The Secretary of State for the Home Department (Sajid Javid)
The Investigatory Powers Act 2016 provides extensive privacy safeguards and has established a robust oversight regime with independent mechanisms for redress. The Investigatory Powers Commissioner, the right hon. Lord Justice Fulford, is responsible for overseeing the use of investigatory powers by the intelligence agencies, law enforcement and other public authorities. This oversight includes a programme of inspection and audit by judicial commissioners and inspectors, reporting to the commissioner.
This statement notifies Parliament of compliance risks MI5 identified and reported within certain technology environments used to store and analyse data, including material obtained under the Investigatory Powers Act.
The investigatory powers regime is the subject of ongoing litigation where the Government continue to defend the UK’s legal framework. This does necessarily limit the extent to which it is appropriate for me to comment further on these issues, noting that the Government have, in line with their duty of candour, made the court aware of this issue in relevant litigation. The sensitivity of this issue will also be apparent. The Government will not say anything that could damage national security. To the extent that it is possible to set out in open the nature and context of the material relevant to this issue, I have done so in this statement. Protecting the UK’s national security is my top priority and it is critical that MI5 is able to continue to carry out its vital role.
The compliance risks identified relate to particular safeguards set out in the Investigatory Powers Act in relation to the processing of material that has been obtained under a warrant. Section 53 of the Act—which relates specifically to lawful interception—and parallel provisions for the Act’s other powers require the authority issuing warrants to ensure certain processing is kept to the minimum necessary for the statutory purpose, including the number of people to whom material is made available, the number of copies made and the length of time it is retained. A report of the Investigatory Powers Commissioner’s Office suggests that MI5 may not have had sufficient assurance of compliance with these safeguards within one of its technology environments.
As will be clear from the above, the compliance risks identified are limited to how material is treated after it has been obtained. They do not relate in any way to the manner in which MI5 acquires information in the first instance or the necessity and proportionality of doing so. All UK intelligence agencies treat protection of personal information seriously. MI5 has in place internal safeguards concerning the handling of such information and ensures stringent vetting of individuals who will have access to this sensitive material.
The report of the Investigatory Powers Commissioner’s Office into these risks concluded that they were serious and required immediate mitigation. The commissioner also expressed concern that MI5 should have reported the compliance risks to him sooner. In response to the commissioner’s report, MI5 has also taken immediate and substantial mitigating actions to address the concerns raised. Work to implement those mitigations is ongoing and is being treated as a matter of the highest priority, both by MI5 and the Home Office. This work is subject to review by the Investigatory Powers Commissioner to ensure that sufficient progress is being made.
It is of course paramount that UK intelligence agencies demonstrate full compliance with the law. In that context, the interchange between the commissioner and MI5 on this issue demonstrates that the world leading system of oversight established by the Act is working as it should.
Following his report, the commissioner was satisfied that the mitigating actions put in place by MI5 were sufficient for him to continue lawfully to approve decisions to issue warrants to MI5. I am also clear that none of the risks identified relate in any way to the conduct and integrity of the staff of MI5, who work tirelessly, under considerable pressure and without public recognition, to keep all of us safe.
The work MI5 does is absolutely critical, at a time when the threat from terrorism persists and continues to diversify. And the role of the Investigatory Powers Commissioner and his office is also fundamental to protecting our citizens, ensuring that our operational agencies are able to carry out their vital work in accordance with strict and proportionate privacy safeguards.
Given the importance of these issues, I have established an independent review to consider and report back to me on what lessons can be learned for the future. MI5 will also continue to work closely with the Investigatory Powers Commissioner and his team to address the concerns raised and I anticipate that the commissioner will outline his position in his annual report in due course. As the parliamentary body responsible for oversight of the intelligence services, the Intelligence and Security Committee has also been updated on this issue.
[HCWS1552]