Artificial Intelligence Agencies

In the corridors of intelligence agencies all over the world, artificial intelligence (AI) tools are becoming fundamental parts of the workflow. But how are intelligence agencies wielding these powerful technologies, and what guides their use? Our research tries to understand this by looking at two questions. First, how are intelligence agencies using AI? And second, how is that use regulated? We focus on the United Kingdom in answering these questions.

What we found is that intelligence agencies appear to be using AI in several ways, including to gather and make sense of vast quantities of public and private data. This data is analysed for many reasons including to analyse sentiment, map relationships, track and predict movement, and identify intelligence targets.

What makes these agencies' use of advanced processing so dangerous is that it is done in secret. For years, we've been tracking intelligence agencies and how changing technologies advance their opportunities for surveillance and exploitation. AI tools may be as significant a change as the rise of the public's use of the unencrypted internet in the 1990s.

Yet surprisingly this is also happening at a time when governments are reluctant to regulate AI. Using the UK as an example, even when governments do act, they continue to exempt intelligence agencies from many rules. As a result, the UK intelligence agencies, and we suspect, most others around the world are using AI with few guardrails or consequences.

What we know: documenting AI in intelligence operations

Documenting the actions of intelligence agencies is inherently difficult. They possess extraordinary powers, operate in secret with minimal oversight and are often exempted from many rules that normally apply to governments.

Ironically, intelligence agencies have occasionally been eager to signal they are using AI, but always careful not to reveal exactly what they are up to. As a result, we are left attempting to surmise, piece-meal, by relying on leaked documents and by reading between the lines of cryptic procurement requests and public-facing statements and policy documents, how intelligence agencies are using AI and what risks their use poses to our human rights.

Leaders in the intelligence space from around the globe, including the (now former) heads of the US’s CIA and the UK’s MI6, have boasted about some of their respective AI capabilities, and promised to continue adopting new AI technology at breakneck speed. In 2024 they heralded their use of AI and in particular how their agencies “cannot do this alone — our partnership is augmented by a network of partnerships with the private sector.” With that assistance they are using AI tools “to enable and improve intelligence activities — from summarisation to ideation to helping identify key information in a sea of data. We are training AI to help protect and ‘red team’ our own operations to ensure we can still stay secret when we need to. We are using cloud technologies so our brilliant data scientists can make the most of our data, and we are partnering with the most innovative companies in the US, UK and around the world.”

AI Infrastructure

The drive to deploy AI is manifesting in significant investment in infrastructure to support AI use.

The UK government is heavily investing in technologies for intelligence purposes. For instance, the National Security Strategic Investment Fund (NSSIF) has been investing in start-up technology for years. But in July 2025, the UK government began to promote it more publicly and allocated to the fund an additional £330 million over the next four years to focus on the ‘critical intersection’ of dual use technologies, which may include AI, and national security. We also know that in 2021 the Financial Times reported that the government contracted with Amazon Web Services to host data for UK intelligence agencies. Such data, as discussed below, is the foundation for AI applications. Outside of the intelligence realm, in 2025, the UK signed a deal with Open AI called ‘stargate UK’ to strengthen the UK’s sovereign computing capabilities to run “world-leading AI models”.

Similar trends are visible in the United States where significant funding has been allocated to procure AI compute, which is the term for data centre infrastructure and chips on which AI relies, and data-centre capacity.

Collecting data

Infrastructure is designed to facilitate the storing and processing of vast amounts of information, which intelligence organisations are also increasingly collecting. For example, under the Trump Administration, the US has moved to collect and analyse more data for border and immigration policing. Social media monitoring in early 2025 was reportedly used for an ‘AI-fueled Catch and Revoke’ to review student visa holders’ social media accounts. The Administration then sought to expand the collection of social media data from all non-residents. Over the last two years Immigration and Customs Enforcement has accumulated vast amounts of data to conduct their operations, and used tools including facial recognition, mobile phone tracking, and predictive software that recommends where the agency should direct enforcement activities.

In a dispute between the US Department of Defence and Anthropic, whose AI models were being used on classified systems, it emerged, according to the New York Times, that the Pentagon wanted to use Anthropic’s technology to assist with “the collection and analysis of unclassified, commercial bulk data on Americans, such as geolocation and web browsing data.” It is unclear how effectively US law would prevent such mass surveillance, including of US persons, either based on commercial data or bulk information collected by their intelligence agencies.

