Covert human intelligence sources: code of practice

2. Covert human intelligence sources: definitions and examples

Definition of a CHIS

2.1. Under RIP(S)A, a person is a CHIS if:

a) he or she establishes or maintains a personal or other relationship with a person for the covert purpose of facilitating the doing of anything falling within paragraph b) or c);

b) he or she covertly uses such a relationship to obtain information or to provide access to any information to another person; or

c) he or she covertly discloses information obtained by the use of such a relationship or as a consequence of the existence of such a relationship. ^[4]

2.2. A relationship is established or maintained for a covert purpose if and only if it is conducted in a manner that is calculated to ensure that one or more of the parties to the relationship is unaware of the purpose. ^[5]

2.3. A relationship is used covertly, and information obtained is disclosed covertly, if and only if the relationship is used or the information is disclosed in a manner that is calculated to ensure that one of the parties to the relationship is unaware of the use or disclosure in question. ^[6]

2.4. The 2014 Order defines a 'relevant source' as being an individual who holds an office, rank or position with the Police Service of Scotland, a police force in England or Wales, the Metropolitan Police, the City of London police force, the Police Service of Northern Ireland, the National Crime Agency, the Ministry of Defence Police, the British Transport Police, the Royal Navy Police or the Royal Military Police. Enhanced authorisation arrangements are in place for this type of source as detailed in this code. Such sources will be referred to as 'relevant sources' throughout this code.

2.5. Any Police Scotland Officer deployed as a 'relevant source' in Scotland will be required to comply with and uphold the principles and standards of professional behaviour set out in Police Scotland's Code of Ethics. Officers deployed as relevant sources from other law enforcement bodies will be required to uphold the principles and standards of professional behaviour set out in the College of Policing Code of Ethics.

Scope of 'use' or 'conduct' authorisations

2.6. Subject to the procedures outlined in Chapter 3 of this code, an authorisation may be obtained under RIP(S)A for the use or conduct of a CHIS.

2.7. For authorisation purposes, the use of a CHIS involves any action on behalf of a public authority to induce, ask or assist a person to engage in the conduct of a CHIS, or to obtain information by means of the conduct of a CHIS. ^[7] In general, therefore, an authorisation for use of a CHIS will be necessary for any steps taken by a public authority in relation to a CHIS.

2.8. The conduct of a CHIS is any conduct of a CHIS which falls within paragraph 2.1 above or is incidental to anything falling within that paragraph. In other words, an authorisation for conduct will authorise steps taken by the CHIS on behalf, or at the request, of a public authority. ^[8]

2.9. Most CHIS authorisations will be for both use and conduct. This is because public authorities usually take action in connection with the CHIS, such as tasking the CHIS to undertake covert action, and because the CHIS will be expected to take action in relation to the public authority, such as responding to particular tasking.

2.10. Care should be taken to ensure that the CHIS is clear on what is/is not authorised at any given time and that all the CHIS's activities are properly risk assessed. Care should also be taken to ensure that relevant applications, reviews, renewals and cancellations are correctly performed. A CHIS may, in certain circumstances, be the subject of different use or conduct authorisations obtained by one or more public authorities. Such authorisations should not conflict.

2.11. The reactive nature of the work of a CHIS, and the need for a CHIS to maintain cover, may make it necessary for a CHIS to engage in conduct which was not envisaged at the time the authorisation was granted, but which is incidental to that conduct. Such incidental conduct is regarded as properly authorised by virtue of sections 1(6)(a), 5 and 7(5) of RIP(S)A, even though it was not specified in the initial authorisation. This is likely to occur only in exceptional circumstances, such as where the incidental conduct is necessary to protect life and limb, including in relation to the CHIS, in circumstances that were not envisaged at the time the authorisation was granted.

