals who are not intelligence targets in their own right” and thus not a threat to national security, or not suspected of any criminal wrongdoing, should be prohibited.

                         An equities policy must be published that sets out a procedure for determining whether flaws or vulnerabilities discovered or purchased by the government should be disclosed to the public or other relevant actors.

                         Government agencies engaged in CNE operations should be prohibited from impersonating trusted professions, including doctors, lawyers, and journalists. They should also be prohibited from deploying CNE in such a manner that impersonates critical cybersecurity infrastructure such as those used by software companies to deliver security updates.

                         Companies should not be compelled, required, or pressured to assist with the development or deployment of CNE.

                         Where CNE has been used against devices owned by individuals who are subsequently criminally prosecuted, there should be a obligation to notify the individual, and provide complete details of how CNE was used to ensure a fair trial.

Bulk Communications Data Acquisition

The use of Bulk Communications Data Acquisition to collect domestic phone records in bulk and subject them to data mining has until recently been kept secret.  Nick Clegg MP stated that even inside Government “only a tiny handful of senior cabinet ministers” knew of such a practice.[13] The Home Secretary only avowed[14] to Parliament the fact that MI5 were relying on an obscure statutory provision contained within Telecommunications Act 1984 in November 2015. When announced, David Anderson QC told the BBC that the "law was so broad and the information was so slight that nobody knew it was happening”. He added it was "so vague that anything could be done under it.”[15]

I explain what is known about Bulk Communications Data Acquisition at Annex C.

In the United States, a similar power has previously existed under Section 215 of the USA PATRIOT Act. After the use of what in the US is called the “bulk telephone records programme” was revealed b Edward Snowden, two independent bodies undertook reviews of, inter alia, the use of this power, in order to determine in part whether the operational case studies put forward by the US government to justify the programme were credible and accurate.

With access to classified material, the The President’s Review Group on Intelligence and Communications Technologies concluded: “Our review suggests that the information contributed to terrorist investigations by the use of section 215 telephony meta-data was not essential to preventing attacks and could readily have been obtained in a timely manner using conventional section 215 orders”.[16]

Similarly the Privacy and Civil Liberties Oversight Board concluded in the same manner that “we are aware of no instance in which the program directly contributed to the discovery of a previously unknown terrorist plot or the disruption of an attack.”[17]

Less than a month ago the US ended the Section 215 bulk phone records program.

Given that two independent bodies, both of which had access to classified material, found a directly similar power ineffective and disproportionate, it should be concluded that the Government’s Bulk Communications Data Acquisition powers are equally ineffective and disproportionate too.

Conclusion and recommendations

            Bulk Communications Data Acquisition powers should be rejected on the grounds that they are ineffective and overly intrusive, until such a time that an operational case to rebut that presumption is made, and can be adequately scrutinised.

            Although I make the above recommendation in the strongest terms, if Bulk Communications Data Acquisition powers are retained in the draft Bill, the following minimum safeguards must be introduced into the legislation:

          The use of data acquired by Bulk Communications Data for target development or to “understand relationships between suspects in a way that would not be possible using only targeted communications data powers” should be prohibited. Only specific queries, relating to an identifiable target, should be permitted.

          There should be an examination regime for access to any Communications Data, regardless of where or how it was obtained.  The lack of examination regime surrounding Bulk Communications Data Acquisition is a notable absence, and it is an important safeguard that exists in all the other bulk power regimes.

Bulk Personal Datasets

Almost nothing is known about Bulk Personal Datasets (BPDs), including what exactly they are, or how they are used. BPDs have been officially described as being comprised of “data that contain personal information about a wide range of individuals, the majority of whom are unlikely to be of any intelligence interest.”[18] The little else that is known suggests the Committee should act with great caution, as Bulk Personal Datasets may end up being the most intrusive and least regulated power being proposed in this draft Bill.

I set out what is publicly known about BPDs in more detail at Annex D.

Occasionally, intelligence service staff point to the richness of data held, with consent, by technology and internet companies. Former Director of GCHQ Iain Lobban told the Telegraph “Who has the info on you? It’s the commercial companies, not us, who know everything.[19]” With Bulk Personal Datasets, intelligence agencies are forcing numerous companies to hand over everything they know, in bulk, to allow the agencies to combining the knowledge of multiple commercial companies in a single place.

