Covert Human Intelligence Sources (Criminal Conduct) Act – are the dark arts about to become mainstream in government agencies?

The Covert Human Intelligence Sources (Criminal Conduct) Act 2021 (“the Act”) received royal assent on 1 March 2021, following a protracted parliamentary process. The Act, whose provisions are yet to enter into force, challenges the traditional boundaries of state investigative power by providing immunity for certain criminal conduct authorised within the scope of covert surveillance activities governed by the Regulation of Investigatory Powers Act 2000 (“RIPA”). Various government bodies, including the SFO, NCA, FCA and CMA, now have the power to authorise criminal conduct by operatives working undercover. Corporations and individuals should be aware of these broad new investigatory powers, and of how evidence obtained as a result of authorised criminal conduct may be used in civil or criminal proceedings. In this OnPoint, we consider the background and nature of criminal conduct authorisations, the potential implications of the Act on the conduct of investigations, and the admissibility of evidence gathered by a broad range of potential government actors under the new legislation.

On Her Majesty’s service: UK surveillance powers 

Historically, UK surveillance powers were not governed by statute. This was for two reasons: first, neither the common law nor statute positively protected certain intangible rights, such as the right not to have phone conversations intercepted without clear lawful authority. Secondly, the intelligence agencies which (alongside the police) made most use of surveillance powers had been set up as emanations of the Crown under prerogative powers. Statutory regulation became necessary after a number of adverse judgments from the European Court of Human Rights, starting with Malone v UK in 1985.¹ The Court found an infringement of the applicant’s Article 8 right to private life where the police had intercepted his phone conversations without clear statutory authority. A series of legislative changes ensued, including the Interception of Communications Act 1985; the Security Service Act 1989; the Intelligence Services Act 1994 (which introduced a power to authorise criminal conduct committed overseas); and the Police Act 1997. The intention behind RIPA was to consolidate and codify the various existing surveillance powers, and to cover previously unregulated areas in time for the coming into force of the Human Rights Act 1998. The Act makes further amendments to RIPA. 

The Dark Arts (and shades of grey) - authorised criminality under the Third Direction

The Security Service Act 1989 provides that there “shall continue to be” a Security Service (also known as MI5). For many years, the Security Service had policies under which criminal conduct by its undercover agents could be authorised. The existence of such policies was avowed by the government for the first time in 2018. The current policy has become known as the ‘Third Direction’, the lawfulness of which was upheld by a divided Investigatory Powers Tribunal in Privacy International & Ors v Foreign Secretary & Ors.² The majority held that MI5 had a public law power to authorise criminal conduct implied into the Security Service Act 1989, which affirmed the continuation of such authorisations by MI5 with all its prior prerogative and de facto practices. However, the power to authorise otherwise unlawful conduct was not accompanied by a corresponding power to grant immunity from prosecution. Rather, MI5 was limited to making representations to the Crown Prosecution Service (or other prosecuting authority) on the grounds that it would not be in the public interest to prosecute an undercover agent who had acted in pursuance of an authorisation. 

Legislative background

The Privacy International case provides the background to the Act. The Tribunal in that case was divided on the lawfulness of the Third Direction; and the majority drew a clear distinction between lawfully authorising certain acts that were otherwise criminal, and immunity from prosecution. The Executive could not grant any such immunity. The Act overcomes this lacuna, and at the same time considerably expands the list of departments and agencies with power to authorise criminal conduct (although the government claims that no new powers are being introduced). The Bill was first introduced by Home Secretary Priti Patel in the Commons in 2019. After some delay amid the COVID-19 pandemic, progress resumed in late 2020, and in early 2021 the Lords proposed a number of substantial amendments to the Bill. In the end, most of the amendments were rejected by the Commons. 

The Act: criminal conduct authorisations – an everyday job?

The new provisions are firmly embedded in the RIPA regime governing the conduct of covert human intelligence. A criminal conduct authorisation now lawfully permits criminal conduct in the course of, or otherwise in connection with, the conduct of a covert human intelligence source (RIPA section 29B(2)). 

Bodies which may authorise criminal conduct

The list of government bodies is broad and not limited to the ‘classical’ surveillance agencies:³

• Any police force, the National Crime Agency (NCA) and the Serious Fraud Office (SFO) 
• The intelligence services (MI5, MI6, GCHQ)
•  The armed forces (Army, Royal Navy, Royal Air Force)
• HM Revenue & Customs
• Department of Health & Social Care, Home Office, Ministry of Justice
•  Competition & Markets Authority (CMA), Environment Agency (EA), Financial Conduct Authority (FCA), Food Standards Agency (FSA), and Gambling Commission 

Undercover criminal investigations by the SFO or FCA, or cartel investigations by the CMA, therefore fall within the scope of the Act. These bodies already have wide-ranging surveillance powers under RIPA, such as wiretapping. The new provisions may make conduct amounting to trespass, entrapment or identity theft by SFO, FCA or CMA agents lawful for all purposes. It is not clear how these government agencies will prepare and train their staff to deploy such significant new powers proportionately, or indeed what kind of selection process will be applied to government actors whose roles may be expanded to include these new powers. 

