Today I wish to notify Parliament of a recent Investigatory Powers Tribunal (IPT) judgment regarding compliance issues identified within a specific MI5 technology environment, and outline the handling of those issues once identified by MI5 and the Home Office.
The IPT judgment in this case has found that MI5 unlawfully held data within the relevant technology environment between late 2014 and April 2019, and that the relevant Home Secretaries acted unlawfully for the period from December 2016 to April 2019, by approving warrants concerning material held in the technology environment in which applicable statutory requirements had not been complied with and failing to make adequate inquiries of MI5, despite being presented with compliance risks. During the proceedings, MI5 and the Home Office conceded a breach of article 8 of the European Convention of Human Rights—regarding privacy rights—and, consequently, of the Human Rights Act 1998. Further to this, the tribunal has noted that it was not the case that MI5 should never have held the material at all, only that some small part of it had been retained for too long, and that the material had been used for valuable national security purposes.
When the scale of the issue became clear in 2019 the then Home Secretary, my right hon. Friend the Member for Bromsgrove (Sajid Javid), established an independent review conducted by Sir Martin Donnelly. His compliance improvement review identified three areas where improvements could be made. These were improvements to support an effective compliance culture across MI5; improvements to ensure more effective sharing of information between MI5 and the Home Office to identify emerging issues; and improvements to ensure increased legal input to the MI5 management board and ensure closer joint working between MI5 and Home Office legal advisors. The review made a total of 14 recommendations to address these issues. The then Home Secretary and the director general MI5 agreed with the review’s conclusions and immediately began a programme of work to address them.
In 2021 Mary Calam independently verified the implementation of Sir Martin’s recommendations. She concluded that
“a huge amount of work has been done through the [compliance improvement] programme and the remediation work. Not all Sir Martin’s recommendations have yet been fully implemented, but significant, measurable progress is evident. MI5 have used the [compliance improvement”] review to make fundamental changes across the whole organisation and develop a new legal compliance operating model intended to cope with future changes in technology and data.”
Today, all 14 of these recommendations have been addressed and MI5 continue to work on further improving their legal compliance. DG MI5 and I discuss this every quarter at the ministerial assurance group, the setting up of which was one of Sir Martin’s recommendations, and my officials maintain close contact with their MI5 counterparts in respect of legal compliance.
While the judgment is clear that there has been unlawfulness by MI5 and former Home Secretaries in the past, this relates to the period between late 2014 and April 2019 and between December 2016 and April 2019 respectively. There have been two programmes of work undertaken within MI5 focused on legal compliance: the introduction of further governance structures to ensure a more open and robust relationship between MI5 and the Home Office, and changes to the Investigatory Powers Commissioner’s Office’s inspection regime since the compliance issue came to light. The effort to address the compliance issues has been consistent and sustained since 2019.
I am aware the judgment has found that former Home Secretaries unlawfully approved warrants between December 2016 and April 2019, and I know this will trouble members of the House. However, all data obtained was in good faith and it was considered necessary and proportionate for the purposes of national security and the department took swift action in conjunction with MI5 in 2019 once the issues were identified.
I would also like to reassure Members that while this case has outlined widespread corporate failings between the Home Office and MI5, these issues are historical and the Home Office has taken steps internally to increase collaboration with MI5 and ensure there is appropriate resourcing in place within the relevant Home Office teams responsible for investigatory powers.
I also wish to be clear that there has been no finding by the tribunal that MI5 misused the data in question, nor any suggestion of this at any time during this process. As the former Home Secretary, my right hon. Friend the Member for Bromsgrove, noted in 2019, none of the risks identified relate in any way to the conduct and integrity of the staff of MI5.
Finally, l would like to reference the endorsement the tribunal has provided on the robustness of the oversight regime and safeguards contained within the Investigatory Powers Act 2016, including the adequacy of the measures available to the Investigatory Powers Commissioner.
MI5 carries out a challenging mission to protect national security and has made significant progress in respect of legal compliance since the issues were identified by the Investigatory Powers Commissioner in 2019. Its officers work on extremely complex and often fast paced issues to keep this country safe and I am grateful for their continued dedication and professionalism. I would like to reaffirm to Parliament that they have my full support and I am committed to continuing to drive forward change in this area to ensure the use of investigatory powers by ail relevant agencies is as compliant as possible.
[HCWS532]