From there, these “millions of records” are “linked together so that analysts can quickly find all the information linked to a selector (e.g. a telephone number or a ***) from one search query.”[20]

No formal oversight, prior to that initiated by the Prime Minister this year, has taken place, despite the conduct clearly affecting the civil liberties of British citizens.

Abuse has already taken place. With the ISC reporting each of the three Agencies “had disciplined – or in some cases dismissed – staff for inappropriately accessing personal information held in these datasets in recent years.”

Without understanding which Bulk Personal Datasets have been acquired already, and which may be acquired in future, the scope of this power cannot be properly assessed. It is likely that medical records, including those from the NHS, could be acquired, in bulk, under this power. Likewise, travel and border records and financial records, including those from credit reference agencies, could be acquired, if they haven’t been already.

BPDs have not been subjected to a single formal review or report and as a result, the proposed legal framework pertaining to BPDs is the least rigorous of all the bulk powers.

Conclusion and recommendations

            Due to the lack of information being provided to assess what would be a power which could be used to obtain any dataset, regardless of size, sensitivity, or scope, and a lack of an operational case, the use of Bulk Personal Datasets should be prohibited

            Although I make the above recommendation in the strongest terms, if Bulk Personal Dataset powers are retained in the draft Bill, the following minimum safeguards must be introduced into the legislation:

          Lists of the Bulk Personal Datasets that have already been acquired should, where possible, be published. Where national security concerns are raised, the Government should publish information on  broad categories of BPDs, such as “financial” or “medical”, and the quantity of BPDs as well as the number of individual records contained within them should be published.

          Criminal offences should be enacted for misuse of Bulk Personal Datasets, in the same way that there are statutory offences for misuse of intercepted material and communications data.

          Bribing staff inside companies/organisations, placing human intelligence assets inside companies/organisations or obtaining Bulk Personal Datasets by any other covert means should be prohibited. Only overt methods, by legal compulsion, should be considered.

          The Committee may wish to consider recommending language be introduced in the legislation to ensure that certain Bulk Personal Datasets that should never be obtained. An initial list could include medical information in bulk from the NHS and other health providers.

          Bulk Personal Dataset warrants must describe specific individual datasets. Provisions in warrantry as per s.152(6) to allow warrants to authorise the obtaining, retention and examination of “replacement datasets” that do not exist at the time of the issue of the warrant should be removed.

          There should be an examination regime for access to any Communications Data, regardless of where or how it was obtained.  The lack of examination regime surrounding Bulk Communications Data Acquisition is a notable absence, and it is an important safeguard that exists in all the other bulk power regimes.

Conclusion

                       The capabilities contained within this draft Bill are extraordinary. This is the first time that Parliament has ever been given the opportunity to debate the necessity of, or the operational case for, many of the most intrusive powers in this Bill. I hope this opportunity will be exploited to its fullest.
 

                       Only the restrictive word count and short submission timeframe prevented me from addressing other problematic areas of this draft Bill. My silence on them in this report should not be taken as a lack of concern. I trust others will have be able to address them in their submissions.
 

                       If there is any further information the Committee requires, I would be happy to assist however I can.

December 2015

Annex A - Bulk Interception

Operating primarily out of Bude in Cornwall, the GCHQ mass surveillance programme TEMPORA includes the first “full take” internet fibre-optic interception site anywhere in the world and purportedly provides the single “biggest internet access” enjoyed by any intelligence agency worldwide.[21] Indeed, the vast number of private communications being intercepted requires a special kind of processing known as “Massive Volume Reduction” to make sense of the collected private communications. In 2009, internal GCHQ documents stated “this massive site uses over 1000 machines to process and make available to analysts more than 40 billion piece of content a day.”[22]

               The volume of data collected is enormous and so most of the material cannot be reviewed by a person. At such a scale, it is impossible to immediately determine what will be of interest to GCHQ, nor is it possible to immediately filter out the private communications of perfectly innocent people who are not suspected of anything. Instead, GCHQ treats every piece of information intercepted as potentially suspicious, pieces it back together, and subjects it to intrusive processing, filtering, and analysis. GCHQ then mines the data for correlations and patterns, suspicious words or phrases, relationships or connections using powerful computers, building profiles on people automatically.

In this way, the private communications of everyone who is caught up in this net are the subject of experimentation in an attempt to determine how suspicious a certain person, about whom nothing previous was known, may or may not be. Emails between close friends, phone calls between family members, internet searches about medical conditions, and the browsing of news websites for political views will all be examined and graded.

