If a terrorist or spy is told the Security Service holds personal data on him or her—so revealing a covert investigation of them—the individual could change their behaviour to thwart that investigation. Alternatively, if told that there is no data held he or she could continue their activities confident in the knowledge that his or her activities had escaped detection. A neither-confirm-nor-deny response avoids both these risks.