UK Surveillance Oversight Board Says It's All Cool When GCHQ Hacks Basically Anyone

from the hack-away,-snoops dept

This isn't a huge surprise, but the UK's Investigatory Powers Tribunal -- which is a sort of extremely weak "oversight" board, charged with making sure that the GCHQ isn't violating the law, but with no real powers over GCHQ and a history of supporting its spying, has now said that the GCHQ's hacking of computers, networks and phones is perfectly fine.

This was in response to a challenge mounted by Privacy International. The IPT was not too concerned about GCHQ spying, and even said that it's fine even without naming specific targets:

Ruling says GCHQ hacking warrants need not name specific individuals - means OK to hack entire orgs/govts/companies: pic.twitter.com/HByqNOVq1l

— Ryan Gallagher (@rj_gallagher) February 12, 2016

As Privacy International has said in response, this appears to completely wipe out the idea that "general warrants" (i.e., not against named individuals/targets) are (and have been) unlawful:

“The IPT has decided that GCHQ can use ‘thematic warrants’, which means GCHQ can hack an entire class of property or persons, such as ‘all phones in Birmingham’.

“In doing so, it has upended a longstanding English common law principle that such general warrants are unlawful. Allowing governments to hack places the security and stability of the internet and the information we exchange on it at stake.”

This is an unfortunate decision, if not that surprising. But yet another reminder that perhaps the UK is a dangerous place for technology firms to do business these days.

Filed Under: gchq, general warrants, hacking, investigatory powers tribunal, ipt, mass surveillance, spying, surveillance, uk

Amnesty International Told That GCHQ Spied On Its Communications

from the because-of-course-it-did dept

Amnesty International has been heavily engaged in fights against mass surveillance, recognizing that many of the people it communicates with need an expectation of privacy in their communications with the group. Last year, Ed Snowden revealed that the NSA specifically spied on Amnesty International and other human rights organizations. And, while Amnesty International was unable to gain standing by the US Supreme Court, since it couldn't prove that the NSA had spied on its communications, the story appears to be somewhat different over in the UK.

Last year a legal challenge was filed in the UK via the Investigatory Powers Tribunal (IPT) concerning Amnesty International. And now, the group has been informed that, yes, it was spied on by GCHQ in the UK.

In a shocking revelation, the UK’s Investigatory Powers Tribunal (IPT) today notified Amnesty International that UK government agencies had spied on the organization by intercepting, accessing and storing its communications.

In an email sent today, the Tribunal informed Amnesty International its 22 June ruling had mistakenly identified one of two NGOs which it found had been subjected to unlawful surveillance by the UK government. Today’s communication makes clear that it was actually Amnesty International Ltd, and not the Egyptian Initiative for Personal Rights (EIPR) that was spied on in addition to the Legal Resources Centre in South Africa.

As you may recall, a little over a week ago, the IPT had ruled that the GCHQ had erred in holding onto emails too long -- but had named that Egyptian organization as the one whose emails were held. However, that's now been corrected to Amnesty International.

The actual email sent by the IPT basically says that GCHQ told them that the IPT made a mistake. What you won't see anywhere is an apology from GCHQ. Amnesty is rightfully incensed about the whole thing:

“How can we be expected to carry out our crucial work around the world if human rights defenders and victims of abuses can now credibly believe their confidential correspondence with us is likely to end up in the hands of governments?

“The revelation that the UK government has been spying on Amnesty International highlights the gross inadequacies in the UK’s surveillance legislation. If they hadn’t stored our communications for longer than they were allowed to by internal guidelines, we would never even have known. What’s worse, this would have been considered perfectly lawful.”

Both issues raised here are significant. The only reason Amnesty now knows about this is because GCHQ held onto the emails too long. If it had done its usual purge, then the IPT likely would never have revealed that, and Amnesty's communications would have continued to go on being compromised without anyone knowing.

Filed Under: amnesty international, gchq, ipt, secrecy, surveillance, uk
Companies: amnesty international

GCHQ Dinged For Illegally Holding Onto Human Rights Groups Emails Too Long, Not For Collecting Them In The First Place

from the that's-not-right dept

Following on a ruling nearly two months ago, where the UK's Investigatory Powers Tribunal -- for the very first time -- found that GCHQ had broken the law with its surveillance of client/attorney communications, now the IPT has ruled against GCHQ again. The IPT says that GCHQ held emails of human rights activists for too long -- but found that the initial collection of those emails was no problem at all.