The UK similarly moved to make the collection of large amounts of data easier in 2024 when it amended the Investigatory Powers Act to allow for less restrictive access to bulk sets of data deemed to have low or no reasonable expectation of privacy attached to them or held by third parties. This was likely in anticipation of applying AI to the more easily accessible data.

Analysing the Data

Once they have collected these vast amounts of data, intelligence agencies need to analyse it.

Richard Moore, the former-chief of the UK MI6, and Bill Burns, the former-director of the US CIA, provided several examples of how AI can contribute to this analysis, including summarisation, ideation, “identifying key information in a sea of data,” ‘red teaming” operations, and using cloud technology for data processing.

Private companies may likely play a significant role in such analysis, as Moore and Burns emphasised the intelligence agencies “cannot do this alone — our partnership is augmented by a network of partnerships with the private sector.” In 2024, MI6 also published calls for bids from tech companies, one asking for companies that can use AI to ‘assist with screening individuals of interest,’ and one seeking AI to support ‘human decision making. The results of these calls were not published.

We also know the UK government has contracted with Babel X, a social media investigation company equipped with AI, to assign human sentiment and detect relationships. And several UK police forces reportedly are working with Palantir to build a real time surveillance network that uses AI to “assist with decision-making,” “aid in the prevention, detection, and investigation of crimes,” and create profiles of people, although Palantir denies its software will be used for predictive policing. These capabilities could just as easily be utilised by intelligence agencies.

In February 2025, the UK’s GCHQ published a white paper called ‘Pioneering a New National Security: The Ethics of Artificial Intelligence.’ The paper vaguely outlines how GCHQ is using AI to process data, promote online safety, and prevent child trafficking. It does acknowledge that there are issues with AI, including a lack of transparency, fairness, and privacy, but assures readers that GCHQ is implementing AI with these issues in mind, and that it has developed an internal AI Ethical Code of Practice and Governance.

This white paper was proceeded by a 2023 Independent Review of the Investigatory Powers Act 2016, which examined, among other things, how UK inteligence agencies are increasingly using bulk data and AI. The report found machine learning systems could “support national security decision-making,” including by “independently adapt[ing] and learn[ing] from the data they process, and synthesis[ing] human-readable summaries and data view.” Acknowledging the increase in data collection, the Review noted that “[s]ignificant increases in the type and volume of data created externally means that ML techniques are proving useful to UKIC in supporting the coverage of subjects of interest,” with those techniques potentially including searching for English and foreign language words simulaneously, advanced image detection, “optical character recognition, machine translation, speech-to-text and speaker identification.”

These glimpses illustrate how the UK may be utilising AI for intelligence work, including for:

• Summarisation;
• Ideation;
• Translation;
• Image and speaker detection and identification;
• Identifying key information in a “sea of data”;
• ‘Red teaming’ operations;
• Sentiment analysis;
• Detecting relationships;
• Assisting with decision making; and
• Profiling.

Other countries’ AI tools also shed light on what intelligence agencies may be able to do.

China is a keen innovator in aggregating and analysing masses of data, though far less is generally known about its intelligence agencies. Reports of their use demonstrate how AI can be used to aggregate and analyse vast datasets for population-scale surveillance, profiling and social control, including monitoring ethnic minorities and foreign residents.

Investigative journalists have disclosed how Israel’s intelligence agencies, including their military intelligence agency, have adopted AI tools. A joint investigation by +972 Magazine, the Guardian and Local Call, revealed that to process the vast data collected through interception of Palestinian telephone and text communications, the Israeli military intelligence agency trained a large-language model to understand spoken Arabic. One technologist involved in the creation of the system said “[w]e tried to create the largest dataset possible [and] collect all the data the state of Israel has ever had in Arabic.”

The processing of this scale of data may require cloud computing. In 2025 Microsoft abandoned elements of its contract with the Israeli government that provided the military intelligence agency with segregated access to its Azure cloud platform, because, according to the Guardian and +972 Magazine, it was being used to process data under the mantra of ‘a million calls an hour’, capturing everyday Palestinian communications, initially from the West Bank but expanding its collection.

