What are cookies?
Cookies are small pieces of information that are stored on your hard drive to allow the British Institute of International and Comparative Law to recognise you when you visit. They can remember your preferences by gathering and storing information. They do not identify you as an individual user, just the computer used. Cookies cannot be used to run programs or create viruses on your computer. Cookies do not give the British Institute of International and Comparative Law access to your computer.
What types of essential cookies does BIICL use?
We also use some third party cookies to help us improve your user experience.
If you don't want to receive cookies.
If you would prefer not to receive cookies while browsing our site, you can set your browser so that it will not download cookies onto your computer. Doing so will still allow you to navigate through the majority of our site but possibly not all of it. If you wish to access the password protected areas of our website you will need to allow "per-session" cookies. These are temporarily used while you are visiting the site but deleted when you close your browser or log out.
Serious mistakes in exercising investigatory powers
Dr Lawrence McNamara
Serious mistakes in exercising investigatory powers
First published on UK Human Rights Blog, 4 February 2019
At the end of January the Investigatory Powers Commissioner published his first annual report for 2017. Its coverage of errors provides some very welcome transparency. But one matter remains opaque and exposes a legislative and policy challenge: when serious mistakes are made, who finds out?
In this post I set out what the IPC report says in this regard, explain the legislative framework, and then identify the challenges and choices for both law and policy. The two points I highlight are:
There is a policy choice underpinning the IPC report about what information to present, and what not to present. It would be helpful and appropriate for the IPC to provide more clarity about how often people were affected by errors but notinformed of it.
There are policy and legislative challenges that remain with regard to whether people will - as it currently seems - neverbe informed that they were affected by a serious error.
What the IPC report tells us about errors
The IPC devotes considerable attention to explaining the errors that have been made by agencies (including MI5, MI6 and GCHQ) exercising investigatory powers. Together, the chapter on errors and breaches and an annex outlining each investigation of a serious error comprise a quarter of the report.
The report states (at 14.25 and 14.30) that in 2017 there were 926 errors reported to IPCO and (its predecessor) IOCCO, and of those 33 were "considered to be serious and resulted in further investigation". Of those 33, 24 were deemed to be "serious errors".
The report also states that during the year "the IPC notified 8 individuals of a serious error" (14.5).
The consequences of errors are evident in the annex and in the report itself (14.34):
We should be in no doubt that reporting and notification of errors is important.
What is a "serious error"?
It seems there are two aspects to the definition and these have different functions.
First, there is the criteria for investigation by IPCO, explained at 14.29, that outlines the circumstances in which an error may be classified as "serious". These include:
The report explains (14.30) that, "in cases where an error may have potentially occurred, an in-depth and detailed investigation is conducted to determine the circumstances and impact." This was the 33 investigations, of which 9 did not meet the above criteria. The remaining 24 are covered by the annex to the report.
The second - and different - definition of a "serious error" is found in section 231of the Investigatory Powers Act 2016. Its purpose is also different.
Here, a serious error is one where "the Commissioner considers that the error has caused significant prejudice or harm to the person concerned" (s 231(2)).
Where that type of error exists then the Commissioner must under s 231(1) notify the affected person that an error was made, but only if the Commissioner considers that
The provision of the information about errors is consistent with the requirements of s 231(8): annual reports must state (a) the number of relevant errors of which the Investigatory Powers Commissioner has become aware, (b) the number of relevant errors which the Commissioner decided were serious errors, and (c) the number of persons informed under subsection (1) during that year.
More than this, however, the IPC has made a choice to be very transparent about those investigations. There is information about the nature of the errors, the investigations and, to some extent, the effects of the errors.
That said, the regime leaves some things unclear.
What can and cannot be inferred from the report?
It is clear that:
But among the things we do not know how many of the 24 serious errors were also serious errors in section 231 terms - errors that "caused significant prejudice or harm" - but which were not notified. We should not infer that 8 of the 24 were errors of that kind because, for instance, one error may have affected more than one individual (see, eg, 14.33).
