Mobile cell phones increased from sixteen million to 741 million…Internet users went from about four million to 361 million.
General Michael Hayden, Director of NSA,
commenting on the 1990s1
In the autumn of 1994, elite counter-drugs forces were searching a compound in an affluent neighbourhood of the Colombian city of Cali, home to some of the world’s major cocaine cartels. This time, instead of finding drugs, they uncovered a large computer centre, with six technicians slaving over an IBM AS400 mainframe around the clock. The presumption was that this had something to do with major underworld financial transactions, so the computer was dismantled and taken to the United States for analysis. In fact, the drug cartel had loaded all the office and home telephone numbers of US diplomats and counter-narcotics agents based in Colombia. They had then added the entire regional telephone log containing the call history of the last two years, purchased illegally from the commercial telephone company in Cali. This was being systematically analysed, using ‘data-mining’ software of the kind now commonly used by intelligence agencies, to identify all the people who had been calling the counter-narcotics officers on a regular basis. The drug barons were engaged in sophisticated sigint to uncover informants in their ranks. Chillingly, a dozen had already been assassinated, and this was the machine that had uncovered them.2
At about the same time, a team from GCHQ were assisting with an investigation into blackouts of the national power grid that had struck Auckland in New Zealand. They proved to be the result of electronic attacks on the country’s electricity distribution network, launched over the internet. Australia’s signals intelligence agency, the DSD, confirmed that intermittent blackouts across Queensland were the result of attacks from the same source. The culprits were a group of hackers called the ‘Anti-Christ Doom Squad’ who were able to move effortlessly across the computer systems of many countries using ‘spoofed’ user names and stolen passwords to hide who they were. Once they gained access to the computers controlling New Zealand’s power supply, they focused on the distribution systems, picking a point where all five main power lines converged before coming into Auckland. By changing the temperature within the sensitive cables they quickly put them out of action. Remarkably, the whole attack was run from a laptop in a drug café in the back streets of Amsterdam. The offenders had then snaked a pathway through host computers in a dozen different countries, and GCHQ thought it was unlikely that it could ever bring a prosecution against them.3
In 1995 GCHQ also found itself investigating cyber attacks on banks in the City of London. Working with the Department of Trade and Industry and the Bank of England, it began to probe crimes which the banks were extremely anxious to hide. Outwardly, they claimed to be secure, but in fact they had paid out millions of pounds to blackmailers who had gained entry to their systems and threatened to wipe their computer databases. GCHQ was hampered by limited cooperation from the banks, which were reluctant to admit the extent to which they had been damaged, for fear of undermining the confidence of investors. Nevertheless, GCHQ was able to identify forty-six attacks that had taken place over a period of two years, including attacks on three British banks and one American investment house. One of the questions GCHQ was asking was how the blackmailers had gained access to ‘hacking’ technologies that had been developed by military scientists.4
Taken together, these computer attacks represented an alarming revolution. The identity of GCHQ had supposedly been ‘modernised’ through the Intelligence Services Act of the previous year. But the language of this legislation was archaic, employing time-worn phrases such as ‘wireless telegraphy’. Moreover, the intelligence agencies were struggling to embrace the new age of personal computing and the internet.5 Of course, GCHQ and NSA had been intimately involved in the development of cutting-edge computing, but the sigint agencies tended to think big. The great prize had always been access to high-grade Soviet cyphers, and for this they needed massive super-computers. The code-breakers had been much less interested in the development of personal computing and the internet. In the 1980s, email had been an eccentric form of communication used mostly by bearded scientists in universities who wanted to chat about quarks and quasars. However, by the 1990s email was rapidly becoming ubiquitous, and global commerce was increasingly dependent on a ‘wired world’ provided by the internet. This in turn led to growing anxiety about the safety of ‘critical national infrastructure’, the ever-growing electronic networks which underpinned not only banking, but also the maintenance of many essential public services.
For GCHQ this was a paradigm shift. Alongside its traditional code-breaking role, Cheltenham was increasingly under pressure to defend the whole underlying electronic system upon which banking, commerce and indeed all the public services that supported national life now depended. GCHQ did not like this, since it resurrected the familiar dilemma of ‘offence versus defence’ in the realm of code-breaking, but in a much more unmanageable form. The dependence of banks and businesses upon ubiquitous networked computers led to a growing demand for widely available computer security and confidential messaging. Yet the very thing that GCHQ and NSA had been battling against for years was the possibility of widely available cyphers and secure communications, since this would undermine the whole business of sigint. Indeed, government was now asking them to advise large swathes of the private sector on the hitherto dark secrets of how to maintain computer security. Even as they did so, they were privately agonising over how to stop the spread of the very same technology.
