Surveillance & RIPA
The RIPA 2000 and IPA 2016 surveillance framework — directed and intrusive surveillance, CHIS (informant) management, communications data acquisition and the necessity and proportionality test — an officer quick-reference cited to legislation.
Unofficial independent resource — always verify with official sources (College of Policing, your force, PFEW).
Reviewed by BlueLineHub Editorial
What does RIPA 2000 require before police can carry out covert surveillance or run a CHIS?
The Regulation of Investigatory Powers Act 2000 (RIPA), as supplemented by the Investigatory Powers Act 2016 (IPA 2016), requires that any surveillance likely to obtain private information about a person be authorised. Directed surveillance needs authorisation from a Superintendent or above and lasts 3 months; intrusive surveillance (on residential premises or in a private vehicle) needs Chief Constable authorisation plus approval from a Judicial Commissioner; a covert human intelligence source (CHIS) needs Superintendent-level authorisation for 12 months (4 months for a juvenile CHIS).
Every authorisation must show necessity and proportionality, and interception of communications and acquisition of communications data are now regulated separately under the Investigatory Powers Act 2016 (Parts 2 and 3), with independent oversight from the Investigatory Powers Commissioner's Office (IPCO) and Judicial Commissioners.
A reference to the RIPA 2000 and IPA 2016 surveillance framework — directed and intrusive surveillance, CHIS management, communications data acquisition and the necessity and proportionality test. It is educational reference, not tactical guidance — follow your force policy, training and current law.
RIPA Overview — What It Governs
The Regulation of Investigatory Powers Act 2000 (RIPA) — supplemented and partly replaced by the Investigatory Powers Act 2016 (IPA 2016) — establishes the statutory framework within which law enforcement may lawfully conduct covert surveillance, acquire communications data, and manage covert human intelligence sources.
RIPA overview — key points
Why RIPA exists
Prior to RIPA 2000, covert surveillance had no statutory basis. Following the Human Rights Act 1998 (Article 8 — right to private life), a legal framework was needed to make surveillance lawful. RIPA provides that framework by requiring necessity, proportionality, and independent oversight.
RIPA vs. IPA 2016
The Investigatory Powers Act 2016 updated and supplemented RIPA, particularly for bulk data, equipment interference, and judicial oversight. RIPA 2000 remains in force for directed surveillance, CHIS management, and covert human intelligence.
Who is subject to RIPA
All public authorities (including police forces) that conduct or authorise covert activities. Individual officers who conduct surveillance without authority are personally accountable.
Key principle
Any surveillance that could obtain private information about a person must be authorised. The more intrusive the surveillance, the higher the authority required and the greater the scrutiny applied.
Surveillance Powers — Authorisation Summary
Note: Timescales and specific requirements may vary. Always consult your force RIPA co-ordinator for current procedures.
| Power | Authorising Officer | Judicial Approval | Duration | Renewal |
|---|---|---|---|---|
| Directed Surveillance | Superintendent (or above) | No (except some covert internet) | 3 months | Yes — Superintendent |
| Intrusive Surveillance | Chief Constable | Yes — Judicial Commissioner | 3 months | Yes — Judicial Commissioner |
| CHIS | Superintendent (or above) | No (for authorisation) | 12 months (juvenile CHIS 4 months) | Yes — regular review |
| Communications Data | Designated Senior Officer (DSO) | Yes — OCDA / judicial authorisation | Specific to request | As needed |
| Equipment Interference | Secretary of State / IPC | Yes — Judicial Commissioner | 6 months | Yes |
Directed Surveillance (RIPA s.26-28)
Directed surveillance is covert surveillance that is preplanned and is likely to obtain private information about an individual. It is the most commonly used RIPA power in everyday policing.
Definition
Surveillance is directed if it is: (1) covert, (2) not intrusive, and (3) undertaken for a specific investigation in a manner likely to result in obtaining private information about a person.
When authorisation is needed
Any planned covert surveillance operation that is likely to gather private information — including covertly following a suspect over multiple occasions, covertly watching a location, or using a covert device. Single brief observations are unlikely to need authority; sustained or systematic surveillance will.