It is possible, though, to speculate by mapping the individual investigations in the Annex against the report's text at 14.33. It perhaps gives an indication of how the Commissioner is undertaking the evaluation required by s 231(4)(a). Among the consequences of the 24 errors, 19 people either had their premises searched under warrant or were arrested on suspicion of offences, including arrest on suspicion of murder in one case and numerous others related to sexualised contact with children on social media or indecent images of children (14.33, Annex B). If we presume that notifications will only occur in the most serious of cases, and noting that two ongoing investigations relate to errors affecting 10 people (so it is likely no notification has yet occurred), then the notifications probably all related to errors in that group of 19, rather than other categories identified at 14.33 of police visiting homes or delays to welfare checks). One possible inference is that anyone who is arrested will be notified, and anyone subject to search warrant will probably be notified, but it is difficult to say this or more with any certainty.
It seems impossible to say anything at all about whether or how there has the public interest balancing required by s 231(4)(b). We know that at least one person who was either arrested or had their premises searched was not notified, but we do not know why there was no notification.
It is troubling that individuals may have suffered significant prejudice or harm at the hands of the state and the regime for reporting obfuscates this.
However, the substantive implications of the law and the reporting process are still more worrying. While there may be genuine national security reasons not to notify a person that they have been affected by an error, the current framework does not provide for notification at a later point where, for example, notification would no longer pose a risk to national security (eg, the security-sensitive dimension of information has subsequently been disclosed elsewhere).
The legislative and policy choices
There are two major choices that arise.
The first is a policy choice. The Act sets out what the IPC must report on, but the IPC has control over how it presents that information and, to some extent (as the annex makes clear) how much information it provides.
It would be very helpful for the IPC to indicate how many serious errors met the s 231 criteria and how many notifications were not made on public interest grounds. It may be that there are genuine security reasons that prevent comprehensive details being provided, but at least some information would be valuable and appropriate.
The second is a legislative choice and it relates to whether, if a notification has been denied, it might be made later.
These problems were identified when the Investigatory Powers Bill was being considered by Parliament. The Report of the Draft Bill Committeecited (para 614) the evidence of the Bingham Centre for the Rule of Law (and I was a co-author of that evidence) and our view that the approach to error reporting and notification was a matter of "profound concern", quoting our evidence:
Our recommendation was that where a person has not been notified on the basis of public interest requirements then the non-notification should be reviewed every five years and if the public interest in non-notification is no longer satisfied then the person is to be notified of the relevant error, with the provision of relevant particulars.
That is a far more challenging matter and really remains a matter for the legislature. Although the statute could arguably be read as not precluding notification some time after the error and its effect, it is probably not something the IPC can or should take upon itself because it expressly fell for legislative consideration and was not taken up. However, it would not be out of place for the IPC to address the issue and identify it as a matter for the legislature.
Conclusions and future reports
The IPC report is welcome. The degree of transparency about errors is warranted and wise, and illustrates clearly that substantial information can be provided with absolutely no risk to national security.
There are unquestionably many challenges for the IPC. Those above are only two, but it is to be hoped that they are met in future reports, with, at least,
It is to be hoped the legislature will also consider those matters and take action.
Postscript (6 Feb 2018)
I am grateful to Sam Smith (@smithsam) and Joshua Rozenberg (@JoshuaRozenberg) for picking up something I missed in Annex B, which is that error investigations 1 and 8 are reported using exactly the same words. That raises a question about whether these are two separate errors but reported in the same terms, or whether they are an indvertent duplicate and so they represent only one error investigation.
If they are duplicates then that reduces the total error investigations to 23, and it would seem likely that all individuals subjected either to arrest or execution of a search warrant were notified. That would obviously be a good thing. However, that conclusion is still obviously speculative as regards the evaluation of what makes an error serious enough to wrrant notification, and it still does not reveal anything about the anything about whether and how any public interest balancing is done.
In any event, it is to be hoped that IPCO will resolve any doubt about whether investigations 1 and 8 are duplicates or represent two investigations.
Ensuring greater protection for fundamental rights in developing EU counter-terrorism policies
Tufyal Choudhury | 21st May 2021
The Terrorist Offenders (Restriction of Early Release) Bill: What’s Wrong with Retrospectivity?
Ronan Cormacain | 24th February 2020
Restricting Foreign Direct Investment: the Rule of Law argument
Anthony Wenton | 18th June 2019
Weekly Update 30 September 2022
30th September 2022
Weekly Update 15 July 2022
15th July 2022
Weekly Update 1 April 2022
1st April 2022