Rules of Engagement - some preconditions for authorising criminal conduct

The person granting the authorisation must believe that doing so is (RIPA section 29B(4)-(6)):

• Necessary for protecting national security, preventing or detecting crime, preventing disorder, or protecting the UK’s economic interests, and 
• Proportionate to the aim sought to be achieved (e.g. is there a non-criminal means to achieve the same end?), and 
• In line with arrangements yet to be made by the Secretary of State by order. 

The Lords had proposed an amendment that would have required the belief to be reasonable. This was rejected by the Commons, on the ground that the standard elsewhere in RIPA is a mere belief. Introducing a reasonable belief requirement in relation to criminal conduct authorisations was therefore liable to cause uncertainty. However, little should turn on the formulation: applying standard public law principles, discretion cannot be unfettered or exercised capriciously, and any belief must be based on articulable reasons.⁴ The extent to which such discretion is reviewable in practice is a separate issue, and is addressed below. 

With great powers come… limited safeguards

 A crucial Lords amendment would have resulted in authorisations being unavailable in relation to certain types of offences, notably murder and grievous bodily harm; perverting or obstructing the course of justice; rape and other sexual offences; torture or inhuman or degrading treatment or punishment; or deprivation of liberty. However, this amendment was rejected by the Commons, on the ground that creating such carve-outs would place sources and the wider public at risk. Part of the concern seems to have been that providing a list of exempted offences might have encouraged criminal gangs to force agents to engage in one of the listed offences, to verify whether they were indeed working undercover. However, legislation in other countries with comparable legislation does exempt certain serious offences from being subject to an authorisation.⁵ Authorised criminal conduct may also include dishonesty offences such as theft or fraud. 

The express safeguards which made it into the final Act are sparse (there are specific safeguards vis-à-vis child informants and vulnerable adults which we do not consider further here). The Act does not override the Human Rights Act, so the Convention rights must be respected when authorising criminal conduct. This should preclude much of the conduct targeted by the proposed Lords amendment, such as the deliberate infliction of bodily harm, murder, torture or sexual violence by state actors or those under state control. The common law also has historically taken a robust stance against torture.⁶ Under the principle of legality, which requires express words or necessary implication before general legislation may set aside a fundamental right, the absolute prohibition on torture is not overridden. 

I beg your pardon, Your Honour…

Each criminal conduct authorisation must be notified to a judicial commissioner as soon as possible (RIPA section 32C). A judicial commissioner is a person appointed by the Prime Minister who holds or has held high judicial office.⁷ The notification requirement had originally been proposed by the Lords, and was accepted by the Commons. However, a further amendment that the judicial commissioner have the power to cancel an authorisation was rejected. The Act therefore imposes a notification requirement without a corresponding power to quash. In practice, quashing a criminal conduct authorisation is therefore only possible via an application for judicial review, or in the case of the intelligence services, via complaint to the Investigatory Powers Tribunal.⁸ Given the secretive nature of surveillance powers, and the fact that targets of covert surveillance will rarely if ever know of the existence of an authorisation, there is only limited effective judicial oversight. Broad strategic oversight is provided by the Investigatory Powers Commissioner, who has to report on the operation of criminal conduct authorisations regularly (Investigatory Powers Act 2016, section 234(ba)). 

License to thrill? : ‘lawful for all purposes’ 

The Act amends Part II of RIPA, section 27 of which provides that conduct under Part II shall be “lawful for all purposes” provided it is properly authorised. Two key issues arise in this context:

1. Is evidence obtained unlawfully admissible in court? Does it make a difference if the evidence was obtained ‘lawfully’ only by virtue of a criminal conduct authorisation?
2. To the extent that such evidence is admissible, are there nevertheless fundamental principles in the law of evidence precluding admissibility? 
    

Pushing the boundaries - admissibility of unlawfully obtained material

The basic position in civil and criminal law is that all relevant evidence is admissible. This is subject to exceptions, notably the absolute bar on admissibility of evidence obtained by torture. However, there is otherwise no automatic bar to the admissibility of unlawfully obtained evidence, either in civil or in criminal proceedings. 

