Bulk Surveillance in the Digital Age: Rethinking the Human Rights Law Approach to Bulk Monitoring of Communications Data

The digital age has brought new possibilities and potency to state surveillance activities. Of significance has been the advent of bulk communications data monitoring, which involves the large-scale collection, retention and subsequent analysis of communications data. The scale and invasiveness of these techniques generate key questions regarding their ‘necessity’ from a human rights law perspective and they are the subject of ongoing human rights-based litigation. This article examines bulk communications data surveillance through the lens of human rights law, undertaking critical examination of both the potential utility of bulk communications surveillance and – drawing on social science analysis – the potential human rights-related harm. It argues that utility and harm calculations can conceal the complex nature of contemporary digital surveillance practices, rendering current approaches to the ‘necessity’ test problematic. The article argues that (i) the distinction between content and communications data be removed; (ii) analysis of surveillance-related harm must extend beyond privacy implications and incorporate society-wide effects; and (iii) a more nuanced approach to bulk communications data be developed. Suggestions are provided as to how the ‘necessity’ of bulk surveillance measures may be evaluated, with an emphasis on understanding the type of activity that may qualify as ‘serious crime’.


INTRODUCTION
The digital age has sparked a fundamental transformation in state surveillance, both in terms of how surveillance is conducted and the types of insight it is intended to facilitate. This transformation is exemplified by the use of bulk communications data techniques, 1 which involve the large-scale collection, retention and subsequent analysis of communications data. 2 These techniques have now become an integral feature of state surveillance. For instance, United Kingdom (UK) intelligence and security services report that the use of bulk communications data is 'essential', 3 and is a key tool in fulfilling their obligation to protect human rights. Others, however, have highlighted the potential for serious human rights concerns, 4 particularly with regard to rights such law perspective, and no specific guidance exists at the international level. This article intends to contribute to emerging understandings of how to approach this issue.
Human rights law typically applies a three-part test to assess the legitimacy of surveillance measures. 9 First, does a legal basis exist under domestic law, and is this legal basis of sufficient quality to protect against arbitrary interference with the rights of individuals? Second, does surveillance pursue a legitimate aim? Third, is the surveillance necessary in a democratic societythat is, does it answer a pressing social need and is it proportionate to the legitimate aim pursued? 10 Evaluating the legal basis, and the quality of this legal basis, is dependent on the specific legal framework applicable in a given jurisdiction, while the uses of surveillance measures by intelligence and security services typically satisfy the legitimate aim test on the basis of protecting national security or public order. 11 As such, and to examine the specific human rights issues raised by the bulk collection of communications data at a more universal level, this article will focus on the third part of the human rights law test: evaluating the necessity in a democratic society of bulk communications surveillance. This requires an examination of both the potential utility, 12 and the potential human rights-related harm, of this practice. To facilitate an understanding of the core issues, this article is organised over four areas of discussion. Section 2 begins by discussing the nature of communications data, and briefly highlighting some relevant human rights law issues. Sections 3 and 4 then engage in an initial discussion of how bulk communications data techniques may be seen through existing formulations of utility and harm.
Section 3 advances the argument that effective assessment of utility is increasingly challenged in its ability to capture the complexity of contemporary digital surveillance practices. In particular, this is because access to specific information demonstrating utility is circumscribedoften legitimatelyby national security concerns, while there is also a more general sense of opacity concerning the instrumentality and impact of digitally generated data. This means that an accurate utility assessment is difficult to achieve. Nonetheless, the benefits associated with bulk practices should not be dismissed summarily. Section 4 examines the other side of the equation, drawing on social science analysis of surveillance to indicate the types of direct and indirect harm linked to bulk monitoring. However, as with utility, this section argues that although factors indicating harm do exist, the precise identification of, for example, a chilling effect is difficult to achieve. Ultimately, the challenges associated with examinations of utility and harm raise pressing questions regarding the appropriateness of the human rights law test, as currently applied, and highlight the need for further transparency in relation to claimed utility, and for further consideration ofand research intothe broader types of human rights harm, including at the societal level.
In an effort to resolve this issue, Section 5 argues that any analysis regarding the 'necessity' of bulk communications data surveillance should take into account: (i) the extent of information revealed by communications data; (ii) the extent to which harm associated with retained communications data affects a broad range of rights; (iii) the ease with which communications data can be subject to analysis; and (iv) the utility of bulk communications data to law enforcement and intelligence agencies. On the basis of these factors it is proposed, first, that communications data be regarded as equivalent to content data and, second, that human rights law should adopt a more nuanced approach to the issue of 'mass surveillance'. In order to take advantage of the utility associated with bulk communications data surveillance techniques, while mitigating the full range of associated types of harm, a clearer and stricter understanding of the types of activity to which bulk techniques may be applied is required. This section provides guidance on how the 'necessity' test can be applied in the context of bulk surveillance, and addresses how current broadly conceived notions of 'serious crime' can be revised.

