Serious mistakes in exercising investigatory powers

Serious mistakes in exercising investigatory powers

First published on UK Human Rights Blog, 4 February 2019 

At the end of January the Investigatory Powers Commissioner published his first annual report for 2017. Its coverage of errors provides some very welcome transparency. But one matter remains opaque and exposes a legislative and policy challenge: when serious mistakes are made, who finds out?

In this post I set out what the IPC report says in this regard, explain the legislative framework, and then identify the challenges and choices for both law and policy. The two points I highlight are:

There is a policy choice underpinning the IPC report about what information to present, and what not to present. It would be helpful and appropriate for the IPC to provide more clarity about how often people were affected by errors but notinformed of it.

There are policy and legislative challenges that remain with regard to whether people will - as it currently seems - neverbe informed that they were affected by a serious error.

What the IPC report tells us about errors

The IPC devotes considerable attention to explaining the errors that have been made by agencies (including MI5, MI6 and GCHQ) exercising investigatory powers. Together, the chapter on errors and breaches and an annex outlining each investigation of a serious error comprise a quarter of the report.

The report states (at 14.25 and 14.30) that in 2017 there were 926 errors reported to IPCO and (its predecessor) IOCCO, and of those 33 were "considered to be serious and resulted in further investigation". Of those 33, 24 were deemed to be "serious errors".

The report also states that during the year "the IPC notified 8 individuals of a serious error" (14.5).

The consequences of errors are evident in the annex and in the report itself (14.34):

Errors in this context can have grave consequences for the victim of the mistake, together with his or her family and friends. This is particularly evident when homes or offices are searched and the nature of the investigation is revealed to members of the individual's family, and his or her neighbours or employer. Children are at risk of being taken into care and individuals in notifiable, and other, occupations may be suspended or dismissed. Strict bail conditions can result in a suspect having to leave his or her home.

We should be in no doubt that reporting and notification of errors is important.

What is a "serious error"?

It seems there are two aspects to the definition and these have different functions.

First, there is the criteria for investigation by IPCO, explained at 14.29, that outlines the circumstances in which an error may be classified as "serious". These include:

• Technical errors relating to the CSP secure-disclosure systems which result in a significant number of erroneous disclosures;
• Errors when a public authority has, as a consequence of relying on the wrong data, initiated a course of action that has an adverse impact on someone (for example, sharing information with another public authority stating a person is suspected of a crime; when an individual is visited or a search warrant is executed; or there is an arrest).
• Errors which result in the wrongful disclosure of a large volume of communications data or a particularly sensitive data set.

The report explains (14.30) that, "in cases where an error may have potentially occurred, an in-depth and detailed investigation is conducted to determine the circumstances and impact." This was the 33 investigations, of which 9 did not meet the above criteria. The remaining 24 are covered by the annex to the report.

The second - and different - definition of a "serious error" is found in section 231of the Investigatory Powers Act 2016. Its purpose is also different.

Here, a serious error is one where "the Commissioner considers that the error has caused significant prejudice or harm to the person concerned" (s 231(2)).

Where that type of error exists then the Commissioner must under s 231(1) notify the affected person that an error was made, but only if the Commissioner considers that

it is in the public interest for the person to be informed of the error (s 231(1)(b)).
In deciding whether it will be in the public interest, s 231(4) states that the Commissioner must, in particular, consider—
(a) the seriousness of the error and its effect on the person concerned, and
(b) the extent to which disclosing the error would be contrary to the public interest or prejudicial to—
      (i) national security,
      (ii) the prevention or detection of serious crime,
     (iii) the economic well-being of the United Kingdom, or
     (iv) the continued discharge of the functions of any of the intelligence services.

The provision of the information about errors is consistent with the requirements of s 231(8): annual reports must state (a) the number of relevant errors of which the Investigatory Powers Commissioner has become aware, (b) the number of relevant errors which the Commissioner decided were serious errors, and (c) the number of persons informed under subsection (1) during that year.

More than this, however, the IPC has made a choice to be very transparent about those investigations. There is information about the nature of the errors, the investigations and, to some extent, the effects of the errors.

That said, the regime leaves some things unclear.

What can and cannot be inferred from the report?

It is clear that:

• there were 24 serious errors in terms of the IPC classification, and
• there were 8 notifications under s 231.

But among the things we do not know how many of the 24 serious errors were also serious errors in section 231 terms - errors that "caused significant prejudice or harm" - but which were not notified. We should not infer that 8 of the 24 were errors of that kind because, for instance, one error may have affected more than one individual (see, eg, 14.33).