Circumstances in which it would be appropriate to authorise the use or conduct of a CHIS

2.12. Public authorities are not required by RIP(S)A to seek or obtain an authorisation just because one is available (see section 30 of RIP(S)A). The use or conduct of a CHIS, however, can be a particularly intrusive and high risk covert technique, requiring dedicated and sufficient resources, oversight and management. Authorisation is therefore advisable where a public authority intends to task someone to act as a CHIS. Public authorities must ensure that all use or conduct is:

• necessary and proportionate to the intelligence dividend that it seeks to achieve; and
• in compliance with relevant Articles of the European Convention on Human Rights ( ECHR), particularly Articles 6 (right to a fair trial) and 8 (right to respect for private and family life).

2.13. Unlike directed surveillance (which relates specifically to private information), authorisations for the use or conduct of a CHIS do not relate specifically to private information, but to the covert forming and/or maintaining of a relationship to gain any information. ECHR case law makes it clear that Article 8 includes the right to establish and develop relationships. Accordingly, any forming and/or maintaining of a relationship by a public authority e.g. one party having a covert purpose on behalf of a public authority, is likely to engage Article 8, regardless of whether or not the public authority intends to acquire private information.

2.14. It is therefore strongly recommended that a public authority consider an authorisation whenever the use or conduct of a CHIS is likely to engage an individual's rights under Article 8, whether this is through obtaining information, particularly private information, or simply through the covert manipulation of a relationship. An authorisation will be required if a relationship exists between the subject and the CHIS, even if specific information has not been sought by the public authority.

Establishing, maintaining and using a relationship

2.15. The word "establishes", when applied to a relationship, means "set up". It does not require, as "maintains" does, endurance over any particular period. Consequently, a relationship of seller and buyer may be deemed to exist between a shopkeeper and a customer even if only a single transaction takes place. Repetition is not always necessary to give rise to a relationship, but whether or not a relationship exists depends on all the circumstances including the length of time of the contact between seller and buyer and the nature of any covert activity.

Example 1: Intelligence suggests that a local shopkeeper is openly selling alcohol to underage customers without any questions being asked. A juvenile is engaged and trained by a public authority and then deployed in order to make a purchase of alcohol. In these circumstances any relationship, if established at all, is likely to be so limited in regards to the requirements of RIP(S)A that a public authority may conclude that a CHIS authorisation is unnecessary. However, if the test purchaser is wearing recording equipment but is not authorised as a CHIS, or the test purchase is being monitored for corroborative purposes by a third party, consideration should be given to granting a directed surveillance authorisation.

Example 2: In similar circumstances, intelligence suggests that a shopkeeper will sell alcohol to juveniles from a room at the back of the shop, providing he has first got to know and trust them. As a consequence the public authority decides to deploy its operative on a number of occasions, to befriend the shopkeeper and gain his trust, in order to purchase alcohol. In these circumstances a relationship has been established and maintained for a covert purpose and therefore a CHIS authorisation should be obtained.

Legend building

2.16. When a relevant source is deployed to establish their 'legend'/build up their cover profile, an authorisation must be considered under RIP(S)A if the activity will interfere with an individual's Article 8 rights. This will include circumstances where it is not clear to the individual that the relevant source is not who he or she claims to be. The individual does not have to be the subject of any current or future investigation. Interference with any individual's article 8 rights requires authorisation under RIP(S)A. The decision whether or not to authorise rests with the Authorising Officer, who should document their rationale accordingly. A decision not to authorise should be reviewed on a suitably regular basis.

Human source activity falling outside CHIS definition

2.17. Not all human source activity will meet the definition of a CHIS. For example, a source may be a public volunteer or someone who discloses information out of professional or statutory duty, or has been tasked to obtain information other than by way of a covert relationship. Further detail on each of these circumstances is provided below.

Public volunteers

2.18. In many cases involving sources, a relationship will not have been established or maintained for a covert purpose. Many sources merely volunteer or provide information that they have observed or acquired other than through a personal relationship, without being induced, asked, or tasked by a public authority. This means that the source is not a CHIS for the purposes of RIP(S)A and no authorisation under RIP(S)A is required. ^[9]

Example 1: A member of the public volunteers a piece of information to a member of a public authority regarding something he has witnessed in his neighbourhood. The member of the public would not be regarded as a CHIS. He is not passing information as a result of a relationship which has been established or maintained for a covert purpose.

