Covert surveillance and property interference: code of practice

3. Directed and intrusive surveillance overview

3.1. This chapter provides further guidance on whether covert surveillance activity is directed surveillance or intrusive surveillance, and whether an authorisation for either activity would not be deemed necessary.

Directed surveillance ^[7]

3.2. Surveillance is directed surveillance if the following are all true:

• it is covert, but not intrusive surveillance;
• it is conducted for the purposes of a specific investigation or operation;
• it is likely to result in the obtaining of private information about a person (whether or not one specifically identified for the purposes of the investigation or operation);
• it is conducted otherwise than by way of an immediate response to events or circumstances the nature of which is such that it would not be reasonably practicable for an authorisation under RIP(S)A to be sought.

3.3. Thus, the planned covert surveillance of a specific person, where not intrusive, would constitute directed surveillance if such surveillance is likely to result in the obtaining of private information about that, or any other person. Chapter 5 provides further information about the authorisation of directed surveillance.

Private information

3.4. RIP(S)A states that private information includes any information relating to a person’s private or family life ^[8] . As a result, private information is capable of including any aspect of a person’s private or personal relationship with others, such as family ^[9] and professional or business relationships. Information which is non-private may include publicly available information such as books, newspapers, journals, TV and radio broadcasts, newswires, web sites, mapping imagery, academic articles, conference proceedings, business reports, and more. Such information may also include commercially available data where a fee may be charged, and any data which is available on request or made available at a meeting to a member of the public. Non-private data will also include the attributes of inanimate objects such as the class to which a cargo ship belongs.

3.5. Whilst a person may have a reduced expectation of privacy when in a public place, covert surveillance of that person’s activities in public may still result in the obtaining of private information. This is likely to be the case where that person has a reasonable expectation of privacy even though acting in public and where a record is being made by a public authority of that person’s activities for future consideration or analysis ^[10] . Surveillance of publicly accessible areas of the internet should be treated in a similar way, recognising that there may be an expectation of privacy over information which is on the internet, particularly where accessing information on social media websites. See paragraphs 3.11 to 3.16 below for further guidance about the use of the internet as a surveillance tool.

Example: Two people holding a conversation on the street or in a bus may have a reasonable expectation of privacy over the contents of that conversation, even though they are associating in public. The contents of such a conversation should therefore still be considered as private information. A directed surveillance authorisation would therefore be appropriate for a public authority to record or listen to the conversation as part of a specific investigation or operation.

3.6. Private life considerations are particularly likely to arise if several records are to be analysed together in order to establish, for example, a pattern of behaviour, or if one or more pieces of information (whether or not available in the public domain) are covertly (or in some cases overtly) obtained for the purpose of making a permanent record about a person or for subsequent data processing to generate further information. In such circumstances, the totality of information gleaned may constitute private information even if individual records do not. Where such conduct includes covert surveillance, a directed surveillance authorisation may be considered appropriate.

Example: Officers of a local authority wish to drive past a café for the purposes of obtaining a photograph of the exterior. Reconnaissance of this nature is not likely to require a directed surveillance authorisation as no private information about any person is likely to be obtained or recorded. However, if the authority wished to conduct a similar exercise, for example to establish a pattern of occupancy of the premises by any person, the accumulation of information is likely to result in the obtaining of private information about that person and a directed surveillance authorisation should be considered.

3.7. Private information may include personal data, such as names, telephone numbers and address details. Where such information is acquired by means of covert surveillance of a person having a reasonable expectation of privacy, a directed surveillance authorisation is appropriate ^[11] .

Example: A surveillance officer intends to record a specific person providing their name and telephone number to a shop assistant, in order to confirm their identity, as part of a criminal investigation. Although the person has disclosed these details in a public place, there is nevertheless a reasonable expectation that the details are not being recorded separately for another purpose. A directed surveillance authorisation should therefore be sought.

Specific situations where an intrusive surveillance authorisation is not available

3.8. Section 1(4) of RIP(S)A provide that the use of surveillance devices designed or adapted for the purpose of providing information regarding the location of a vehicle is not considered to be intrusive surveillance. The use of such devices alone does not necessarily constitute directed surveillance as they do not necessarily provide private information about any individual but sometimes only supply information about the location of that particular device at any one time. However, the use of that information, when coupled with other surveillance activity which may obtain private information about the occupants of the vehicle, could interfere with Article 8 rights. A directed surveillance authorisation may therefore be appropriate ^[12] . A property interference authorisation may also be appropriate for the covert installation of the device.

