The regime that governs the sharing between Britain and the US of electronic communications intercepted in bulk was unlawful until last year, a secretive UK tribunal has ruled.
Aspects of intelligence-sharing between security agencies in Britain and the United States were unlawful until December 2014, a secretive UK tribunal ruled today.
The Investigatory Powers Tribunal (IPT) declared regulations covering access by Britain's GCHQ to emails and phone records intercepted by the US National Security Agency (NSA) breached human rights law.
Advocacy groups said the decision raised questions about the legality of intelligence-sharing operations between the UK and the US. The ruling appears to suggest that aspects of the operations were illegal for at least seven years - between 2007, when the Prism intercept programme was introduced, and 2014.
The critical judgment marks the first time since the IPT was established in 2000 that it has upheld a complaint relating to any of the UK’s intelligence agencies. It said that the government’s regulations were illegal because the public were unaware of safeguards that were in place. Details of those safeguards were only revealed during the legal challenge at the IPT.
An “order” posted on the IPT’s website early on Friday declared: “The regime governing the soliciting, receiving, storing and transmitting by UK authorities of private communications of individuals located in the UK, which have been obtained by US authorities … contravened Articles 8 or 10” of the European convention on human rights.
Article 8 relates to the right to private and family life; article 10 refers to freedom of expression.
The decision, in effect, refines an earlier judgment issued by the tribunal in December, when it ruled that Britain’s current legal regime governing data collection through the internet by intelligence agencies - which has been recently updated to ensure compliance - did not violate the human rights of people in the UK.
Civil liberties groups
The challenges were brought by Liberty, Privacy International and other civil liberties groups who claimed that GCHQ’s receipt of private communications intercepted by the NSA through its “mass surveillance” programmes Prism and Upstream was illegal.
The existence of Prism and Upstream was revealed by the Guardian from documents provided by the NSA whistleblower Edward Snowden. The case brought by Liberty and Privacy International was the first in the UK to challenge GCHQ's participation in these programmes. Lawyers argued that receiving information about people in Britain from the NSA sidestepped protections provided by the UK legal system.
Eric King, deputy director of Privacy International, said: "For far too long, intelligence agencies like GCHQ and NSA have acted like they are above the law. Today's decision confirms to the public what many have said all along - over the past decade, GCHQ and the NSA have been engaged in an illegal mass surveillance sharing programme that has affected millions of people around the world.
“We must not allow agencies to continue justifying mass surveillance programmes using secret interpretations of secret laws. The world owes Edward Snowden a great debt for blowing the whistle, and today’s decision is a vindication of his actions.
“But more work needs to be done. The only reason why the NSA-GCHQ sharing relationship is still legal today is because of a last-minute clean-up effort by the government to release previously secret ‘arrangements’.
“That is plainly not enough to fix what remains a massive loophole in the law, and we hope that the European court decides to rule in favour of privacy rather than unchecked state power.”
James Welch, legal director for Liberty, said: "We now know that, by keeping the public in the dark about their secret dealings with the NSA, GCHQ acted unlawfully and violated our rights. That their activities are now deemed lawful is thanks only to the degree of disclosure Liberty and the other claimants were able to force from our secrecy-obsessed government.
“But the intelligence services retain a largely unfettered power to rifle through millions of people’s private communications - and the tribunal believes the limited safeguards revealed during last year’s legal proceedings are an adequate protection of our privacy. We disagree, and will be taking our fight to the European court of human rights.”
However, a GCHQ spokesperson contested the significance of the latest ruling, saying: “We are pleased that the court has once again ruled that the UK’s bulk interception regime is fully lawful. It follows the court’s clear rejection of accusations of ‘mass surveillance’ in their December judgment.”
The agencies make a distinction between intrusive “mass surveillance”, which they insist they do not undertake, and “bulk interception” of electronic communications, which they say is necessary in order to carry out targeted searches of data in pursuit of terrorist or criminal activity.
The GCHQ statement continued: “Today’s IPT ruling reaffirms that the processes and safeguards within the intelligence-sharing regime were fully adequate at all times - it is simply about the amount of detail about those processes and safeguards that needed to be in the public domain. We welcome the important role the IPT has played in ensuring that the public regime is sufficiently detailed.
GCHQ’s work must remain secret
“By its nature, much of GCHQ’s work must remain secret. But we are working with the rest of government to improve public understanding about what we do and the strong legal and policy framework that underpins all our work. We continue to do what we can to place information safely into the public domain that can help to achieve this.”
The UK government issued a robust defence of GCHQ on Friday and said the judgment would not alter in any way the work of the monitoring agency. The prime minister’s spokeswoman said: “Overall, the judgment this morning is that the UK’s interception regime is fully lawful. That follows on from the courts clear rejection of accusations of mass surveillance in their December judgment and we welcome that.
“Because of the nature of their work, we are unable to express gratitude to them [the security services] and we should make sure they continue to have the powers they need to keep us safe.
“What they [the tribunal] said was that there should be more about the rules [governing surveillance] that should be disclosed publicly … They are not questioning in this judgment that the safeguarding of privacy was in any way jeopardised and the judgment will not require GCHQ to change in anyway what it does,” she said.
During hearings at the IPT last year, Matthew Ryder QC, for Liberty, had alleged that the intelligence services were constructing vast databases out of accumulated interceptions of emails.
Ben Jaffey, for Privacy International, had claimed that the Regulation of Investigatory Powers Act (Ripa) was no longer providing the significant safeguards it once guaranteed against interception of communications without an individual warrant.
The legal challenge was the first of dozens of GCHQ-related claims to be examined in detail by the IPT, which hears complaints against British intelligence agencies and government bodies that carry out surveillance under Ripa. Some of the most sensitive evidence about interceptions was heard in private sessions from which the rights groups were excluded.
In defence documents that were released, the government's most senior security official, Charles Farr, explained how searches on Google, Facebook, Twitter and YouTube, as well as emails to or from non-British citizens abroad, could be monitored legally by the security services without obtaining an individual warrant because they were deemed to be external communications.
Farr said he could neither confirm nor deny the existence of Tempora, another interception programme revealed by the Guardian from the Snowden documents, although he did acknowledge that Prism exists “because it has been expressly avowed by the executive branch of the US government”.
Much of the tribunal’s deliberations therefore proceeded on the basis of agreed hypothetical facts, such as the assumption that Tempora exists. Lawyers for the government refused again, during a short hearing after the judgment, to say whether Tempora exists.
The Guardian