In the past, NSA and GCHQ had dealt with the demand for encryption from banks and businesses by forcing IBM, the computer industry leader, to weaken its Data Encryption Standard or ‘DES’, a cypher which protected communications between computers. The idea was that DES should be strong enough to prevent rival commercial companies or hackers from breaking it, but weak enough to allow NSA and GCHQ to read it if they needed to.6 In June 1985 British, French, German and American code-breakers had come together for a secret quadripartite meeting in London about this problem, chaired by GCHQ. They agreed that the Japanese computer industry would be a problem ‘for the foreseeable future’, since it was not party to this collective agreement. GCHQ arranged a division of labour, with each sigint agency tracking the work of particular companies: the British would watch Nokia in Finland, the French were to track the French arms company Thompson-CSF, and the Americans followed Japanese activities. They all agreed that they needed a long-term programme to ‘destabilise’ DES and any successors. As they suspected, by the 1990s DES was looking weak, and demands for stronger encryption by banks and businesses were emerging everywhere.7
In fact, the nemesis of the code-breaking agencies was not large corporations, but a group of maverick scientists. They explicitly set themselves the task of recovering truly private communication for the ordinary citizen after decades of government surveillance. For them the Holy Grail was something they called ‘Public Key Cryptography’. The growing popularity of desktop computers in the 1990s, and their growing processor power, had opened up the possibility of ordinary people creating their own codes of mind-boggling complexity. The problem that confronted these mavericks was key distribution. It was no good being able to send a message secretly halfway around the world if the recipient could not read it. To do this the recipient needed the key to unlock the code, and without the paraphernalia of a government courier system, distributing the key safely and without interception was a problem. However, the mavericks now made a breakthrough. The most common analogy used to explain it is a series of padlocks. The sender, who we will call ‘Alice’, secures her message to her friend ‘Bob’ with a cypher that works like a padlock to which Bob does not have the key. When Bob receives it, instead of trying to open it, he adds a second padlock that depends on a cypher of his own devising, and sends it back to Alice. Alice then removes only her original padlock and sends it back to Bob, by which time it is only secured by Bob’s padlock. Bob can now open the box and read the message. They have communicated securely, yet there has been no key distribution.8
This was a revolutionary breakthrough. The arrival of Public Key Cryptography triggered a veritable war between civil libertarians and the code-breaking agencies. For the mavericks, the possibility of email secrecy and anonymous web activity offered the prize of a return to the golden age of privacy for the citizen. For the sigint agencies, the military and the police this conjured up a world in which criminals, drug dealers and terrorists would be able to avoid the interception of their communications and encrypt what was on their computers. The double irony was that the global telecommunications revolution that had helped to bring all this about was also placing the sigint agencies under growing pressure from their own governments to assist with secure e-commerce. Some time after his retirement, Sir Brian Tovey, a former Director of GCHQ, explained the dilemma:
The question is: how in the world does one reconcile these two? How does one on the one hand assure industry that its communications are confidential and reliable, and how on the other hand is Government under these very carefully defined circumstances to continue to derive important information, be it about drug running, terrorism et cetera, from the interception of communications…?
Either way, the tide of technology and economic activity, one might even say the tide of globalisation, was moving in favour of ever greater security and against the sigint agencies. Taken together with the huge increase in the use of fibre-optic cables to carry telecom traffic, which was hard to tap into, this spelt disaster for GCHQ.9
Just like fibre-optics, Public Key Cryptography appears to have been discovered first by the British. Arguably the most important development in secure communications for several centuries, it was partly invented by James Ellis at GCHQ in the 1970s. However, Ellis’s achievement was so far ahead of its time that neither GCHQ nor NSA could initially see any application for it, since the internet did not then exist. Sean Wyllie, one of GCHQ’s top mathematicians, had raised the issue of Ellis’s invention during a visit to Washington and asked if it had any uses, but it did not seem significant at the time.10 There was some talk of using it to distribute the ‘go-codes’ for nuclear weapons, but that was it. In the 1980s Whitfield Diffie and Martin Hellman, two American computer scientists, discovered Public Key Cryptography quite independently at a time when the development of desktop computers and the internet rendered it a breakthrough development. They immediately recognised its importance, and took it much further, developing ideas such as digital signatures.11 The US government responded by threatening to prosecute them. Martin Hellman recalls: ‘Some of my friends who had worked in the intelligence community even told me that my life could be in danger.’12