Recording of telephone conversations

3.9. The interception of communications sent by public post, or by means of public telecommunications systems, or private telecommunications is governed by Part 2 of the IPA. Nothing in this code should be taken as granting dispensation from the requirements of that Part of the IPA.

3.10. The recording or monitoring of one or both ends of a telephone conversation by a surveillance device as part of an authorised directed (or intrusive) surveillance operation will not constitute interception under Part 2 of the IPA provided the process by which the product is obtained does not involve any modification of, or interference with, the telecommunications system or its operation. This will not constitute interception as sound waves obtained from the air are not in the course of transmission by means of a telecommunications system (which, in the case of a telephone conversation, should be taken to begin with the microphone and end with the speaker). Any such product can be treated as having been lawfully obtained.

Example: A property interference authorisation may be used to authorise the installation in a private car of an eavesdropping device with a microphone, together with an intrusive surveillance authorisation to record or monitor speech within that car. If one or both ends of a telephone conversation held in that car are recorded during the course of the operation, this will not constitute unlawful interception provided the device obtains the product from the sound waves in the vehicle and not by interference with, or modification of, any part of the telecommunications system.

Online covert activity

3.11. The internet may be used as a surveillance tool, and where online research or investigation is conducted covertly for the purpose of a specific investigation or operation and is likely to result in the obtaining of private information about a person or group, an authorisation for directed surveillance should be considered as set out elsewhere in this code. Where a person acting on behalf of a public authority is intending to engage with others online without disclosing his or her identity, a CHIS authorisation may be needed (see Covert Human Intelligence Sources code of practice).

3.12. In deciding whether online surveillance should be regarded as covert, consideration should be given to the likelihood of the subject(s) knowing that the surveillance is or may be taking place. Use of the internet itself may be considered as adopting a surveillance technique calculated to ensure that the subject is unaware of it, even if no further steps are taken to conceal the activity. Conversely, if reasonable steps have been taken to inform the public or particular individuals that the surveillance is or may be taking place this can be regarded as overt and a directed surveillance authorisation will not normally be available.

3.13. Public use of the internet has expanded rapidly so that far more activity and interaction now occurs online than ever before. As set out in paragraph 3.5, there may be a reduced expectation of privacy for material accessible on the internet, but privacy considerations may still apply, for example to information posted on social networking sites where the information may include or constitute private information. This is regardless of whether or not the account holder has applied any privacy settings to the account.

3.14. Where information about an individual is placed on a publicly accessible database, for example the telephone directory or Companies House, which is commonly used and known to be accessible to all, they are unlikely to have any reasonable expectation of privacy over the monitoring by public authorities of that information. Individuals who post information on social media networks and other websites whose purpose is to communicate messages to a wide audience are also less likely to hold a reasonable expectation of privacy in relation to that information. However, information posted on personal social networking sites which are normally accessed by a smaller circle of personal contacts is likely to include private information to which an expectation of privacy would apply and fall within the scope of a person’s private life. Whether a public authority interferes with a person’s private life includes a consideration of the nature of the public authority’s activity in relation to that information. Simple reconnaissance of such sites (i.e. preliminary examination with a view to establishing whether the site or its contents are of interest) is unlikely to interfere with a person’s reasonably held expectation of privacy and therefore is not likely to require a directed surveillance authorisation. But where a public authority is systematically collecting and storing information about a particular person or group, a directed surveillance authorisation should be considered. These considerations apply regardless of when the information was shared online. See also paragraph 3.6 above.

Example: A simple internet search on a name, address or telephone number to find out whether a subject of interest has an online presence is unlikely to need an authorisation. If, however, having found an individual’s social media profile or identity it is decided to monitor it or extract information from it for retention in a record because it is relevant to an investigation or operation, authorisation should then be considered. Visiting a website would not normally amount to surveillance, but if during that visit it is intended to extract and record information to establish a profile including information such as identity, pattern of life, habits, intentions or associations, it may be advisable to have in place an authorisation even for that single visit. As set out in the following paragraph, the purpose of the visit may be relevant as to whether an authorisation should be sought.

