Rights groups have promised to challenge a ruling by the Investigatory Powers Tribunal approving GCHQ hacking as lawful.
The case – brought by Privacy International and several ISPs – was the first legal challenge to GCHQ’s state-sponsored hacking, during the course of which the spy agency admitted for the first time that it does engage in computer network exploitation.
In a lengthy response, Privacy International explained its beef with the ruling:
“The IPT condoned GCHQ’s use of a broad legal basis – the power to interfere with ‘property’ under section 5 of the Intelligence Services Act 1994 (‘ISA’) – to authorise hacking. It then concluded that adequate safeguards existed to prevent abuses of that power. But the IPT refused to rule on whether GCHQ’s use of an even broader power under ISA section 7 – authorising any unlawful acts committed abroad – complies with the European Convention on Human Rights. That refusal represents a startling departure from its approach in our separate case challenging mass surveillance and intelligence sharing with the NSA, which assessed the legality of both regimes in light of the ECHR.
ECHR Articles 8 and 10 require that any interference with the fundamental rights to privacy and freedom of expression be ‘prescribed by law’. Before these proceedings, nothing at all was known about any rules or safeguards governing GCHQ hacking. Over the course of the proceedings, the government scrambled to articulate such a regime. On the day the government served its Response to our complaint, it also released a draft Code of Practice purporting to govern GCHQ hacking. At the same time, the government asserted that bare bones authorisation contained in the ISA demonstrated compliance with the ECHR, an argument accepted by the IPT despite the government’s sudden unveiling of the draft Code.”
The tribunal also accepted the government’s position that it is legal for GCHQ to serve “thematic warrants” when planning a new surveillance campaign.
These warrants are so generic they could apparently cover “any class of property, persons or conduct” such as "all mobile phones in London."
“English law has rejected such warrants as unlawful for hundreds of years. As a matter of fundamental constitutional law, parliament is presumed not to have overridden such bedrock principles unless it uses clear and express language, which it did not in the ISA,” argued Privacy International.
“In effect, the IPT said that the principle of legality – that parliament must speak with deliberate intent when overturning a fundamental right – does not apply to the Security and Intelligence services.”
The rights group says it will challenge the tribunal’s findings. It’s possible it may have some success at a European level, given that GCHQ’s actions could conflict with the European Convention on Human Rights.
Ironically the surveillance powers of GCHQ and the other intelligence services are now being debated by parliament, as the government seeks to pass the Investigatory Powers Bill.
That was given a knock last week when the influential Intelligence and Security Committee became the third cross-party parliamentary body in 10 days to highlight serious concerns about the proposed legislation.
“Despite reams of evidence from the Home Office, the Committee finds the case for unprecedented powers to bulk hack, intercept and collect our private data has not been made,” said human rights group Liberty in response.
“The government needs to pause, take stock and redraft – to do anything else would show astonishing contempt for parliamentarians’ concerns and our national security.”