In 1993 these matters were brought to a head by a software engineer living in Boulder, Colorado, called Phil Zimmermann. He developed a code-making programme for desktop personal computers called ‘PGP’, which stood for ‘Pretty Good Privacy’, and then gave it away on the internet for free. Zimmermann had developed a quick and easy-to-use version of Public Key Cryptography that retained much of its strength, but greatly simplified its use. Now even the most non-technical computer user enjoyed access to strong cyphers and secure email communications. The American government was horrified, declaring that Zimmermann had effectively ‘exported munitions’, and actually began a public prosecution, hoping to put him in jail. After three years, the case – which became a cause célèbre – collapsed. Zimmermann asserted triumphantly: ‘This technology belongs to everybody.’13
GCHQ had debated the possibility of announcing its own early discovery of Public Key Cryptography as early as 1984. However, even while it pondered this, the controversy over Peter Wright’s Spycatcher memoirs erupted, inflaming Margaret Thatcher’s notorious obsession with secrecy. GCHQ’s senior management, who were also embattled over the trade union issue, took fright and decided to keep quiet. It was more than a decade before GCHQ summoned up the courage to make a public avowal of its remarkable achievements. Cabinet Office approval for a public announcement was finally granted in late December 1997. Tragically, James Ellis, a true hero of sigint who certainly ranks alongside the greats such as Alan Turing, had died just a month earlier, on 25 November 1997. He never received proper recognition within his lifetime.14
Throughout the 1990s, both NSA and GCHQ doggedly fought Public Key Cryptography. The Clinton administration came up with the idea of the so-called ‘Clipper Chip’, a small device in every computer that could be directly accessed by government to bypass any encryption used by the owner. However, it was soon shown that this device was easily disabled. Later, NSA suggested that American computer manufacturers should be permitted to export computers with strong encryption if a spare set of decoding keys was accessible to the government through a trusted third party. The proposals, known as ‘Key Recovery’ or ‘Key Escrow’, were bitterly criticised by privacy advocates. In fact, this scheme was soon rendered unworkable by the export of strong computer encryption from other countries like Switzerland, France, Germany and Belgium. This was a rerun of the European cypher machine problem encountered in the 1960s. The difficulties only increased when mobile phones appeared that also boasted strong encryption, which were quickly purchased by the Chinese government. In the 1990s the communications revolution continually favoured the code-makers, and pushed the code-breakers firmly into second place.15
Keeping up with the internet revolution was proving expensive for the code-breakers. Yet just as GCHQ was faced with these major challenges, its budget was severely cut. In the summer of 1993 the British government began to call for defence cuts following the end of the Cold War. The Soviet Union had visibly disintegrated, and the huge arsenals maintained by the West for half a century no longer seemed necessary. When intelligence chiefs tried to justify their budgets, there was no shortage of security problems in the world, but most looked quite small in scale. They included narcotics, money laundering, people trafficking, terrorism, nuclear proliferation and the illegal light weapons trade. There was now more emphasis on economic intelligence. GCHQ was also giving more attention to ‘economic well-being’. Robin Robison, who worked in the Cabinet Office, declared in 1992 that he had seen ‘sack loads’ of economic material making its way from GCHQ to the JIC.16 However, this did not keep the economisers at bay. In late 1993 Sir Michael Quinlan, former Permanent Under-Secretary at the Ministry of Defence, was asked to carry out a ‘Review of Intelligence Requirements and Resources’. This was completed in early 1994, and suggested only some gentle retailoring.17 Quinlan was a great friend of the intelligence services, yet even the modest cut of 3 per cent that he imposed on GCHQ was painful. Cold War icons were wound up, including the long-serving 13 Signals Regiment which had listened to the Soviets along the Inner German Border for four decades.18
GCHQ now became entangled with the fate of a single individual. This was a rising star in the Conservative Party called Jonathan Aitken. Having previously been a Minister for Defence, in 1994 he was appointed Chief Secretary to the Treasury, perhaps the most coveted post amongst younger Ministers and carrying Cabinet rank. Britain was in the middle of another expenditure crisis, and Aitken’s main task was to look for savings. One of the effects of the end of the Cold War had been to allow the Treasury to strip away a little of the mystery of secret services funding. For decades this had been grouped together as the ‘Secret Vote’ and decided upon by the Prime Minister. In 1994 the Treasury managed to make some inroads here, requiring each agency chief to face bilateral discussions with the Chief Secretary like ordinary mortals. As a result, much more of Britain’s carefully hidden intelligence spending became visible. At this point formal British intelligence spending was about £1.1 billion per year, of which GCHQ claimed the lion’s share as ever, at £850 million. MI5 and SIS received the crumbs from under the table, at £125 million each.19
MI5 and SIS performed faultlessly in their meetings with Aitken. David Spedding, the new chief of SIS, was a Middle East expert and was at home in the post-Cold War environment. He explained how his networks of agents were a long-term business, and could not be rebuilt quickly in a crisis if they were cut back. Stella Rimington, Director General of MI5, together with her deputy, Stephen Lander, made a convincing case for protection of its budget focused on the IRA. They argued that while the Republicans were engaged in talks, they were also secretly re-arming, so MI5 too escaped lightly. Aitken confessed that he was ‘actually convinced by some of the arguments against cuts put forward by the spooks’.