3.15. In order to determine whether a directed surveillance authorisation is required for accessing information on a website as part of a covert investigation or operation, it is necessary to look at the intended purpose and scope of the online activity it is proposed to undertake. Factors that should be considered in establishing whether a directed surveillance authorisation is required include whether:

• the investigation or research is directed towards an individual or group of people;
• it is likely to result in obtaining private information about a person or group of people (taking account of the guidance at paragraph 3.14);
• it is likely to involve visiting internet sites to build up an intelligence picture or profile;
• the information obtained will be recorded and stored;
• the information is likely to provide an observer with a pattern of lifestyle;
• the information is being combined with other sources of information or intelligence, which amounts to information relating to a person’s private life;
• the investigation or research is part of an ongoing piece of work involving repeated viewing of the subject(s);
• it is likely to involve identifying and recording information about third parties such as friends and family members of the subject of interest, or information posted by third parties such as friends or family members, which may include private information and therefore constitute collateral intrusion.

3.16. Internet searches carried out by a third party on behalf of a public authority, or with the use of a search tool, may still require a directed surveillance authorisation (see paragraph 4.31).

Example: Police researchers using automated monitoring tools to search for common terminology used online for illegal purposes will not normally require a directed surveillance authorisation. If, however, specific names or other identifiers of an individual or group are applied to the search, an authorisation should be considered.

Aerial surveillance

3.17. Where surveillance using airborne crafts or devices, for example helicopters or drones, is planned, the same considerations outlined in chapters 3 and 5 of this code should be made to determine whether a directed surveillance authorisation is appropriate. In considering whether the surveillance should be regarded as covert, account should be taken of the reduced visibility of a craft or device at altitude.

Example: A drone deployed by a police force to monitor a known group of individuals at a public demonstration is likely to require an authorisation for directed surveillance, as it is likely that private information will be obtained and the observees are unaware it is taking place, regardless of whether the drone is marked as belonging to the police force, unless sufficient steps have been taken to ensure that participants in the demonstration are aware that aerial surveillance will be taking place, such activity should be regarded as covert.

Intrusive surveillance

3.18. Intrusive surveillance is covert surveillance that is carried out in relation to anything taking place on residential premises or in any private vehicle, and that involves the presence of an individual on the premises or in the vehicle or is carried out by a means of a surveillance device ^[13] . If surveillance activity falls within the definition of intrusive surveillance, this has the effect of reducing the number of public authorities able to authorise such surveillance, principally to the Police Service and the PIRC. It will also make authorisations in respect of such surveillance subject to prior approval by a Judicial Commissioner.

3.19. The definition of surveillance as intrusive relates to the location of the surveillance, and not any other consideration of the nature of the information that is expected to be obtained as it is assumed that intrusive surveillance will always be likely to result in the obtaining of private information. Accordingly, it is not necessary to consider whether or not intrusive surveillance is likely to result in the obtaining of private information.

3.20. In addition, directed surveillance under the ambit of the 2015 Order is to be treated as intrusive surveillance ^[14] .

Residential premises

3.21. For the purposes of RIP(S)A, residential premises are considered to be so much of any premises as is for the time being occupied or used by any person, however temporarily, for residential purposes or otherwise as living accommodation. This specifically includes hotel or prison accommodation that is so occupied or used. ^[15] However, common areas (such as hotel dining areas) to which a person has access in connection with their use or occupation of accommodation are specifically excluded. ^[16]

3.22. RIP(S)A further states that the concept of premises should be taken to include any place whatsoever, including any vehicle or moveable structure, whether or not occupied as land ^[17] .

3.23. Examples of residential premises would therefore include:

• a rented flat currently occupied for residential purposes;
• a prison cell (or police cell serving as temporary prison accommodation);
• a hotel bedroom or suite.

3.24. Examples of premises which would not be regarded as residential would include:

• a communal stairway in a block of flats (unless known to be used as a temporary place of abode by, for example, a homeless person);
• a police cell (unless serving as temporary prison accommodation);
• a prison canteen or police interview room;
• a hotel reception area or dining room;
• the front garden or driveway of premises readily visible to the public;
• residential premises occupied by a public authority for non-residential purposes.