AI-facilitated analysis of this data appears to have included a method called ‘noisy message’ which “scanned all texts messages between Palestinians in the West Bank and assigned each message a risk rating based on an automated analysis of whether it included words deemed to be suspicious.” During the war in Gaza, the cloud-based system was reportedly “put to frequent use alongside a series of AI-driven target recommendation tools.”

The Israeli military also has been reportedly using a series of AI systems, including one called “Lavender” that analyses mass surveillance data to identify ‘incriminating features’ and target suspected Hamas militants. Another system called ‘The Gospel’ reportedly uses surveillance data to generate scores for an ‘AI target bank’, dramatically increasing the number of target recommendations for bombings. Additionally, they reportedly used AI to listen in on calls, use that information to generate an approximate location for the target,and then launch airstrikes.

These instances show that intelligence agencies possess vast amounts of data and seek access to more, then apply AI tools and make determinations that affect people’s lives. These examples from China and Israel expand our AI use cases to include:

• Surveillance of entire populations of certain ethnicities or minority groups;
• Facilitating social credit systems;
• Monitoring foreigners in country;
• Using LLMs to understand spoken language and analyse audio communications at scale;
• Assigning risk ratings to communications at scale;
• Generating target recommendations; and
• Analysing audio communications to generate location information for targeting.

We do not know how many people these systems affect, how these AI systems were trained, or how much faith intelligence agencies place in them. Many questions are left unanswered, and a dearth of regulation or overly broad national security exemptions mean that intelligence agencies are currently not under any legal obligation to answer them.

Why do we care?: the harms from intelligence agency use of AI

The ways that intelligence agencies are using AI have created some particularly unique and far-reaching harms.

The first harm arises because of what agencies are doing with this data: agencies use AI-enabled algorithms to analyse the data they gather, and then make inferences and predictions about people, groups, and phenomena. This deepens the privacy harm caused by collecting the data in the first place.

Second, AI allows intelligence agencies to operate at a massive and unprecedented scale because the technology can independently analyse data without agencies having to dedicate human resources to the endeavour. In other words, AI enables intelligence agencies to gather and process more data about more people, without sacrificing other capabilities or activities.

Third, the secrecy with which intelligence agencies have adopted AI is harmful in and of itself, because it has robbed the public of meaningful participation in the debate about the risks to human rights that AI-enabled surveillance and intelligence gathering poses.

When combined, masses of data, the methods of intelligence agencies and the power of AI tools, all operating in secrecy, create unprecedented risks.

Scale of collection

Governments now have access to vast amounts of personal data that can reveal an individual’s location, age, gender, political beliefs, hobbies, sexual orientation, medical conditions, religious beliefs, and who they contact. There are three main ways intelligence agencies access this data.

First, as revealed by Edward Snowden in 2013, governments, including the UK’s GCHQ, collect bulk telecommunications data and content through methods such as intercepting internet traffic, hacking, recording phone calls, copying address books, and more. These programs are far reaching and intrusive, recording where people go, with whom they speak, and their web activity. The UK also likely has access to information intercepted in bulk by the US government, and the other members of the Five Eyes Alliance.

Second, national security agencies work closely with technology companies and data brokers to acquire, access, and use large volumes of personal data held by the private sector. The Interface recently published an excellent report which describes this phenomenon, and shows that the sources of this data, and the ways governments can access it, are varied, but include bidding at auctions, software development kits, social media, exploiting technical vulnerabilities, and applications connected to the Internet of Things. Intelligence agencies have a number of means of accessing this private data, including through: direct procurement from commercial vendors of datasets generated from data used for advertising or from data leaks; purchasing surveillance or SOCMINT platforms that provide access to aggregated and already processed personal data; and direct collection through the development of shell companies to directly engage in the ad tech industry. Intelligence agencies can also use this information to train AI models.

Third, intelligence agencies likely have access to vast amounts of data held on government databases, including driver’s license, passport and immigration databases, and law enforcement databases. In the UK, law enforcement agencies are building an even more integrated data platform, the National Data Integration and Exploitation Service (NDIES), that will further combine sources of data that were traditionally siloed. We do not know, but assume, that intelligence agencies will be able to access NDIES.