               One programme, KARMA POLICE, used the communications captured in bulk to provide the agency with "a web browsing profile for every visible user on the Internet.”[23] The individuals whose communications were intercepted, and had profiles built about them, were not specifically named in or targeted by interception warrants; rather, the collection is constituted from "unselected" or "untargeted" material. This is not mere passive collection and storage of private communications, but an active attempt to build detailed profiles, akin to a physical dossier or file on everyone on the internet, based on individuals' web searches. As extraordinary as it sounds, nevertheless, this was the stated goal of the GCHQ programme.

               Under another programme, OPTIC NERVE, GCHQ intercepted substantial quantities of sexually explicit communications from private video conversations.[24] In one six month period in 2008, GCHQ collected webcam imagery from more than 1.8 million Yahoo user accounts globally. Rather than collecting webcam videos in their entirety, the programme saved one image every five minutes to avoid overloading GCHQ's servers. GCHQ also reportedly applied facial recognition technology to the collected video chats.

               From the webcam imagery harvested by this programme, documents reveal that between 3% and 11% contained "undesirable nudity". The large amount of private sexually explicit webcam imagery was noted by GCHQ, and an internal guide explained to intelligence analysts that "there is no perfect ability to censor material which may be offensive. Users who may feel uncomfortable about such material are advised not to open them." The programme began in 2008 and was still active in 2012.

               Even when data does not immediately yield interesting or useful intelligence, agencies seek to store as much of it as possible, with the intention of returning to it and applying retrospective analyses at some point in the future when it might be newly interesting or useful. The objective is to strive to build an ever-larger haystack, in order to improve both the intelligence agencies' current and future capacity to find needles. This mind-set, coupled with dramatically decreasing costs of data storage and exponentially increasing volumes of communications, has created what GCHQ's close partner NSA calls “the golden age of SIGINT.”[25]

The underpinning architecture, TEMPORA, is designed to act as an “Internet Buffer” that “slows down a large chunk of Internet data.”[26] The goal is to allow intelligence agencies “retrospective analysis” of any communication they wish to examine that flows through the internet past their sensors. By deploying a high speed filtering and exploitation system called “XKEYSCORE” the agency is able to ingest, search and analyse exceptionally large quantities of private communications. When access to the GCHQ programme was first provided to NSA, it was described as “World's Largest” which “contains more data than all other XKEYSCORE’S combined” [27] and “more than 10 times larger than the next biggest XKEYSCORE.”[28]

The Guardian reported that TEMPORA potentially gives GCHQ access to 21 petabytes of data a day. A petabyte is approximately 1,000 terabytes (which is in turn 1000 gigabytes). To put this in perspective, this is the equivalent of sending all the information in all the books in the British Library 192 times every 24 hours. In a presentation to GCHQ analysts, it was put simply that "[t]his is a massive amount of data!"[29]

            Although Britain has a long history of gaining access to communications via the interception of undersea cables, the volume of communications that is being intercepted and analysed under TEMPORA is orders of magnitude greater than GCHQ's previous capacity. Despite efforts to downplay the scale of access GCHQ enjoys, around 25% of the worlds internet traffic flows through the UK. [30]

            In 2009, this internet traffic flowed through around 1600 bearers[31] contained within undersea fiber optic cables. Internal documents explain that “although the total percentage processed may seem in the lower percentile range we [GCHQ] can actually survey the majority of the 1600 […] This allows us to select the most valuable to switch into our processing systems.”[32]

The constraints and limitations on processing more bearers are mostly technical in nature and due to resourcing and other budgetary constraints, rather than any legal limits or issues of principle. The plan in one set of GCHQs document suggests that by March 2011, the number processed into GCHQ systems would rise to 415; more than a quarter of all bearers transiting the UK.[33]

As of May 2012, there has been a 7000 per cent increase in information obtained from fibre optic undersea cables[34] with TEMPORA capabilities at multiple processing centres based within the UK and overseas.[35]

One report heard evidence on this more specifically. The RUSI panel “were told that the technical work that goes in before the actual interception takes effect is very important, in terms of minimising intrusion and ensuring that large amounts of incidental material are not intercepted.“[36] Despite this, there is nothing in the draft Bill that sets out that policy, or places any constraints on practice.