A judge in a criminal trial must not admit confession evidence obtained by oppression or in circumstances making the confession unreliable.⁹ Beyond that, the judge has a discretion to exclude evidence proffered by the prosecution obtained in circumstances which have an adverse effect on the fairness of the proceedings.¹⁰ For example, while not every breach of the PACE codes of practice will result in evidence obtained as a result being thrown out, egregious breaches will usually have this effect. However, the result is not automatic. 

The fact that evidence has been obtained unlawfully is nevertheless a strong argument in support of an application to exclude prosecution evidence. However, under the new legislation, evidence obtained pursuant to a criminal conduct authorisation has been obtained lawfully “for all purposes” – this is the effect of RIPA section 27. It is currently unclear whether the existence of an authorisation makes any difference for evidential purposes. The statutory test for the exclusion of evidence centres on fairness rather than lawfulness, but the concepts are linked. The issue will need to be addressed by the courts. 

An easily escapable mechanism? - Fundamental principles leading to exclusion of evidence

To the extent that evidence obtained ‘lawfully’ pursuant to a criminal conduct authorisation is prima facie admissible, there may be additional arguments as to why doing so would adversely affect the fairness of the proceedings. One such argument concerns legal professional privilege (LPP): can privileged material obtained ‘lawfully’ under a criminal conduct authorisation be admitted in evidence? 

There is some prior guidance from the courts on this question. In Re McE,¹¹ the House of Lords was concerned with RIPA powers authorising covert surveillance, in this case of exchanges between prisoners in a police station and their solicitors. The surveillance was contrary both to the detainees’ common-law right to LPP and their statutory right to consult a lawyer in private at any time.¹² The House of Lords held that RIPA by necessary implication overrode both LPP and the statutory consultation right. In other words, surveillance of the communications was lawful, but their Lordships did not have to decide whether the communications would be admissible in evidence. There are however observations in the speeches which suggest that LPP material intercepted lawfully under covert surveillance powers would not be admissible.¹³ In R v Turner,¹⁴ the Lord Chief Justice did not find that LPP had been waived in intercepted communications. Similarly, it is to be expected that the courts will not readily admit LPP material obtained ‘lawfully’ under a criminal conduct authorisation. 

Conclusion

The Act considerably expands the powers available to the SFO, FCA, CMA and other law enforcement and government bodies, by creating a statutory immunity from prosecution for authorised unlawful conduct. The consequences of these new forms of authorised conduct and immunity are not yet clear. The courts are yet to interpret key threshold questions, including the admissibility of evidence obtained under the new provisions, which will determine the full impact of these bold new measures. What is already abundantly clear is that many government employees who have never wielded such power will need to do so with great responsibility, or criminality may soon become part of their everyday job. At Dechert, our expert civil and criminal litigators and investigators include former members of the government agencies who are now empowered to administer these new laws. We are uniquely placed to advise corporates and individuals on all aspects of covert surveillance, investigations and the lawful use of evidence.

Footnotes

1) 7 EHRR 14, (1985) 7 EHRR 14, [1984] ECHR 10 

2) [2019] UKIPTrib IPT_17_186_CH.

3) RIPA Schedule 1 Part A1

4) Secretary of State for Education v Tameside MBC [1977] AC 1014; Al-Jedda v Home Secretary [2013] UKSC 62.

5) As in Canada: Canadian Security Intelligence Service Act 1985, section 12.1 (which the Lords’ amendments would have broadly replicated). In respect of the U.S., the guidelines typically exclude authorisation of acts of violence other than self-defence: see e.g. Attorney General’s Guidelines for Domestic FBI Operations, at V.C.4.; Guidelines for FBI Undercover Operations IV.H(3); Guidelines regarding the Use of Confidential Informants, at III.C.1(b).

6) A & Ors v Home Secretary [2006] 2 AC 221.

7) Investigatory Powers Act 2016, s. 227. The Investigatory Powers Commissions is also a judicial commissioner.

8) RIPA s 65(2). Ordinary judicial review is limited and not available for human rights claims. However, the Investigatory Powers Tribunal is subject to judicial review by the High Court: R (Privacy International & Ors) v IPT [2019] UKSC 22.

9) Police and Criminal Evidence Act 1984 (PACE), s. 76

10) PACE, s. 78. R v Mason [1988] 1 WLR 139.

11) [2009] AC 908

12) PACE, s. 58.

13) [2009] AC 908 (HL), at [83] where Lord Carswell referred to the “inviolability of the rule against the admission in evidence of privileged communications.”

14) [2013] EWCA Crim 642, at [26].