Who authorises
A Superintendent or above (for standard directed surveillance). Some forces have Inspectors authorised for urgent directed surveillance in certain narrow circumstances — check force policy.
Necessity test
The surveillance must be necessary for a statutory purpose — for police, typically the prevention or detection of crime, or in the interests of national security. The application must specify which statutory purpose applies.
Proportionality test
The surveillance must be proportionate to what it seeks to achieve. The application must address whether less intrusive means could achieve the same objective, and whether the level of intrusion is proportionate to the seriousness of the offence.
Duration and review
Directed surveillance authority lasts 3 months. The senior authorising officer should be kept updated during the operation. The authority must be cancelled as soon as surveillance is no longer necessary.
Intrusive Surveillance (RIPA s.26, 32-34)
Intrusive surveillance is the most serious RIPA category. It involves covert surveillance carried out on residential premises or in private vehicles. It is far more restricted than directed surveillance and requires judicial approval.
Definition
Surveillance is intrusive if it is covert surveillance carried out on residential premises or in a private vehicle — either by a person on the premises/in the vehicle, or by a surveillance device.
Who authorises
The Chief Constable (or a designated deputy) authorises intrusive surveillance. The authorisation also requires approval from a Judicial Commissioner (part of IPCO) before it takes effect — except in urgent cases where a senior officer can grant temporary authority.
Judicial Commissioner approval
The Judicial Commissioner independently reviews the application and must be satisfied that the necessity and proportionality tests are met. This judicial oversight is a safeguard against executive overreach.
Practical use
Intrusive surveillance is reserved for the most serious investigations — typically organised crime, terrorism, or murder. The high authorisation threshold means it is rarely used for volume crime.
CHIS — Covert Human Intelligence Sources (Informants)
A CHIS is a person who establishes or maintains a personal or other relationship with another person for the covert purpose of obtaining information or facilitating access to information. This includes traditional informants, undercover officers, and in some contexts, test purchase officers.
Who can authorise
A Superintendent or above authorises CHIS use. The authority is for the use or conduct of the CHIS — both must be authorised. Duration is 12 months (or 4 months for a juvenile CHIS under 18 — extended from 1 month by SI 2018/715).
Handler and controller
The handler is the officer who directly manages the CHIS day-to-day. The controller provides independent management oversight of the handler. These roles must be separate — the handler cannot be their own controller.
Risk assessment
A formal risk assessment must be completed before a CHIS is authorised and regularly reviewed. This covers: risk to the CHIS, risk of crime commission, and risk to third parties. The CHIS's welfare must be a primary consideration.
CHIS welfare
Forces have a duty of care to their CHIS. This includes regular welfare checks, access to support if the CHIS is harmed, and provision for their safety if exposed. Welfare obligations continue even after the CHIS relationship ends.
CHIS who commit crimes
The Covert Human Intelligence Sources (Criminal Conduct) Act 2021 (CHIS Act) created a statutory framework allowing authorised CHIS to commit certain criminal acts as part of their authorised activities. This is highly regulated and requires specific CHIS Criminal Conduct Authority (CCA).
Juvenile and vulnerable CHIS
Stricter requirements apply. Juvenile CHIS must only be authorised in exceptional circumstances. An appropriate adult or similar protective oversight role is required. These cases require Chief Constable level authorisation.
Communications Data — Metadata Acquisition
Communications data is information about communications — who contacted whom, when, from where, and for how long — but not the content of those communications. It is now regulated under the Investigatory Powers Act 2016 (Part 3).
What it covers
Subscriber information (who owns a number or account), traffic data (who contacted whom, when, duration, routing), service use data (what services were accessed), and location data from cell site analysis.
What it does NOT cover
The content of calls, text messages, emails, or online communications. Content acquisition requires a warrant under IPA 2016 Part 2 — a significantly higher threshold.
SPOC process
Requests for communications data go through the force Single Point of Contact (SPOC) — a trained specialist who liaises with communications service providers (CSPs). Officers should not approach CSPs directly.
Authorisation
Under IPA 2016, communications data requests require authorisation by a Designated Senior Officer (DSO) within the force, and in many cases require approval from the Office for Communications Data Authorisations (OCDA) — part of IPCO.