Annex B - Bulk Equipment Interference

Intelligence agencies have developed hacking techniques they call “Computer Network Exploitation” (CNE) or “Active Signals Intelligence” (Active SIGINT), which, NSA documents explain, “offers a more aggressive approach to SIGINT. We retrieve data through intervention in our targets’ computers or network devices. Extract data from machine.”[37] With these capabilities to infect devices with intrusive malware,[38] GCHQ hopes to be able to “exploit any phone, anywhere, any time.”[39] A GCHQ document explains: “if it’s on the phone, we can get it.”[40]

             Hacking a mobile phone gives governments (or others) total control of features like the camera, microphone and keyboard, which may be utilised, manipulated and turned against the user of the device. Internal GCHQ documents explain that the agency is interested in "[n]ot just collecting voice and SMS and geo-locating phone, but getting intelligence from all the extra functionality that iPhones and BlackBerrys offer."[41]

             A suite of tools – codenamed WARRIOR PRIDE – is used by GCHQ to achieve some of these goals. This framework includes a range of capabilities: using DREAMY SMURF, GCHQ are able to turn on a mobile phone that is apparently switched off; NOSEY SMURF allows the agency to activate the device’s microphone; and TRACKER SMURF allows the agency to activate the device’s GPS location tracker.[42] To ensure that the presence of malware is not detected, PARANOID SMURF helps the malware to remain hidden on the device.[43]

             GCHQ is able to record every keystroke pressed on a device using QWERTY, designed to collect and exfiltrate all keyboard keys pressed by the victim and record them for later inspection.[44] This enables the agency to see everything that the user has typed, including not just the contents of communications and documents, but also any text that was subsequently deleted, and any passwords that the user entered.

             When CNE is targeted against networks, matters get more complex. In the words of an NSA analyst, “there are a plethora of things you could do once you get CNE access to a router…suffice it to say, getting access to a router is very good for the actor, and very bad for the victim.”[45]

             Far from being a capability of last resort for extreme circumstances, it appears this kind of large-scale attack against networks are being deployed regularly against both company and country communications networks. As one document explains “Hacking routers has been good business for us and our 5-eyes [sic] partners for some time.”[46]

             Telecommunications companies are often the targets of these attacks. Just within Germany, several communications have been compromised by GCHQ. Deutsche Telekom AG, which provides mobile phone, internet and landline service to 60 million people in Germany, was hacked by GCHQ.[47] Likewise, Netcologne, which operates a fiber-optic network and provides telephone and internet services to 400,000 customers, was targeted by GCHQ, as were German satellite operators Stellar, Cetel, and IABG.[48]

             These companies are not considered national security threats nor are they suspected as being involved in crime. Instead their networks are attacked and their employees targeted because they are seen as a means to an end.

             Once on their networks, there are a range of activities that can be undertaken. Communications traffic can be redirected in bulk, as a 2008 warrant explains: “[o]ur presence on routers likewise allows us to re-route selected traffic across international links towards passive collection systems.”[49]

             Another reason why GCHQ attacks networks is to use the network as a launching pad for further attacks.  GCHQ’s deployment of CNE against Belgium’s largest telecommunications provider, Belgacom, suggests the ultimate goal was to “enable CNE access to BELGACOM Core GRX Routers from which we can undertake MiTM [man-in-the-middle] operations[50] against targets roaming using Smart Phones.”[51]  In other words, GCHQ wanted to use Belgacom’s network to launch further CNE operations against phones that used the network.[52]

             In some circumstances, documents show intelligence agencies undertake what they call “supply chain enabling, exploitation, or intervention operations” including “[h]ardware implant enabling exploitation or operations.”[53] Interfering with the network hardware supply chain in this way allows intelligence agencies to place controlled backdoors in the “internet backbone”[54] and gain access to communications networks, providing potential access to a whole country’s core communication infrastructure used by millions of people.[55]

                           GCHQ use a variety of methods to exploit hardware and software. Many of those methods rely on the use of a vulnerability – a pre-existing error, often called a “bug” or in hardware or software that allows it to be used in a manner that was not intended or anticipated. Zero day vulnerabilities get their name from the fact that, when identified, the computer user has had “zero days” to fix them before attackers can exploit the vulnerability. By purchasing zero days, and using them offensively as part of attacks, GCHQ are preventing preventing potentially millions of individuals and companies from being protected.

