Mass surveillance of UK citizens' internet communications by the UK intelligence services was unlawful until the end of last year, according to Britain’s top security court.
The Investigatory Powers Tribunal (IPT) ruled that the UK’s electronic intelligence gathering agency, GCHQ, had breached the Human Rights Act by using intelligence on UK residents supplied by the US National Security Agency (NSA) .
The ruling follows a case brought by human rights groups earlier this year challenging the legality of GCHQ’s gathering of private internet communications following leaks by whistleblower Edward Snowden.
The IPT judgement rules that GCHQ was in breach of article 8 of the Human Rights Act which governs the right to a private and family life and Article 10, which covers the right to freedom of expression.
However, in an earlier ruling, the Tribunal held that access by GCHQ to NSA data was lawful from December 2014 onwards, because the case itself had rendered some of the secret policies more transparent. That ruling now faces further legal challenges from human rights groups.
Sharing data supplied by NSA unlawful
The current case centres on the legality of GCHQ’s use of data supplied by the NSA to the UK under the US Prism and Upstream data collection programmes.
Prism, which was first made public by NSA whistleblower Edward Snowden in 2013, gives the NSA access to social media content from Apple, Microsoft, Google, Facebook, Yahoo, YouTube, Paltalk, AOL and Skype.
The Upstream programme gives the NSA the ability to intercept emails and data by directly tapping into fibre-optic transmission cables.
The court ruled the regime governing the soliciting, receiving, storing and transmitting by UK authorities of private communications of individuals in the UK, obtained by the US under Prism and Upstream had been unlawful up until December 2014.
That decision is now being challenged by the human rights groups, Privacy International and Bytes for All, which plan to lodge an application with the European Court of Human Rights (ECHR).
Mike Rispoli of Privacy International said he disagreed with the tribunal that “limited transparency after the fact” has made GCHQ’s activities after December 2014 legal.
“[We] disagree with the tribunal’s earlier conclusion that the forced disclosure of a limited subset of rules governing intelligence-sharing and mass surveillance is sufficient to make GCHQ’s activities lawful as of December 2014.”
The human rights groups said they will ask the Investigatory Powers Tribunal to investigate whether their communications were unlawfully collected prior to December 2014 and, if so, demand their immediate deletion.
GCHQ using NSA to intercept data without a warrant
In the UK, interception of data is regulated by the Regulation of Investigatory Powers Act (RIPA).
But Rispoli said that by using data intercepted by a foreign body, GCHQ has effectively been able to avoid the need to obtain specific warrants to intercept private communications.
“Secret policies divulged during Privacy International’s case revealed that British intelligence services can request or receive access to bulk data from foreign agencies like the NSA without a warrant whenever it would ‘not be technically feasible’ for the government to obtain it themselves,” he said.
Illegal interception will continue, says human rights group
Privacy International warned that GCHQ would be able to continue to legally share the NSA’s data without supervision under RIPA, while its appeal to the European Court of Human Rights was underway.
“While that appeal is pending,” said Rispoli, “GCHQ will retain unfettered access to this material intercepted by the NSA. The two agencies by default share intelligence gleaned from Prism and Upstream, sometimes with few or no safeguards."
Eric King, deputy director of Privacy International, paid tribute to Snowden’s efforts to shed light on the work of the NSA.
“The world owes Edward Snowden a great debt for blowing the whistle,” he said, “and today's decision is a vindication of his actions.”
Read more on Network security strategy
GCHQ bulk interception programme breached privacy rights, Strasbourg court rules
Civil liberties groups to challenge bulk surveillance and intelligence sharing in Strasbourg
GCHQ mass surveillance regime was in breach of human rights law, European court rules
Surveillance watchdog investigates security risks of GCHQ IT contractors