The Investigatory Powers Tribunal (IPT), a shadowy UK judicial body independent of the British government and which hears complaints about surveillance by public bodies, on Friday ruled (.pdf) that between 2007 (when the PRISM program was first introduced), and 2014, aspects of how GCHQ accessed emails and phone records collected by its senior Five Eyes spying partner, the NSA, were illegal and violated human rights law.
Specifically, the IPT found that although safeguard regulations were in place, they were illegal because the public was not aware of them (they only became public during the IPC’s investigation into GHCQ in December),
‘The regime governing the soliciting, receiving, storing and transmitting by UK authorities of private communications of individuals located in the UK, which have been obtained by US authorities … contravened Articles 8 or 10 [of the European Convention on Human Rights].’
The law requires that a detailed and accessible legal framework be available to the public, explaining any privacy safeguards that are in place to help regulate programs that interfere with privacy. The big catch, however, is that Friday’s finding effectively confirm the IPT’s December ruling, which found that GCHQ is currently acting within the law.
A particularly frustrating aspect of this is that GCHQ only started acting within the law when the IPT put behind-the-scenes pressure on it in advance of making its December ruling, which itself only came about thanks to legal challenges from civil right groups Liberty and Privacy International. This has, however, allowed GCHQ to dismiss Friday’s announcement as being of only ‘historic’ interest,
‘The IPT has, however, found against the government in one small respect in relation to the historic intelligence-sharing legal regime… But the judgment does not in any way suggest that important safeguards protecting privacy were not in place at all relevant times. It does not require GCHQ to change what it does to protect national security in any way… Today’s IPT ruling reaffirms that the processes and safeguards within the intelligence-sharing regime were fully adequate at all times – it is simply about the amount of detail about those processes and safeguards that needed to be in the public domain.’
Unsurprisingly, the civil rights groups who launched the initial legal challenge view the situation very differently. James Welch, legal director for Liberty, noted that,
‘We now know that, by keeping the public in the dark about their secret dealings with the National Security Agency, GCHQ acted unlawfully and violated our rights. That their activities are now deemed lawful is thanks only to the degree of disclosure Liberty and the other claimants were able to force from our secrecy-obsessed Government.’
Eric King, Deputy Director of Privacy International, said,
‘For far too long, intelligence agencies like GCHQ and NSA have acted like they are above the law. Today’s decision confirms to the public what many have said all along — over the past decade, GCHQ and the NSA have been engaged in an illegal mass surveillance sharing program that has affected millions of people around the world.
We must not allow agencies to continue justifying mass surveillance programs using secret interpretations of secret laws. The world owes Edward Snowden a great debt for blowing the whistle, and today’s decision is a vindication of his actions.
But more work needs to be done. The only reason why the NSA-GCHQ sharing relationship is still legal today is because of a last-minute clean-up effort by Government to release previously secret “arrangements”. That is plainly not enough to fix what remains a massive loophole in the law, and we hope that the European Court decides to rule in favour of privacy rather than unchecked State power.’
During the hearing it was revealed that GCHQ performs searches on social networks such as Google, Facebook, Twitter and YouTube, and on emails sent to or received from non-UK citizens abroad, which are considered legal to intercept as they are deemed ‘external communications’. Tellingly however, large sections of evidence that were deemed ‘sensitive’ were only heard in closed sessions to which the rights groups were not invited…
The government, of course, rather than taking the ruling that GCHQ acted illegally for seven years as a rebuke, instead sees it as vindicating current surveillance safeguards,
‘Overall, the judgment this morning is that the UK’s interception regime is fully lawful. That follows on from the courts clear rejection of accusations of mass surveillance in their December judgment and we welcome that. Because of the nature of their work, we are unable to express gratitude to them [the security services] and we should make sure they continue to have the powers they need to keep us safe. What they [the tribunal] said was that there should be more about the rules [governing surveillance] that should be disclosed publicly … They are not questioning in this judgment that the safeguarding of privacy was in any way jeopardised and the judgment will not require GCHQ to change in anyway what it does.’