Example 2: A caller to a confidential hotline (such as Crimestoppers) reveals that he knows of criminal activity. Even if the caller is involved in the activities on which he is reporting, the caller would not be considered a CHIS as the information is not being disclosed on the basis of a relationship which was established or maintained for that covert purpose. However, should the caller be asked to maintain his relationship with those involved and to continue to supply information (or it is otherwise envisaged that they will do so) an authorisation for the use or conduct of a CHIS may be appropriate.

Professional or statutory duty

2.19. Certain individuals will be required to provide information to public authorities or designated bodies out of professional or statutory duty. For example, employees within organisations regulated by the money laundering provisions of the Proceeds of Crime Act 2002 are required to report suspicious transactions.

2.20. Any such regulatory or professional disclosures should not result in these individuals meeting the definition of a CHIS, as the business or professional relationships from which the information derives will not have been established or maintained for the covert purpose of disclosing such information.

2.21. Furthermore, this reporting is undertaken 'in accordance with the law' and therefore any interference with an individual's Article 8 rights will satisfy that requirement of Article 8(2).

2.22. This statutory or professional duty, however, would not extend to the situation where a person is asked to provide information which they acquire as a result of an existing professional or business relationship with the subject but that person is under no obligation to pass it on. For example, a travel agent who is asked by the police to find out when a regular client next intends to fly to a particular destination is not under an obligation to pass this information on. In these circumstances a CHIS authorisation may be appropriate.

Tasking not involving relationships

2.23. Tasking a person to obtain information covertly may result in authorisation under RIP(S)A being appropriate. However, this will not be true in all circumstances. For example, where the tasking given to a person does not require that person to establish or maintain a relationship for the purpose of obtaining, providing access to or disclosing the information sought or where the information is already within the personal knowledge of the individual, that person will not be a CHIS.

Example: A member of the public is asked by a member of a public authority to maintain a record of all vehicles arriving and leaving a specific location or to record the details of visitors to a neighbouring house. A relationship has not been established or maintained in order to gather the information and a CHIS authorisation is therefore not available. Other authorisations under RIP(S)A e.g. for directed surveillance may need to be considered where there is a possible interference with the Article 8 rights of an individual.

Identifying when a human source becomes a CHIS

2.24. Individuals or members of organisations (e.g. travel agents, housing associations and taxi companies) who, because of their work or role have access to personal information, may voluntarily provide information to the police on a repeated basis and need to be managed appropriately. Public authorities must keep such human sources under constant review to ensure that they are managed with an appropriate level of sensitivity and confidentiality, and to establish whether, at any given stage, they should be authorised as a CHIS.

2.25. Determining the status of an individual or organisation is a matter of judgement by the public authority. Public authorities should avoid inducing individuals to engage in the conduct of a CHIS either expressly or implicitly without obtaining a CHIS authorisation.

Example: Mr Y volunteers information to a member of a public authority about a work colleague out of civic duty. Mr Y is not a CHIS at this stage as he has not established or maintained (or been asked to establish or maintain) a relationship with his colleague for the covert purpose of obtaining and disclosing information. However, Mr Y is subsequently contacted by the public authority and is asked if he would ascertain certain specific information about his colleague. At this point, it is likely that Mr Y's relationship with his colleague is being maintained and used for the covert purpose of providing that information. A CHIS authorisation would therefore be appropriate to authorise interference with the Article 8 right to respect for private and family life of Mr Y's work colleague.

2.26. However, the tasking of a person should not be used as the sole benchmark in seeking a CHIS authorisation. It is the activity of the CHIS in exploiting a relationship for a covert purpose which is ultimately authorised by RIP(S)A, whether or not that CHIS is asked to do so by a public authority. It is possible therefore that a person will become engaged in the conduct of a CHIS without a public authority inducing, asking or assisting the person to engage in that conduct. An authorisation should be considered, for example, where a public authority is aware that a third party is independently maintaining a relationship (ie "self-tasking") in order to obtain evidence of criminal activity, and the public authority intends to make use of that material for its own investigative purposes.