By contrast, John Adye, leading the GCHQ team, performed badly. Initially GCHQ produced ‘bewildering countermeasures’ by moving into the stratosphere of ‘technical incomprehensibility’. As Aitken studied the agency more closely, burning the ministerial midnight oil, he became convinced that there was something wrong. GCHQ, he concluded, was ‘suffering from out-of-date methods of management and out-of date methods for assessing priorities’. There was undoubtedly great technical wizardry. GCHQ was monitoring communications between Russian tank commanders in Chechnya – but what, asked Aitken, was the real value of this to British national interests?20
Aitken sensed weakness. He pressed for a deep probe of GCHQ led jointly by Foreign Secretary Douglas Hurd and himself for the Treasury. The real work was to be led by an outsider – Roger Hurn, the successful chairman of Smiths Industries, which made technical instruments.21 Hurn’s review team was formidable. It included Alice Perkins (a.k.a. Mrs Jack Straw), one of the most effective Treasury officials, and David Omand, ‘a fearlessly outspoken Deputy Secretary at the MoD’.22 The schedule was tight. Commissioned on 12 December 1994, the team reported back to Ministers on 25 March 1995.23 GCHQ suffered a body blow. Hurn took almost £200 million per annum off Cheltenham’s budget in one bite, somewhere close to a quarter of its spending. This left managers in deep shock. No British intelligence agency had suffered such deep retrenchment since the end of the Second World War.24 These cuts heralded ‘massive and dramatic change’, and staff understandably had ‘fears for the future’. The vast Cold War ‘silos’ were broken up, resulting in the death of the mighty J Division, which handled sigint on Russia, and K Division, which handled the rest of the world. Even greater changes lay in store for the communications security wing. Hurn suggested that this should go over to charging its Whitehall customers on a cost-recovery basis.25
If this was not enough, on 23 November 1995 it was announced that the GCHQ Director, John Adye, would be replaced by someone from outside the agency. This was David Omand, a senior official who had been part of the Hurn Review team. Many at GCHQ greeted this news with ‘consternation and disappointment’, since it seemed to signal that internal candidates were not good enough. Some pondered aloud whether Omand was yet another ‘axe man’ sent to further downsize GCHQ.26 In fact it was inaccurate to say that Omand was an ‘outsider’, since he had joined GCHQ straight from Corpus Christi College, Cambridge, in the 1970s. However, an obvious high-flyer, he had soon moved on to the Ministry of Defence. Omand’s reputation for tough management and intellectual rigour caused visible panic at GCHQ.27 Wild rumours abounded that the target figure for further job losses was at least three thousand, leaving a staff of perhaps just over two thousand at GCHQ by the end of the century.28 In reality, Omand was GCHQ’s saviour, rapidly reordering it for the post-Cold War world and putting in place imaginative new plans that central government would fund. Meanwhile, the planned cuts were far more modest than the doom-mongers had suggested. GCHQ stood at 5,900 staff in April 1995, and managers envisaged a move to 5,300 over two years.29
Omand performed open-heart surgery on GCHQ. He realised that both rapidly shifting targets and the increasing pace of technological evolution would mean abandoning the old structures. The central concept was now something called ‘Sinews’, or ‘Sigint NEW Systems’, which gained massive momentum by 2000. The aim of Sinews was to provide maximum flexibility of operations while avoiding wasteful overlap. In practice it resulted in the creation of fourteen domains, each with a defined area of work. The key to success was a small team of programme managers who could move people rapidly from task to task, and a lot of time was now spent balancing competing intelligence requirements. The whole purpose was to come to grips with the messy post-Cold War environment, with its myriad targets and changing priorities. One of the most important drivers of Sinews was a recognition that the culture of GCHQ had to change from a highly secretive ‘need to know’ towards ‘need to share’.30
When David Omand took over on 1 July 1996, the most striking aspect of GCHQ was its physical dilapidation. His own office was a drab 1950s affair in C Block on the Oakley site. Even as GCHQ’s management sought to anticipate the challenges of the twenty-first century, their own windows looked out on a heritage theme park covered with 1940s prefabs. The contrast was made all the sharper by the fact that SIS had just moved into distinctive new London offices at Vauxhall Cross, by the side of the Thames, designed by the architect Terry Farrell, that could easily have been the work of the visionary television producer Gerry Anderson, creator of the 1960s puppet series Thunderbirds. More importantly, one of the obstacles to improving GCHQ was the fact that it was spread across innumerable small buildings on two sites, at Oakley and Benhall.31 Accordingly, in September 1996 Omand began to consider a Private Finance Initiative to provide new accommodation. He also improved the agency’s profile with a new high-level GCHQ post in Whitehall and new London facilities in Albany Court, across the road from its existing offices in Palmer Street.32
The future shape of GCHQ was round – or to be more precise, doughnut-shaped. Under Omand’s new plan, by 2003 all of GCHQ’s activities were to be brought together on the Benhall site, in a vast new circular building with an open centre. The optimistic idea of post-Cold War peace was still in the air, and it was thought that while the building would take all of GCHQ’s staff, by the time it was completed lower numbers might even allow them to rent out some of the space.33 GCHQ would actually lease rather than buy its new quarters. When construction began in the late 1990s it was the largest building ever initiated by the British government, and indeed the largest construction project then in progress in Europe. The plan included an underground road to service the main building, and massive basement computer halls. Above ground, it required sixteen miles of carpet and provided more than a million square feet of office space. There was great excitement about ‘the Doughnut’, but also some trepidation. The new MI5 and SIS headquarters had each cost more than three times their original estimated price, largely due to computer problems, and by 1999 the projected figures for the GCHQ building were already being looked on with some scepticism.34
