Section 7, Third Direction, CHIS, And A Licence For Criminality
A regulation drafted in a Malayan police station to excuse a massacre already committed set a habit the British state never broke. Give the killing a category. Sign the paper afterwards. Watch the law that should have caught you become the thing that clears you.
In January 1949, a month after the Scots Guards shot twenty-four unarmed men at Batang Kali, colonial authorities in Malaya issued a new emergency regulation. Number 27A permitted the use of lethal weapons to prevent escape from arrest, and it was written to apply backwards. The soldiers had already killed.
The official account (the villagers had been shot running) now had a statute built to receive it. A crime committed in December became, by the following January, a category of permitted conduct which reached back to cover the men who committed it.
The instinct did not stay in Malaya. It came home, matured, and acquired over the next seventy years a sophistication which would have astonished the officials who scrawled 27A into the Malayan statute book.
By 2021 the same manoeuvre would be performed in the Palace of Westminster, in daylight, with the government defending in open debate its refusal to say whether the conduct it was authorising included torture.
Scrope And The Tower In 1742
It was not always so. There is a period in British history when the direction of travel ran the other way, when Parliament treated the secret expenditure of the Crown as something ministers were obliged to explain.
In 1742 a Treasury Solicitor named John Scrope was sent to the Tower of London for refusing to tell a parliamentary committee how Robert Walpole's government had spent its secret service money. Forty years later, the Civil List and Secret Service Money Act of 1782 capped what the Crown could quietly disburse on espionage.
Through the eighteenth and nineteenth centuries, parliaments of a far less democratic character than anything we would recognise returned repeatedly to the same demand: account for the money, or answer for it.
The 1782 Act was not repealed until 1977.
When Robin Cook set out in the late 1980s to force MI5 onto a legal footing, he had to dig this forgotten statute out of the ground to remind the Commons it had once possessed the nerve to interrogate the secret state about its spending.
By then the reminder was almost archaeological. The modern services had spent the better part of a century operating on precisely the opposite principle: the less Parliament knew, the better everyone was served.
As Jim Hacker elucidated:
The three articles of civil service faith: it takes longer to do things quickly; it's more expensive to do them cheaply; it's more democratic to do them in secret.
Illegally Bugging Their Way Across London
What the British state actually maintained during those decades of official silence was staggering. Wireless interception stations. Networks of listening posts across London and beyond. Safe houses, registries, administrative units, a payroll. All the physical apparatus any twentieth-century intelligence service requires to function, humming away in ordinary buildings on ordinary streets.
Under what law? Named by which minister? Funded by what transparent vote?
None.
MI5 had operated since 1909. MI6 and GCHQ traced their origins to the First World War. Not one of them was avowed. No statute recognised they existed, which meant no statute could constrain what they did.
The constitutional cover was the same prerogative haze which had shrouded Sir Francis Walsingham under Elizabeth I, updated with nothing more modern than an official willingness to neither confirm nor deny.
The official theory of what these bodies could lawfully do was set down by Lord Denning in his 1963 report on the Profumo affair, and it reads now as comedy. Members of the security service, Denning wrote, were in the eyes of the law ordinary citizens with no powers greater than anyone else. No special power of arrest. No special power of search. They could not enter a home without the householder's consent even if they suspected a spy sat inside.
Everyone in the building knew this was fiction.
Peter Wright, whose memoir the Thatcher government spent years and fortunes trying to suppress, gave the truth its lasting phrase on its jacket: MI5 bugged and burgled its way across London for years.
It did so illegally.
And it did so, as Cook told the Commons in December 1988, because:
.... some Governments and some Home Secretaries preferred it to behave like a private army rather than cause the embarrassment that would result from the need for MI5 to obtain explicit ministerial permission to tap a trade union leader's home or to enter the premises of a private citizen, believing him to be assisting the Soviet Union. When the Home Secretary was courteous enough to discuss those matters with me, he agreed that one of the arguments had always been that it is best to keep the service outside the law, because that way, a Minister's hands are kept clean.
It's almost impossible to believe. In Parliament, it was openly stated MI5 had been acting illegally.
The illegality was not a defect in the arrangement. It was the arrangement. A minister who signs nothing has nothing to explain. An organisation which does not exist cannot be called to account. Deniability was total precisely because avowal was absent, and the absence was deliberate.
A recruit arriving at MI5's Mayfair headquarters was taught from the first day he was a crown servant rather than a civil servant, answerable to the Royal Prerogative rather than to Parliament.
