The Annual Report of the Investigatory Powers Commissioner, laid before Parliament on 29 October 2026, opens with reassurance. In his covering letter to Keir Starmer, Sir Brian Leveson, now Lord Leveson of Liverpool, reports a “generally strong culture of compliance”. Then come the qualifications: “several disappointing instances that raised acute questions about compliance and candour”, the first being Agent X. His small inspectorate, he notes, relies on those it inspects to flag difficult cases, since “random selection can only go so far”.
Launching the report, Leveson went further. The case “is as serious as anything I have dealt with as Commissioner”, he said. “Oversight depends on candour. Failings of candour undermine the entire basis of oversight and accountability.”
How MI5 Misled Its Inspectors
Chapter 5 shows how the Security Service misled the courts and its inspectors. In late 2021, the Attorney General sought an injunction against the BBC reporting on Agent X. X was an alleged MI5 covert human intelligence source said to have used that status “as a tool in abusing his partner”. MI5 told the High Court that X’s status had not been disclosed to the BBC. It was untrue; an MI5 officer had confirmed it to a BBC journalist in June 2020.
The watchdog’s inspectors worked this out for themselves. Their 2022 inspection found “serious issues” with MI5’s record-keeping and concluded that X’s status had been disclosed. Shown the draft in February 2023, MI5 “robustly asserted” the opposite, and suggested the inspectors’ mistaken finding might have coloured their view of the whole case. Asked for contemporaneous records, MI5 “could not provide any”. The inspectors still withdrew their finding “based on MI5’s assertions and its evidence provided to the High Court”. The overseers were right; the agency talked them out of it.
The report quotes the Divisional Court’s judgement of 2 July 2025: the special advocates, the High Court, the Investigatory Powers Tribunal and the Commissioner “were all misled”, and MI5’s own investigations “suffer from serious procedural deficiencies”. The judges also found that MI5’s third most senior officer had given misleading assurances, and that the truth had “to be extracted from, not volunteered by, MI5”.
That investigation, by the deputy commissioner Sir John Goldring, was published on 16 July 2026. It found “serious and systemic failures”. The officer who made the disclosure “knew throughout what he had done yet failed to report it”. Others “knew that NCND had been departed from, but a false account was allowed to take hold and persist”, and MI5 officers “failed to comply with their duty of candour”.
The Rest of the Report
MI5 recorded 211 of its own errors in 2025, against 70 in 2020, when McCallum took over. Some of the rise may have been bookkeeping: two categories accounting for 38 of the 2025 errors did not exist before 2023. Errors involving agents reached 21, the highest since the series began in 2017. Inspectors concede that because MI5 chooses which agent files to show them, “we have not always been confident that the material provided reflects the full set of factors informing compliance decisions”.
On Northern Ireland, the report records that in December 2025, in the Kearney case, MI5 made a concession “similar” to the police admissions of unlawful communications data acquisition in the case brought by Barry McCaffrey and Trevor Birney. It covered MI5’s own acquisitions in 2006 and 2009. None of the eight serious-error investigations in Annex C involves MI5; all concern police forces or telecoms companies.
Is McCallum “Repeatedly Called Out for Lack of Candour”?
Some charges against Ken McCallum can be tested, not assumed. Five episodes stand out.
The “ungoverned spaces” (2016–2019). MI5’s compliance team found in January 2016 that data might be held in “ungoverned spaces”. The then-commissioner, Lord Justice Fulford, found the handling “undoubtedly unlawful” and accused officials of “misleading euphemism”. McCallum was deputy director general (DG) from April 2017, and Fulford’s questions focused on what “four of MI5’s Directors” knew in October 2017 and the board knew in January 2018. The apology came from his predecessor, Andrew Parker. A June 2019 review found “a sustained organisational failure”, not “individual negligence or a deliberate intention to mislead”, and asked that the fix be led by the deputy director general personally: McCallum. No published document seen for this article names him among those who knew.
The bulk data judgement. Often dated to 2022, the tribunal’s ruling came on 30 January 2023. It found that MI5 had held data unlawfully from late 2014 to April 2019, did not tell the commissioner until February 2019, and breached its duty of candour in earlier litigation. These are findings against the institution, not against McCallum by name, though he was deputy DG from April 2017.
Manchester Arena bombing (2023). Sir John Saunders said MI5’s “corporate position” at times looked like “retrospective justification” and rejected MI5’s claim that two pieces of intelligence concerning Salman Abedi related to “non-terrorist criminality”. Abedi had been among those encouraged by both MI5 and MI6 to travel to Libya in 2011. McCallum, who as deputy had led the 2017 post-attack review, apologised. The criticism targeted MI5’s corporate account, not him.
Agent X (2020–2026). This case sits wholly in his tenure: the disclosure (2020), the false evidence (2022) and the “robust” assurances to inspectors (2023). But the December 2023 reply to the inspectors was signed by the senior officer in MI5’s oversight engagement team, not by him. He “personally informed” Leveson and apologised in December 2024, and repeated a “full and unreserved apology” to the courts. Yet the review by Sir Jonathan Jones that he commissioned with Yvette Cooper was rejected by the court, its terms of reference “fundamentally incoherent”. Goldring is pointed about one decision that was McCallum’s own. In February 2025, he chose to keep up “neither confirm nor deny”, a position the court called “patently unrealistic”, and accepted that it was “his decision for which he took full responsibility”. Goldring adds that the internal inquiry and the Jones review together “did not amount to an independent review”, but also that “the DG wished to get to the truth”.
Kenova (2024–2025). MI5 found further Stakeknife files in April 2024, after prosecution decisions had been taken. The final Operation Kenova report called this “a serious organisational failure”, one of several incidents “capable of being negatively construed” as attempts to “conceal the truth”. It found MI5 was “closely involved” with Freddie Scappaticci, where MI5 had called its role “peripheral”. McCallum apologised again. The review MI5 requested found that nothing was “deliberately withheld”. Kevin Winters of KRW Law, for bereaved families, called it a “damp squib”.
The Sean Brown case does not belong on this list. The coroner criticised state agencies’ disclosure failings, in a case where, in 1997, Sean Brown was abducted, assaulted and murdered. In February 2024, however, an investigation “indicated that a number of individuals linked to the murder were agents of the state.” At the time McCallum was an agent handler in the north of Ireland for MI5 (fresh out of university). The Secretary of State for Northern Ireland’s refusal to hold a public inquiry was found unlawful by the court, and that ruling was subsequently upheld on appeal. It is now before the Supreme Court. The judgement in this was ministerial, and no finding on MI5’s candour specifically has been made there. One wonders, however, what advice ministers received from McCallum and MI5 in that instance.
The Verdict
The pattern is real. Over a decade, judges, inquiry chairs, and commissioners have found that MI5 misled its overseers and failed to disclose or held data unlawfully, while McCallum held senior posts. No court or commissioner has yet found that he personally misled anyone. The most pointed finding against him is a bad judgement call in 2025, which he owned. To say he personally has been “called out for lack of candour” overstates the record. To say candour has repeatedly failed under his leadership, and that he answers for it, is supported by the evidence.
All these judgements were made by the British judicial system, and they don’t touch any of the large number of other questions about McCallum’s candour — on Ireland, yes, but also in recent pronouncements on ‘Islamist terrorism’, Russia, China, and Iran. They may well be as interesting and telling, or more so. Further investigations will be required, though.
