Privacy International to challenge UK Government's use of general warrants to hack unspecified groups of people and computers

Privacy International, the leading global privacy rights NGO, has today filed a Judicial Review at the UK High Court, challenging the Investigatory Powers Tribunal's (IPT) decision that the Government can issue general hacking warrants. This decision means that British intelligence agency GCHQ can continue to hack into the computers and phones of broad classes of people - including those residing in the UK. The Investigatory Powers Bill, currently being debated in Parliament, seeks to further enshrine this power into law. Against that backdrop, the case we have filed today calls on the High Court to stop the practice of bulk hacking within the UK. 

Privacy International originally brought a complaint in the IPT against GCHQ hacking in May 2014. We were soon joined in our complaint by seven internet and communications providers from around the world. Our complaint argued that GCHQ had no authority under UK law to hack, and that such activities violated Articles 8 and 10 of the European Convention on Human Rights. Articles 8 and 10 respectively protect the rights to privacy and freedom of speech. The IPT rejected both these claims in February 2016.

In its decision, the IPT also accepted the Government's position that GCHQ was permitted to seek "thematic warrants", which are general warrants to hack inside and outside the UK. General warrants can cover an entire class of unidentified persons or property, such as "all mobile phones in Nottingham".

The IPT's decision fundamentally undermines 250 years of English common law, which has long rejected general warrants. The common law is clear that a warrant must target an identified individual or , or group of identified individuals. Parliament is presumed not to have overridden such a profound and fundamental right unless it clearly and expressly states that general warrants are now permissible - which it has not. 

In the US, the prohibition against general warrants has a similarly long history.  It is enshrined in the Fourth Amendment to the Bill of Rights, which explicitly states that "no warrants shall issue, but upon probable cause . . . and particularly describing the place to be searched, and the persons or things to be seized."

The IPT's decision also ignores that general warrants fail to comply with international human rights law, particularly Article 8 of the European Convention on Human Rights. By permitting the Government to hack large groups of people without judicial authorisation and individualised suspicion, general warrants fail to protect against arbitrary interference and abuse.

General hacking warrants are a dangerous and unprecedented expansion of state surveillance capabilities. The IPT has not only sanctioned state-sponsored hacking of individuals, but also permitted its use at an industrial scale.

Hacking is one of the most intrusive surveillance capabilities available to the Government and entails a serious interference with the right to privacy. Using hacking capabilities, the Government can log keystrokes, track locations, take covert photographs and videos, and access stored information. Hacking can also be used to corrupt files, plant or delete documents and data, or send fake communications from a device. These techniques can be mobilised against entire networks, comprising the devices of large groups of people.

Hacking also undermines the security of computers and the internet, especially when conducted on a large scale. Hacking is fundamentally designed to permit an unauthorised person to control another person's device. The security holes created by hacking can be exploited by many other people, including cyber-criminals and other governments' intelligence agencies.

This case has broader implications for the current debate around the Investigatory Powers Bill, which permits the UK Government to approve general warrants as part of its so-called "targeted" interception and hacking regimes. The inclusion of these warrants is directly contrary to the explicit recommendation of the Joint Committee on the Draft Investigatory Powers Bill, which recommended that both interception and hacking warrants not be "used as a way to issue thematic warrants concerning a very large number of people."

Scarlet Kim, Legal Officer at Privacy International said:

"The IPT's decision grants the Government carte blanche to hack hundreds or thousands of people's computers and phones with a single warrant. General warrants permit GCHQ to target an entire class of persons or property without proving to a judge that each person affected is suspected of a crime or a threat to national security. By sanctioning this power, the IPT has upended 250 years of common law that makes clear such warrants are unlawful. Combined with the power to hack, these warrants represent an extraordinary expansion of state surveillance capabilities with alarming consequences for the security of our devices and the internet."