The service's legal adviser was once asked by trainees whether an officer might one day be caught in an act of burglary or worse, and was reported to have offered a single dry assurance: they had always got away with it so far.
Cornered Into Accountability
What finally forced the services into the light was not a democratic awakening. It was Strasbourg. A run of cases through the European human rights system in the 1980s made the legal vacuum untenable.
- A Swedish citizen established intelligence agencies ought to be avowed and placed on a statutory footing.
- A Surrey antiques dealer whose telephone had been tapped brought the question home.
- Harriet Harman and Patricia Hewitt (then running the National Council for Civil Liberties) discovered they had been placed under surveillance and took their case to Europe.
Britain was being backed into a corner from which the only exit was legislation.
The Security Service Act 1989 is remembered as the moment MI5 came in from the cold. Its opening words deserve closer reading than they usually get.
There shall continue to be a Security Service (in this Act referred to as “the Service”) under the authority of the Secretary of State.
The Act does not establish a security service. It declares there shall continue to be one. Parliament was not creating an institution. It was conceding eighty years late a powerful body had been running without its sanction, and hurrying to draw a legal box around a thing already in full motion.
The Intelligence Services Act 1994 did the identical work for MI6 and GCHQ with the same telling verb of continuation.
There shall continue to be a Secret Intelligence Service (in this Act referred to as “the Intelligence Service ”) under the authority of the Secretary of State; and, subject to subsection (2) below, its functions shall be—
There shall continue to be a Government Communications Headquarters under the authority of the Secretary of State; and, subject to subsection (2) below, its functions shall be—
Here the Malayan reflex reappears, transposed into a wholly different setting. As in 1949, conduct came first and law came second. As in 1949, the statute did not expose what had been done; it regularised it.
The difference was one of sophistication.
In Malaya the regulation had covered a single afternoon's killing. In Westminster the two Acts retrospectively furnished a legal home for decades of surveillance, burglary and interception which had been, on Denning's own account, unlawful the entire time.
What Cook said of the 1989 Bill applies to the whole exercise: it allowed Parliament and the public to know nothing more than before; offered no fresh reassurance about the service's conduct; and arguably increased its powers; converting a body which had operated in illegal shadow into one which could now act under statutory warrant. The shadow was not dispelled. It was issued with letterhead.
Section 7: The Hidden "James Bond Clause"
The 1994 Act carried within it the purest distillation of the whole habit. Section 7. It deserves precise description rather than the lurid summary it usually attracts, because the precise version is worse.
Section 7 does not license murder. What it does is remove British legal consequences.
If a person would otherwise be liable under the criminal or civil law of the United Kingdom for an act done outside the British Islands (i.e. murder), the liability disappears where the Foreign Secretary has authorised the act (murder) in writing.
(1) If, apart from this section, a person would be liable in the United Kingdom for any act done outside the British Islands, he shall not be so liable if the act is one which is authorised to be done by virtue of an authorisation given by the Secretary of State under this section.
Read it slowly. The full section is large.
The clause does not make the act lawful in the country where it happens. It does not make it defensible under any foreign law. It does not make it moral. It simply withdraws the reach of the one legal system which might otherwise prosecute the British agent who carried it out, on the signature of a single minister.
The authorisations can run six months and be renewed. They can take the form of class authorisations covering whole categories of conduct rather than named operations.
By 2014 the Intelligence and Security Committee recorded MI6 held eight such class authorisations and GCHQ seven.
This is particularly useful when British law makes it a criminal offence to bribe a foreign official when overseas outside UK jurisdiction:
A person (“P”) who bribes a foreign public official (“F”) is guilty of an offence if P's intention is to influence F in F's capacity as a foreign public official.
When the 1994 Bill originally passed, Liberty's legal director John Wadham warned in print it left open whether torture might be authorised, and action against a British citizen abroad could be placed beyond the law's reach entirely. The warning was not hysteria. It was a straight reading of the text.
The Malayan drafters had reached for a statute to make a domestic killing lawful at home. Section 7 refined the technique for the age of overseas operations: leave the act criminal everywhere on earth, and merely amputate the jurisdiction which could punish it.
The paper is signed in advance now, rather than after the fact. That is the only real change. The object, insulating the state's agent from the ordinary law which governs everyone else, was exactly the object of 27A.