Today in the UK, these bulk surveillance capabilities are mostly regulated by provisions in the Investigatory Powers Act 2016, and UK intelligence agencies need a warrant before collecting or accessing the desired information. But those warrants do not sufficiently protect our privacy in light of AI advancements that make it vastly easier to process and analyse this data. Tools like Palantir’s Investigative Case Management system, used by the US’s ICE, can help governments manage these vast quantities of data from all of these sources by combining them into a single investigative platform that lets agents search using categories like immigration status, scars, tattoos, and license plate number. Examples discussed above, particularly coming out of Israel, demonstrate the vast power of modern processing which can identify tens of thousands of potential targets from bulk data. By combining government datasets with commercial datasets, and using AI to analyse it all, intelligence agencies are likely able to create full pictures of individuals lives that would otherwise be impossible.

Scale of operations

The law needs to catch up quickly with the scale of this AI-facilitated processing. In a 2012 US Supreme Court decision regarding warrantless location tracking of an individual (United States v Jones), the Court held that warrantless GPS evidence could not be used for prosecution, citing concerns about how GPS tracking tools impermissibly expanded the sheer number of people the police could surveil if they did not have to expend manpower on physically following people around.

AI surveillance presents the same concern, but at an even greater scale because of the potentially exponential increase in the number of people intelligence agencies are able to surveil. Like in US v Jones, where a GPS tracking device reduced the cost of surveillance to the government, the resources required to make mass surveillance the default tool for investigation have dramatically decreased as a result of AI: the precipitous decline in the cost of technology and data storage; the ubiquity of digital devices and connectivity; and the exponential increase in the processing power faciliated by AI. This environment potentially allows the government to monitor whomever they wish, without having to prioritise.

Before AI, thousands of people would have had to comb through this data, searching for, in a post-9/11 framing, needles in illicitly gathered haystacks. AI makes this easier – based on the data it is fed, algorithms can paint a picture of what someone’s life looks like – where do they work? What are their habits? Who is their family? What do they believe? What is their immigration status? It may also figure out vital information like relationships between individuals and between groups, how movements are funded, and where crime may occur. Even where this information is not explicit, AI may be able to infer it. And everything can now likely be accessed with natural language queries and agentic workflows, similar to those we are becoming used to employing with commercially available AI tools.

As one example of these developments, government agencies increasingly rely on AI systems to make predictions about human behaviour and to make decisions or recommendations about how the state should treat people. AI tools can make decisions about whether a person should be surveilled, detained, or interrogated; whether they should be allowed to access rehabilitative services or welfare payments; whether they should or should not be granted immigration status; and even whether they should be killed or be allowed to live. In these contexts, AI risks violating the most fundamental of human rights. And realistically, these represent only a handful of use cases for intelligence agencies.

This change is significant because it can alter the basic logic of how intelligence investigations function. Traditionally, surveillance powers were deployed to investigate individuals already reasonably suspected of committing a crime or posing a threat. AI-enabled systems make it possible to reverse this process: rather than beginning with a suspect and gathering evidence, agencies can analyse vast quantities of data to predict subjects of interest. It shifts intelligence work from investigating suspects to searching for predicted ones.

Both US and UK intelligence officials have confirmed that predictive AI is being used in intelligence agencies to some degree. While we cannot analyse the risks of actual use-cases, use of predictive-capabilities with AI tools in intelligence and law enforcement contexts opens the door to several types of potential harms, most notably: (1) a significant potential for error, inaccuracy or bias to creep into the assessment, which is (2) compounded by the opaque nature of the reasoning underlying such predictions.

Scale of error

AI may recreate and amplify human bias, hallucinate or otherwise be unreliable, making it all the more dangerous to our rights.

Numerous studies looking at the use of predictive tools in policing have shown that when software is trained on previous law enforcement data, and that data contains biases, e.g. discrimination against certain communities, the system might also learn to propagate those biases. For example, a 2026 study commissioned by the Mayor of London found that black Londoners are up to 48 times more likely to be stopped and searched by police. If we train systems on that data we risk propagating those biases and discriminatory activity.
 