In Britain, the advent of a new Labour government in 1997 brought further change. At the start of the 1990s a young Tony Blair – then Shadow Employment Secretary – told an enthusiastic GCHQ trade union rally that the first act of a Labour government would be to restore union rights to Cheltenham.35 The union issue had not been dormant. By the 1990s the GCHQ Trade Union Campaign was a small but hardened machine, working remorselessly to stay in touch with Blair, continually thanking him for speaking about GCHQ, congratulating him on the attainment of each Shadow Cabinet post and keeping him up to date with the campaign. Blair always responded warmly and enthusiastically.36 Gordon Brown was also energetic and sincere in his offers of assistance.37 Other key members of Blair’s team, including Peter Mandelson and Tessa Jowell, had continually praised what they called a brave and admirable activity. Now Labour was back in power, the unions were coming back to Cheltenham, with cloth caps, brass bands and banners flying, all somewhat out of step with David Omand’s new mood of modernisation.38
In the two years before the election, Tony Blair regularly repeated his pledge to restore full trade union rights at Cheltenham. During the period June to September 1995 he repeated the undertaking on no fewer than four separate occasions.39 Yet trust between the GCHQ trade unions and the Labour Ministers who had backed them unstintingly for thirteen years was surprisingly fragile. Although publicly thanking the new Foreign Secretary Robin Cook, they suspected him of capitulating on the matter of a no-strike deal, and were sufficiently anxious to write to him asking him to deny rumours to this effect. Despite plaintive reassurances from Tony Blair, the last remaining GCHQ trade unionists expected to be sold down the river. In fact, Cook went for a voluntary agreement, exactly as the GCHQ Trade Union Campaign desired.40 The complex process of negotiating the ‘collective agreement’ began with the Director of GCHQ, Kevin Tebbit, making it clear that he wanted ‘no outside inducement to disruption’. The only sticking point was that the unions wanted an agreement on non-disruption by arbitration, while the managers desired a solid legal agreement.41
IRA terrorism stood out as the seemingly perennial sigint target in the early 1990s. Down the years, perhaps GCHQ’s biggest contribution in Northern Ireland was in the electronic war against the radio-controlled bombs used by terrorists. Once the IRA moved away from old-fashioned command wires towards radio-controlled bombs, researchers at GCHQ came up with special equipment that inundated the Province with random radio signals on the bomb command frequencies. This caused a number of bombs to detonate while they were being constructed and tested. It was only after a number of volunteers had been killed or injured by their own bombs exploding in their secret workshops that the IRA realised what was happening. A scientific war developed, with the IRA creating a new type of bomb that was triggered by two separate coded signals. GCHQ eventually discovered this, and took further countermeasures, resulting in more IRA deaths. To counter this, the IRA tried to move to using other kinds of trigger, including adapting radar guns used by the police in speed traps.42
The main source of technical collection on the IRA was local telephone tapping, most of which was undertaken by the Royal Ulster Constabulary Special Branch, together with bugging with microphones facilitated by the Army and MI5. The scale of bugging was so great that in the 1980s extra Army personnel had to be borrowed from units such as the Royal Electrical and Mechanical Engineers to do the work. Telephone interception was an especially skilled business because of the sensitivity of the IRA to surveillance. The core analysis was provided by about thirty women working for the RUC in a building nicknamed ‘the hen house’, where real-time listening continued twenty-four hours a day. The analysts required the most acute skills, since it was often the inflection in a voice, the particular way in which someone said, ‘Are you coming out for a drink then?’, or even a period of silence, that suggested imminent activity. GCHQ had responsibility for longer-distance communications, including telephone lines between Northern Ireland, the British mainland and the Republic of Ireland. The IRA was known to run its own ingenious sigint operations, dismantling old television sets to obtain UHF/VHF receivers to allow them to listen in on the high-frequency radios used by the Army and the RUC.43
Intelligence was no less vital during the mid-1990s, when the British government had entered into tentative dialogue with the Republicans. Key participants included Sinn Féin’s Martin McGuinness and senior British government figures including Mo Mowlam, the Northern Ireland Secretary, and Jonathan Powell, Tony Blair’s Chief of Staff. Blair’s immediate circle soon noticed that the Sinn Féin President Gerry Adams was sensitive to surveillance, and ‘went without a mobile…because he knew he could be tracked on it’.44 Like not a few government Ministers, Mo Mowlam struggled to deal with the intricacies of using intercepts. She was regularly provided with transcripts of IRA conversations derived from surveillance, yet she would discuss sensitive political subjects, such as her battle to stop the Prime Minister sacking her, with Martin McGuinness in circumstances in which she was also likely to be captured by British technical collection. More alarmingly, she sometimes introduced details into her conversations with Adams and McGuinness that she could only have been privy to from technical collection. This led the Republicans to uncover listening devices in one of their key safe houses. In May 1998 the security agencies accused Mowlam of revealing a listening operation that had been mounted against Gerry Kelly, a leading Sinn Féin official living in Belfast. A wooden rafter in his house had been hollowed out and packed full of listening equipment, which had been providing good intelligence for three years.45 Needless to say, the intelligence and security services did not consider Mo Mowlam their all-time-favourite Northern Ireland Secretary.
