Six internet service providers (ISPs) from around the world – including the UK’s GreenNet – have filed a legal complaint with the Investigatory Powers Tribunal, calling for an end to what they term GCHQ’s “attacking and exploitation” of network infrastructure for mass surveillance.
Besides GreenNet, which bills itself as an ethical ISP, the collective is composed of Chaos Computer Club, from Germany; GreenHost, from the Netherlands; Jimbonet, from Korea; Mango, from Zimbabwe; May First/People Link and Riseup, both from the US; as well as pressure group, Privacy International.
Privacy International has previously filed cases against the mass surveillance programmes Tempora, Prism and Upstream, and GCHQ's use of computer intrusion software. However, the ISPs' collective legal move marks the first time a group action has been taken against the British intelligence agency.
The group’s claim is based on a series of articles in German magazine Der Spiegel and the Intercept, which made a number of allegations. These include the claim that GCHQ used malware to gain access to network infrastructure, by targeting employees of Belgian comms firm Belgacom.
The reports claimed GCHQ and the US National Security Agency (NSA) have developed a range of network exploitation and intrusion capabilities. These include a "man on the side" technique, which injects data into existing data streams to create connections that target individual users for infection. The publications accused GCHQ and the NSA of using a system codenamed "Turbine" that uses automation techniques to substantially scale the implant network to target millions of users.
The reports identified a number of other companies – including three internet exchange points in Germany – that were targeted by GCHQ and the NSA, to spy on traffic passing through their nodes, to identify and target customers.
The complaint asserts that GCHQ’s attacks on their networks were not only illegal, but were destructive, undermined the goodwill the ISPs had built up with their customers, and damaged the trust in security and privacy the ISPs claim is vital to the existence of the internet. It calls for an immediate end to the exploitation of internet and communications services and the targeting of their administrative staff.
While none of the ISPs involved in the action were named in the original documents leaked by Edward Snowden, they claim the type of attacks carried out could have been made against any ISP or comms provider, so they and their users were at equal risk.
Privacy International deputy director Eric King said the attacks had crippled confidence in the internet economy and were threatening the rights of all users.
Our entire modus operandi is threatened by this illegal and intrusive mass surveillanceCedric King, GreenNet
“These widespread attacks undermine the trust we all place on the internet and endangers the world’s most powerful tool for democracy and free expression,” said King.
GreenNet spokesman Cedric King added: “Snowden's revelations have exposed GCHQ's view, that independent operators like GreenNet are legitimate targets for internet surveillance, so we could be unknowingly used to collect data on our users.
“We say this is unlawful and utterly unacceptable in a democracy.
"Our long established network – of non-governmental organisations and charities, or simply individuals who value our independent and ethical standpoint – rely on us for a level of integrity they can't get from mainstream ISPs. Our entire modus operandi is threatened by this illegal and intrusive mass surveillance.”
Jan Girlich, from the Chaos Computer Club, said: “The GCHQ's dragnet surveillance takes away all citizens' privacy rights indiscriminately.
"Thus, not only lawyers, doctors, journalists and many more people are robbed of their working basis, but everybody is stripped of his or her ability to object to their government's opinion without fear of retribution.
“We are heading towards a police state and the only way to stop this is to bring mass surveillance to an end.”
02 Jul 2014