Third Direction: Using Criminal Proxies
If Section 7 handled the world beyond Britain's shores, the domestic version of the reflex was buried deeper still, and for longer.
For decades MI5 ran agents inside terrorist and criminal organisations, and those agents committed crimes. This is not an allegation but an operational certainty: an informant who refuses all wrongdoing is an informant exposed within a week.
The question was never whether it happened, but whether any law permitted it, and for most of its history the service simply declined to say.
In 2016, litigating an unrelated matter at the Investigatory Powers Tribunal, the government disclosed a fragment revealing the Prime Minister had issued something called a third direction to the Intelligence Services Commissioner. The text was redacted. The mere fact of the direction's existence had been classified as a national security secret.
Pressed by Reprieve and Privacy International, the government finally published it in March 2018, and with it conceded MI5 had operated guidelines authorising its agents to participate in criminality since the early 1990s.
It read:
Under paragraph 59A of RIPA, inserted by the Justice and Security Act, the Prime Minister may direct me to keep under review the carrying out of any aspect of the functions of the intelligence services. The Prime Minister has now issued three such directions placing all of my oversight on a statutory footing.
Two of the directions are set out in my open report
• The acquisition, use, retention, disclosure, storage and deletion of bulk personal datasets, including the misuse of data and how this is prevented
• Compliance with the Consolidated Guidance.
• The application of the Security Service guidelines on the use of agents who participate in criminality <— [this was redacted]
The document entered into the record was labelled the Investigatory Powers Commissioner (Additional Directed Oversight Functions) (Security Service Agent Participation in Criminality) Direction 2017 .
The chronology is the point. The policy dated from the early nineties.
It received no external oversight of any kind until 2012, when David Cameron asked the Commissioner to keep an eye on it – roughly a fortnight before he stood in the Commons and described shocking levels of state collusion in the 1989 murder of the Belfast solicitor Pat Finucane.
Cameron's own instruction to the Commissioner carried a revealing caveat: the oversight would not amount to an endorsement of the policy's legality. Even the government watching the policy would not vouch that it was lawful.
The policy did something stranger than Section 7, and understanding the difference matters.
On its own terms, an MI5 authorisation to an agent did not make the crime lawful. It conferred no immunity. It did not stop a prosecution. The agent who committed the offence remained, on paper, an offender who could be charged. What the authorisation did instead was furnish MI5's justification if police or prosecutors ever came asking, and license the service to argue, in secret, pursuing the case would not be in the public interest.
Set against the realities of agent-running, this was a distinction without much practical weight. The crime might never be reported. The police might never learn the offender was an agent. The victim would never know an authorisation existed. And MI5 could make its case against prosecution behind closed doors, on grounds no one outside the room could test.
The organisations challenging the policy put the objection precisely: it manufactured immunity in practice while denying that any immunity had been granted.
When the challenge reached the Investigatory Powers Tribunal, the result was the most revealing split in the body's history.
In December 2019, for the first time in nearly two thousand rulings, the Tribunal divided and published dissents. Three judges upheld the policy, and the ground on which they upheld it should stop anyone short.
They held that MI5's power to approve criminal participation arose by necessary implication from its statutory functions: Parliament in 1989 had chosen to let an existing Security Service continue, i.e. running agents inside organisations such as the IRA was already a core part of what that service did, and so Parliament must have meant it to go on using informants who took part in crime.
Read that again.
The very Troubles-era practices (the turned men inside the paramilitaries, the tolerated criminality) were now cited by a British court as the reason the power must lawfully exist. Northern Ireland had stopped being merely the place the method was rehearsed. It had become the legal justification for the method's survival.
Parliament, they pointed out, had gone to the trouble of writing warrants and safeguards for comparatively minor intrusions such as interfering with someone's property, yet on this reading had silently conferred an open-ended power to approve grave offences against people, with no warrant, no defined limit, no time limit and no outside approval.
Professor Graham Zellick wrote to accept the government's argument would open the door to powers of which the country had no notice or notion, creating uncertainty and the potential for abuse.
The Court of Appeal upheld the policy again in 2021, on the same theory of implication.
No meaningful limit had ever been disclosed. Not murder. Not torture. Not sexual assault. Trust me, bro.
The reflex again, at its most concealed: the state doing the thing first, arranging its legitimacy in the dark; then, when a court finally looked, persuading the court to find the legitimacy hidden inside a statute which never mentioned it.