Private vehicles

3.25. A private vehicle is defined in RIP(S)A as any vehicle, including vessels, aircraft or hovercraft, which is used primarily for the private purposes of the person who owns it or a person otherwise having the right to use it. This would include, for example, a company car, owned by a leasing company and used for business and pleasure by the employee of a company ^[18] .

Places for Legal Consultation

3.26. The 2015 Order provides that directed surveillance that is carried out in relation to anything taking place on so much of any premises specified in article 3(2) of the Order as is, at any time during the surveillance, used for the purpose of legal consultations shall be treated for the purposes of RIP(S)A as intrusive surveillance. The premises identified in article 3(2) are:

(a) any premises in which persons who are serving sentences of imprisonment or detention, remanded in custody or remanded or committed for trial or sentence, may be detained;

(b) legalised police cells within the meaning of section 14(1) of the Prisons (Scotland) Act 1989;

(c) any premises in which persons may be detained under paragraph 16(1), (1A) or (2) of Schedule 2 or paragraph 2(2) or (3) of Schedule 3 to the Immigration Act 1971 or section 36(1) of the UK Borders Act 2007;

(d) any premises in which persons may be detained under Part VI of the Criminal Procedure (Scotland) Act 1995 or the Mental Health (Care and Treatment) (Scotland) Act 2003;

(e) police stations;

(f) the place of business of any professional legal adviser; and

(g) any premises used for the sittings and business of any court, tribunal or inquiry.

Further considerations

3.27. Intrusive surveillance may take place by means of a person or device located in the residential premises or private vehicle. It may also take place by means of a device placed outside the premises or vehicle which consistently provides information of the same quality and detail as might be expected to be obtained from a device inside. ^[19]

Example: An observation post outside residential premises which provides a limited view compared to that which would be achievable from within the premises does not constitute intrusive surveillance. However, the use of a zoom lens, for example, which consistently achieves imagery of the same quality as that which would be visible from within the premises, would constitute intrusive surveillance.

Circumstances where a covert surveillance authorisation is not available

3.28. Some surveillance activity does not constitute intrusive or directed surveillance for the purposes of RIP(S)A and no directed or intrusive surveillance authorisation can be obtained for such activity. Such activity includes:

• covert surveillance by way of an immediate response to events;
• covert surveillance as part of general observation activities;
• covert surveillance not relating to specified grounds;
• overt use of CCTV and ANPR systems;
• covert surveillance authorised as part of a targeted equipment interference warrant under the IPA;
• certain other specific situations (see paragraphs 2.19 - 2.20).

3.29. Each situation is detailed and illustrated below.

Immediate response

3.30. Covert surveillance that is likely to reveal private information about a person but is carried out by way of an immediate response to events would not require a directed surveillance authorisation. RIP(S)A is not intended to prevent public authorities from fulfilling their legislative functions. To this end section 1(2)(c) of RIP(S)A provides that surveillance is not directed surveillance when it is carried out by way of an immediate response to events or circumstances the nature of which is such that it is not reasonably practicable for an authorisation to be sought for the carrying out of the surveillance. ^[20]

Example: An authorisation under RIP(S)A would not be appropriate where police officers conceal themselves to observe suspicious persons that they come across in the course of a routine patrol or monitor social media accounts during a public order incident.

General observation activities

3.31. The general observation duties of many law enforcement officers and other public authorities do not require authorisation under RIP(S)A, whether covert or overt. Such general observation duties frequently form part of the legislative functions of public authorities, as opposed to the pre-planned surveillance of a specific person or group of people. General observation duties may include monitoring of publicly accessible areas of the internet which is not part of a specific investigation or operation.

Example 1: Plain clothes police officers on patrol to monitor a high street crime hot-spot or prevent and detect shoplifting would not require a directed surveillance authorisation. Their objective is merely to observe a location and, through reactive policing, to identify and arrest offenders committing crime. The activity may be part of a specific investigation but is general observational activity, rather than surveillance of individuals, and the obtaining of private information is unlikely. A directed surveillance authorisation need not be sought.

