Whistleblowers have come to us alleging spy agency wrongdoing, says UK auditor IPCO

Three UK law enforcement agents blew the whistle about unlawful state surveillance to the Investigatory Powers Commissioner’s office – and one of those incidents was bad enough for the investigation to still be ongoing today.

The investigation’s existence was revealed in audit body IPCO’s annual report for 2018-19, published (PDF) earlier this week.

In addition, an MI6 spy “engaged in serious crime overseas” which senior managers tried to cover up – only to be forced to admit what had happened when the agent crossed “red lines”.

Meanwhile, police forces were found by IPCO to be treating applications to use spying powers as a tickbox exercise, perhaps unsurprisingly given that these are self-authorisations rubberstamped by police managers themselves. IPCO found that forces self-authorising surveillance fishing expeditions tended to use “templated or generic” reasons for doing so, often ignoring the “necessity and proportionality of the tactics requested”.

The auditor warned that police were paying less attention to supposedly strict surveillance laws, saying: “There were several forces where the processes for urgent applications for both surveillance and property interference fell below the standards expected, which was contrary to our findings from the previous year.”

On the bright side, court cases brought by privacy campaign organisations were having positive effects, with bulk personal datasets (collections of large amounts of personal information) being handled a little bit more diligently.

“To provide oversight that satisfies this judgment, IPCO reviewed the use of bulk data at GCHQ and has now incorporated the sharing of bulk data with foreign partners into its regular oversight and inspection arrangements,” said IPCO in a statement.

Some allegations 'could not be substantiated' ... but third case being probed

As for the whistleblowers, IPCO tried to gloss over them in a single paragraph of its report, saying:

The whistleblowing pathway, as explained by IPCO in its report, stems from section 237 of the Snoopers’ Charter Investigatory Powers Act. Though worded very obscurely, this means non-disclosure agreements and normal employment contract provisions about confidential information cannot be enforced against police workers and others who talk to IPCO’s commissioners about wrongdoing in their organisations.

“Although it is important to note that IPCO does not perform an ombudsman role (such a function is properly that of the Investigatory Powers Tribunal), IPCO’s statutory information gateway enables both current and former staff of the public authorities which we oversee to raise any serious concerns they have with us,” said IPCO.

The Investigatory Powers Commissioner’s Office functions mostly as an auditor that trawls through the use of surveillance powers by State agencies, though its judicial commissioners also provide before-the-event signoffs in some cases – and IPSO was keen to stress in its report that occasionally it does reject applications by police and other public sector bodies to spy on members of the public. ®