UNDERSTANDING COMMUNICATIONS DATA?
The term 'communications data' (or 'metadata') refers to all of the information associated with a communication, apart from the actual substance of the communication. 13 A frequently used example suggests that communications data consists of the information on the outside of an envelope, while content data relates to the information contained within the actual letter. However, this analogy does not reflect the true nature or extent of communications data in the current era, or the fact that it can be just as invasive as content data. The widespread integration of technology into everyday life, coupled with increasing digitisation, means that individuals produce significant amounts of communications data in the course of a normal day. 14 This information can reveal extensive insights, such as a near comprehensive record of an individual's movements, with whom he or she communicates, how frequently and for how long. Communications data is not restricted to conventional communications such as phone calls, emails, or messaging, but also includes communication between computers and internet browsing histories. 15 Communications data is deemed particularly useful for the intelligence and security services when combined and aggregated to produce a near comprehensive record of an individual's communications and internet-based activity. 16 Such data is used to find patterns in, or characteristics of, communications that may indicate involvement in a threat to national security or the 13 The UK High Court classified communications data into three broad categories: subscriber data, service data, and traffic data: see Davis and Others v Secretary of State for the Home Department [2015] EWHC 2092, [13]. 14 For instance, normal use of a smartphone will indicate the user's location history, the identity of everyone with whom he or she communicates (over email, phone or messaging), the time and duration of this communication, and the user's internet search history. 15  commission of a crime, 17 or to construct a more generalised 'intelligence picture' of a particular subject. In particular, communications data can be used to uncover the composition of a network, potential hierarchies within that network, and a series of related yet non-obvious relationships. This information can also be used to develop revealing individual profiles. 18 Advances in the collection, storage, collation and analysis of communications data have transformed the extent of detail that can be exposed. As noted by the Advocate General of the CJEU, the use of such data makes it possible to 'create both a faithful and exhaustive map of a large portion of a person's conduct strictly forming part of his private life, or even a complete and accurate picture of his personal identity'. 19 The Special Rapporteur on Freedom of Opinion and Expression similarly noted: 20 When accessed and analysed, even seemingly innocuous transactional records about communications can collectively create a profile of an individual's private life, including medical conditions, political and religious viewpoints and/or affiliation, interactions and interests, disclosing as much detail as, or even greater detail than would be discernible from the content of communications alone. By combining information about relationships, location, identity and activity, States are able to track the movement of individuals and their activities across a range of different areas, from where they travel to where they study, what they read or whom they interact with.
For intelligence agencies, the benefit of communications data over content-based information may be demonstrated by the following (simplified) example. If a state agent wishes to identify all those individuals who attended a particular protest march, or all those who oppose government policy in relation to a specific issue, they may attempt to do so using content-based information, but this would require considerable resources. 21 However, a cursory search of retained communications data will immediately reveal all those who were at the location of the protest march during the identified time frame, and all those who contacted a particular opposition group (by phone, message, email, or by visiting a website), and will also instantly provide further information such as how frequently this contact occurred. Those individuals who fall into all of the specified categories may then be quickly, indeed almost instantaneously, identified. 22 In addition to revealing information about an individual's political opinion or participation, 17  communications data can also be combined, analysed and used to infer other highly sensitive personal information, such as an individual's health status, position in a social network, political affiliation, financial situation or sexual orientation. 23 Bulk communications data surveillance refers to the large-scale collection and retention of communications dataas opposed to the targeted collection of such data 24and is today employed by both intelligence and law enforcement agencies. 25 For instance, the UK Investigatory Powers Act allows the Secretary of State to require domestic telecommunications operators to retain communications data for a period of up to 12 months. 26 The retention of communications data may be requested in relation to a broad range of objectives, which include 'the interests of national security', 'for the purpose of preventing or detecting crime or of preventing disorder', and 'for the purpose of assessing or collecting any tax, duty, levy or other imposition, contribution or charge payable to a government department'. 27 As telecommunications operators are the principal providers of internet access, the Act allows for collection of information relating to virtually every individual within the jurisdiction.
The retention of bulk communications data, in itself, constitutes an interference with the right to private life 28 and the right to freedom of expression. 29 In order to determine whether this interference is legitimate or results in a violation of human rights law the three-part test developed by the European Court of Human Rights must be applied. 30

BULK COMMUNICATIONS DATA SURVEILLANCE AND CLAIMED UTILITY
Evaluating the utility of bulk communications data surveillance is a complex task, and two key difficulties must be highlighted. First, information relating to state surveillance activity remains necessarily restricted, and this factor is heightened in the national security context, despite 23 See, generally, Viktor Mayer-Schönberger and Kenneth Cukier, Big Data: A Revolution that Will Transform How We Live, Work, and Think (John Murray 2013). 24 ie, the collection of communications data relating to a specific individual, initiated on the basis of a reasonable suspicion that that individual is engaged in criminal activity. 25 See, inter alia, David Lyon, Surveillance after Snowden (Polity Press 2015). 26 Investigatory Powers Act (n 2) s 87. If this retained data is accessed by the intelligence and security services and therefore becomes 'operationally relevant', it is possible that it may be retained by these agencies for significant periods of time, and also potentially reassembled into new forms in the future, thus ensuring a more enduring legacy. This may be a loophole in existing legislation, such as the UK Investigatory Powers Act, which has the effect of facilitating the retention of communications data for significantly longer than envisaged in the legislation. 27 Investigatory Powers Act (n 2) s 61(7)(a), (b) and (f), respectively. 28  Cause and effect in this area are not always straightforward: indeed it will only rarely be possible to attribute a successful outcome solely to the exercise of a particular power. In almost every scenario to which I have been introduced, both in the course of this Review and in several years of reviewing counter-terrorism operations … [a] mosaic of different information sources is classically involved in identifying a target or threat.
While acknowledging these complexities, the current human rights law approach nonetheless necessitates that efforts be made to identify the particular benefit of this surveillance practice: this examination of utility is essential in determining whether the techniques are 'necessary'.
To analyse these issues effectively, we acknowledge a key distinction between the related themes of 'use' and 'utility'. 'Utility' in this sense constitutes a more value-laden assessment of the worth of these distinct and potential 'uses'. As such, the following four areas of discussion first explore attributions of use as expressed by those who operate and oversee these techniques.
Here, reports by the UK intelligence and security services, 33 the UK Independent Reviewer of Terrorism Legislation, 34 and others indicate that the use and utility of bulk data communications surveillance relates to, inter alia, (i) mapping of activity and network composition; (ii) pattern identification; (iii) resource efficiencies; and (iv) the ability to 'look into the past'. While implicit in these discussions, the fifth area of discussion engages in more detailed analysis of utility and the claims made for the operational value of these measures.

MAPPING OF ACTIVITY AND NETWORK COMPOSITION
The collection and retention of bulk communications data allows intelligence and security services to create a map of allor nearly allcommunications activity. This map may be used to determine the composition of a particular organisation or network, identify previously unknown persons of interest, develop partial intelligence leads, link anonymous profiles to real world identities, or note changes in communications activity that may be suspicious. communicated, and the relationship between them. This can be used to identify the membership of a particular network or group. 35 Importantly, this process may flag individuals previously unknown to the security services. Further analysis of these individuals' communications can then be used to infer whether they themselves are suspect. For example: 36 The security and intelligence agencies' analysis of bulk data uncovered a previously unknown individual in 2014, in contact with a Daesh-affiliated [ISIS] extremist in Syria, who was suspected of involvement in attack planning against the West. As this individual was based overseas, it is very unlikely that any other intelligence capabilities would have discovered him.
This form of analysis may also be initiated on the basis of sparse information, as the ability to place even limited information within a near comprehensive communications data set may well indicate other avenues of investigation. In this regard, intelligence leads 37 … might indicate that a British extremist who travelled to join Daesh in Syria in late 2014, whose full name is not yet known, is trying to make contact with a group of known extremists back in a particular region in the UK. The intelligence might indicate that the group potentially has access to firearms, and may be planning an attack.
In such cases, the analysis of data obtained in bulk is frequently the only means of identifying those involved. 38 Further analysis may also indicate key individuals within a network. For instance, communications patterns may identify a hierarchy among the members, or interlocutors through which a high percentage of communications pass. The ability to examine individual users in the context of all communications activity also facilitates the identification of 'anonymous' users. 39 Individuals may use specific software or practices to hide their identity. However, by placing the communications activity of an anonymous user within the entire pool of communications activity, patterns or overlaps may be identified.

