MI5 and Home Office acted unlawfully

But tribunal rules that a public finding of ‘serious failings’ is punishment enough

Yesterday’s ruling from the Investigatory Powers Tribunal is deeply disturbing. The judicial body that deals with complaints about the intelligence agencies found “very serious failings” by the Security Service MI5, as a result of which surveillance and interception warrants were issued unlawfully by successive home secretaries over a three-year period.

Thames House, London headquarters of MI5

Two campaign groups, Liberty and Privacy International, challenged MI5’s failure to comply with statutory safeguards relating to personal data. These safeguards — initially in the Regulation of Investigatory Powers Act 2000 and then in the Investigatory Powers Act 2016 — govern the retention, review and destruction of personal data within what are described as MI5’s “technology environments”.

In a briefing on the judgment, Privacy International said it believed these environments were systems that hold vast amounts of intelligence material on potentially millions of people:

We understand it to be a federated system which is used for data analysis, and the use of “technology environment” suggests something more than simply a compilation of a few datasets or databases.

The personal data held within these environments falls into two categories — bulk personal datasets and bulk communications data. Privacy International said the data potentially included “everything from the the content of intercepted communications to data obtained from targeted acquisitions of communications data from telecommunications systems (such as traffic data, location data, subscriber data and any other data surrounding a communication)”.

An internal MI5 document had referred to “ungoverned spaces” on the technology environment, the tribunal found. Another said that much of the technology environment was akin to the “Wild West”.

Following MI5’s admissions, the investigatory powers commissioner concluded in April 2019 that there had been “a serious failure to handle warranted data in compliance with the Investigatory Powers Act for a considerable period of time” and that data had been held and handled “in an undoubted unlawful manner”.

In response, the then home secretary Sajid Javid announced an independent review. That review of compliance was conducted by Sir Martin Donnelly later in 2019 and a further review was conducted by Mary Calam in 2021.

The claims against MI5 and the Home Office were heard at the tribunal last July by Lord Justice Edis and Mrs Justice Lieven — both judicial high-flyers — and Charles Flint KC, best known as a mediator.

Admissions

MI5 was aware of a very high risk that it was in breach of its statutory obligations from May 2016 onwards. It was aware of the possibility from late 2015 of compliance failures in the technology environment relating to retention, review and disposal of personal data.

MI5 and the Home Office also accepted that MI5 knew from 2016 that it should have notified the investigatory powers commissioner — a former appeal judge — of its failure to comply with the required safeguards. The commissioner was not given any notice of the serious and extensive compliance problems in the technology environment until 21 February 2019.

Findings

The tribunal found that:

1. There were serious failings by MI5 in complying with its statutory obligations from late 2014 onwards. The holding and handling of data was therefore unlawful. MI5 accepts that it was in breach of its safeguarding obligations from at least 2016. It accepts that it should have notified the investigatory powers commissioner of its compliance failings from 2018.

2. The Home Office did not make adequate enquiries about longstanding compliance risks that had been reported on several occasions from December 2016. No explanation was sought by, offered to or reported to the home secretary of the day about the scale and seriousness of the risk to handling arrangements required by law. In issuing warrants permitting activities by MI5, the home secretary could not be sure that effective safeguards were in place.

3. Questions had been raised about whether MI5’s compliance failings extended to other technology environments and to other safeguards — including access controls data copying and the protection of legal professional privilege. The tribunal did not publish its findings on these issues.

4. MI5 had breached its duty of candour in an earlier case by failing to notify the tribunal that its handling arrangements for bulk communications data did not comply with the law. The tribunal will consider whether that case should be reopened as a result.

Relief

The tribunal then had to decide whether the claimants should be granted any “relief”. They had argued that unauthorised warrants should be quashed and unlawfully retained data should be destroyed.

That would are very damaging to national security, the tribunal said. The nature of this damage could not be disclosed.

