22 April 2025
On 27 March Sir Brian Leveson, the Investigatory Powers Commissioner since 2019, gave a talk to Security Studies students at King’s College London, entitled ‘Overseeing the Use of Covert Powers by the State: The Role of the IPC’. In the talk, which was organised by Hillary Briffa and Joe Devanny, Sir Brian delved into the history of state surveillance in the UK and the evolution of the legislation and bodies that govern it, as well as exploring how emergent technologies can and may continue to challenge his work. At the conclusion of the talk, students took the opportunity to pose questions to Sir Brian. Cosimo Lewis (MA Intelligence & International Security) was one such student and he gave his round-up of the topics covered.
Lifting the veil of secrecy around data retention.
Sir Brian opened the talk by plotting the history of ‘interception and secret practices of the state’. While this is traceable as far back as the 16th Century, specific legislation governing state surveillance only emerged in the UK in 1985 and would continue to develop significantly over the following 30 years. The Investigatory Powers Act of 2016 (IPA) was brought into law in response to domestic and European Court of Human Rights legal challenges, phone hacking scandals and the Edward Snowden leaks. Sir Brian pinpointed that the act ‘resulted in lifting the veil of secrecy around data retention.’ It resulted in the creation of the role of Investigatory Powers Commissioner (IPC), which Sir Brian took over in 2019.
The Investigatory Powers Commissioners Office (IPCO) was created to enable the IPC to fulfil their function. The IPC and IPCO are ‘responsible for reviewing the use of covert investigative powers by public bodies, such as intelligence agencies, the police and local authorities.’ A key function is authorising surveillance powers before they can be used. Rather than being authorisation being applied retrospectively, Sir Brian stressed that it is ‘prospective, except in urgency,’ in which case a secretary of state can give authorisation that must be approved by IPCO within 3 days.
Authorisation of surveillance is mostly delegated to the judicial commissioners within the IPCO, but Sir Brian personally considers the most sensitive cases. While most applications are protected by a “double lock” (authorisation from the secretary of state and a commissioner), the more sensitive ones fall under a “triple lock”, which also requires the approval of the Prime Minister. In all cases, Sir Brian emphasised that, ‘we consider the objective of the warrant – what is it designed to achieve, who’s it covering, is it proportionate?’ The IPCO is required to determine whether the same ends could be achieved with less intrusive means, placing human rights conventions at the heart of its work. While ‘national security or serious crime overrides the right to privacy,’ all warrants must nevertheless by checked for ‘legality against the principles of judicial review,’ – ultimately, is it reasonable?
The IPC also advises on novel or contentious issues to identify potential flaws in existing legislation, inspecting public authorities, overseeing the “Principles” that govern to what extent UK intelligence agencies can receive and share intelligence with foreign partners, investigating non-compliances and errors, and carrying out investigations of agencies on behalf of the Intelligence and Security Committee of Parliament. IPCO publishes an annual report on its activities.
It is important that people understand what we do and why we do it.
Ensuring transparency of both surveillance and the work of IPCO is essential; ‘it is important that people understand what we do and why we do it.’ Prior to the establishment of the IPC and IPCO, the Regulation of Investigatory Powers Act 2000 had been designed to regulate the use of surveillance and covert information gathering by public authorities, ensuring it aligned with human rights principles. But it faced criticism that it wasn’t easy to understand, and that the resulting obscurity of the law was undemocratic, unnecessary, and intolerable. To Sir Brian, such criticisms were a key part of the rationale behind the IPC and a key focus for him is therefore building trust and confidence in IPCO as a transparent public body.
The State doesn’t know as much about you as Google or Amazon do.
Acknowledging that the powers the IPC oversees can be highly intrusive, Sir Brian highlighted the need to reassure the public that their rights are being protected, stating clearly that ‘the state doesn’t know as much about you as Google or Amazon do.’ An essential component of this is that he is careful to fulfil what he perceives to be his statutory responsibilities, without going beyond them. He also prioritises the independence of IPCO’s judicial commissioners, where the UK’s legal traditions have been very valuable, remarking ‘you don’t need to tell judges to be independent!’
It’s important that we compare how we work with our like-minded nations, so we can learn from and support each other.
IPCO is widely seen on the international stage as a model of best practice. Sir Brian sees partnerships as essential, saying, ‘It’s important that we compare how we work with our likeminded nations, so we can learn from and support each other.’ He has worked to strengthen these relationships, aiming to learn from and support one-another with a particular focus on Europe. The UK’s traditional Five Eyes partners ‘share mutual interests in recruitment, retention, training, technical capabilities, and preparing to operate in potentially hostile conditions.’ He also welcomed scrutiny from NGOs, noting that there would always be limits on what could be made public, but also that ‘if I satisfy you, I’ve deprived you of your reason to exist.’
The greatest challenge for me is trying to construe modern conditions against the terms of the Act.
Sir Brian singled out Artificial Intelligence as a technology that ‘can have significant impacts on privacy if not managed responsibly.’ The IPA was intended to be technologically neutral, but he believes this may have been too optimistic, and that there are ‘problems as we try to fit modern developments in technology into legislation designed in a different time.’ For him, the biggest question is whether even a revised Act could ever cover what is available. ‘The greatest challenge for me is trying to construe modern conditions against the terms of the Act.’
When asked about the current controversy concerning Technical Capability Notices (TCNs), he stressed that a TCN only enables lawful access capability and does not itself result in the acquisition of data or a privacy intrusion, which is covered by the IPA.
Throughout the discussion, Sir Brian’s emphasis was clearly on how critical the IPC and IPCO are to national security, and the need to balance this requirement with the human rights of individuals. The pace of change of technology will continue to challenge the ability of legislation to cover everything that is possible, but IPCO is ‘always learning, and will continue to improve.’
Senior Lecturer in National Security Studies
Senior Lecturer in the Department of War Studies
Students at King's will have the opportunity to hear from Sir Brian Leveson, the IPC, where he will share his insights into IPCO...