PATTERN IDENTIFICATION
Bulk communications data can be analysed to identify suspicious patterns of behaviour. Unlike mapping-related activity, which depends on previously identified information, 40 this form of analysis is more proactive, and is used to generate new intelligence and to reveal (or 'surface') individuals and devices considered to be worthy of further investigation. For instance, it can be used to flag specific users engaged in 'suspicious' patterns of communications activity, such as visiting specific websites, communicating with certain persons, using particular forms of 35 Operational Case for Bulk Powers (n 3) para 5.6. 36 ibid 28. 37 ibid para 5.2. 38 ibid paras 5.2-5.3. 39 ibid para 3.13. 40 For instance, a specific individual, or a suspect's device.

ISRAEL LAW REVIEW
[Vol. 52:1 38 communication, searching for particular terms online, following accounts, or 'liking' posts on social media sites. These individuals may then be prioritised for further investigation. In relation to social media, for example, the UK security and intelligence services state that they: 41 use bulk communications data and bulk personal datasets to gain vital insights into the plans of those plotting against the UK, and to understand the connections between individuals. These capabilities frequently provide one of the only sources of information at the early stages of an investigation.
This pattern analysis may also be used to search for suspect means of communication and applied to cybercrime as well as counter-terrorism operations. In this regard, it is reported: 42 In 2010, an intelligence operation identified a plot which came right from the top of al-Qaida: to send out waves of operatives to Europe to act as sleeper cells and prepare waves of attacks. The intelligence specified unique and distinctive communications methods that would be used by these operatives. GCHQ, in partnership with many other countries, was able to identify operatives by querying bulk data collection for these distinctive patterns. This international effort led, over a period of months, to the arrest of operatives in several European countries at various stages of attack preparationincluding one group literally en route to conducting a murderous attack.

RESOURCE EFFICIENCIES
Analysis of retained communications data may facilitate more efficient resource utilisation by reducing the number of personnel required to conduct physical surveillance, 43 or by discounting potential avenues of investigation. For instance, if UK security services identify a suspected member of the Islamic State, but that individual does not communicate with anyone within the UK, he or she may accordingly be discounted as a threat to the United Kingdom (and perhaps passed on to other intelligence services), thereby freeing up resources to focus on UK-specific threats. 44 This ability to discount potential avenues of investigation can also accelerate investigative processes, thereby 'enabl[ing] the security and intelligence agencies to narrow down likely targets much more quickly, so that they can focus limited investigative resources where it is really needed'. 45 The intelligence and security services state that access to retained communications data facilitates this process, as it removes the need to make individual requests, or a series of All of these methods of interrogating retained communications data benefit from the ability to look into the past, 47 and several specific benefits may be highlighted. First, in the event of a crime, retained data allows the security services to 'rewind' events, facilitating the identification of suspects and a better understanding of what happened. For instance, if a body is found in waste ground and murder is suspected, analysis of retained data may indicate the presence of individuals at the location where the body was found and enable investigation of their prior activity. 48 Second, retained data allows analysts to 'look back' and immediately identify a suspect's preexisting network. It is argued that this ability is particularly important in the context of foreign intelligence activities. 49 Third, pattern identification is heavily dependent on accessing retained data. 50 Fourth, access to retained data facilitates speedier investigations, as the data is immediately available in full, and access is not dependent upon targeted requests. For example, the UK intelligence and security services report: 51 Following a failed terrorist attack in London in 2007, the security and intelligence agencies were able to confirm that the perpetrators were the same as a group who had carried out another attack shortly afterwards. This was achieved in a matter of hours through the analysis of bulk communications data, and was vital in understanding the scale of the threat posed in a fast-moving post-incident investigation, because of the ability to identify connections at speed; it would not have been possible to do this at speed by relying on requests for targeted communications data.
Additionally, it is important to note that a wide range of other agencies claim utility in the retention and analysis of bulk communications data. Indeed, in the United Kingdom, the same legislation that legitimates the use of this data by the intelligence and security servicesthe 2016 Investigatory Powers Acthas enabled other agencies, not focused on security, to access and retain access to such information. In terms of the utility of bulk communications data surveillance in practice, recent releases of information and statistics by the UK intelligence and security services report that bulk communications data has: 53 • 'played a significant part in every major counter terrorism investigation of the last decade, including in each of the seven terrorist attack plots disrupted since November 2014'; 54 • 'been essential to identifying 95% of the cyber-attacks on people and businesses in the UK discovered by the security and intelligence agencies over the last six months' [to 2016]; 55 • 'been used to identify serious criminals seeking to evade detection online, and who cannot be pursued by conventional means, supporting the disruption of over 50 paedophiles in the UK in the last three years'; 56 • been used 'in 95 per cent of serious and organised crime prosecution cases handled by the Crown Prosecution Service Organised Crime Division and has been used in every major Security Service counter-terrorism investigation over the last decade'; 57 • played a significant role in terrorism prosecution: 'The CPS reviewed a snapshot of recent prosecutions for terrorist offences and concluded that in 26 recent cases, of which 17 have concluded with a conviction, 23 could not have been pursued without communications data and in 11 cases the conviction depended on that data'. 58 Despite these broad claims of utility, it is difficult to examine the specific role and degree of influence played by bulk communications data surveillance, given the limited publicly available information. From a human rights law perspective, the issue is not whether bulk communications data surveillance is useful, but rather whether it is 'strictly necessary in a democratic society', including whether it is 'strictly necessary … for the obtaining of vital intelligence in an individual operation'. 59 Although this test was applied to content and not communications data, it suggests that should the European Court of Human Rights specifically address bulk communications data surveillance, it may examine whether these techniques constitute a 'vital' part of an operation. The case studies released by the UK intelligence and security services raise a number of questions regarding the useful/vital nature of bulk techniques. For example, the 'Operational Case for (b) It may be relatively easy to arrest the minor players in a drugs importation or smuggling ring. But by going through their historic communications data, it may become possible to trace the bigger players who have taken care to remain in the background. (c) A time lapse between the incident and the identification of a suspect will mean that old data is needed. 53  Bulk communications data provided the breakthrough. Through interrogation of the data, the security and intelligence agencies found previously unknown members of the network and were able to increase their coverage of the expanded group. As a result they became aware of a sudden further increase in activity from analysis of the group's communications activity. This led to police action and the recovery of an improvised explosive device.
This example gives rise to questions regarding the 'vital' role played by retained communications data. If a number of the suspected terrorists were known, this indicates that targeted surveillance could have been initiated. This would facilitate the mapping of the network (by monitoring those with whom the known individuals communicate), and the monitoring of the groups' communication patterns (facilitating, for instance, identification of hierarchies), without the need to resort to retained bulk communications data. Similarly, the 'preventing a kidnap' case study relates to a plot by known terrorists to stage a kidnapping. 62 As the terrorists were known, surveillance could feasibly have been initiated with regard to their devices.
A similar analysis may be applied to the drug smuggling ring example provided by the UK police and the Crown Prosecution Service. 63 While it may be faster to identify 'the bigger players who have taken care to remain in the background' 64 using retained communications data, the same result could be achieved by the initiation of surveillance targeting identified 'minor players'. The 'vital' role played by retained communications data in these operations is difficult to demonstrate.
Ultimately, the case studies presented by the UK intelligence and security services demonstrate the important role played by retained bulk communications data. They do not, however, unequivocally demonstrate that these measures were strictly necessary, or vital to all of the operations in question. 65 Two points may be made. First, in some of the case studies it is not clear that the same outcome could not have been achieved by initiating targeted surveillance of specific individuals, devices, etc. Second, in other cases the benefit appears to be speed and efficiency.
Accordingly, it is possible that a court may not regard bulk communications data techniques as vital and would therefore find them to be incompatible with international human rights law. Such a conclusion, however, risks simplifying a more complex reality. It is difficult to draw a bright line distinction between those intelligence techniques that are merely useful and those that are vital. An approach that fails to take into account these difficulties risks ignoring factors 60  In particular, the embeddedness of these practices within intelligence work renders it difficult to conduct a post-operation review to identify which specific components of the operation contributed to a successful outcome. An operation will necessarily draw on myriad available techniques, and it is extremely difficult to know which will be effective in advance. In this context, serious consideration must be given to the experience of the intelligence and security services and their claims that bulk communications data techniques are 'essential'.