Example 2: Police officers monitoring publicly accessible information on social media websites for information using the search term “theft” would not normally require a directed surveillance authorisation. If, however, they were seeking information relating to a particular individual or group of individuals, for example by using the search term “group x”, even where the true identity of those individuals is not known, this may require authorisation. This is because use of a specific search term such as this indicates that the information is being gathered as part of a specific investigation or operation particularly where information is recorded and stored for future use.

Example 3: Local authority officers attend a car boot sale where it is suspected that counterfeit goods are being sold, but they are not carrying out surveillance of particular individuals and their intention is, through reactive policing, to identify and tackle offenders. Again this is part of the general duties of public authorities and the obtaining of private information is unlikely. A directed surveillance authorisation need not be sought.

Example 4: Surveillance officers intend to follow and observe Z covertly as part of a pre-planned operation to determine her suspected involvement in shoplifting. It is proposed to conduct covert surveillance of Z and record her activities as part of the investigation. In this case, private life considerations are likely to arise where there is an expectation of privacy and the covert surveillance is pre-planned and not part of general observational duties or reactive policing. A directed surveillance authorisation should be considered.

Surveillance not relating to specified grounds or core functions

3.32. An authorisation for directed or intrusive surveillance is only appropriate for the purposes of a specific investigation or operation, insofar as that investigation or operation relates to the grounds specified at section 6(3) or 10(2) of RIP(S)A. Covert surveillance for any other general purposes should be conducted under other legislation, if relevant, and an authorisation under RIP(S)A should not be sought.

3.33. A public authority may only engage in the RIP(S)A when in performance of its ‘core functions’. The ‘core functions’, as referred to by the Investigatory Powers Tribunal (C v The Police and the Secretary of State for the Home Office - IPT/03/32/H dated 14 November 2006), are the ‘specific public functions’, undertaken by a particular authority, in contrast to the ‘ordinary functions’ which are those undertaken by all authorities (e.g. employment issues, contractual arrangements etc). The disciplining of an employee is not a ‘core function’, although related criminal investigations may be. The protection of RIP(S)A may therefore be available in relation to associated criminal investigations so long as the activity is deemed to be necessary and proportionate.

Example 1: A police officer is suspected by the Police Service of undertaking additional employment in breach of discipline regulations. The Police Service wishes to conduct covert surveillance of the officer outside the police work environment. Such activity, even if it is likely to result in the obtaining of private information, does not constitute directed surveillance for the purposes of RIP(S)A as it does not relate to the discharge of the Police Service’s core functions. It relates instead to the carrying out of ordinary functions, such as employment, which are common to all public authorities. Activities of this nature are covered by the data protection law and the Information Commissioner’s Office’s employment practices code ^[21] .

Example 2: It is alleged that a public official has brought their department into disrepute by making defamatory remarks online, and identifying themselves as a public official. The department wishes to substantiate the allegations separately from any criminal action. Such activity, even if it is likely to result in the obtaining of private information, does not constitute directed surveillance for the purposes of RIP(S)A as it does not relate to the discharge of the department’s core functions.

CCTV and ANPR (Automatic Number Plate Recognition) cameras

3.34. The use of overt CCTV cameras by public authorities does not normally require an authorisation under RIP(S)A. Members of the public will be aware that such systems are in use ^[22] , and their operation is covered by data protection law and the Information Commissioner’s Office’s surveillance cameras code of practice ^[23] . Similarly, the overt use of ANPR systems to monitor traffic flows or detect motoring offences does not require an authorisation under RIP(S)A.

3.35. The Protection of Freedoms Act 2012 requires that a Surveillance Camera Code ^[24] of Practice for England and Wales be published. While this does not extend to Scotland, RIP(S)A authorities may find it useful to take into consideration when preparing to engage cameras for directed or intrusive surveillance.

Example: Overt surveillance equipment, such as town centre CCTV systems or ANPR, is used to gather information as part of a reactive operation (e.g. to identify individuals who have committed criminal damage after the event). Such use does not amount to covert surveillance as the equipment was overt and not subject to any covert targeting. Use in these circumstances would not require a directed surveillance authorisation.