It is possible, though, to speculate by mapping the individual investigations in the Annex against the report's text at 14.33. It perhaps gives an indication of how the Commissioner is undertaking the evaluation required by s 231(4)(a). Among the consequences of the 24 errors, 19 people either had their premises searched under warrant or were arrested on suspicion of offences, including arrest on suspicion of murder in one case and numerous others related to sexualised contact with children on social media or indecent images of children (14.33, Annex B). If we presume that notifications will only occur in the most serious of cases, and noting that two ongoing investigations relate to errors affecting 10 people (so it is likely no notification has yet occurred), then the notifications probably all related to errors in that group of 19, rather than other categories identified at 14.33 of police visiting homes or delays to welfare checks). One possible inference is that anyone who is arrested will be notified, and anyone subject to search warrant will probably be notified, but it is difficult to say this or more with any certainty.

It seems impossible to say anything at all about whether or how there has the public interest balancing required by s 231(4)(b). We know that at least one person who was either arrested or had their premises searched was not notified, but we do not know why there was no notification.

It is troubling that individuals may have suffered significant prejudice or harm at the hands of the state and the regime for reporting obfuscates this.

However, the substantive implications of the law and the reporting process are still more worrying. While there may be genuine national security reasons not to notify a person that they have been affected by an error, the current framework does not provide for notification at a later point where, for example, notification would no longer pose a risk to national security (eg, the security-sensitive dimension of information has subsequently been disclosed elsewhere).

The legislative and policy choices

There are two major choices that arise.

The first is a policy choice. The Act sets out what the IPC must report on, but the IPC has control over how it presents that information and, to some extent (as the annex makes clear) how much information it provides.

It would be very helpful for the IPC to indicate how many serious errors met the s 231 criteria and how many notifications were not made on public interest grounds. It may be that there are genuine security reasons that prevent comprehensive details being provided, but at least some information would be valuable and appropriate.

The second is a legislative choice and it relates to whether, if a notification has been denied, it might be made later.

These problems were identified when the Investigatory Powers Bill was being considered by Parliament. The Report of the Draft Bill Committeecited (para 614) the evidence of the Bingham Centre for the Rule of Law (and I was a co-author of that evidence) and our view that the approach to error reporting and notification was a matter of "profound concern", quoting our evidence:

We accept fully that there will be circumstances where a person has suffered significant prejudice or harm but that there will be good reasons (eg, national security) why they should not be notified, and it is right that the legislation provides for that. However, it is entirely inappropriate that the legislative presumption is against notification and that the legislation does not provide for notification at a future point when there are no longer reasons for secrecy. The rule of law requires access to justice, and this means that a person who is wronged should have an effective right to a remedy. This is especially so when that wrong has been at the hands of the state, and when the wrong has resulted in significant prejudice or harm.

Our recommendation was that where a person has not been notified on the basis of public interest requirements then the non-notification should be reviewed every five years and if the public interest in non-notification is no longer satisfied then the person is to be notified of the relevant error, with the provision of relevant particulars.

That is a far more challenging matter and really remains a matter for the legislature. Although the statute could arguably be read as not precluding notification some time after the error and its effect, it is probably not something the IPC can or should take upon itself because it expressly fell for legislative consideration and was not taken up. However, it would not be out of place for the IPC to address the issue and identify it as a matter for the legislature.

Conclusions and future reports

The IPC report is welcome. The degree of transparency about errors is warranted and wise, and illustrates clearly that substantial information can be provided with absolutely no risk to national security.

There are unquestionably many challenges for the IPC. Those above are only two, but it is to be hoped that they are met in future reports, with, at least,

• identification and acknowledgement of how often and why there were not notifications of s 231 serious errors, and
• a consideration of the possibility of later notification.

It is to be hoped the legislature will also consider those matters and take action.

Postscript (6 Feb 2018)

I am grateful to Sam Smith (@smithsam) and Joshua Rozenberg (@JoshuaRozenberg) for picking up something I missed in Annex B, which is that error investigations 1 and 8 are reported using exactly the same words. That raises a question about whether these are two separate errors but reported in the same terms, or whether they are an indvertent duplicate and so they represent only one error investigation.

If they are duplicates then that reduces the total error investigations to 23, and it would seem likely that all individuals subjected either to arrest or execution of a search warrant were notified. That would obviously be a good thing. However, that conclusion is still obviously speculative as regards the evaluation of what makes an error serious enough to wrrant notification, and it still does not reveal anything about the anything about whether and how any public interest balancing is done.

In any event, it is to be hoped that IPCO will resolve any doubt about whether investigations 1 and 8 are duplicates or represent two investigations.