Retrospective Warrants: Legal Theory?

[Ian Batten]

The GCHQ/NSA narrative on bulk interception appears to be that it's OK provided the data isn't
looked at by humans without a warrant.   There seems to be an assumption that it's OK to data-mine
bulk data, but that before the data belonging to an individual is looked at by humans there has to be a warrant.

I think the first part of that argument has a fairly straightforward legal basis (whatever my personal view
might be on the morality of it). RIPA S.2(2) defines intercept to occur when content is made available
"to a PERSON other than the sender or intended recipient of the communication" (my emphasis). 
I doubt a court would agree with the contention that software under the control of a person is equivalent to a person.

My interest is the legal theory which allows them to look at the output from that chain.  

S.9(6)(c) is quite clear about the period for which a new warrant is valid: "the period of three months beginning
with the day of the warrant’s issue".  So if you have a bulk data store, and are relying on S.2(2) to permit you
to data-mine it, why would a S.6 warrant give a person any authority to look at the data?  S.2(8) could be read
to outlaw the storage of bulk data full stop ("shall include any case in which any of the contents of the communication, 
while being transmitted, are diverted or recorded so as to be available to a person subsequently.")  but even taking
the most favourable to the authorities reading of "so as to be available", which only covers when the data is
actually made available, it seems to outlaw "store it, then get a warrant later".  S.2(7) is about data at rest which the
subscriber has access to, voicemail and inboxes and suchlike ("storing it in a manner that enables the intended
recipient to collect it or otherwise to have access to it") but S.2(8) doesn't appear to refer to subscriber storage,
rather to storage as part of the interception.

So I think that a narrow reading of S.2(8) outlaws storage without a warrant and later extraction under warrant.
But I can't think of any reading of S.2(8) which permits you to store data, search it automatically (under a reading
of S.2(2) which permits non-human access), get a warrant on the basis of the selectors that throws up, and
then read the content under a S.6 warrant.  

So if GCHQ are storing bulk data, analysing it, then applying for warrants to access the content (as they
seem to be admitting), I think it breaches RIPA S.1(1) because S.2(8) explicitly forbids access to recorded
content.

Thoughts?

ian





 


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.chiark.greenend.org.uk/pipermail/ukcrypto/attachments/20140617/2bb720d7/attachment.html>