In the US, multiple lawsuits have been brought against police departments for their use of predictive policing software. In Pasco County, Florida, the Sheriff admitted after lengthy litigation that he had been using an unconstitutional predictive policing program that used an algorithm to produce a list of “prolific offenders.” Although the kinds of data this algorithm analysed were never fully revealed; race, ethnicity, social-economic status, and whether or not a family member had previously committed a crime were factors, and the community reported that black individuals were disproportionately affected by the program. Based solely on their inclusion on this list, and not due to other criminal activity, children were targeted and interrogated without supervision, individuals and families were continuously harassed, and the police carried out “prolific offender checks,” during which deputies looked to cite the people targeted for issues like having grass that was too long, missing house numbers, unvaccinated pets, and excessive window tint on parked cars.
 
In Plainfield, New Jersey, police had been using predictive software from Geolitica – formerly known as PredPol. WIRED and the Markup conducted a study on the software and found that it was accurate less than 1% of the time in predicting where and when crimes were most likely to occur. Additionally, according to the Markup, “the software disproportionately directed officers to patrol neighborhoods with relatively higher percentages of low-income, Black, and Latino residents compared to those cities or counties on the whole.”

Another form of error is when AI systems hallucinate. The tools may draw false or misleading conclusions in their analysis of context and data. They may even fabricate data and present it as factual. This is why it is so important for reasoning and decisions to be checked. If given vast amounts of personal data, say an entire social media history of numerous people, the conclusions drawn may not be accurate or reliable.

This was part of the conflict between Anthropic and the Department of Defense in early 2026. On top of the privacy concerns of building comprehensive pictures of people’s lives automatically and at massive scale, Anthropic also said that “frontier AI systems are simply not reliable enough to power fully autonomous weapons.” Putting a tragic real world example to this concern, in September 2026 Bloomberg reported that overreliance on AI may have led to a missile strike on a school in Iran which killed 123 children.

The fact that predictive policing software, manufactured by some of the same companies likely providing AI-enabled surveillance tools to intelligence agencies, is simply bad at its job has not stopped its proliferation. Although we do not know how intelligence agencies are using AI to make predictions, we strongly suspect that they are doing so, and we also know that intelligence agencies are not immune to discrimination, likely meaning that the datasets with which they train predictive AI models may be similarly tinged with bias and inaccuracy.

Opaque reasoning

As intelligence agencies begin to rely on AI to make predictions and decisions about people, it is unclear whether the same standard of proof can be met. When an AI system “predicts” that someone is likely to commit a crime, and decides or recommends that someone be placed under surveillance, arrested, or targeted in a conflict setting, the AI cannot necessarily articulate the reason why it came to its decision, and as a result humans cannot judge if the AI reached the requisite standard of proof for the action taken.

This is in part because certain AI, including the currently most advanced, is trained on vast amounts of data to produce desired outputs, but how it produces those outputs is often unknown, even to a system’s creators. This is often referred to as the “black box” problem with AI. Reasons for delivering a particular response may be hard to explain or nonexistent, at least in a way humans usually understand and articulate “reasons”. However, this ‘how’ is critical to understanding the ways that different AI systems work, what biases they might carry, and their capability to analyse information and make predictions.

This opaque nature of AI decision-making also risks individuals’ right to a meaningful remedy after a state has taken action – if the government cannot or will not tell individuals why they were targeted, individuals cannot challenge unlawful surveillance or arrest.

These risks would exist even if predictive AI was flawless - but unfortunately, as discussed above, it is error prone and can recreate human bias.

Lack of transparency

In the best-case scenario, therefore, even when governments are acting in good faith, the way that intelligence agencies may be using AI is problemmatic. Governments are collecting and analysing data about all of us from public and private sources at unprecedented scales and relying on opaque technology to analyse it. Swaths more people risk being unlawfully and unjustly targeted based purely on the recommendation or decision of software that cannot explain its decision-making process, cannot be easily challenged, and may be inaccurate or biased. And all of this is happening behind doors that must remain closed, we are told, for our own safety.