3.36. Where, however, overt CCTV or ANPR cameras are used in a covert and pre-planned manner as part of a specific investigation or operation, for the surveillance of a specific person or group of people, a directed surveillance authorisation should be considered. Such covert surveillance is likely to result in the obtaining of private information about a person (namely, a record of their movements and activities) and therefore falls properly within the definition of directed surveillance. The use of the CCTV or ANPR system in these circumstances goes beyond their intended use for the general prevention or detection of crime and protection of the public.

Example: A local police team receives information that an individual suspected of committing thefts from motor vehicles is planning to commit further thefts in a town centre area. A decision is taken to use the town centre CCTV system to conduct surveillance against that individual such that he remains unaware that there may be any specific interest in him. This targeted, covert use of the overt town centre CCTV system to monitor and/or record that individual’s movements should be considered for authorisation as directed surveillance.

Specific situations where authorisation is not available

3.37. The following specific activities also constitute neither directed nor intrusive surveillance:

• the use of a recording device by a covert human intelligence source in respect of whom an appropriate use or conduct authorisation has been granted permitting him to record any information obtained in his presence ^[25] ;
• the recording, whether overt or covert, of an interview with a member of the public where it is made clear that the interview is entirely voluntary and that the interviewer is a member of a public authority. In such circumstances, whether the recording equipment is overt or covert, the member of the public knows that they are being interviewed by a member of a public authority and that information gleaned through the interview has passed into the possession of the public authority in question ^[26] ;
• the covert recording of suspected noise nuisance where the intention is only to record excessive noise levels from adjoining premises and the recording device is calibrated to record only excessive noise levels. In such circumstances the perpetrator would normally be regarded as having forfeited any claim to privacy and an authorisation may not be available;
• entry on or interference with property or wireless telegraphy under Part III of the 1997 Act (such activity may be conducted in support of surveillance, but is not in itself surveillance) ^[27] .

Covert surveillance authorised by an equipment interference warrant

3.38. The obtaining of communications or information authorised by a targeted equipment interference warrant issued under Part 5 of the IPA includes obtaining those communications or information by surveillance. This could include intrusive surveillance or directed surveillance.

3.39. A separate authorisation for surveillance under RIP(S)A will not therefore be required providing the conduct comprising the surveillance is properly authorised by a targeted equipment interference warrant. The interference with privacy and property resulting from the surveillance will be considered as part of the equipment interference authorisation.

3.40. By contrast, where the surveillance is not linked to the communications, equipment data or other information obtained from the equipment interference, this will not be capable of authorisation under a targeted equipment interference warrant.

3.41. For example, if an agency capable of authorising equipment interference wishes to conduct separate surveillance by directing an officer to observe the user of a device at the same time as the device itself is being subject to equipment interference, then this will not be considered as part of the equipment interference authorisation and an appropriate surveillance authorisation must be obtained. In this situation a combined warrant may be appropriate (for information on combined warrants, see paragraphs 4.19 – 4.27).

Foreign surveillance teams operating in UK

3.42. The provisions of section 76A of RIPA, as inserted by the Crime (International Co-Operation) Act 2003, provide for foreign surveillance teams to operate in the UK, subject to the following procedures and conditions.

3.43. Where a foreign police or customs officer ^[28] , who is conducting directed or intrusive surveillance activity outside the UK ^[29] , needs to enter the UK for the purposes of continuing that surveillance, and where it is not reasonably practicable for a UK officer ^[30] to carry out the surveillance under the authorisation of Part II of RIPA (or of RIP(S)A), the foreign officer must notify a person designated by the Director General of the National Crime Agency immediately after entry to the UK and shall request (if this has not been done already) that an application for a directed or intrusive surveillance authorisation be made under RIPA (or RIP(S)A).

3.44. The foreign officer may then continue to conduct directed or intrusive surveillance for a period of five hours beginning with the time when the officer enters the UK. The foreign officer may only carry out the surveillance, however, in places to which members of the public have or are permitted to have access, whether on payment or otherwise. The directed or intrusive surveillance authorisation, if obtained, will then authorise the foreign officers to conduct such surveillance beyond the five hour period in accordance with the general provisions of RIPA (or RIP(S)A).