EXAMINING THE POTENTIAL HARM CAUSED BY BULK COMMUNICATIONS DATA SURVEILLANCE
This section draws on social science research and empirical evidence to examine the potential harm associated with bulk collection of communications data, and seeks to progress beyond the well-worn frame of privacy costs. Any survey of surveillance harm is necessarily selective. The purpose here is not to supply a comprehensive inventory of potential impacts resulting from surveillance. 67 Instead, it seeks to focus the discussion on a number of potential impacts resulting from the rapid spread of bulk communications data collection. Claims and counterclaims are common in this contested field of debate. In order to establish clarity, social science research and empirical evidence are drawn upon to stake a number of core areas in which potential types of harm from surveillance have been identified. Principal among these are (i) chilling effects, and (ii) shifting modes of suspicion, with the latter subdivided into issues of labelling and mental health. In doing so, a series of arguments are developed which gravitate towards two prominent polarities used to assess the permissibility and impact of surveillance practices.
Similar to the debates regarding the utility of surveillance, harm arising from surveillance is a highly complex and contested issue. Analysis of these debates further challenges the adequacy of utility-harm oppositions to understand the benefits and impacts of surveillance practices in the digital age. observed. 68 Any chilling effect immediately brings into play rights such as freedom of expression, freedom of association and freedom of assembly, as it will impact upon the ability of individuals to freely access information, to develop their understanding of specific issues, to engage in communicationor meetwith particular individuals or organisations, and so on. When these rights considerations are addressed at a societal level, it is apparent that a chilling effect can impact upon the effective functioning of a participatory democracy. In short, democracy is dependent upon an informed citizenry, capable of engaging with a diverse range of ideas, and of challenging the status quo. This is the essence of the 'free marketplace of ideas'. 69 It is the possibility that individuals refrain from engaging in activity perceived to be contentious that risks undermining democracy.
Potential chilling effects brought about by surveillance have long been an area of debate and scholarly interest. The origins of such inquiries are unclear but extend at least to the Watergate-era and the analysis by Gregory White and Phillip Zimbardo of what they describe as the psychological breaching of the First Amendment. 70 Participants in a small study were asked about their views on the legal status of marijuana consumption. These views became attenuated in significant ways depending on their likely exposure to law enforcement agencies for 'training purposes'. For those authors, 'surveillance engenders both anxiety and inhibition', 71 stimulating inhibitions and encouraging those threatened with state surveillance to 'act in ways to deindividuate themselves by increasing their anonymity and guarding their behaviour so that they don't seem "out of line"'. 72 While this study is fairly small, simplistic and 'pre-digital'and thus restricted in its application vis-à-vis understanding more complex unseen and opaque contemporary forms of surveillancepotential chilling effects have remained a prominent area of debate, and are a key focus of human rights law analysis. 73 These ideas have gained importance since Edward Snowden's revelations in 2013. Indeed, given how the right to freedom of expression applies to more than what is merely said, but also covers a range of communications and interactions, a number of recent studies have been quick to link bulk surveillance activities to wide-ranging chilling effects on freedom of expression and association across society. 74 However, despite such potential impacts of a surveillance-induced chilling effect on individual rights and the functioning of democracy, robust empirically grounded studies of this phenomenon are rare. An exception to these is a survey by the Pew Research Center. 75 In a survey of 475 adults, the research identified how 34 per cent of those aware of surveillance programmes run by the National Security Agency (NSA) had taken one or more measures to conceal their online information, while 25 per cent stated that they had modified how they used technological platforms. Elsewhere, a survey of 520 US authors by PEN America found that many writers were worried about state surveillance and, as a result, engaged in significant levels of self-censorship. 76 According to this survey, large numbers of writers 'reported avoiding writing or speaking about particular subjects that they thought could make them a target of surveillance', 77 with 28 per cent of participants having reduced or avoided social media contact and 24 per cent consciously having avoided discussing particular topics via telephone or email. Significantly, 16 per cent of participants stated that they had avoided writing or talking about specific topics in respect of which they would feel they were under scrutiny.
Despite the prominence of this theme, and the apparentalbeit limitedempirical support for its existence, identifying chilling effects is far from straightforward and existing studies are afflicted with a range of shortcomings. First is the issue of generalisability. The aforementioned studies have relied on very small sample sizes and (largely) highly specific contexts. These studies cannot claim a more general societal impact and, indeed, the generalisability of studies on chilling effects are influenced by issues of 'ecological validity', where findings from low stakes scenarios in social psychologists' laboratories face difficulties of replication in the more high stakes and messy social world.
Second, problems exist in capturing how intentions are mobilised. For example, successfully identifying a chilling effect rests on measuring a non-event (such as failure to engage in some form of activity). Also important are problems over accurately measuring distinctions between one's intention to express something and the actual likelihood of articulating such thoughts.
Third, surveillance practices operate in a complex social and cultural milieu, making it difficult to isolate surveillance as the sole driver for mediating specific intentions and types of behaviour. Such circumstances make it challenging to identify the precise driver of any chilling effect, whether it be, for example, fear of a hostile reception from a disagreeing audience, fear of a punitive sanction from more remote and invisible state agencies, or something else. Relatedly, chilling effects may be mediated by a range of subjective, social, psychological and ideological beliefssuch as belief in the legitimacy of state surveillance, levels of fear, perceived likelihood of terrorist attack, demographic location, and so onwhich makes additionally complex more generalised conclusions that a censored opinion is related solely to state surveillance. While encountering similar limitations of sample size and potential for generalisation, one recent study does provide a more nuanced and detailed analysis of this latter issue of sociocultural location. 78 Although small (the sample involved 225 self-selecting participants, and was therefore not controlled for non-response bias), key findings reveal the highly focused impacts of chilling effects and their mediation via a range of subjective and social perceptions. Among the results are suggestions that it is an individual's perceived dissonance with majority opinion, rather than exposure to information about online surveillance, that most heavily influences the likelihood of someone expressing an opinion online. Thus, it is possible to extend this analysis to identify two major, yet related, implications for the consideration of surveillance chill. First, as numerous other empirical studies have pointed out, chilling effects are not generalisable, precisely because they are not felt evenly across social groups. 79 Second, and as a corollary, it is important to recognise that it is the groups holding the fewest resources and social capital required to challenge authority that are most heavily impacted upon by chilling effects. This has particular relevance for any human rights law analysis as it directly relates to the ability to challenge the status quo and thus to the effective functioning of participatory democracy. It directly brings into play rights such as the rights to freedom of expression and to freedom of assembly.
Overall, such insights provide a corrective to crude statements that a linear path exists between state surveillance and a generalised chilling of expression. Available evidence challenges the notion that chilling effects hold a uniform and very general coarse-grained impact across the societal range. Instead, a range of variables assert themselves onto the process, attenuating their intensity, form and prevalence.
Concerns over the ambiguity and reach of chilling effects have found expression in the courts and served to weight arguments against acknowledging surveillance harm. Perhaps most wellknown among these occurred just a few months before Snowden's revelations, during the 2013 US Supreme Court defence by then NSA chief, James Clapper, against the challenge by Amnesty International USA to surveillance authorised under the US Foreign Intelligence Surveillance Act of 1978 (FISA). Here, and citing the 1972 Laird v Tatum case that '[a]llegations of a subjective "chill" are not an adequate substitute for a claim of specific present objective harm or a threat of specific future harm', the Court stated repeatedly that claims for chilling effects were 'speculative'. Nevertheless, one of the most robust analyses of chilling effects focuses on internet usage and, coincidentally, covers the period in which the US Supreme Court ruled on the speculative nature of surveillance chill claims. The study focused on access to 48 Wikipedia articles, selected on the basis of alignment with the keywords used by the US Department of Homeland Security to track and monitor social media. It sought to examine variations in related web traffic for the months immediately preceding and following the Snowden revelations in June 2013. 81 Quantifying such activity through advanced statistical modelling techniques, the authors were able to demonstrate a 'large, sudden, and statistically significant drop in the total view counts' for these articles, an 'immediate drop-off of over 30% of overall views'. 82 This translated into a reduction of 995,085 views and is suggestive of a substantial chilling effect on online searches.
Taken together, available evidence suggests that chilling effects can neither be assumed in their totality nor summarily rejected out of hand as unproblematic. Yet, empirical evidence suggests that chilling effects hold complex and variegated forms and assert diverse impacts most acutely felt outside the 'mainstream'that is, an underlying element in why individuals modify (or 'chill') their behaviour is to bring their activity in line with perceived majority sentiment. This last point is pertinent to the current discussion, given the implications for individual development and democratic participation.

