GCHQ Officer on What His Agency Actually Does and Why More Investigatory Power Is Necessary

‘Peter’ 

November 5, 2015 

My work at GCHQ and the surveillance myths that need busting 

Many words about GCHQ have appeared over the last two years – but rarely have they been GCHQ’s own words. We welcome the debate now under way in parliament and among the public about our work. We need public consent for what we do – we wouldn’t want to do our jobs without it. We want the debate to be informed by facts, not half-understood inferences. We do not expect to persuade everyone to support what we do, but GCHQ certainly does bear a responsibility to make sure the discussion about us is based in reality. I want to cover two particular topics frequently misunderstood: bulk interception and encryption. 

The draft bill published on Wednesday responds to three independent reviews carried out into investigatory powers. The reviews were unanimous in their agreement that the powers currently available to the intelligence and security services remain essential. And while the courts have recently confirmed that the bulk interception regime was lawful, the reviewers concluded that the legal framework needed updating. We are confident that the draft bill places our powers on a clearer footing and strengthens safeguards and oversight to a world-leading standard. The draft bill also enables GCHQ and our sister agencies to meet the challenges of technological advances. As the internet grows exponentially, and smartphones create an explosion in information, increasingly tech-savvy criminals and terrorists attempt to hide in the mass of data and the dark recesses of the web.

Our best – often our only – chance to detect them is to search and analyse datasets in which they might be found. All major UK counter-terrorism investigations of the last decade have relied on analysis of data collected at scale to understand and disrupt the threat. This is particularly critical when a threat emanates from overseas, where we and other agencies have fewer options to illuminate it. Many other aspects of our work depend on it too, including child exploitation, cybersecurity and serious crime. 

In 2014, GCHQ analysis of bulk data uncovered a previously unknown individual in contact with Isis attack-planners in Syria. Although he tried to hide his activity, we were able to use bulk data to spot that he had travelled to Europe, where he planned to carry out an attack. The data was provided to the authorities in that country, enabling the successful disruption of the plot, including capturing the home-made bombs he had manufactured. 

Use of these bulk data powers is not indiscriminate. GCHQ cannot and would not hoover up every piece of information. It would be illegal for us to carry out “mass surveillance”, nor would we want to, even if the law allowed it. And stringent access controls apply before analysts may examine any particular piece of data. We always focus on maximising the probability of identifying people who wish to do us harm. The scale of internet data is staggering compared to 10 years ago, so while the volume we scan may seem large, it is a minute slice of the whole. Those with unfettered access to our operations have quickly dispelled the mass surveillance myth. David Anderson QC examined examples of cases reliant on bulk interception, interrogated our analysts and looked at our intelligence reports. He wrote: “They leave me in not the slightest doubt that bulk interception, as it is currently practised, has a valuable role to play in protecting national security.” The parliamentary intelligence and security committee stated: “Our inquiry has shown that the agencies do not have the legal authority, the resources, the technical capability, or the desire to intercept the communications of British citizens, or of the internet as a whole. GCHQ is not reading the emails of everyone in the UK.” Sir Anthony May, one of Britain’s most senior judges, conducted an investigation and asked the question whether we engage in random mass intrusion into the private affairs of innocent citizens. His answer was “emphatically no”.

There is another myth that badly needs busting, namely the idea that GCHQ is against encryption and would not disclose vulnerabilities in software. We live more and more of our lives online and it is right that companies which hold the personal data of their customers take the strongest steps to keep it secure. It is also right that people should be able to interact with their bank and other businesses with confidence. As well as being civil servants charged with a unique mission, our own staff live everyday lives where they, their family and their friends depend on the same secure technology as everyone else. 

The draft bill essentially repeats what the law currently says about encryption. 

We do not seek to ban encryption, we do not want mandatory “back doors” in products and we frequently warn companies about security vulnerabilities we find. On a daily basis we advise companies and public services about how to deal with specific cyber-attacks. No organisation does more to protect UK cybersecurity than GCHQ. In September 2015, Apple publicly credited CESG (the information assurance arm of GCHQ) with the detection of a vulnerability in its iOS operating system for iPhones and iPads which could have been exploited. That vulnerability has now been patched. 

Dealing with encryption and analysing data at scale were crucial for GCHQ’s predecessors at Bletchley Park to succeed in their mission. Protecting life and liberty is our heritage, but it’s our current and future duty too. We need legislation and powers fit for the modern world to carry out that duty.