Legislative Scrutiny: Covert Human Intelligence Sources (Criminal Conduct) Bill Contents

7Adequacy of oversight mechanisms

83.In his report into the death of Patrick Finucane, Sir Desmond Da Silva QC, stated that:

“[…] I have not concluded that the running of agents within terrorist groups is an illegitimate or unnecessary activity. On the contrary, it is clear that the proper use of such agents goes to the very heart of tackling terrorism. The principal lesson to be learned from my Report, however, is that agent-running must be carried out within a rigorous framework. The system itself must be so structured as to ensure adequate oversight and accountability. Structures to ensure accountability are essential in cases where one organisation passes its intelligence to another organisation which then becomes responsible for its exploitation.

It is essential that the involvement of agents in serious criminal offences can always be reviewed and investigated and that allegations of collusion with terrorist groups are rigorously pursued.”75

84.Sir Desmond da Silva QC’s conclusions are consistent with the requirements of human rights law. For any interference with human rights to be considered “in accordance with the law” for the purposes of the ECHR, the law that governs it must contain effective safeguards against abuse. Does the Bill provide the rigorous framework of oversight and accountability necessary to safeguard against abuse of the exceptional power to authorise criminal conduct? In their submission to the Committee, the law reform and human rights organisation Justice described the Bill as “extremely limited in its oversight mechanisms” and summarised its safeguards as being “woefully inadequate”.76

Internal oversight

85.Published with the Bill, the draft revised Code of Practice provides detail on the way in which the CCA process will operate. It notes that only a designated authorising officer within a public authority may make a CCA.77 CCAs must be made in writing unless urgent (when the full detail should subsequently be recorded as soon as possible), and authorising officers cannot authorise themselves to carry out criminal conduct. Otherwise, in respect of oversight, the Code of Practice provides for how applications for authorisations ‘should’ (not must) be made and recorded;78 and how authorisations once granted ‘should’ (not must) be kept under regular review by the authorising officer and subjected to audit by the CHIS controller.

86.The Code of Practice is issued pursuant to section 71 of RIPA. It can be revised at any time, but only by an order of the Secretary of State that has been laid before Parliament and approved by a resolution of each House.79

Oversight by the Investigatory Powers Commissioner

87.In respect of external oversight, the Bill does no more than bring CCAs within the responsibility of the Investigatory Powers Commissioner (IPC).

88.The IPC must be a senior judicial figure, and this requirement is well met by the current incumbent, Sir Brian Leveson.80 The IPC already has an obligation to keep under review a wide range of covert investigatory functions.81 These relate to the interception of communications and acquisition of data, covert surveillance and the use of CHIS. The IPC, so far as directed by the Prime Minister, must also keep under review any aspect of the functioning of the intelligence services (or Her Majesty’s Forces or the Ministry of Defence when engaging in intelligence activities).82 It is now known that one such direction from the Prime Minister (known as the ‘Third Direction’) requires the IPC to scrutinise the authorisation of criminal conduct by MI5.83

89.In carrying out his or her review function, which under the Bill will include review of the use of CCAs, the IPC84 has the power to conduct investigations, inspections and audits. However, these are oversight functions only. The IPC plainly does not have the capacity to investigate every time a CCA is used.

90.Otherwise the IPC’s oversight role under the Bill is restricted to covering the use of the power to grant CCAs in his annual report to the Prime Minister.85 This annual report must be published and laid before Parliament, but may first be redacted.86

91.In their submissions to the Committee, both Justice and Reprieve et al, highlighted what they considered was a need for greater transparency than the Bill currently provides. Justice commented that:

“Transparency is essential in establishing legitimacy for the use of CHIS […] it is vital that the public understand how widely such powers are used, and have effective mechanisms for challenging overreach by the state.”87

92.Reprieve et al compared the provisions of the Bill with the arrangements in place in other jurisdictions:

“Once more, the oversight powers in the Bill are far weaker than those operated by the UK’s intelligence partners. The FBI has repeatedly released details of the number of crimes committed by its agents as part of efforts to increase transparency over the use of this power […] Canada’s new legislation requires details of the use of CHIS to be issued in an annual report, as this Bill does, but requires it to include not only the number of authorisations issued each year but also the nature of the acts committed–which this Bill does not.”88

93.The IPC’s ability to conduct even a high-level review of the use of CCAs effectively will depend on the provision of clear data on their use by the bodies authorised to make them. In this regard, the most recent available annual report of the IPC is of some concern. Whilst no concerns were raised about the authorisations examined, the IPC noted that

“MI5 lack reliable central records around [participation in criminal] activity and that there is no consistent review process. We recommended that MI5 should implement a system to capture accurately the extent of participation in criminality by CHIS across the organisation. This should record the number of […] authorisations, the nature of the activity authorised and the number of times each authorisation has been relied upon.”89

Lack of prior independent scrutiny or approval for CCAs

94.The case law of the European Court of Human Rights indicates that where public authorities are being granted exceptional powers with obvious potential for interfering with human rights, such as the power to grant CCAs, the best form of protection against abuse is prior independent scrutiny by a judge.90 The IPC’s role in the oversight of CCAs is entirely ‘after the event’. The IPC carries out no check on CCAs before they are made, nor does the Bill provide for the IPC to be informed of authorisations at the time they are made so that prompt scrutiny can take place.