                           In the normal course, when researchers and others discover vulnerabilities, they report the vulnerability to the company responsible for the security of the equipment affected.  If GCHQ discover a vulnerability, however, they have an incentive not to reveal it in order to use it offensively as part of a CNE attack, or to stockpile it for future use.  An NSA classification guide states that “technical details concerning specific software vulnerabilities, when not publicly known, and [that] are exploited for CNE activities” hold a minimum classification of TOP SECRET.[56]

                           Even at the law enforcement level, zero days are being used. Companies trying to sell malware to law enforcement bodies, including National Crime Agency, use zero days in their products[57].  Recently the FBI confirmed that malware they deploy also makes use of zero day vulnerabilities.[58]

                           This perverse situation has drawn criticism in the US, from the President’s own Review Group on Intelligence and Communications Technologies. When considering the zero day problem, the Review Group recommended that “[i]n almost all instances, for widely used code, it is in the national interest to eliminate software vulnerabilities rather than to use them for US intelligence collection. Eliminating the vulnerabilities — ‘patching’ them — strengthens the security of US Government, critical infrastructure, and other computer systems.”[59]

Unintended consequences of CNE

             Unlike more traditional SIGINT collection techniques that acquire communications passively, the active intervention of CNE is fraught with difficulties.

             Occasionally, unintended consequences occur when targeting large scale, core communications infrastructure with CNE. In 2012, it was reported that 92 per cent of the communications networks providing internet connectivity to Syria were suddenly knocked offline.[60] At the time, this disruption was widely assumed to have been caused by the Syrian government in order to destabilise opposition groups, and was criticised by world leaders.

             According to Edward Snowden, however, the NSA, not the Syrian government, caused the disruption.  The NSA had been attempting to use CNE to conduct surveillance on the Syrian network when something went wrong with the operation “and the [targeted] router was bricked instead—rendered totally inoperable. […] The failure of this router caused Syria to suddenly lose all connection to the internet – although the public didn’t know that the US government was responsible.”[61]
 

             Other issues also occur, such as malware spreading beyond its intended target, as was the case when Iranian nuclear facilities were targeted by Stuxnet; other companies such as Chevron were caught up in the attack. The CIO of the Chevron put it plainly: “We’re finding it in our systems and so are other companies [. . .] [s]o now we have to deal with this.” [62]
 

             It also appears to be hard to remove malware from computer systems once it has been deployed. One set of researchers who examined Five Eyes malware, found that despite the fact that a CNE attack occurred over 12 years ago, victim computers around the world were still infected with the malware, with dozens of them continuing to transmit information back from around the world.[63]

Scale of CNE deployments
 

             CNE was once a rarely used capability, but this did not stay the case for long. In the United States, by 2003, the use of CNE had risen dramatically, and with a few hundred NSA staff conducting on average 20-25 CNE operations a day, rising again to 100 CNE operations a day by the end of 2005.[64]
 

             Since then the Five Eyes have “aggressively scaled”[65] their hacking initiatives, in the past decade computerizing some processes previously handled by humans. One key system codenamed TURBINE now “allow[s] the current implant network to scale to large size (millions of implants) by creating a system that does automated control implants by groups instead of individually.”
 

             Another document confirms the scale of the ambition, stating TURBINE’s goal is to “increase the current capability to deploy and manage hundreds of Computer Network Exploitation (CNE) and Computer Network Attack (CNA) implants to potentially millions of implants.”[66] Developed as part of the Tailored Access Operations unit, the TURBINE system is described in leaked documents as an “intelligent command and control capability” that enables “industrial-scale exploitation.”[67]
 

             It is unclear how many devices the Five Eyes have interfered with over the years. The Washington Post reported that the LinkedIn profile of one NSA staffer included the fact that the 14 personnel under his command had undertaken over 54,000 CNE operations.[68] I imagine the total number must be in the millions.

             Equipment Interference and Bulk Equipment Interference will likely continue to be deployed in this way, and continue to scale, infecting computers and networks many of which are not an intelligence target themselves, are not a threat to national security, nor suspected of any criminal wrongdoing.

             Despite the agencies’ clear existing CNE capabilities, there is currently no clear statutory authority and Parliamentary consent for the them to undertake Computer Network Exploitation.

CNE code review
 

             In Germany, the use of malware has been contested for many years. In 2008, the German constitutional court created a new computer basic right for "fundamental right to ensure the confidentiality and integrity of information technology systems” which imposed restrictions that that must be ensured both in by legal processes but also technically.