The most striking physical feature of GCHQ’s participation in the intelligence war against the IRA was a 150-foot-high concrete tower built in 1989 within a secure compound at Capenhurst in Cheshire owned by British Nuclear Fuels Ltd. It was on a direct line between the British Telecom Medium Wave Tower at Holyhead in Anglesey and another tower at Sutton Common near Macclesfield, a microwave link which carried most of the telephone calls between mainland Britain and Ireland. The tower contained seven floors of secret monitoring equipment and three floors of aerials. Its staff were rumoured to be drawn from the Royal Radar Establishment at Malvern. The tower was closed in 1998 when the Irish government protested strongly and insisted on telephone calls being sent by a different route. Over a decade the Capenhurst tower had allowed GCHQ to intercept a vast volume of telephone traffic for analysis. A similar station on Croslieve Mountain in South Armagh is thought to have taken traffic between Belfast and Dublin. This was a classic example of the bonanza of clear voice material that could be provided by microwave telephone interception. Unsurprisingly, during the Peace Process in the 1990s the IRA was most anxious to see the physical architecture of surveillance in Northern Ireland removed, including the watchtowers that bristled with aerials and antennae.46
On 15 August 1998, twenty-nine people died at the town of Omagh in County Tyrone in the most deadly bomb attack ever carried out in Ireland. This was the work of a small breakaway faction called the ‘Real IRA’. Recently, dramatic claims have been made suggesting that the Omagh bombing could have been disrupted by the security forces had intelligence from GCHQ been properly utilised. BBC investigative journalists said that GCHQ intercepted mobile phone calls from members of the Real IRA in the car carrying the bomb towards the target, and that these should have indicated that a major attack was being launched. There is no doubt that the RUC had asked for the mobiles in question to be given a very high priority for monitoring. Ray White, a former Assistant Chief Constable in the RUC, recalls that Special Branch had requested ‘live’ monitoring of particular mobile phone numbers in the hope of stopping such attacks.
In September 2008 the BBC’s Panorama claimed that just ninety minutes before the attack, GCHQ captured a call to a suspect phone which contained the phrase: ‘We’re crossing the line,’ meaning the car carrying the bombers was passing from Eire into Northern Ireland. Forty minutes before the explosion, the words ‘The bricks are in the wall’ were heard on the same phone, a code understood to mean the bomb was in place. White claims that when Special Branch later asked why the information came so late, GCHQ said: ‘We missed it.’47 Understandably, the assertions that GCHQ had intercepted mobile phone calls prior to the detonation caused a public furore. Eventually the Intelligence Commissioner, Sir Peter Gibson, was called on to investigate.
GCHQ is such a sensitive topic that Gibson’s report was never made public. Instead, a short summary was produced that was hedged around by the excruciating secrecy that still accompanies sigint. Nevertheless, to the discerning eye much was revealed. Gibson effectively conceded that the mobile phones of the Real IRA were indeed being monitored live by GCHQ—which underlines that these people were a very high priority. But there were two problems. First, the Real IRA knew this, and used obscure code words. It is unlikely that the conversations GCHQ captured prior to the bombing indicated clearly that an attack was under way. Second, GCHQ had insisted on convoluted procedures that restricted sigint very tightly to a few people in Northern Ireland. Some GCHQ staff had been lent out to RUC’s intelligence headquarters in Belfast; however, Gibson himself concedes that:
Once intercept material reached RUC HQ and Special Branch South, any further publication and release of that material, even to another part, or other members, of Special Branch, was subject to strict conditions imposed by GCHQ…If those persons within the RUC HQ and Special Branch South who received intelligence from GCHQ wanted to disseminate it within the RUC or even within Special Branch a set procedure had to be followed…and a form of words cleared with GCHQ.
