British Spy Agency GCHQ's Oversight Has Technical Blind Spots
A new report released today by the Royal United Services Institute (RUSI) highlights key technical blind spots in current GCHQ oversight and calls for a new, comprehensive and clear legal framework governing British intelligence agencies' surveillance capability.
The report panel, which included three former British intelligence chiefs, sets out clear deficiencies in the existing technical oversight regime, explaining current oversight "does not check the code [that underlies GCHQ’s interception capabilities], nor does it have the capacity to do so". The Interception Commissioner has previously signalled in annual reports that the office would "benefit from more resources and expertise in some key areas, such as technical and legal" and that existing inspection and audit mechanisms for GCHQ "need further thought”. GCHQ's mass surveillance systems rely heavily on computer automation and processing to crunch the large numbers of private communications that it collects. When GCHQ’s processing goes wrong, it results in "large volumes of material erroneously collected". Adequate technical oversight is necessary to prevent this from happening.
An overhaul of existing legal frameworks for interception is recommended by the RUSI panel who state that "antiquated laws will neither keep the public safe nor ensure privacy”, and that that the present legal framework is “unclear, has not kept pace with the developments in communications technology and does not serve either the government or members of the public satisfactorily".
The report criticises the Investigatory Powers Tribunal (IPT) for making a "significant error" following the revelation that the tribunal had failed to correctly identify Amnesty International, instead of the Egyptian Initiative for Personal Rights, as being the victim of unlawful surveillance. The IPT issued an incorrect judgement, only correcting it ten days later. The report panel suggests identifying errors in this reactive, rather than pro-active way is a "systematic weakness" of our current oversight arrangement. As a partial solution, the report recommends allowing the commissioners who oversee the intelligence services to refer errors to the IPT for consideration.
Many of the conclusions from David Anderson QC in his report, A Question of Trust, were supported by the RUSI panel. This includes reform of the myriad pieces of legislation currently in place that make up the powers of the security and intelligence service, the need for judicial authorisation, and an overhaul of oversight and the IPT.
While the report takes a strong stand in favour of transparency, it fails to provide additional insight into the justifications for controversial surveillance powers such as bulk interception. This is yet another lost opportunity to engage in a crucial assessment of the validity of these powers as new legislation is being considered.
Eric King, Deputy Director of Privacy International said:
The RUSI report, from start to end, emphasises how technological change has rendered the current legal system governing surveillance obsolete. Every day, the highly technical GCHQ finds new ways to eavesdrop, while our oversight tries to cope with technical blind spots.
It should be obvious that the most technologically advanced government agency, with the most intrusive powers, would require oversight bodies to have the independent technical chops to match. Yet today, our oversight relies on technical errors to be self-reported by GCHQ itself.
Fundamentally, our safeguards against abuse will not be effective when the core technical activities of GCHQ cannot be kept in check by equally technically-equipped overseers. While recent efforts by the Interception Commissioner have been made, they are essentially trying to make the best of what is an impossible situation.
While we applaud such efforts to navigate this problem, this is a gaping structural deficiency, plain as day, that needs to be fixed. A better resourced, more technically-equipped oversight body who can take GCHQ to task should be a priority in the coming discussion of reform.
The RUSI panel's call for Judges rather than Ministers to sign warrants and an overhaul of the Investigatory Powers Tribunal should be the baseline for new legislative proposals. No matter how you look at it, root and branch reform is needed to bring our spy agencies under democratic control. Three reports in a matter of months have said as much, now it's up to the government to do something about it.