RECONFIGURED SUSPICION AND SURVEILLANCE COLLATERAL
Often expressed through a familiar trinity of justificationsthat no harm is inflicted, individuals are unaware of being observed, and only the smallest fragments of metadata are recordeddigital data collection and analysis are regularly assigned benign labels. 83 Yet it is also possible to argue that the warehousing of data associated with millions of people, almost all of whom are lawabiding and engaged in normal daily life, exerts a profound impact on how suspicion is rendered and administered. Bulk monitoring elevates millions into the realm of the potentially suspicious in a narrowed field of enquiry. In such circumstances, suspicion does not precede data collectionsurveillance is not initiated on the basis of 'reasonable suspicion'. Rather, it is generated by analysis of the data itself. As discussed below, such practices raise important questions over the role of probable cause and reasonable suspicion alongside issues of due process and the presumption of innocence.
These questions are not exclusive to the bulk monitoring of digital communications and exist in parallel with debates that accompany other technological forms of security, such as the use of Among other arguments, the plaintiffs argued that such surveillance activities exerted a chilling effect on their First Amendment rights. 81 Jon Penney, 'Chilling Effects: Online Surveillance and Wikipedia Use' (2016) 31 Berkeley Technology Law Journal 117. This study offers empirical evidence of chilling effects on online searches relating to Wikipedia articles following Edward Snowden's revelations of June 2013 and the publicity that followed. The study identifies a reduction of 995,085 (over 30%) visits to Wikipedia sites that could be deemed subject to government surveillance (such as those discussing terrorism, suicide attack and Al-Qaeda, among others). 82 86 and surveillance drones. 87 Yet the scope and scale of bulk collection extends far beyond the reach of these other practices, signifying a transformation in the way in which suspicion is characterised.
Of key concern here is the range of activities that may be described as bulk monitoring. While Snowden's exposure of the Government Communications Headquarters' (GCHQ) TEMPORA programme 88 offers a picture of indiscriminate and comprehensive data warehousing, this should not be regarded as an exemplar for all forms of bulk monitoring. Common to surveillance more generally, there are gradations of intensity, with highest concentrations centred on particular populations, typically those at the margins of society. For example, NSA chain analysis is performed by analysing associations across degrees of separation, or 'hops' in the intelligence vernacular. While the net is wide, a filtering and triaging process is at play, which necessarily focuses bulk collection activities in highly specific ways. Attention congregates most intensively at particular nodes, communities and networks, elevating specific populations into the realm of the potentially suspicious. Inevitable among these are cohabitees of identity, culture, ethnicity and territory, as well as any activist and advocacy groups that support these populations: a process we may define as 'surveillance collateral'. Overall, any boundary between bulk collection and targeted surveillance becomes blurred in significant ways. This will bring into play a number of human rights considerations relating, for example, to dignity, non-discrimination and equality.