What the tribunal could say was that searching for unauthorised warrants would be impracticable, would serve no useful purpose and would “have a deleterious effect on the efficiency of MI5”. Information from the warrants had already been obtained and processed, so quashing them would serve no useful purpose.

Relief was discretionary, the tribunal pointed out. A number of factors persuaded the tribunal members not to grant the orders that the claimants had requested:

• The failure that lies at the root of the unlawfulness identified by the tribunal was the failure to have and use a proper system for review, retention and destruction of material. It was not a failure that meant that MI5 should never have had the material at all. The failure meant that a small proportion of the material was retained for longer than it should have been. For the tribunal to decide that all of the product of all of the warrants should be destroyed would be disproportionate to the unlawfulness it had found. That did not minimise its seriousness.

• There was no evidence that any individual had suffered harm as a result of that unlawfulness. That being so, compensation as a means of remedying harm was not required. The claimants had brought these proceedings as a matter of public service and had obtained the findings summarised above.

• The material had been processed over a number of years. It had “generated product which is of continuing value to national security”. The orders that the tribunal declined to make would be very damaging to national security.

• An effective remedy had already been given. After the disclosure made to investigatory powers commissioner in February 2019, vigorous action by the commissioner’s office had resulted in a full understanding of what went wrong. The tribunal was satisfied that the investigatory powers commissioner’s functions provided an effective remedy.

The tribunal concluded:

This judgment itself is part of the remedy. We have made findings of serious failures by MI5 and also by the secretary of state. These findings have been set out in a public document by the tribunal. Both the investigatory powers commissioner and the investigatory powers tribunal will have continuing oversight of the conduct of MI5 and the secretary of state in the future and will exercise that oversight, expecting [MI5 and the home secretary] to have learnt the lessons of this damaging series of events.

We do not consider that it is appropriate or necessary to single out any individual at MI5 or the Home Office for any blame. There was a widespread corporate failure.

Reaction

Caroline Wilson Palow, legal director at Privacy International, said:

While we are pleased that the Investigatory Powers Tribunal has recognised MI5’s serious failures, we are disappointed that they did not go further to remedy them. What’s important now though is that the government recognises that we are entitled to real protections for our privacy and takes action to safeguard them.

She added:

We’ve been here many times before. UK intelligence agencies seriously intrude on thousands or even millions of people’s privacy, we call them out, then the government promises better safeguards. Today’s ruling is especially troubling because it confirms that those safeguards can be illusory. MI5 failed to follow them for years, with successive home secretaries ignoring signs of their breach, too.

The judgment also acknowledges that MI5 breached its duty of candour to the tribunal in a previous case by withholding crucial information, which calls past decisions into question.

These are not technical breaches. At its highest levels, MI5 systemically disregarded the law and the Home Office’s failure to do anything green-lighted their activities.

Nothing good comes of unchecked power being exercised by government intelligence agencies operating in the shadows. It’s undemocratic and dangerous to our rights to give MI5 a free pass.

Megan Goulding, a lawyer at Liberty, said:

We are pleased that the tribunal has found that MI5 have been mishandling our data, storing it when they shouldn’t have, and the home secretary has been unlawfully granting warrants. This judgment confirms what we at Liberty, and others, have been saying for years — surveillance safeguards are not fit for purpose and fail to protect our fundamental privacy rights.

For years, MI5 knowingly broke the rules and failed to report it, the internal oversight body did not detect it and the government failed to investigate clear red flags. Instead, the Home Office continued to issue unlawful warrants and MI5 kept information from the authorities about its mishandling of our data…

Now is the time for the government to step up and create restrictions that protect our privacy rights.

The Home Office said:

MI5 consistently work to a high standard in challenging circumstances and treat the protection of personal information with the utmost seriousness. Substantial action has been taken over a number of years to address the concerns raised in this case.

We accept the judgment delivered and will continue to drive forward work to ensure we and our partners remain fully compliant with the law.