             German authorities reassured concerned parties that malware would be “hand-crafted” for the specifics of each case and would meet strict levels of quality control, not least because of the active nature of computer network exploitation the risk for things to go wrong is high.

             Despite these reassurance, security researchers who were able to obtain copies of the trojan used by Germany authorities found that the design and implementation of the trojan used “lacked basic safety requirements”.[69] They concluded that “the government malware can, unchecked by a judge, load extensions by remote control, to use the trojan for other functions, including but not limited to eavesdropping. This complete control over the infected PC – owing to the poor craftsmanship that went into this trojan –  is open not just to the agency that put it there, but to everyone. It could even be used to upload falsified "evidence" against the PC's owner, or to delete files, which puts the whole rationale for this method of investigation into question. […] Not only can unauthorized third parties assume control of the infected system, but even attackers of mediocre skill level can connect to the authorities, claim to be a specific instance of the trojan, and upload fake data. It is even conceivable that the law enforcement agencies' IT infrastructure could be attacked through this channel.” [70]

             In response, a standardised terms of reference[71] was created to define technical specifications which had to be met by the trojans to be compliant with the constitutional and statutory requirements. This includes a source code audit and function test by an outside party. While criticised as not going far enough,[72] an independent review of malware used would be a welcome first step to protect against abuse.

              Impairment of forensic evidence

             With the deployment of CNE inside the United Kingdom by security agencies or law enforcement bodies, principles pertaining to the integrity of computer evidence fall into question. Any intrusion into a computer will necessarily result in a change to the contents of the device unless the most stringent precautions are taken. As a result, access to a computer or device via CNE prior to the seizure of a device, makes a mockery of the the precautions usually followed by law enforcement when copying hard drives such as the the use of write-protect devices. The risk, if there is an eventual criminal prosecution, is of potential defence accusations of evidence tampering. There is nothing in the proposed Bill, or public statements by the Home Office on this point, that reassures me that the use of CNE will not result in the automatic exclusion of material that otherwise would have been relied on in evidence.

              Targeting innocents

                        The Draft Equipment Interference Code of Practice permits the targeting of "individuals who are not intelligence targets in their own right.” This will allow GCHQ to undertake missions against those who are not a national security threat, not suspected of any crime, or any other wrongdoing. This is plainly inappropriate.

Annex C - Bulk Acquisition

The use of Bulk Communications Data Acquisition to collect domestic phone records in bulk and subject them to data mining has until recently been kept secret.  Nick Clegg MP stated that even inside Government “only a tiny handful of senior cabinet ministers” knew.[73] The Home Secretary only avowed[74] to Parliament the fact that MI5 were relying on an obscure statutory provision contained within Telecommunications Act 1984 in November 2015. When announced, David Anderson QC told the BBC that the "law was so broad and the information was so slight that nobody knew it was happening”. He added it was "so vague that anything could be done under it.”[75]

              Transparency and oversight

Attempts to subject the power to oversight have only just begun. The Interception of Communications Commissioner (IOCCO) was asked to oversee s.94 of the Telecommunications Act 1984 by the Prime Minister. IOCCO has not yet been able to report back on the use of the power. As its more recent report explains  “[t]he challenges stem from the fact that the directions are secret as allowed for by statute, can be given by any Secretary of State and do not automatically expire after a certain period. There does not appear to be a comprehensive central record of the directions that have been issued by the various Secretaries of State. My office is therefore not yet in a position to be able to say confidently that we have been notified of all directions.”[76]

It is not known what directions have been made under the provision. Telecommunications companies must retain telephone and internet metadata records, as required previously under the Data Retention Directive and now under the Data Retention and Investigatory Powers Act. The telephone metadata records include who called whom, location, and length of phone calls. Internet metadata records include billing records, and assigned IP addresses.

Statements by Nick Clegg MP suggest it was these records, among others, that may have been acquired in bulk. He stated “previous government had granted MI5 direct access to records of millions of phone calls made in the UK.”[77] The lawfulness of the power is currently being considered by the Investigatory Powers Tribunal in a claim brought by Privacy International.[78]

Due to the extreme secrecy that surrounded the power, neither the Anderson, ISC, or RUSI report devoted more than a couple of paragraphs to the capability. As such no operational case has ever been made, no detailed independent review or assessment made of the effectiveness, or usefulness of the capability.

              Comparison to Section 215 Patriot Act

Helpfully, a comparison to the likely use of Bulk Communications Data Acquisition can be drawn from the United States, where the equivalent authority has been the centre of prolonged public debate and scrutiny.

