UK Tribunal Rules GCHQ and NSA Mass Internet Surveillance Sharing Unlawful

The United Kingdom’s Investigatory Powers Tribunal (IPT), which is a court that was setup in 2000 to investigate and determine complaints of unlawful use of covert techniques by public authorities, has ruled that the mass Internet surveillance approach used by Government Communications Headquarters (GCHQ) was unlawful.

The situation first came to light in 2013 after ex-NSA employee Edward Snowden leaked significant details of several mass Internet and phone snooping systems (e.g. the NSA’s PRISM and UPSTREAM programmes), which separately included operation TEMPORA (here and here) that was caught tapping into at least some of the world’s 10Gbps transatlantic fibre optic cable links.

Naturally it didn’t take long for a coalition of privacy and civil rights organisations – including Liberty, Privacy International, Bytes for All and Amnesty International – to take the Government to task over their snooping arrangements with the USA by issuing a challenge via the IPT. It should be noted that the IPT are also dealing with a slew of related complaints from other groups.

At issue in today’s ruling was the way in which GCHQ was able to effectively circumvent UK legal protections (i.e. they had no need for a warrant to conduct the snooping) by obtaining the data they required externally because it was supplied by an NSA programme. The IPT declared today that this intelligence sharing between the USA and UK was unlawful, albeit only prior to December 2014.

Privacy International Statement

“In a previous December 2014 ruling, the IPT held that GCHQ’s access to NSA data was lawful from that time onward because certain of the secret policies governing the US-UK intelligence relationship were made public during Privacy International’s case against the security services. Yet that belated disclosure could not remedy the lack of transparency regarding the UK-US sharing prior to December 2014, meaning that all UK access to NSA intelligence material was unlawful before the Court’s judgement.

While we welcome today’s decision, Privacy International and Bytes for All disagree with the tribunal’s earlier conclusion that the forced disclosure of a limited subset of rules governing intelligence-sharing and mass surveillance is sufficient to make GCHQ’s activities lawful as of December 2014. Both organisations will shortly lodge an application with the European Court of Human Rights challenging the tribunal’s December 2014 decision.

While that appeal is pending, GCHQ will retain unfettered access to this material intercepted by the NSA. The two agencies by default share intelligence gleaned from PRISM and UPSTREAM, sometimes with few or no safeguards. Secret policies divulged during Privacy International’s case revealed that British intelligence services can request or receive access to bulk data from foreign agencies like the NSA without a warrant whenever it would “not be technically feasible” for the government to obtain it themselves.”

Elizabeth Knight, Legal Director at the Open Rights Group, said:

“This ruling is a very welcome first step. It shows that secret polices are not an acceptable basis for highly intrusive intelligence sharing practices. However, the IPT has not gone far enough. These flimsy policies are not enough to comply with the requirements of human rights law, even now they are public. And GCHQ’s own TEMPORA programme of mass interception is clearly both unlawful and disproportionate. We hope the European Court of Human Rights will go further than the IPT and find that mass surveillance breaches our human right to privacy.”

The full ruling can be read here and it’s noted that a number of pending IPT cases will now be able to proceed, although it remains to be seen whether the IPT will rule in favour or against the complaints about Tempora and or other aspects of state sponsored snooping.