LABELLING
Surveillance collateral may intersect with forms of chilling to assert further potential for harm. For more than half a century sociologists of deviance have developed a series of influential theories identifying the complex individual responses to being labelled as an object of suspicion. Like chilling effects, the feeling that one falls into a suspect group is also sufficient to exert an influence. The processes by which this occurs are complex and controversial. They include individuals who internalise the label of suspicion and increasingly act outside the law, 89 and the ways in which ascriptions of suspicion act as a 'master status', 90 defining individuals as suspects above all other potential attributes. Other, more focused, surveillance-related research argues that a series of deeper transactions occur once someone feels he or she is subject to suspicion. Given the asymmetry of power relations among surveyor-surveyed interactions, this includes the communication of clear messages regarding eligibility for social inclusion and citizenship. 91 This will bring into play a number of human rights considerations relating, for example, to dignity, nondiscrimination and equality.

MENTAL HEALTH
Such transactions of suspicion hold further material effects on the observed. For example, recent studies have evidenced deleterious mental health impacts among those living in communities subjected to increased police scrutiny. Moreover, these impacts are not evenly distributed among all inhabitants of targeted neighbourhoods. In one study in New York City, which drew on micro-level health data of over 8,000 cases, researchers found that within areas of high police surveillance activity, it is minorities living in areas of high ethno-racial diversity who are likely to experience the most significant impacts on their mental health. 92 Other related research identifies the gender-related impact of such activities, with men likely to experience markedly higher degrees of psychological distress. 93 While these findings focus largely on visible policing strategies in urban areas and the implications of the extended reach of formal corrections and criminal justice into the civil domain, 94 they hold wider resonance. For example, in the national security context, research into the UK's anti-radicalisation 'PREVENT' agenda has consistently identified how those subjected to scrutiny regularly view state agencies similarly in terms of coercive potential. 95 By extension, further corollary effects of heightened suspicion and surveillance may impact on the ability of non-coercive public agencies, such as social work and community-based organisations, to operate effectively in these same communities. These effects raise clear concerns regarding perceived ability to engage in democratic processes.

SUMMARY
Overall, this discussion has focused on the potential for multiple indirect and less visible types of harm brought by bulk collection and analysis of communications data. In addition to prominent arguments over potential chilling effects is the potential for transformations of established constructions and applications of suspicion in itself. Most obvious, perhaps, are questions regarding 91  thresholds for reasonableness or probable cause along with the potential circumvention of the presumption of innocence. Such circumstances give rise to questions of whether simply engaging in certain forms of activity or communication, or a tenuous indirect association with someone worthy of suspicion, becomes sufficient to become an object of suspicion. Importantly, as discussed above, such consequences are focused heavily on marginalised communities, affecting opposition to the status quo. Labels of suspicion may assert further corollary effects, which may condition the availability of life chances and the sustainability of mental health. These factors demonstrate that significant further research into the impact of a chilling effect is required and that consideration of harm must be broadened beyond an exclusive, or near exclusive, privacy focus. Quite simply, an exclusive reliance on privacy is incapable of addressing the totality of the rights implications.

RE-EXAMINING THE HUMAN RIGHTS LAW APPROACH TO BULK COMMUNICATIONS DATA SURVEILLANCE
The above discussion demonstrates the complexities involved in assessing potential utilities and harm associated with bulk communications data techniques. Given the significant human rights issues involvedrelating not only to the protection of individuals' rights, but also to the effective functioning of democracy itselfthis is of serious concern. In particular, this uncertainty and ambiguity make effective assessment of the necessity of bulk communications data surveillance difficult to achieve. 96 In light of the risks posed by ineffective regulation, and mindful of the need to ensure the full spectrum of human rights protection, 97 a new, more nuanced, approach is clearly required.
In determining how human rights law could more effectively respond to bulk communications monitoring, four factors should be taken into account: (i) the extent of information that can be revealed by communications data; (ii) the extent to which harm associated with the retention of communications data affects other rights; (iii) the ease of analysing communications data; and (iv) the operational utility of bulk collection. Each of these factors are addressed in turn as they provide the basis for the subsequent recommendations.

THE EXTENT OF INFORMATION REVEALED BY COMMUNICATIONS DATA
As noted above, communications data is not benign. It can be used to reveal highly sensitive personal information, including sensitive health conditions, 98 psychological wellbeing, 99 sexual orientation, relationship status, political affiliation and activist histories. 100 As the former general 96 Szabo and Vissy v Hungary (n 5) para 73. 97 ie, ensuring both the protection of the right to life, and the right to freedom of expression or the right to privacy. 98

