British intelligence services acted unlawfully in accessing millions of people’s personal communications collected by the NSA, the Investigatory Powers Tribunal ruled today. The decision marks the first time that the Tribunal, the only UK court empowered to oversee GHCQ, MI5 and MI6, has ever ruled against the intelligence and security services in its 15 year history.
The Tribunal declared that intelligence sharing between the United States and the United Kingdom was unlawful prior to December 2014, because the rules governing the UK’s access to the NSA’s PRISM and UPSTREAM programmes were secret. It was only due to revelations made during the course of this case,which relied almost entirely on documents disclosed by NSA whistle-blower Edward Snowden, that the intelligence sharing relationship became subject to public scrutiny.
The claimants in the case are Privacy International, Bytes for All, Liberty, and Amnesty International.
In a previous December 2014 ruling, the IPT held that GCHQ’s access to NSA data was lawful from that time onward because certain of the secret policies governing the US-UK intelligence relationship were made public during Privacy International’s case against the security services. Yet that belated disclosure could not remedy the lack of transparency regarding the UK-US sharing prior to December 2014, meaning that all UK access to NSA intelligence material was unlawful before the Court’s judgement.
In light of today’s ruling, Privacy International and Bytes for All will now ask the court to confirm whether their communications were unlawfully collected prior to December 2014 and, if so, demand their immediate deletion.
While we welcome today’s decision, Privacy International and Bytes for All disagree with the tribunal’s earlier conclusion that the forced disclosure of a limited subset of rules governing intelligence-sharing and mass surveillance is sufficient to make GCHQ’s activities lawful as of December 2014. Both organisations will shortly lodge an application with the European Court of Human Rights challenging the tribunal’s December 2014 decision.
While that appeal is pending, GCHQ will retain unfettered access to this material intercepted by the NSA. The two agencies by default share intelligence gleaned from PRISM and UPSTREAM, sometimes with few or no safeguards. Secret policies divulged during Privacy International’s case revealed that British intelligence services can request or receive access to bulk data from foreign agencies like the NSA without a warrant whenever it would “not be technically feasible” for the government to obtain it themselves.
PRISM and UPSTREAM, which have been in existence for nearly a decade, were made public in June 2013 by NSA whistle-blower Edward Snowden. Through PRISM, the NSA has gained access to the data and content handled by some of the world’s largest Internet companies, including Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube and Apple.
With UPSTREAM, the NSA intercepts bulk data via fibre optic cables that carry the world’s communications. The scope of this surveillance is unprecedented. For instance, the top five programmes within UPSTREAM created 160 billion interception records in one month. In one day, the NSA was able to collect 444,743 e-mail address books from Yahoo, 105,068 from Hotmail, 82,857 from Facebook, 33,697 from Gmail and 22,881 from unspecified other providers.
Eric King, Deputy Director of Privacy International, said:
“For far too long, intelligence agencies like GCHQ and NSA have acted like they are above the law. Today’s decision confirms to the public what many have said all along, over the past decade, GCHQ and the NSA have been engaged in an illegal mass surveillance sharing program that has affected millions of people around the world.
We must not allow agencies to continue justifying mass surveillance programs using secret interpretations of secret laws. The world owes Edward Snowden a great debt for blowing the whistle, and today’s decision is a vindication of his actions.
But more work needs to be done. The only reason why the NSA-GCHQ sharing relationship is still legal today is because of a last-minute clean-up effort by Government to release previously secret “arrangements”. That is plainly not enough to fix what remains a massive loophole in the law, and we hope that the European Court decides to rule in favour of privacy rather than unchecked State power.”
James Welch, Legal Director for Liberty, said:
“We now know that, by keeping the public in the dark about their secret dealings with the National Security Agency, GCHQ acted unlawfully and violated our rights. That their activities are now deemed lawful is thanks only to the degree of disclosure Liberty and the other claimants were able to force from our secrecy-obsessed Government.
But the Intelligence Services retain a largely unfettered power to rifle through millions of people’s private communications – and the Tribunal believes the limited safeguards revealed during last year’s legal proceedings are an adequate protection of our privacy. We disagree, and will be taking our fight to the European Court of Human Rights.”