This was hardly a procedure designed to permit immediate action. Moreover, Gibson also shows that GCHQ had prioritised the flow of sigint to RUC headquarters in Belfast and the border areas. Omagh was in a quiet area west of Belfast, and had been given a lower priority.48 Whatever the shortcomings of the system, it remains unlikely that the security forces could have responded in the limited time-frame available. Even with the most attentive real-time listening, for GCHQ to have analysed the conversations, contacted the right units in Northern Ireland, and for them in turn to have put several roadblocks in place, in a little more than an hour, is improbable. Quite simply, in real life, response times are not that fast.49
Much more convincing are the complaints about the way in which the dead hand of sigint security rules impeded the subsequent police investigation. GCHQ shared intelligence with the RUC Special Branch, which it saw as another intelligence service, but not with the CID officers pursuing the criminal investigations. Gibson concedes that this led to ‘a tension between Special Branch and CID’.50 GCHQ’s voice recordings might well have assisted in the CID’s subsequent efforts to identify and arrest the perpetrators. Instead they spent months trawling through call logs, in effect doing their own more primitive sigint, and as a result the trail went cold.51
The Omagh bombing underlined that ‘need to share’ was a major problem right across the British intelligence community. The sort of targets that were of rising importance in the late 1990s, including Middle Eastern terrorists, Colombian drug cartels and warlords in the former Yugoslavia, required closer and faster cooperation with MI5 and SIS. A well-worn system of liaison already existed. GCHQ had a small unit called ‘Z Division’, whose job it was to pass material to the other secret services and to agree on the use to which it could be put. However, the formal regulations surrounding the use of sigint, called ‘IRSIG’, largely drawn up by NSA, were proving cumbersome and made ‘Action On’ very difficult. (‘Action On’ was the phrase used to indicate permission to share sigint with colleagues with a view to taking positive action.) GCHQ’s instinct was always to hide its source. Now, a younger generation of MI5 and SIS officers was tending to bypass these obstacles, preferring to meet up informally with GCHQ personnel in the pleasant Cotswolds pubs around Cheltenham. This was a grassroots revolt, and during the late 1990s top managers in the British intelligence community had to accept the new trend. Organic connections were developing fast between the three secret agencies under the pressure of fast-moving day-to-day operations.52
In the summer of 1998, after only six months in office, Kevin Tebbit handed over to Francis Richards, who would be GCHQ’s fourth Director in as many years. Like his immediate predecessors, Richards was an outsider, but he was not entirely unacquainted with the secret world. He had served in the Army, including on Cyprus, and had then joined the diplomatic service. His father, Brooks Richards, had served in SOE during the war, and had been Cabinet Office Coordinator of Intelligence in the late 1970s. For Richards, and for Britain’s other intelligence chiefs, one of the pleasing aspects of the Blair administration was that the Prime Minister took intelligence seriously, partly because of his abiding enthusiasm for military intervention. However, in the late 1990s the emerging security issue was the rising tide of global organised crime. In early December 1999, Richards joined the Chief of SIS and the Director General of MI5 in an extended meeting at Downing Street on the ‘crime emergency’ facing Britain, including the threat from the Russian Mafia. GCHQ was asked to work more closely with the National Criminal Intelligence Service and to help set up a new unit called the Government Telecommunications Advisory Centre, which addressed the growing use of email and encrypted computers by organised crime.53
By the late 1990s the main threats that preoccupied government arose from shadowy non-state organisations rather than foreign countries. They included terrorism, organised crime and warlordism, together with a proliferation of private networks interested in nuclear, chemical and biological weapons. The common element among these new threats was that many of them operated clandestinely. The British response was to give more emphasis to intelligence-led activity. Indeed, as Britain’s borders became more porous, and with the growing volumes of international trade, there was little else that could be done. The expansion of the European Union seemed to suggest practically an open frontier for Britain that extended as far as the Urals.54 In June 2000 the shocking discovery of fifty-eight Chinese illegal immigrants who had perished in a container lorry at Dover highlighted how serious these matters were. The government was now reversing the cuts it had imposed on the intelligence agencies, because they seemed a plausible antidote to these intractable problems.55
GCHQ’s contributions in this realm were valuable. This was illustrated by the capture of the exceedingly dangerous criminal Kenneth Noye. In 1996 Noye was the prime suspect in the notorious murder of Stephen Cameron in a road-rage incident on the M25 motorway. The perpetrator fled the motorway junction where the attack took place in a black Range Rover. Noye was also linked to a string of high-profile crimes, including the disposal of the assets from the Brinks Mat bullion robbery at Heathrow airport in 1983. After the murder, Noye slipped abroad: the police would visit no fewer than thirteen countries, including Russia and northern Cyprus, in their quest for him. Huge efforts were made to keep the search secret, since some police officers and one senior politician were thought to be in Noye’s pay. All the police had to go on were reports that he was in Spain and his current mobile phone number. In 1998 GCHQ used cell-site tracking of his mobile phone to identify his movements, and this allowed him to be located in Spain, despite numerous false identities. Stephen Cameron’s girlfriend, Danielle Cable, who had witnessed the M25 murder, was flown out to Spain to assist in his identification. One evening Noye was eating dinner in an expensive restaurant when four undercover detectives in T-shirts and shorts surprised him and handcuffed him. Britain’s most wanted criminal had been caught. Jack Straw, the Home Secretary, signed Public Interest Immunity certificates on 8 February 2000 to ensure that details of GCHQ’s role in finding Noye were not revealed in court.56