CHIS 2021: A Licence For Criminality
Faced with a three-to-two ruling it might still lose on appeal, the government did what the British state reliably does when a secret practice is dragged into the light. It legislated.
The Covert Human Intelligence Sources (Criminal Conduct) Act 2021, nicknamed the Spy Cops Bill, amended the Regulation of Investigatory Powers Act to create the Criminal Conduct Authorisation.
A Criminal Conduct Authorisation (CCA) must describe why the criminal conduct is necessary for a statutory purpose. The Authorising Officer must consider whether the outcome could be achieved by non-criminal means.
The government's defence of the Act was, remarkably, it changed nothing. The activity had always happened, ministers insisted; the statute merely gave it a clear legal basis.
This is not a new capability; the Bill provides a clear legal basis for a longstanding tactic which is vital for national security and the prevention and detection of crime.
State agents committing crime is vital for the prevention and detection of crime. Orwell couldn't have written it.
The claim of continuity concealed a transformation. The old MI5 policy had insisted, however hollowly, an authorised crime was still a crime.
The new Act said the opposite in four words which do all the work.
A valid authorisation renders the conduct it covers lawful for all purposes. Not shielded from prosecution. Not likely to escape the public interest test.
Lawful.
There is no longer an offence for a court to consider, and normally no civil wrong for a victim to sue over.
What the Third Direction had furtively achieved in practice while denying it in principle, the CHIS Act now granted openly and in terms: advance statutory immunity for authorised crime committed inside the United Kingdom.
This was the decisive step the whole sequence had been building toward. It was taken in the least concealed setting available: a Bill debated on the floor of both Houses.
Decades of unlegislated practice were being converted into statute, exactly as 1949 had converted a massacre into a permitted category; exactly as 1989 and 1994 had converted the unavowed existence of the services into law. Each time, the law arrives after the act, and arrives not to catch it but to bless it. The difference in 2021 was only that the blessing was made explicit.
The power did not stay with the spies.
Then it ran onward to a parade of regulators no one would associate with national security: the Financial Conduct Authority, the Competition and Markets Authority, the Environment Agency, the Food Standards Agency, the Gambling Commission.
A power forged in the dirty war of Belfast was handed, in the same Act, to the officials who police fishing quotas and fruit machines. The Act also expressly contemplated authorising criminal conduct by juvenile and vulnerable sources, subject to additional safeguards. Which is to say Parliament knowingly legislated for children to be placed inside criminal operations and told to break the law.
The most contested feature of the 2021 Act was what it refused to contain: any list of crimes placed beyond authorisation. Not murder, not torture, not rape.
The Joint Committee on Human Rights, noting Canadian legislation on the identical subject sets out explicit prohibitions, pressed for the same.
Peers inserted an amendment barring authorisation of the gravest offences.
The Commons stripped it out. Labour's front bench abstained.
The government's reason for the omission is worth stating in full, because it is the reflex reduced to pure argument. To name forbidden crimes on the face of the Act, ministers said, would hand criminals a checklist: a suspected informant could be ordered to commit an excluded offence, and his refusal would expose him. Therefore, to keep agents safe, the law must remain silent on whether it authorised torture.
The safeguard offered instead was the Human Rights Act, which ministers said already prohibited such things, i.e. rendering an explicit ban unnecessary.
It could not be both.
The government declined to choose, and the Act passed with the silence intact.
The Legacy Act: Closing The Books On Belfast
Every mechanism so far pointed forwards. Section 7, the Third Direction, and the CHIS Act all concerned conduct not yet committed and granting permission in advance. In 2023 the state completed the pattern from the other end.
Having spent decades building the machinery the earlier articles described, it passed a law to bury the accountability for the machinery it had already run.
The Northern Ireland Troubles (Legacy and Reconciliation) Act 2023 did in one statute what no single mechanism had managed before. It halted the inquests into Troubles-related deaths which had not reached an advanced stage, and barred any new ones. It ended the civil claims, including those already lodged. It stopped the criminal investigations.
And in place of all of it, it installed a single new quango, the Independent Commission for Reconciliation and Information Recovery, empowered to offer something the British state had never before granted in statute: immunity from prosecution for Troubles-related crimes (including killings) to anyone who cooperated with its reviews. Cooperation, not innocence, was the price of a clean slate.
Every party in Northern Ireland opposed it.
The Irish government opposed it so firmly it took the United Kingdom to the European Court of Human Rights over it.
Victims' groups called it what it plainly was, an amnesty in all but name.
