The powers of the intelligence services

MI5, the Security Service, distinguishes on its website between seven different types of “intelligence gathering activities”, otherwise known as spying. We’ll explain each one in turn.

The Investigatory Powers Act 2016, once in force, will set down the authorities’ powers for some of these activities. The Act has been controversial—some people have dubbed it a “Snooper’s Charter”—even though a lot of it is tidying up existing rules. The government has said that the only new power contained in the Act is the requirement for companies to retain records of the websites that internet users have visited.

Despite being a mammoth undertaking, the Investigatory Powers Act doesn’t cover all spying. It’s mostly about the internet end of things. More traditional surveillance and agent-running powers will continue to fall under an older law, the Regulation of Investigatory Powers Act 2000.

In some cases these laws are different in Scotland and Northern Ireland.

Communications data (IPA 2016)

‘Communications data’ is information about someone’s communications rather than the contents of it. So in the case of an email, the communications data would be who sent it, who received it, the time and date—but not the actual text of the email.

A range of public bodies, from GCHQ to the Food Standards Agency, can get access to communications data. A request needs to be authorised by a senior figure within that organisation. They can only authorise it if the request is necessary for one of 10 purposes, the first of which is “national security”.

Communications data includes records of which websites someone has visited, although there are more restrictions on accessing these records.

Phone and internet companies that have your communications data can be told to hold onto it for up to 12 months.

Interception of communications (IPA 2016)

This covers the actual content of communications—listening to the actual words spoken on a phone call or reading the text of an email.

The heads of the intelligence agencies, some police forces and HMRC can intercept communications if they have a warrant.  The Home Secretary (personally) can grant a warrant if she deems it necessary for national security, to fight serious crime, or to protect the economy at a national security level.

Except in urgent cases, the Home Secretary’s decision then has to be approved by a Judicial Commissioner. The post of Judicial Commissioner is only open to people who have been a senior judge (High Court or above).

Directed surveillance (RIPA 2000)

This is spying on someone in a public place in a bid to find out private information. A core example would be following a suspect around in public to see where they go, what they do and who they talk to.

Directed surveillance needs to be authorised. It can be authorised where necessary and proportionate for a range of reasons, from national security to protecting public health. A wide range of public bodies, from the intelligence services to your local council, carry out directed surveillance (although not all for the same reasons).

Authorisation comes from someone of appropriate rank within the organisation—for instance, a superintendent in the police or a member of the Area Management Team in the Environment Agency. Councils, though, need approval from a magistrate following changes made in 2012.

As that example suggests, directed surveillance isn’t only carried out by M15—it’s also a tool in more mundane investigations. Law enforcement agencies authorised it around 7,000 times in 2015/16, and other public bodies around 2,000 times. The majority of these 2,000 were within the Department for Work and Pensions, which carries out benefit fraud investigations.

Intrusive surveillance (RIPA 2000)

This is like directed surveillance but, as the name suggests, more so. It refers to spying on someone in a home or private vehicle, rather than in public. “It is classically performed by attaching or embedding a device to record the activities of the individual or individuals under surveillance”, in the words of the Independent Reviewer of Terrorism Legislation.

Intrusive surveillance can only be used for national security, serious crime or high-level economic reasons. The Home Secretary can authorise members of the armed forces or intelligence services to carry it out. Other agencies—such as HMRC or the Competition and Markets Authority—can get authorisation from a senior police or army officer, but that needs to be signed off by a Surveillance Commissioner except in urgent cases. (Judicial Commissioners will take over this role under the 2016 Act.)

Authorisations of intrusive surveillance have been falling over the past few years, with fewer than 300 granted in 2015/16.

Covert human intelligence sources (RIPA 2000)

MI5 refers to these people as “agents”, although not in the James Bond sense. People employed by the intelligence services are referred to as “officers”, whereas agents are their sources. Anthony Blunt, for example, was an MI5 officer but a Russian agent.

It’s not just the intelligence services that make use of agents. The list of public bodies allowed to authorise their use isn’t quite as long as for directed surveillance, but they overlap significantly.

In practice, though, agents are only significantly used by law enforcement agencies. They had 2,300 agents authorised as of 31 March 2016, whereas other organisations had just 62.

Equipment interference (IPA 2016)

This is about hacking into computers or other devices to mess with or get information out of them. The Home Secretary can grant interference warrants to the intelligence services for the same reasons as for interception of communications (national security, serious crime, economy). Various “law enforcement chiefs” can grant warrants to prevent serious crime, or to ward off death or serious injury. But in both cases, Judicial Commissioners also have to sign off on the warrant, unless it’s urgent.

Bulk personal data (IPA 2016)

This refers to databases containing information on lots of people when someone the authorities are interested in might be among them. An example might be a Home Office database of everyone who has a UK passport.

The intelligence services generally need a warrant to keep or look at bulk personal data. Again, these are granted by the Home Secretary on national security, serious crime or economic grounds, with sign-off from a Judicial Commissioner. There are extra protections for health records in particular.