A review of police surveillance of journalists, lawyers and non-governmental organisations (NGOs) has found that police in Northern Ireland failed to comply with legal provisions during surveillance operations.
But the review by Angus McCullough KC found there was no basis for concerns that surveillance of journalists and lawyers is “widespread and systemic”.
The review, ordered by the Police Service of Northern Ireland’s (PSNI) chief constable examined allegations that the PSNI had unlawfully monitored the communications of journalists, lawyers and non-profit groups from 2011 to November 2024.
The review found:
- The PSNI made 21 applications for communications data to identify journalists’ sources without recognising the “overriding public interest” in protecting their confidentiality.
- The police force maintained a secret register containing the phone numbers of over 1,000 journalists and others, as part of a “defensive operation” to identify PSNI staff who had spoken to journalists.
- There were concerns about a PSNI operation to monitor the social media posts of investigative journalist Donal MacIntyre.
- The PSNI failed to delete data seized from journalists Barry McCaffrey and Trevor Birney despite a court agreement to do so and failed to fully disclose phone surveillance against the two journalists to the Investigatory Powers Tribunal (IPT).
- Ten complaints – involving four lawyers, four journalists and two staff of the police ombudsman – are being investigated by the Investigatory Powers Tribunal.
Surveillance not systemic
McCullough today said that he had found no basis for concerns that PSNI surveillance of journalists or lawyers was widespread or systemic following a 15-month review.
“I can find no basis for any suggestion that the powers available to PSNI are being routinely abused in relation to journalists, lawyers, or others of ‘special status’,” he wrote in a 200-page report published today.
McCullough said the review had been given direct, unrestricted and unsupervised access to all relevant PSNI systems.
“The nature and extent of this access from an organisation holding material of the highest sensitivity is … almost unprecedented,” he said.
Defensive operation
McCullough said his findings were subject to a “significant qualification” and that he had “profound reservations” about a PNSI programme to identify staff who may have spoken to journalists.
The PSNI was routinely “washing through” a long list of journalists’ telephone numbers to compare against numbers called by PSNI officers and employees to identify any who had contact with journalists.
“The scale of this practice, the duration over which it was carried out, and the apparent lack of any questioning as to the necessity or proportionality … is troubling,” the report stated.
McCullough found that the PSNI appeared not to have sought any legal advice over the practice and appeared to “lack awareness” that it could breach the legal rights of people whose data was unknowingly used.
“This practice does not appear to have been necessary or proportionate, or indeed compatible with the rights of journalists whose personal data was being processed in this way,” the report said.
The PSNI’s Operation Settat in 2011 checked over 65,000 calls against a spreadsheet of phone numbers collected on more than 380 journalists who had contacted the PSNI’s press office. The spreadsheet, which contained 3,100 lines, identified well over 1,000 individuals and organisations, according to the report.
In 2020, in Operation Puddening, the PSNI automated the process by collecting phone numbers of journalists from the PSNI’s corporate communications department’s Vuelio computer system, until the practice was discontinued in March 2023 following concerns about its effectiveness.
According to the review, the targeting and tracking of the media was “so widespread that any individual journalist working in Northern Ireland was quite likely to be on the list used for the check against PSNI communications systems”.
Communications data
An earlier report by PSNI chief constable Jon Boutcher to Northern Ireland’s policing board in June 2024 found that the police service had made 10 applications to obtain phone data to identify journalists’ sources.
McCullough found that the total number of unlawful applications for communications data used to identify journalists’ sources was higher, at 21.
They were made under a 2007 code of practice that did not consider that identifying a journalist’s source must be justified based on an “overriding public interest”.
The authorisations impacted seven journalists, including investigative journalist Barry McCaffrey, who was wrongly arrested by the PSNI in 2018 in an attempt to identify a confidential source.
McCullough said he had contacted the journalists affected, with the exception of one who is now deceased, to notify them that their phone data was obtained without an apparent “identified justification”.
In one case, the PSNI’s Anti-Corruption Unit issued applications for communications data from journalists after “sensitive” details suspected to have been leaked by a PSNI source were published in a newspaper. The call data contained in excess of 1,000 phone numbers, of which the PSNI identified the owners of 600.
“It does not appear that, at any point in this investigation, thought was given to the fact that the purpose of all the applications was to identify a journalistic source, and therefore a heightened level of scrutiny ought to apply,” the report stated.
McCullough said he found no indication that the PSNI had attempted to make use of any information related to journalists’ sources collected collaterally during investigations, “but this data remains available on PSNI systems”.
The PSNI made no applications to identify journalists’ sources after a new code of practice was introduced that recognised the public interest in protecting sources in 2015, apart from one application that was refused, the report reveals.
Tribunal is investigating 10 complaints
The review did not consider cases that are the subject of ongoing legal procedures in the Investigatory Powers Tribunal.