On June 5, 2013, The Guardian published an article based on documents provided by Edward Snowden, a contractor for the NSA, which revealed the fact that NSA was running a bulk domestic telephone records program to the public. It subsequently became apparent that the US Foreign Intelligence Services Court had, in secret, accepted the government’s argument that the phrase “relevant” contained with s.215 of the USA PATRIOT Act could be reinterpreted to expand authority from compelling phone companies to hand over individual specific phone records, to hand over all phone records they held. Multiple orders were made to multiple phone companies which were renewed every 90 days.

It is thought that the scope of the s.215 USA PATRIOT Act program was narrower, and less intrusive than what could be possible under s.94 of the Telecommunications Act. This includes the fact that “cell site location information” was not provided by the phone companies, something that is possible under s.94 , and NSA policy was not to subject the material to data mining, something that the ISC has confirmed UK security and intelligence agencies undertake.

The US intelligence community put forward strong arguments for keeping the s.215 USA PATRIOT Act authority, despite public pressure. To bolster their position, they compiled a list of fifty-four counterterrorism events in which s.215 USA PATRIOT Act “contributed to a success story.”

Two independent bodies undertook reviews relating to this powers, and to determine in part whether the case studies put forward were credible and accurate. They immediately determined that, in fact, only twelve of the fifty-four counterterrorism events cited had any relevance to s.215.

With access to classified material, the President’s Review Group on Intelligence and Communications Technologies concluded that “Our review suggests that the information contributed to terrorist investigations by the use of section 215 telephony meta-data was not essential to preventing attacks and could readily have been obtained in a timely manner using conventional section 215 orders”.[79]

            The Privacy and Civil Liberties Oversight Board concluded in the same manner: “[…] the Section 215 program has shown minimal value in safeguarding the nation from terrorism. Based on the information provided to the Board, including classified briefings and documentation, we have not identified a single instance involving a threat to the United States in which the program made a concrete difference in the outcome of a counterterrorism investigation. Moreover, we are aware of no instance in which the program directly contributed to the discovery of a previously unknown terrorist polite or the disruption of an attack.”[80]

Subsequently, the US Court of Appeals for the Second Circuit considered the statutory and constitutional validity of the section 215 programme in the case of ACLU v Clapper,[81] and concluded that the 215 collection programme was not authorised by statute, and could not be unless “preceded by substantial debate, and expressed in unmistakeable language”.[82]

In June 2015, the US Senate passed USA FREEDOM Act,[83] which ended the collection of bulk domestic phone records (with a 180-day grace period granted for compliance). Just a few weeks ago, the programme was confirmed to have ended[84] with the Office of the Director of National Intelligence stating “beginning Sunday, November 29, the government is prohibited from collecting telephone metadata records in bulk under Section 215, including of both U.S. and non-U.S. persons.”[85]

Given the conclusion of two independent reports, who had access to classified material, into the usefulness of a directly similar power found them ineffective and disproportionate, the presumption must be that Bulk Communications Data Acquisition is equally inadequate.

Annex D - Bulk Personal Datasets

Almost nothing is known about Bulk Personal Datasets; what they are, or how they are used. They have been officially described as holding “data that contain personal information about a wide range of individuals, the majority of whom are unlikely to be of any intelligence interest.”[86] The little else that is known suggests the committee should act with great caution, as Bulk Personal Datasets may end up being the most intrusive and least regulated power being proposed in this draft Bill.

One reason that such poor regulation is being proposed in relation to them, is because historically, the regulation and scrutiny BPDs have been subjected to has been essentially non-existent. It was not until the March 2015 publication of the Intelligence and Security Committee’s report[87] earlier this year that any reference to Bulk Personal Datasets was made. In that report the ISC expressed his criticism in the highest terms

On the same day as the ISC Report was published, the Prime Minister signed the Intelligence Services Commissioner (Additional Review Functions) (Bulk Personal Datasets) Direction 2015. The Direction places the review of Bulk Personal Datasets by the Intelligence Services Commissioner onto a statutory basis. This was the first time they were to be formally reviewed.

              What is known

The ISC gave the following explanation of Bulk Personal Datasets:

Bulk Personal Datasets are “large databases containing personal information about a wide range of people” (p. 55).

