Court says GCHQ spied on human rights NGOs, acted unlawfully
The Investigatory Powers Tribunal (IPT) today revealed that the UK Government Communications Headquarters (GCHQ) spied on two international human rights organisations, failed to follow ITS own secret procedures and acted unlawfully.
The targeted NGOs are the South African Legal Resources Centre (LRC) and the Egyptian Initiative for Personal Rights (EIPR). Both are leading civil liberties organisations and co-claimants alongside Privacy International, Liberty, Amnesty International, Bytes For All and several other human rights organisations in a legal challenge brought against GCHQ in the wake of the Edward Snowden revelations.
GCHQ's mass surveillance systems violated the NGOs' fundamental rights in two separate ways, according to the IPT. In the first instance, EIPR's communications were intercepted, accessed and then unlawfully "retained for materially longer than permitted". In the second, LRC's communications were intercepted, then unlawfully selected for examination in contravention of GCHQ's secret procedures that were "not followed in this case".
Astonishingly, the tribunal did not find that GCHQ's interception of the NGOs' communications was itself unlawful. Instead, it was GCHQ's failure to follow their own secret procedures that resulted in the unlawful conduct.
This is the third judgement criticising GCHQ in recent months and follows an earlier decision in February this year that all intelligence sharing from the US National Security Agency (NSA) to GCHQ prior to December 2014 was unlawful. In addition, in the Libyan politician Abdul-Hakim Belhaj's case, the IPT held that GCHQ's safeguards to protect lawyer-client communications were inadequate. Despite these continuing problems, the IPT described the violations revealed today as "technical" breaches that resulted from GCHQ "overlook[ing]" its own policies.
Many aspects of today's decision remain unclear. Due to concerns about national security, more detail about why it was deemed necessary and proportionate to spy on the civil liberties organisations were not made public. Likewise, further detail surrounding the errors made by GCHQ, including what caused them or whether they have been fixed, remain secret.
Eric King, Deputy Director of Privacy International, said:
"If spying on human rights NGOs isn't off-limits for GCHQ, then what is? Clearly our spy agencies have lost their way. For too long they've been trusted with too much power, and too few rules for them to protect against abuse. How many more problems with GCHQ's secret procedures have to be revealed for them to be brought under control?
Mass, suspicionless surveillance can never be justified. Secret internal safeguards were always a poor fix for a bigger problem, and today's judgment shows that plain as day. If GCHQ cannot follow their own internal guidelines, why should they be trusted with some of the most intimate details of our lives?
Make no mistake, these internal failures will not be limited to just these instances. Trying to pass off such failings as 'technical', or significant changes in law as mere 'clarifications', has become a tiring defence for those who know the jig is up. The courts are helping to ensure that the sun is slowly setting on GCHQ's Wild West ways. Now we need Parliament to step in to fix what should have been fixed a long time ago."
Shahzad Ahmad, Country Director of Bytes for All, Pakistan, said:
"The IPT's latest ruling is yet another reminder that legal justice mechanisms are a useful way of understanding how impunity thrives within different layers of the government's security apparatus. These varying forms of impunity can range from internal laws to practice, often masked under the hood of national security.
It is unfortunate that countries such as the UK, which supposedly set standards for the rest of the world to follow, often let their political insecurities prey on fundamental human rights causing exponential damage.
If positive change is to be brought about, it is important to understand that no matter what the ruling, utilising the rule of law to uncover injustice embedded within legal systems is a crucial process for paving the parliament's way towards making necessary amends for restoring human rights in the future.”
====
FAQ
=====
#What does the judgment say?
GCHQ spied on two human rights NGOs, the South African Legal Resources Centre (LRC) and and the Egyptian Initiative for Personal Rights (EIPR). GCHQ intercepted their communications, and accessed them or selected them for examination, but errors were made, resulting in communications being held for longer than they should, or selected for examination in breach of GCHQ's internal guidelines.
#What is its significance?
This judgment reveals internal errors in GCHQ’s systems that resulted in unlawful conduct. The manner of the breaches suggests that it won’t just have effected the claimants in this case, but a wider range of groups and individuals. At a time when people are trying to assess the level of accountability our spy agencies need, this case suggests the problems are worse than many feared, with the agency not even able to follow its own internal guidelines.
#Why does GCHQ think it's ok to spy on human rights NGOs?
That is really a question for GCHQ. Importantly, the NGOs' communications were not just caught up in the GCHQ dragnet, but specifically targeted by the agency. It suggests that there are few lines GCHQ isn’t willing to cross.
#Why was there 'no determination' found as to eight of the claimants if mass surveillance is occurring?
The IPT is only required to reveal if a claimant has been the subject of surveillance if it concludes that surveillance was unlawful. By making "no determination" as to Privacy International, the IPT is not saying Privacy International has not been under surveillance, but only that the IPT determined such surveillance to be lawful, if it occurred. Given GCHQ's mass interception programmes, such as TEMPORA, and its access to information collected in bulk by the NSA, we think it is highly likely Privacy International's communications were in GCHQ's possession, but that the IPT felt that was lawful. The same applies to all of the other claimants in the action to which "no determination" was made.
#How would GCHQ have intercepted the NGOs' communications?
One of the first and largest surveillance programmes revealed by Edward Snowden was TEMPORA, which potentially gives GCHQ access to 21 petabytes of internet communications a day. Operating primarily out of Cornwall, TEMPORA includes the first “fulltake” internet fibre-optic cable interception site in the world and claims to provide the single “biggest internet access” enjoyed by any intelligence agency worldwide. In a presentation to GCHQ analysts, TEMPORA's intake was describe simply as "a massive amount of data".
#Have their been prior judgments on this case?
Yes. Confusingly, there have already been two judgements as part of this case, addressing different aspects of the challenge.
In its 5 December 2014 ruling, the IPT held that UK security services may in principle carry out mass surveillance of all fibre optic cables entering or leaving the UK, and that GCHQ's intelligence sharing with the NSA is lawful because of the IPT's release of summaries of formerly secret policies governing that sharing.
In its 6 February 2015 ruling, the IPT found that British intelligence services acted unlawfully prior to the court’s December ruling in accessing millions of people’s communications collected by the NSA.
Privacy International and the other claimants have already appealed these judgments to the European Court of Human Rights.
#What else is being done?
Privacy International has two other separate cases pending in the IPT. The first challenges GCHQ's widespread hacking, and is based on two complaints filed on behalf of Privacy International and seven internet service and communications providers from around the world. The second objects to GCHQ's bulk domestic spying.
Privacy International is also part of the Don't Spy On Us Coalition, campaigning for surveillance reform in the UK.
#What's next for the case?
Today’s judgment is the final one in the UK courts, but the case has already been appealed to the European Court of Human Rights on the points of law that we felt were unjust. Courts can take a while, so it’s likely we won't have a hearing and final judgment until 2016. However we have a number of other cases being run in the UK courts.Please visit our website for more information.
Privacy International is a small charity and we rely on generous support from funders and individuals so that we are able to hold intelligence agencies like GCHQ to account. You can donate to us by clicking here.