Purposes
Communications data can be obtained for prevention or detection of crime, public safety, or national security. The DSO must be satisfied that the request is necessary and proportionate.
Equipment Interference — Device Access
Equipment interference (EI) — colloquially known as "hacking" — involves accessing a device to obtain data from it covertly. It is the most restricted investigatory power and is governed by IPA 2016 Part 5.
What it covers
Covertly accessing computers, phones, or any electronic device to extract data, install monitoring software, or observe activity. Accessing a device that has been lawfully seized as evidence is NOT equipment interference — that is a separate process.
Who authorises
EI warrants are issued by the Secretary of State (for national security) or a Judicial Commissioner (for serious crime). Individual officers cannot authorise EI. It requires specialist capability and is typically handled by specialist covert units.
Why so restricted
Equipment interference provides access to enormous volumes of private data — communications, location history, contacts, documents, and more. The potential for abuse is significant. The judicial commissioner must approve the necessity and proportionality.
Bulk vs. targeted
Targeted EI covers a specific device. Bulk EI (used by intelligence agencies, not typically policing) covers categories of devices. Policing almost exclusively uses targeted EI for specific investigations.
Necessity & Proportionality — The Golden Thread
Every surveillance authorisation must demonstrate both necessity and proportionality. These are not formalities — they are substantive legal requirements that must be genuinely considered and documented.
Necessity
Is the surveillance necessary to achieve the stated purpose? This requires identifying the statutory purpose (crime prevention/detection, national security, etc.) and demonstrating that the intelligence objective cannot reasonably be achieved by other, less intrusive means.
Proportionality
Even if necessary, the intrusion must be proportionate to the objective. Consider: the seriousness of the crime, the importance of the information sought, the degree of intrusion on the subject and any collateral intrusion on third parties, and whether the benefit justifies the privacy cost.
Collateral intrusion
Where surveillance will unavoidably capture information about people who are not the primary target, this must be acknowledged and minimised. The authorisation should address how collateral intrusion will be managed and what will happen to data about third parties.
Ongoing review
Necessity and proportionality must be re-assessed throughout the operation, not just at the point of authorisation. If the justification no longer holds — e.g., the suspect is no longer a target — the authority must be cancelled.
Oversight — IPCO & Judicial Commissioners
Investigatory Powers Commissioner's Office (IPCO)
IPCO was established by the IPA 2016 to provide independent oversight of the use of investigatory powers by all public authorities, including police forces. It is led by the Investigatory Powers Commissioner (IPC), a senior judge.
Inspections
IPCO conducts regular inspections of forces, reviewing surveillance authorisations, CHIS management, communications data requests, and equipment interference use. Non-compliant practices are identified and must be rectified. Reports are published annually.
Judicial Commissioners
Judicial Commissioners (senior retired judges) review and authorise the most intrusive surveillance powers — intrusive surveillance warrants and equipment interference warrants — providing independent judicial oversight before surveillance commences.
Investigatory Powers Tribunal (IPT)
Members of the public who believe their communications have been unlawfully intercepted or that unlawful surveillance has been conducted can bring a complaint before the IPT. The IPT can investigate and provide remedies including damages.
Compliance culture
IPCO inspections assess not just paperwork but whether there is a genuine compliance culture within the force. Forces where surveillance is used without proper regard for the legal framework face recommendations and in serious cases referral to prosecution authorities.
Common Mistakes & How to Avoid Them
RIPA compliance failures can result in evidence being excluded, criminal liability for individual officers, and institutional embarrassment. These are the most frequently identified issues.