THE BROAD IMPACT OF BULK COMMUNICATIONS DATA RETENTION ON HUMAN RIGHTS
To date, courts and human rights bodies have focused primarily on the impact of surveillance in the context of the right to privacy. However, a number of other rights may be affected, and the effect on these rights may be particularly severe in the context of bulk communications data surveillance. Relevant rights include, for example, the rights to freedom of expression, association and assembly, and respect for human dignity. Importantly, although it has not addressed the issue in detail, the CJEU has acknowledged that retention of communications data may affect the willingness of individuals to engage the right to freedom of expression. 102 Notwithstanding the difficulties associated with demonstrating the chilling effect, particular attention must be paid to identifying and understanding its impacts, given the potentially serious consequences for both individuals and society. For example, if individuals are discouraged from engaging in their right to freedom of expression, this risks impairing the fundamental objectives that underpin the right. The right to freedom of expression is regarded as essential for, inter alia, individuals' development and the effective functioning of a pluralist democracy. If individuals are deterred from engaging in expression, or if this expression is restricted, then they cannot fully develop their identity or fully participate in the democratic process. When individuals are concerned that a state may react to certain types of expression, it is more likely that this concern will arise in relation to non-mainstream opinions, such as political expressionthat is, expression that may be regarded as opposing the state, the government, or elements of government policy. If this political expression is restricted, then the ability to oppose government policies will be undermined. Existing research indicates that those most vulnerable to a chilling effect are opposition movements, minority groups, and those with fewest resources to challenge the status quo. 103 The effect is such that it may reproduce marginalisation and impact upon, or undermine, the basis of a pluralistic democracythat is, the ability to debate and oppose government policies. This risks a further corollaryerosion of the right to freedom of expression. This line of reasoning may be extended easily to the rights to freedom of association and assembly. Bulk communications data surveillance extends the possibilities for monitoring beyond the movements of a car, to the movements of an individual and, indeed, an identification of the individual's entire pattern of life. The possibility that individuals or groups may be subject to surveillance is therefore dramatically increased if the state can routinely monitor not just one instance of engagement with this political group, but all engagement, and if this informationand any other relevant datacan be accessed instantaneously with little or no resource implications. 106 It is this ability to monitor and to analyse that makes communications data so useful for intelligence agencies. Indeed, the UK Intelligence and Security Committee noted that 'the primary value to GCHQ of bulk interception was not in reading the actual content of communications, but in the information associated with those communications'. 107 This transforms the nature of surveillance. It is no longer the case that the state can subject certain individuals to surveillance and gain relatively limited insights into their activity. Communications data surveillance makes it possible to monitor virtually all activities of all individuals, to discover and evaluate their relationship with others, and to gain profound insights into their lives.

THE UTILITY OF BULK COMMUNICATIONS DATA COLLECTION
The previous subsections focused on the potential human rights harm associated with bulk communications data collection. In developing appropriate human rights responses, it is of no less importance to highlight that the activities of the intelligence and security services do contribute to the fulfilment of states' human rights law obligations. In particular, states are subject to a positive obligation to protect rights, such as the individual's right to life and right to property, from threats posed by terrorists or other criminal organisations. Indeed, the failure of states to 'take measures within the scope of their powers which, judged reasonably, might have been expected to avoid' 108 an identified risk will result in a violation of their human rights obligation. This obligation may apply not only in relation to specific threats against identified individuals, 'but also in cases raising the obligation to afford general protection to society'. 109 In this regard, and as discussed briefly above in Section 2, bulk communications data collection can play a significant role in contributing to the fulfilment of a state's human rights obligations. Lack of knowledge with regard to the techniques used, and the ways in which they are used, make this component difficult to engage with from outside. However, utility of bulk communications data techniques should not be lightly dismissed.
That said, in order to ensure effective oversight and regulation, and to maintain public confidence in the state and its security apparatus, it is essential that transparency be prioritised. The professed utility of bulk measures should be more clearly demonstrated, and their necessityor strict necessitymore clearly addressed. Public disclosure of certain activities may legitimately be restricted on the basis of national security considerations, but transparency should be the rule and secrecy the exception.