Those closed doors make it next to impossible for lay people, even highly skilled investigative reporters and researchers, to figure out exactly how intelligence agencies are using AI. This was a key message from the American Civil Liberties Union and the Brennan Center for Justice when they argued that “[t]he lack of proactive and meaningful disclosures from the government makes it nearly impossible for the public to understand how AI systems are used in these operations, how these systems make decisions or recommendations, how their outputs influence agency decisions or action, and what safeguards, if any, are in place.”

Even though the phenomenon of AI being used in surveillance contexts is well documented, we do not know very much about exactly what technology is being used by which intelligence agencies, or how this technology works. Most governments are refusing to explain how they are using AI, claiming that sharing this information would endanger national security.

In the UK, intelligence agencies are exempt from Freedom of Information Act requests (FOIA), meaning that it is impossible to even ask the agencies to disclose how they are using AI. In the US, even though it is possible to FOIA intelligence agencies, the requests are often ignored, or the files thoroughly redacted on national security grounds. And although the European Union led the way for AI regulation by passing the AI Act that mandates reporting on when AI is used, there is a national security exemption.

It is worth noting that without the 2013 Snowden disclosures, we might never have known that the UK intelligence services even had bulk collection powers.

Understanding what data is collected by the intelligence agencies, much less how it is internally processed and how AI is used, is thus very difficult. This lack of transparency is a problem in a democracy because it prevents effective democratic control of intelligence agencies. And in our current environment, where concerns about the potential for AI’s impact, its use and abuse, are extremely high, there is no good reason for the intelligence agencies to be fully exempt from the discussion.

The struggle to regulate

This lack of transparency contributes to open questions about how the law does and should regulate intelligence agency use of AI.

In the report, we examine in more detail how existing legal regimes within the UK currently regulate AI use by intelligence agencies. In short:

• The UK doesn’t have one singular comprehensive law that regulates the use of AI. It has a fragmented, cross-sectoral approach where different existing laws govern different aspects of the AI pipeline.
• Data protection law plays an important role in the regulation of AI, where AI processes personal data. However, for the most part, intelligence agencies are exempt from complying with data protection law when acting to safeguard national security. For instance, the UK government can issue national security certificates to exempt from data protection requirements a wide range of government bodies acting in the interest of national security.
• Human rights and equality law provide safeguards to protect human rights, including the right to privacy, and guard against discrimination as a consequence of AI use by public authorities. But their application to intelligence services may be limited, including by the lack of transparency, or circumvented for the purposes of national security.
• Sector-specific regulation, such as the Investigatory Powers Act 2016 (IPA) provides avenues for AI regulation, but must be improved.

While the UK’s system of regulation is complicated, a core component of it is the IPA. The IPA controls the UK intelligence agencies’ ability to acquire data in a variety of ways, including through the interception of content, hacking, collection of communications data, and bulk versions of all of these powers, which allow the UK intelligence services to intercept or collect vast amounts of data without reasonable suspicion. The IPA also notably gives the intelligence services the ability to acquire bulk personal data sets from third parties, which might include demanding access to or buying them from corporate actors like data brokers or AI companies.

The IPA is a helpful regulatory regime to use to assess the legal gaps in controlling intelligence agency use of AI. That is because despite its relatively recent enactment, latest amendments, and the detail it provides about how intelligence agencies gather and process data, the IPA fails in many ways to effectively control the new power of AI.

The IPA and AI

The IPA does not mention AI explicitly, but we know intelligence agencies are using it. What the IPA regulates most thoroughly is data collection, which is the foundation for AI use. The rules around collection and use of that data, however, do not live up to the demands of our new AI era. They leave serious gaps which can undermine all of our rights.

Those gaps include:

• missed opportunities in the authorisation stage to impose a duty to disclose and interrogate the use of AI in the decision to apply for a warrant or other form of authorisation;
• provisions designed to accommodate specific authorisation challenges which are less protective in an AI environment, including
  • (1) urgency carve outs, which could allow data to be collected or a model trained prior to authorisation being granted, making that data hard to “forget” or extract if authorisation is ultimately denied;
  • (2) providing a lower standard of authorisation for the collection of data deemed to have ‘a low or no expectation of privacy.’ This category of data is poorly defined and may become a nulity as the ability of AI to collate, aggregate and analyse vast amounts of data allows for the extraction of useful information from even the most innocuous seeming data, a phenomenon similar to the mosaic effect; and
  • (3) allowing for the examination of “third party bulk personal datasets” prior to authorisation being obtained. Without requisite safeguards, such data may be injested into intelligence agency systems, raising similar concerns to the urgency carve outs.
• secret orders, called “technical capability notices”, which might allow the UK government to force companies anywhere in the world to, among other things, rearchitect their systems to make more content available to intelligence agencies, apply AI tools to their systems, or create backdoors in secure systems, which become even easier for malicious actors to access due to advancements in AI which facilitate finding and exploiting vulnerabilities;
• outdated safeguards intended to narrow the scope of the intelligence agencies access to information collected through bulk surveillance, which are no longer fit for purpose in an AI world, including:
  • only requiring a targeted “examination warrant” to access content collected in bulk if the purpose of the examination is to identify material that is sent to, or intended for, an individual known to be in the UK, as AI-facilitated forms of examination may no longer require an analyst to “know” where their target is located, or indeed, to have a specific target in mind at all; and
  • perceiving as a robust safeguard the authorisation of “selectors”, which are specific search terms, identifiers or rules that can be used to filter bulk data. AI analysis has likely moved beyond the need to rely solely on selectors, with its potential to both analyse vasts amounts of data without necessarily narrowing the scope of the search, and to identify behavioural patterns and correlations, and predictively profile without a specific target at the outset.

What to do?

Given these significant gaps in AI regulation, we have developed a set of recommendations, using the UK investigatory powers legislation as a starting point, to illustrate how regulation could be updated to face new AI challenges. The full set of recommendations are available in the report here.

The recommendations aim to prevent core concerns regarding intelligence use of AI including facilitating explainability and minimising errors and bias. Effective record-keeping, transparency and oversight are fundamental. And national security exemptions must be reconsidered and narrowed, especially to permit more nuanced application of data protection law in the national security context.

Our recommendations cover: principles applicable to warrants and applications, including bulk and examination warrants; addressing heightened concerns about the collection of data outside of the warrantry process; combining data; logging, audits and transparency; and oversight and redress.

Our recommendations also deem certain uses of AI by intelligence agencies to be so inherently incompatible with fundamental human rights standards that they should never be permitted. These include:

• fully automated decision-making;
• sentiment analysis;
• uncorroborated behavioural prediction;
• profiling based solely on protected activities;
• disadvantaging or profiling a person based solely on protected characteristics;
• “live” identification of a person based on biometrics;
• scraping to create biometrics databases;
• relying solely on AI for analysis;
• forcing third-party AI use; and
• AI-directed equipment interference.

Closing: our futures

The very people building some of the most advanced AI systems are concerned about their surveillance potential. As Anthropic CEO Darius Amodei wrote in early 2026, “[s]ufficiently powerful AI could likely be used to compromise any computer system in the world, and could also use the access obtained in this way to read and make sense of all the world’s electronic communications (or even all the world’s in-person communications, if recording devices can be built or commandeered). It might be frighteningly plausible to simply generate a complete list of anyone who disagrees with the government on any number of issues, even if such disagreement isn’t explicit in anything they say or do. A powerful AI looking across billions of conversations from millions of people could gauge public sentiment, detect pockets of disloyalty forming, and stamp them out before they grow. This could lead to the imposition of a true panopticon on a scale that we don’t see today.”

And Peter Thiel, chairman of Palantir and tech investor stated in 2019 that “A.I. is a military technology. Forget the sci-fi fantasy; what is powerful about actually existing A.I. is its application to relatively mundane tasks like computer vision and data analysis. Though less uncanny than Frankenstein’s monster, these tools are nevertheless valuable to any army — to gain an intelligence advantage, for example, or to penetrate defenses in the relatively new theater of cyberwarfare, where we are already living amid the equivalent of a multinational shooting war.”

The lack of regulation of AI use by intelligence agencies is alarming. But that AI devleopers imagined these accountability gaps and vast challenges to human rights, and yet their technologies are likely being used by intelligence agencies in these very ways, is even more alarming. This was all foreseeable, even if we are not fully permitted to see. Which means we must act on what we can foresee to protect ourselves from the dystopian future being imagined.