The police were so anxious about the safety of their witnesses that they were protected in a police station in north London with three separate air locks. Each witness was guarded by an armed policeman who had been specially vetted to ensure that he had no links to south London, where Noye operated. This caution was justified. Danielle Cable courageously gave evidence at Noye’s trial in 2000, and was later given a new identity. Alan Decabral, an eye-witness to the murder who also gave evidence, refused a new identity and was shot dead in his car in Ashford in Kent on 5 October 2001.57 To the dismay of GCHQ, its role in the effort against Noye was being discussed in the newspapers even before the case came to trial. This triggered a further operation, this time against journalists and their sources. Code-named ‘Operation Nigeria’, it caught journalists from tabloid newspapers on tape during a surveillance operation that showed they were procuring intelligence from a private detective agency which, in turn, obtained its information from corrupt police officers. Over the summer of 1999 the detective agency in question, known as Southern Investigations, was secretly bugged by the Metropolitan Police’s anti-corruption squad, CIB3, and one leading figure was recorded discussing how he had sold a story to a reporter about GCHQ’s role in tracking down Noye. It was also found that Southern Investigations had an informant in the Diplomatic Protection Squad at Buckingham Palace.58
No one could possibly argue that the identification and arrest of Kenneth Noye was anything other than an immense public good. Yet, because crime recognises no borders, this sort of work meant that GCHQ was being inexorably drawn into the controversial realm of domestic surveillance as well as having to engage with the contentious politics of internet privacy. During 1996 GCHQ and NSA had joined forces to put forward a solution to the problem of publicly available encryption, called ‘Key Escrow’. However, this idea had proved unworkable, and in any case the new Blair government was unsympathetic to it. On 26 May 1999 Stephen Byers, Secretary of State at the Department of Trade and Industry, revealed the latest thinking on ‘Encryption and Law Enforcement’. Speaking at the Cabinet Office, he confirmed that ‘Key Escrow’ was finished, and now emphasised cooperating closely with the computer industry rather than fighting it. The government accepted that no single magic technique was likely to sustain interception in the face of rising use of encryption by criminals.59 Instead, it placed its hopes on new legislation called the Regulation of Investigatory Powers Act 2000, under which criminals would face serious penalties for refusing to offer up the keys to encrypted material.60
In addition, there would be a new dedicated computer unit called the Government Technical Assistance Centre (GTAC), intended to break the codes that criminals used to encrypt their emails and computer hard drives. While this was nominally a Home Office unit, in reality code-breaking and code-making always meant GCHQ, and officials joked privately that ‘GTAC’ actually stood for ‘GCHQ Technical Assistance Centre’. Sure enough, in July 2000 GCHQ was asked to lend one of its top experts, Brian Paterson, to the Home Office to establish the unit.61 Even Paterson called GTAC a ‘euphemistic title’ for what was in effect a code-cracking unit at the Home Office. He explained that modern criminals tended to use the internet in three different ways. First, as a simple extension of ordinary crimes, such as fraud, theft and smuggling. Second, there were crimes which had only developed because of the existence of the internet, such as hacking and virus attacks.62 Third, there was the use of the internet by criminals as a means of communications or storage. When it came to the third problem, Paterson explained that domestic interception presented multiple difficulties. It required warrants literally signed by the Home Secretary, ‘even if it means getting him out of bed’. Moreover, in the era of the internet, interception was being made ‘very much more difficult by new technology’.63 Surprisingly, GTAC was developed, staffed, and then little used. Always partly run by GCHQ, it was quietly transferred to Cheltenham in April 2006.64
The number of criminals encrypting their emails and computer files proved to be fairly small. In fact, for a decade both NSA and GCHQ had been barking up the wrong tree in terms of their obsession with the dangers of Public Key Encryption. This was a small problem, compared to the sheer explosion of open communications, especially those based around the internet. In October 2002 General Michael Hayden, Director of NSA, explained to Congress that in the 1990s the number of mobile phones in the world had increased from sixteen million to 741 million. At the same time, internet users went from about four million to 361 million. Half as many landlines were laid between 1994 and 2000 as in the whole previous history of the world. International telephone traffic went from thirty-eight billion minutes a year to over a hundred billion.65 Both NSA and GCHQ were simply overwhelmed by a tidal wave of data, despite the fact that almost none of it was in code. One insider recounted that NSA had created a special facility with three years’ worth of storage capacity for intercepted internet traffic. ‘They filled it in eleven months.’66
By 2000, some intelligence chiefs had even begun to question the value of sigint in this era of superabundant communication. GCHQ and NSA could collect all of this new traffic, but they could not begin to listen to it or process it—so intelligence chiefs were at a loss to know what to do with it. One disillusioned code-breaker observed that it was like trying to pour a glass of water with a firehose. The costs of collecting all this material were huge, and the benefits were uncertain. In the United States, the price of satellite collection was threatening to overwhelm the whole intelligence budget, while in Britain the cost of transferring GCHQ’s massive computers to the new building had begun to rise alarmingly. More importantly, the new sigint, which focused on emails and mobile phone calls, only worked if you knew precisely who you wanted to listen to, since trying to listen to everyone in a globalising world was impossible. Was this the right kind of intelligence-gathering for the twenty-first century? Even as security agencies pondered this question, frightening events were lurking just around the corner that would give it a sharper edge.67