95.The lack of prior independent scrutiny for CCAs under the Bill stands in marked contrast to the procedures in place for other investigatory functions. For example:

a)Police search warrants–the police make an application to magistrates who must authorise the warrant in advance for it to be valid.91 The magistrates must be satisfied that there are objectively reasonable grounds for the warrant.

b)Targeted interception of communications (or ‘phone-tapping’) warrants–these warrants must first be approved by the Secretary of State (or Scottish Ministers) and then authorised by a Judicial Commissioner before they can be activated.92 This is referred to as the ‘double-lock’, which the IPC’s website states “ensures that all Investigatory Powers Act warrants issued are necessary, proportionate and lawful”.93

c)Retention of data - the power to require telecommunications operators to retain communications data for investigatory purposes can be exercised by the Secretary of State but must be approved by a Judicial Commissioner (the ‘double lock’).94

96.The primary concern in respect of each of these examples is to avoid unnecessary or excessive interference with the privacy of the subject. While privacy is a vitally important right, protected under Article 8 ECHR, the authorisation of criminal conduct gives rise to significant risks of more damaging human rights violations - including physical violence. As the former Director of Public Prosecutions, Sir Ken MacDonald, put it: “[u]nder this bill it will be easier for a police officer to commit a serious crime than to tap a phone or search a shed”.95

97.It is notable that the Bill as it stands imposes no requirement that the belief of the individual making the CCA that it is necessary must be a reasonable belief (see further Chapter 5 above). A significant advantage of prior judicial scrutiny would be that it would allow a requirement of objectively reasonable belief to be applied before the authorisation is made. This would safeguard against unreasonable authorisations being made. It would also prevent the CHIS themselves only finding out after the event that their criminal conduct was not covered by a valid CCA.

98.Bringing CCAs within the review function of the IPC provides some reassurance of independent scrutiny of their use after the event. However, this is insufficient protection for human rights. It is unacceptable for this Bill to propose that the authorisation of crime, and the consequential grant of civil and criminal immunity, should have fewer safeguards than the authorisation of search warrants and phone tapping.

99.In his annual report the IPC must provide as much detail on the use of CCAs as possible, in the interests of transparency. Bodies permitted to make CCAs must also ensure accurate records are made and shared with the IPC.

100.The Bill must be amended to include a mechanism for prior judicial approval of CCAs (with appropriate provision for urgent cases). It is noted that Judicial Commissioners appointed under the Investigatory Powers Act 2016 carry out a prior approval function in respect of other covert investigatory activities. This function of Judicial Commissioners could be extended to cover the grant of CCAs.

75 The Report of the Patrick Finucane Review, The Report of the Patrick Finucane Review, HC 802-I, December 2012, paras 112–113


77 The designated authorising officer is identified by rank or office in the Regulation of Investigatory Powers (Directed Surveillance and Covert Human Intelligence Sources) Order 2010

78 The only strict requirement is that “the public authority must ensure that the case for the authorisation is presented in the application in a fair and balanced way” (Code of Practice at 6.17)

80 Former President of the Queen’s Bench Division and Head of Criminal Justice - see https://www.ipco.org.uk/

81 Investigatory Powers Act 2016, section 229

82 Investigatory Powers Act 2016, section 230

84 With the assistance of Judicial Commissioners, to whom the IPC may delegate functions- see Investigatory Powers Act 2016, section 227(8), and staff

85 CHIS Bill, Clause 4, which inserts a new section 234(2)(ba) Investigatory Powers Act 2016

86 Investigatory Powers Act 2016, section 234(7)


88 Reprieve et al (CHIS0002)

89 Investigatory Powers Commissioner’s Office, Annual Report of the Investigatory Powers Commissioner 2018, HC 67, para 6.8

90 See Roman Zakharov v Russia, 4 December 2015 (App.No. 47143/06) at [233]: ” Review and supervision of secret surveillance measures may come into play at three stages: when the surveillance is first ordered, while it is being carried out, or after it has been terminated. As regards the first two stages, the very nature and logic of secret surveillance dictate that not only the surveillance itself but also the accompanying review should be effected without the individual’s knowledge. Consequently, since the individual will necessarily be prevented from seeking an effective remedy of his own accord or from taking a direct part in any review proceedings, it is essential that the procedures established should themselves provide adequate and equivalent guarantees safeguarding his rights. In addition, the values of a democratic society must be followed as faithfully as possible in the supervisory procedures if the bounds of necessity, within the meaning of Article 8 § 2, are not to be exceeded. In a field where abuse is potentially so easy in individual cases and could have such harmful consequences for democratic society as a whole, it is in principle desirable to entrust supervisory control to a judge, judicial control offering the best guarantees of independence, impartiality and a proper procedure.”

92 Investigatory Powers Act 2016, section 23. Where a warrant is urgent it can be granted without approval from the Judicial Commissioner, but the Judicial Commissioner must be notified and must approve the warrant within 3 days or it will lapse - see sections 24–25.

94 Investigatory Powers Act 2016, section 89

95Government must not give green light to lawbreaking”, The Times, 5 October 2020

Published: 10 November 2020