Bulk Personal Datasets are used to identify subjects of interest, establish links between individuals and groups and improve understanding of a target’s behaviour and connections, and to verify information obtained from other sources (p. 55).

The collection and search of Bulk Personal Datasets “may be highly intrusive and impacts upon large numbers of people” (p. 59Y).

Bulk Personal Datasets vary in size “from hundreds to millions of records” and may be “linked together so that analysts can quickly find all the information linked to a selector (e.g. a telephone number or a ***) from one search query” (§156).

Bulk Personal Datasets affect British citizens (“may include significant quantities of information about British citizens” and “none of the Agencies was able to provide statistics about the volume of personal information about British citizens that was included in these datasets”) (§158 and fn 142).

              Abuse

Abuse has already taken place. With the ISC reporting each of the three Agencies “had disciplined – or in some cases dismissed – staff for inappropriately accessing personal information held in these datasets in recent years.” While attempts to place this power now in statute, it is difficult to see how this new legal framework will reduce the likelihood of future abuse.

              Intelligence sharing

Existing practice is that entire Bulk Personal Datasets, including those relating to British citizens may be shared with foreign intelligence agencies. When shared, not even minimal safeguards apply. As the ISC explains “… while these controls apply within the Agencies, they do not apply to overseas partners with whom the Agencies may share the datasets.” There doesn’t appear to be any new safeguards in the bill to remedy this. Given the relationship our intelligence agencies enjoy within the Five Eyes, it is assumed a number of Bulk Personal Datasets will have been shared with the alliance by default.

It is possible that a very large number of Bulk Personal Datasets have already been acquired by the security and intelligence agencies. The newly published Arrangements for the Obtaining and Disclosing of Bulk Personal Datasets[88] provide no specific numbers, but leave the impression that acquisition and the loading of datasets into analytical systems may be being done at the level of individual intelligence officers.

              Lack of information

I note Committee members[89] have sought to find out which Bulk Personal Datasets have been acquired already, and which may be acquired in future. Privacy International[90] in their legal challenge in the Investigatory Powers Tribunal have speculated what such Bulk Personal Datasets could contain. Just three examples are excerpted below:

                        Medical records
Databases such as those held by the NHSBSA Prescription Pricing Division hold all prescriptions written in England in the last five years. The NHS Personal Demographics Service, the national electronic database of NHS patients, could be acquired. The British Pregnancy Advisory Service, which is Britain's largest single abortion provider, holds hundreds of thousands of records for the 65,000 women they help each year. Private health records from BUPA, or Nuffield Health are growing in size.

                        Travel records
Many databases contain detailed personal travel records. Oyster card transactions provide a detailed map of movements throughout London and similar metrocard databases could be obtained for other cities. Centralised hotel reservation services, flight booking services, as well as car rental databases from companies like Sixt, Europcar, or Enterprise, all contain personal information on a large number of people that may be of interest to intelligence agencies.

                        Financial records and credit reference agencies
Credit reference agencies in the UK such as Experian, Equifax or Callcredit hold personal details of millions of people. These databases contain information such as loan borrowing and repayments, water and energy bills, payday loans, court records and fraud allegations. Some even include the angle of your garden, whether you have a burglar alarm fitted, the make and mileage of your car, how much you spend on wine, sports and vitamins, if you gamble, where you go on holiday and what you read.

In the new framework there is little on how the Bulk Personal Datasets would be compelled. Notably, the ISC report mentions covert action could used to acquire Bulk Personal Datasets[91]. At it’s simplest, covert collection could take the form of the physical stealing of the data from a company. With the establishment of internal GCHQ HUMINT (human intelligence) Operations Team[92] whose who are tasked with “identifying, recruiting and running covert agents ,” these traditional spying techniques are likely not to be ignored. Another common tactic used is bribery, with recent news showing the Drugs Enforcement Agency paid employees of foreign telecommunications firms for copies of similar databases. [93]

Occasionally, intelligence service staff point to the richness of data held, with consent, by technology companies. Former Director of GCHQ Iain Lobban told the Telegraph “Who has the info on you? It’s the commercial companies, not us, who know everything.[94]” With Bulk Personal Datasets, intelligence agencies are able to exploit that, combining the knowledge of multiple commercial companies into a single place.

Due to historic secrecy around the capability, the operational case for why Bulk Personal Datasets are necessary has never been made. They have not been subjected to a single formal review or report and as a result, the proposed legal framework is the least rigorous of all the bulk powers.

21 December 2015