RETHINKING HUMAN RIGHTS LAW CONSIDERATIONS IN THE DIGITAL AGE
This article identifies how bulk communications data surveillance can both contribute to the protection of human rights and result in harm to such rights. Widespread interference with these rights may have implications both at the individual level, affecting individuals' ability to freely develop their identity and opinion, and at the societal level. The societal effect is such that these interferences may fundamentally alter the balance between the state and its citizens, potentially impairing the effective functioning of a pluralistic, participatory democracy. At the same time, the protection of individuals' rights, and in particular the right to life, is clearly and appropriately a key concern of the state. Efforts to effectively address this potential conflict are compounded by the fact that a precise analysis of utility and harm, and an identification of the specific role played by bulk communications data techniques in a given operation, is exceptionally difficult. In determining how best to move forward, two factors should be considered. First, the current distinction between content and communications data in terms of the level of rights protection should be removed. Second, a more nuanced approach to the regulation of bulk communications data surveillance should be developed. on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life'. 110 This may be contrasted with the finding in Digital Rights Ireland in which it was held that the retention of communications data 'is not such as to adversely affect the essence of these rights given that … the directive does not permit the acquisition of knowledge of the content of the electronic communications as such'. 111 This distinction was also made by the UK High Court: 'interception of content is more intrusive than access to communications data'. 112 However, the distinction between the content of communications and communications data is no longer viable. 113 As discussed above, the insights revealed by communications data, and the ease with which this data may be subject to analysis, indicate that it is wholly appropriate that communications data and the content of communications be granted an equivalent level of protection. Not only are analyses of metadata as intrusive as the examination of content, but the partition between metadata and content is in itself a spurious distinction. Much of the latter can be discerned from the former and their delineation can be achieved only through highly subjective means. Simply put, there is no meaningful distinction between the sensitivity of information revealed by content and that of communications data. There is increasing recognition as regards the validity of this conclusion. For instance, the Advocate General of the CJEU has stated that 'the risks associated with access to communications data (or 'metadata') may be as great or even greater than those arising from access to the content of communications'. 114 Similarly, and persuasively in this context, statements from various intelligence agencies indicate a prioritisation of communications data over content data. 115 At the national level, this may require modification of the existing legal framework in order, for example, to harmonise the rules applicable to the acquisition, retention and management of content data (that is, through lawful interception) and communications data.
Removing the distinction between communications data and content data in terms of the level of human rights protection is a first step towards a more realistic appraisal of surveillance practices. There are indications that the European human rights system is moving in this direction. In Szabo and Vissy, for instance, the European Court of Human Rights stated that the protections established in the Court's case lawwhich currently focus on content interception -'need to be enhanced' 116 in order to address bulk communications data techniques. More recently, in Big Brother Watch and Others, the Court stated that it was 'not persuaded that the acquisition of related communications data is necessarily less intrusive than the acquisition of content'. 117 At the domestic level, the US Supreme Court has also moved in this direction, holding in Carpenter that access to communications dataat least in the context of modern surveillancerequired a warrant, thereby treating it as equivalent to content interception. 118 This re-classification of communications data may raise certain challenges to bulk communications data surveillance regimes, and may require a departure from existing case law. In Maximillian Schrems v Data Protection Commissioner the CJEU held that 'legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life' 119 and, as such, is unequivocally impermissible. In Digital Rights Ireland, a communications data-related case, the Court reached a different conclusion: 120 [E]ven though the retention of data required by Directive 2006/24 constitutes a particularly serious interference with those rights, it is not such as to adversely affect the essence of those rights given that … the directive does not permit the acquisition of knowledge of the content of the electronic communications as such.
This finding is in keeping with the existing, but inappropriate, distinction between content and communications data. Going forward, this position should be reconsidered. Any legislation permitting access on 'a generalised basis' to communications data must also be regarded as interfering with the essence of the right to privacy, and thus as unequivocally impermissible, in line with Maximillian Schrems. This is entirely appropriate if content and communications data are to be granted the same level of protection vis-à-vis the right to privacy. The question arises, therefore, as to what this means for bulk communications data surveillance regimes. Key in this regard is the Court's prohibition of access on a 'generalised basis', that is: 121 [W]ithout any differentiation, limitation or exception being made in the light of the objective pursued and without an objective criterion being laid down by which to determine the limits of the access of the public authorities to the data, and of its subsequent use, for purposes which are specific, strictly restricted and capable of justifying the interference which both access to that data and its use entail.
This does not indicate that all bulk communications surveillance is unlawful. Rather, the legality of any bulk communications data surveillance regime will depend not only on satisfying the necessity test, but also on ensuring appropriate limitations vis-à-vis collection, access, use, sharing, detention, and so on. In Big Brother Watch and Others the CJEU made significant steps forward in relation to safeguards, 122 although these were applied exclusively in the content of externally focused surveillance activities. These appear to constitute an appropriate starting point, and so attention will now turn to how 'necessity' is evaluated. 118 Carpenter v United States (n 43). 119  As noted, the opacity associated with effectively measuring both the utility and harm of bulk powers renders a straightforward application of the current human rights law test problematic. To overcome these difficulties, it is suggested that a more nuanced approach is required, so that the weakness of this dichotomy and the complexity and dynamism of the operating environment can be fully taken into account. As it currently stands, there is insufficient information in the public domain to take a position as to whether particular bulk powers satisfy the relevant human rights law test and can therefore be lawfully deployed. However, these are live issuesboth in terms of legislative developments and judicial proceedingsand so it is essential that the human rights law test be clearly set out.
In developing any approach, recourse must be had to existing case law. The required standard was set forth most clearly by the European Court of Human Rights in Szabo and Vissy: 123 A measure of secret surveillance can be found as being in compliance with the Convention only if it is strictly necessary, as a general consideration, for the [sic] safeguarding the democratic institutions and, moreover, if it is strictly necessary, as a particular consideration, for the obtaining of vital intelligence in an individual operation.
Two core requirements emerge from this ruling. First, the use of bulk techniques must be restricted to circumstances that are strictly necessary to safeguard the democratic institutions. This indicates that powers may be used only in relation to certain categories of serious crime, 124 although this requirement should perhaps be more appropriately read as safeguarding the components essential for a democratic society. Second, if such powers are appropriate as a general consideration, then the strict necessity test further requires that at an operational level powers must be 'vital' to an individual operation. These requirements will be discussed in turn.
In relation to the first component, it is appropriate that the use of bulk powers be restricted to only the most significant threats. As discussed above, although the harm associated with bulk surveillance is difficult to quantify, it is of a nature to undermine the effective functioning of a democratic society. It stands to reason, therefore, that only threats that themselves threaten a democratic society could justify such measures. However, uncertainty exists as to what crimes may be defined as 'serious' for these purposes. For instance, the CJEU has referred to threats to national security and activities that will affect the monetary stability of the state, 125 while the UK Investigatory Powers Act defines serious crime as that which will result 123 Szabo and Vissy v Hungary (n 5) para 73. in a three-year or longer custodial sentence. 126 This is a significant difference and clarity is required. 127 Clearly, defining the specific crimes to which bulk communications data techniques may be applied is an important step. Such a decision should be based upon determining those crimes that constitute a genuine threat to democratic institutions, for which extensive powers are warranted. It should not be based on a general understanding of what constitutes 'serious' crime. Although it is difficult to define 'serious' in the abstract, the human rights law test and the invasiveness of the measures in question point to a high threshold. At issue, therefore, is crime that is defined as actively threatening the functioning of a democratic societyfor instance, through attacks on or interference with democratic institutions and processesand crime that affects the functioning of society itself, for instance through large-scale interference with the ability to live a normal life. In this regard, serious threats to national infrastructure (such as dams, power plants, or the national grid), serious threats posed by organised terrorism (such as that previously posed by the Provisional IRA) or foreign espionage may satisfy the threshold. Other activities that threaten national security should also be addressed. However, caution is required in this regard, as national security is a broad concept and one that has been abused in the past. Rather than being regarded as a catch-all category justifying bulk powers, only those specific national security threats rising to the threshold elaborated above should be considered. This raises difficult questions. For instance, should the threat posed by lone-wolf attackers be distinguished from the threat posed by more organised terrorist groups?
Equally, the human rights law threshold means that other crimes, although 'serious' in terms of their gravity and impact on affected individuals, will not satisfy the required threshold. For instance, murder is unquestionably a serious crime that will result in a significant custodial sentence. However, it is not of a nature to threaten the functioning of a democratic society. To reiterate, this does not suggest that those crimes that fall below the initial strict necessity threshold are not grave, or do not warrant full and effective investigation. Indeed, in a large number of instances international human rights law requires that effective investigations be undertaken, and requires that the state be held to account should it fail to do so. Rather, it is a clear acknowledgement that bulk powers are particularly invasive and pose risks of harm that may undermine or impair the functioning of a democratic society. Only threats to a democratic society itself can justify such measures.
The second component requires that measures be 'vital' to a specific operation. In the context of bulk powers this is a potentially difficult test to apply as a 'mosaic' of different approaches are used in the development of intelligence or investigative profiles. Care should therefore be taken to develop an appropriately nuanced approach. It may be impossible to make a bright line