<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">The GCHQ/NSA narrative on bulk interception appears to be that it's OK provided the data isn't<div>looked at by humans without a warrant. There seems to be an assumption that it's OK to data-mine</div><div>bulk data, but that before the data belonging to an individual is looked at by humans there has to be a warrant.</div><div><br></div><div>I think the first part of that argument has a fairly straightforward legal basis (whatever my personal view</div><div>might be on the morality of it). RIPA S.2(2) defines intercept to occur when content is made available</div><div>"<span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px; text-align: justify;">to a PERSON other than the sender or intended </span><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px; text-align: justify;">recipient of the communication" (my emphasis). </span></div><div><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px; text-align: justify;">I doubt a court would agree with the contention that software under </span><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px; text-align: justify;">the control of a person is equivalent to a person.</span></div><div style="text-align: justify;"><br></div><div style="text-align: justify;"><font face="arial, helvetica, verdana, sans-serif"><span style="font-size: 12px; line-height: 18px;">My interest is the legal theory which allows them to look at the output from that chain. </span></font></div><div style="text-align: justify;"><font face="arial, helvetica, verdana, sans-serif"><span style="font-size: 12px; line-height: 18px;"><br></span></font></div><div style="text-align: justify;"><font face="arial, helvetica, verdana, sans-serif"><span style="font-size: 12px; line-height: 18px;">S.9(6)(c) is quite clear about the period for which a new warrant is valid: "</span></font><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">the period of three months beginning</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">with the day of the warrant’s issue". So if you have a bulk data store, and are relying on S.2(2) to permit you</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">to data-mine it, why would a S.6 warrant give a person any authority to look at the data? S.2(8) could be read</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">to outlaw the storage of bulk data full stop ("</span><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">shall include any case in which any of the contents of the communication, </span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">while being transmitted, are diverted or recorded so as to be available to a person subsequently.") but even taking</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">the most favourable to the authorities reading of "so as to be available", which only covers when the data is</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">actually made available, it seems to outlaw "store it, then get a warrant later". S.2(7) is about data at rest which the</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">subscriber has access to, voicemail and inboxes and suchlike ("</span><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">storing it in a manner that enables the intended</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">recipient to collect it or otherwise to have access to it") but S.2(8) doesn't appear to refer to subscriber storage,</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">rather to storage as part of the interception.</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;"><br></span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">So I think that a narrow reading of S.2(8) outlaws storage without a warrant and later extraction under warrant.</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">But I can't think of any reading of S.2(8) which permits you to store data, search it automatically (under a reading</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">of S.2(2) which permits non-human access), get a warrant on the basis of the selectors that throws up, and</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">then read the content under a S.6 warrant. </span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;"><br></span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">So if GCHQ are storing bulk data, analysing it, then applying for warrants to access the content (as they</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">seem to be admitting), I think it breaches RIPA S.1(1) because S.2(8) explicitly forbids access to recorded</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">content.</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;"><br></span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">Thoughts?</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;"><br></span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;">ian</span></div><div style="text-align: justify;"><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px;"><br></span></div><div><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px; text-align: justify;"><br></span></div><div><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px; text-align: justify;"><br></span></div><div><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px; text-align: justify;"><br></span></div><div><span style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px; text-align: justify;"><br></span></div><span style="font-family: arial, helvetica, verdana, sans-serif; font-size: 12px; line-height: 18px; text-align: justify; background-color: rgb(255, 255, 255);"> <br></span><div><br></div><div><br></div></body></html>