Ten IPT cases, including a case brought by the BBC and former BBC journalist Vincent Kearney, which is due to be heard in November 2025, are underway. Four of the cases are related to journalists, four are related to lawyers, and two are related to the Police Ombudsman of Northern Ireland.
McCullough told a press conference this morning that he would produce a second report following up on progress to his recommendations to the PSNI and the outcome of the IPT cases.
Covert Human Intelligence Sources
McCullough identified a number of cases in which a Covert Human Intelligence Source (CHIS) had “incidentally reported” on confidential journalistic material, information that might identify a journalist’s source, or material considered to be protected by legal protected privilege.
He said there had been cases where a CHIS, who is tasked to provide information about an individual or group, begins to report on legal advice that has been shared, or provides information about associates who are meeting with journalists.
Boutcher’s June 2024 report to the Policing Board identified no occasions where directed surveillance was taken against journalists, but in today’s report, McCullough identified four journalism-related directed surveillance operations.
He also raised concerns about a directed surveillance authority (DSA) taken out against a lawyer suspected of being involved in serious criminal activity, after the lawyer was placed under surveillance in a court building.
A second DSA against the lawyer did not properly consider the risks of legally privileged material being obtained.
PSNI failed to destroy journalists’ data
As reported in Computer Weekly, McCullough found that the PSNI had failed to destroy data it had unlawfully seized from journalists Trevor Birney and Barry McCaffrey, in what appeared to be a clear breach of undertakings the PSNI had given to the High Court in Northern Ireland.
The PSNI’s Computer Crime Unit initially showed McCullough an email stating that all information relating to the case, called Operation Yurta, had “been deleted”.
However, a search of digital files revealed that the PSNI had retained data from a memory card, two memory sticks and an Apple laptop seized from Birney’s home, in addition to a Dell desktop computer, digital camera and memory stick seized from a raid on McCaffrey’s home.
State surveillance ‘normalised’
Following the publication of the McCullough Review today, Belfast journalists Birney and McCaffrey expressed “grave concerns” that state surveillance of journalists and lawyers had become “normalised” in Northern Ireland.
The PSNI arrested the journalists in 2018 after they made a film exposing police collusion in paramilitary killings in Loughinisland. They were exonerated by the High Court in 2019, which found the arrests were unlawful.
In 2024, the Investigatory Powers Tribunal found that the PSNI had acted unlawfully by placing them under surveillance to identify their confidential sources.
Birney said: “We would question the claim that the powers available to the police have not been routinely abused.
“Our case has all the hallmarks of routine abuse by the police, and we are not the only journalists that have been put under unlawful surveillance. We are concerned that there has been an attempt to normalise state surveillance in Northern Ireland.”
McCaffrey said: “We have been told time and again that the police have disclosed all the relevant information about our case and there is nothing more to see. Yet today we find out there is more to see.
“The McCullough Review shows the PSNI have repeatedly misled the courts in Belfast and London. We are dismayed the PSNI have disrespected the court orders and have failed to notify the Investigatory Powers Commissioner’s Office (IPCO) of their unlawful misconduct.”
PSNI ‘trigger-happy’ and ‘dishonest’
Investigative journalist MacIntyre said the report demonstrated that the PSNI had been “bungling, trigger-happy, disorderly and dishonest” with some of the most powerful tools a police force can exercise in a democracy.
“Angus McCullough has delivered a tour de force and, without any surprise headlines or knockout blows, took the force’s shockingly reckless practices in relation to surveillance to task, one word, one paragraph and one page at a time,” he said.
“The report delivered upon its promise and may prove to be a watershed in policing in Northern Ireland,” he added.
Call for review of MI5 surveillance
Following the report, human rights organisations Amnesty International and the Committee on Administration of Justice have written to the secretary of state for Northern Ireland to ask for a further public inquiry into covert surveillance in Northern Ireland by MI5, which fell out of the scope of the McCullough Review.
The Investigatory Powers Tribunal heard last week that MI5 breached the human rights of former BBC journalist Vincent Kearney by accessing his telecommunications records in 2006 and 2009. Further cases involving Northern Ireland journalists are now subject to ongoing proceedings at the IPT.
Patrick Corrigan, Northern Ireland director of Amnesty International UK, said: “This report exposes a disturbing pattern of unlawful covert surveillance of journalists, with the PSNI showing clear disregard for press freedom and the rule of law.
“But questions remain. How far has MI5 gone in unlawfully monitoring journalists in Northern Ireland? A free press simply cannot function under the shadow of state surveillance.”
Daniel Holder, director of the Committee on Administration of Justice, said that oversight of the PSNI by IPCO had failed.
He called for the government to implement the recommendations to establish a “commissioner for covert law enforcement in Northern Ireland” to ensure covert policing powers were used within the law.