The majority of the outstanding inquests it shut down concerned deaths caused by the state itself, the soldiers and the agents and the operations the previous articles traced. An inquest is the one legal proceeding capable of forcing disclosure, compelling witnesses and reaching a public finding about how a person died at the hands of the state.
The Ballymurphy families, whose relatives an inquest found in 2021 had been killed without justification by the Army, had reached such a finding only because the inquest system existed.
The Legacy Act was engineered to ensure the cases still waiting never would.
Here the Malayan reflex reaches its logical end. Regulation 27A dressed a completed killing in the language of law. The Legacy Act dressed the concealment of hundreds of completed killings in the language of reconciliation.
The Belfast High Court saw through it at once. In 2024 it held the immunity scheme incompatible with Articles 2 and 3 of the European Convention (the rights to life and against torture), both of which carry a duty to investigate and, where the evidence allows, to prosecute. The judgment was withering on the central pretence.
Conditional amnesties of this kind might be defensible where a country is emerging from dictatorship or civil war and trading justice for peace. The Troubles had ended in 1998. The need for a sweeping amnesty a quarter of a century later, the court found, was inexplicable, and the claim immunity would foster reconciliation was contradicted by all the evidence before it.
By 2025 the incoming government had accepted the Act was not fit for purpose and moved to strip out the immunity scheme and the bar on civil claims.
Yet the deeper structure survived. The Commission the Act created remained, along with the powers it handed the Secretary of State to control disclosure; appoint the commissioners and decide on grounds of national security what the families and their lawyers would never be allowed to see. The amnesty was the part the courts could strike.
The architecture of managed, ministerially controlled disclosure, the mechanism by which the state investigates itself and withholds from itself whatever it deems too sensitive to surrender, proved far harder to dislodge. The reflex adapts. Struck down in its crudest form, it persists in its administrative one.
The Same Move, Four Centuries Apart
Set the whole sequence in a single line and the trajectory is unmistakable.
| Moment | What the state did with the law |
|---|---|
| 1742 | Jailed a Treasury official for refusing to disclose secret service spending |
| 1782 | Passed a statute capping what the Crown could spend in secret |
| 1909–1989 | Ran MI5 for eighty years with no law admitting it existed |
| 1949 | Drafted Regulation 27A to make a completed massacre retrospectively lawful |
| 1989 / 1994 | Conceded the services shall continue, boxing running machinery in law |
| 1994 | Section 7 stripped UK liability from MI6's overseas crimes on a minister's signature |
| 1990s–2019 | Ran a secret MI5 policy approving agents' crimes at home, denying it granted immunity |
| 2021 | Made authorised crime in the UK lawful for all purposes, naming no offence as beyond reach |
| 2023 | Halted the inquests and claims into its own Troubles killings, offering amnesty for cooperation |
The eighteenth-century Parliament sent a man to the Tower for staying silent about money. The twenty-first-century Parliament passed a law engineered to stay silent about torture, and called it oversight.
The lesson was a killing; a burglary; an act of torture; a quarter-century of unacknowledged criminal authorisations; even thirty years of deaths at the state's own hand; could be lifted clear of the ordinary law. Sometimes by authorising the act before it happened. Sometimes by legislating over it once it could no longer be hidden. Sometimes by closing the courts that might otherwise have named those responsible.
Do the thing. Wait until a court or a newspaper or a European judgment forces the question. Then reach for the statute book, not to confess but to convert, turning the crime into a category, or the inquest into a review, and the category and the review alike into a shield.
What connects a police station in Selangor to the floor of the House of Commons is not a conspiracy run from a single desk. It is a durable administrative instinct, refined across four centuries into something almost elegant.
The law which in 1742 was a weapon Parliament pointed at the secret state has become the secret state's most dependable armour. And the one thing the machinery will never do, through every reform and every Act, is write down in plain words the worst of what it permits.
To name it would be to invite the question the whole apparatus exists to prevent: who authorised this, and will they answer for it?
The answer, reliably, dissolves. Upward, so the operative is cleared. Downward, so the minister is protected. And the paper, signed before or after, is always in order.
The British Murder Machine series is a stark reminder the cover-up of atrocities like Pakistani rape gangs is a long-established pattern. The obsession with secrecy has bred endemic corruption for a century. If we truly want to begin again, our country needs an era of public repentance and reconciliation, with external superinvestigators, to wash out the ugly truth of Establishment criminality.