| Mistake | Detail |
|---|---|
| Using directed surveillance without authorisation | Simply watching someone covertly in a planned way without RIPA authority is unlawful. Officers who conduct surveillance without authorisation expose themselves to personal liability and render any evidence gathered potentially inadmissible. "I only watched them for a bit" is not a defence. |
| Proportionality not evidenced in the application | The authorisation must explicitly explain why the intrusion is proportionate to the objective. A general statement that the target is suspected of a serious offence is not sufficient — the document must address why this level of intrusion, and why now, is proportionate. |
| Failing to cancel when no longer necessary | Directed surveillance authorities must be cancelled as soon as the operation is complete or the surveillance is no longer necessary. Allowing authorities to run beyond operational necessity is unlawful. Officers responsible for the authority must review and cancel promptly. |
| Social media monitoring crossing into surveillance | Passive monitoring of public social media posts is not surveillance. However, setting up a false profile, using OSINT tools to covertly monitor a specific individual systematically over time, or accessing private content without authority may constitute directed surveillance or require CHIS management. Take legal advice before conducting systematic online monitoring. |
| Handler/controller role confusion in CHIS | CHIS management requires separate handler and controller functions. A handler cannot also be their own CHIS's controller. The controller provides independent oversight. Conflating these roles is a compliance failure and may invalidate the CHIS authority. |
| Treating communications data as content | Communications data (who contacted whom, when, cell site data) is separately regulated from the content of communications. Acquiring content (reading messages, listening to calls) requires a separate, higher authority — typically a warrant under IPA 2016. Do not confuse the two. |
Key Legislation
| Provision | Description |
|---|---|
| RIPA 2000 Part II | Directed and intrusive surveillance, and CHIS — the primary source of authority for covert policing techniques. |
| RIPA 2000 s.26 | Definitions of directed and intrusive surveillance. |
| RIPA 2000 s.29 | Authorisation of CHIS. |
| IPA 2016 Part 2 | Interception of communications (content) — warrants required, regulated separately from communications data. |
| IPA 2016 Part 3 | Acquisition of communications data (metadata). |
| IPA 2016 Part 5 | Equipment interference — the most restricted power. |
| CHIS Act 2021 | Covert Human Intelligence Sources (Criminal Conduct) Act — authorises CHIS to commit certain criminal acts. |
| ECHR Art.8 | Right to respect for private and family life — the fundamental right that RIPA exists to balance against law enforcement need. |
| COPO 2010 (Surveillance) | Code of Practice for Covert Surveillance and Property Interference — issued under RIPA, provides detailed operational guidance. |
Related reading
Primary sources
BlueLineHub is independent and unofficial. Always verify with the authoritative source below.
- Verify on official source
Regulation of Investigatory Powers Act 2000, section 26
Defines the conduct to which RIPA Part II applies — directed surveillance, intrusive surveillance, and the use of a covert human intelligence source (CHIS).
Last checked: August 2026 - Verify on official source
Regulation of Investigatory Powers Act 2000, section 28
Authorisation of directed surveillance.
Last checked: August 2026 - Verify on official source
Regulation of Investigatory Powers Act 2000, section 29
Authorisation of covert human intelligence sources (CHIS).
Last checked: August 2026 - Verify on official source
Regulation of Investigatory Powers Act 2000, section 32
Authorisation of intrusive surveillance.
Last checked: August 2026 - Verify on official source
Investigatory Powers Act 2016, Part 2
Interception of communications (content) — the warrant regime referenced in the guide's Key Legislation table as "IPA 2016 Part 2".
Last checked: August 2026 - Verify on official source
Investigatory Powers Act 2016, Part 3
Acquisition of communications data (metadata) — referenced in the guide's Key Legislation table as "IPA 2016 Part 3".
Last checked: August 2026
Frequently asked
- What is the difference between directed and intrusive surveillance?
- Directed surveillance is covert, planned surveillance likely to obtain private information about a person, authorised by a Superintendent or above and lasting 3 months. Intrusive surveillance is covert surveillance carried out on residential premises or in a private vehicle — it requires Chief Constable authorisation plus approval from a Judicial Commissioner because it is far more intrusive.
- Who can authorise use of a CHIS (informant)?
- A Superintendent or above authorises the use or conduct of a CHIS. Authorisation lasts 12 months (4 months for a juvenile CHIS under 18). The handler who manages the CHIS day-to-day must be a different person from the controller who provides independent oversight.
- Does RIPA cover intercepting someone's messages or calls?
- No — interception of communications (content) and the acquisition of communications data (metadata) are now regulated under the Investigatory Powers Act 2016 (Parts 2 and 3), separately from the RIPA 2000 surveillance and CHIS framework.