In respect of the Third Claimant (The Egyptian Initiative for Personal Rights), the Tribunal has found that email communications of the Third Claimant were lawfully and proportionately intercepted and accessed, pursuant to s.8(4) of RIPA. However, the time limit for retention permitted under the internal policies of GCHQ, the intercepting agency, was overlooked in regard to the product of that interception, such that it was retained for materially longer than permitted under those policies.

So, no problem spying on human rights organizations -- just make sure you delete the emails within the allotted timeframe. And, of course, the court concludes that this is a pretty minor violation, given that there's no evidence anyone actually looked at the data after they should have destroyed it:

We are satisfied however that the product was not accessed after the expiry of the relevant retention time limit, and the breach can thus be characterised as technical...

Still, it notes, even a technical breach is a breach and thus slaps GCHQ on the wrist. This seems like pretty weak sauce all around, but at the very least, the IPT is finally recognizing that GCHQ isn't following the law at times. It's not nearly enough, and the level of oversight is laughable. And, of course, none of these breaches, technical or otherwise, likely would have come to light at all without Ed Snowden.

Filed Under: emails, gchq, human rights, investigatory powers tribunal, ipt, privacy

UK Tribunal Rules GCHQ Conducted Illegal Surveillance And Must Destroy Legally Privileged Documents

from the unlawful,-unnecessary-and-disproportionate dept

A couple of months ago, we reported on a surprising admission by the UK government that GCHQ has been carrying out illegal surveillance by monitoring privileged conversations between lawyers and their clients. As we noted at the time, the reason for this sudden access of conscience was simply that it knew it was going to lose an imminent case before the Investigatory Powers Tribunal (IPT), the body that considers complaints about UK government surveillance. And that, indeed, is what has just happened. As the human rights organization Reprieve, which helped bring the legal action, explains, not only has GCHQ been found guilty of illegal spying, it has also been ordered to destroy the materials it collected as a result:

Today's decision marks the first time in the IPT's fifteen-year history that it has upheld a complaint against the security services. It is also thought to be the first time the secretive tribunal has ordered an intelligence agency to give up surveillance material.

The Reprieve post has more details about the case, which involves Sami al-Saadi, a former opponent of Libya's Muammar Gaddafi. al-Saadi and his family were kidnapped in a joint MI6-CIA operation and 'rendered' to Libya in 2004, as was his colleague, the Libyan politician Abdul-Hakim Belhaj and his pregnant wife:

Both families have brought civil claims against the then-Foreign Secretary Jack Straw, former MI6 counter-terror head Sir Mark Allen, and the UK Government for their kidnap. The al-Saadi family settled their civil claim in December 2012 for 2.2 million pounds; the Belhaj claim comes before the [UK] Supreme Court this year. A Metropolitan Police investigation into both kidnappings, Operation Lydd, is thought to be near conclusion

Whatever happens with those cases, the latest IPT judgment is another important step in forcing the UK government to acknowledge that its mass surveillance programs broke the law in numerous ways. Moreover, as Richard Stein, the lawyer who represented the families before the Tribunal, pointed out:

Today marks the end of GCHQ's standard boilerplate response that its activities are lawful, necessary and proportionate. GCHQ unlawfully spied on privileged legal communications for years, and the secret oversight mechanisms failed to stop it.

That alone would be reason enough to celebrate this decision. But the IPT's ruling is unsatisfactory in other respects:

The IPT made 'no determination' in favor of Mr Belhaj and his wife. The IPT can make 'no determination' either if there was no spying, or if the IPT finds that spying did take place but was lawful. But the couple may never know the precise reasons for the decision.

That's an indication that still more must be done to bring greater transparency and accountability to the UK's surveillance programs. Fortunately, as the UK government continues to lose the fight against legal challenges to its activities, it is being forced to move in that direction, albeit very slowly.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: gchq, ipt, privacy, surveillance, uk

GCHQ Will Have To Start Letting Everyone Know Whether Or Not They've Been Illegally Spied On

from the suck-it,-spooks dept

Last December, the IPT (Investigatory Powers Tribunal) ruled that GCHQ's surveillance programs didn't violate human rights, despite being broad and untargeted dragnets. This ruling -- in response to several legal challenges brought in the wake of the Snowden leaks -- was unsurprising. The IPT has overwhelmingly supported GCHQ's spying efforts in the past, having only sided against it in one-half of one percent of the challenges brought against it.

The IPT's ongoing support of the UK's intelligence community is unsurprising. To declare any of its programs as illegal or in violation of citizens' rights would be to implicate itself for its near-constant approval of surveillance programs. That makes its February decision a bit of an aberration. In response to Privacy International's legal challenge, it changed course slightly, declaring certain elements of the GCHQ's spying efforts "illegal" -- specifically, information sharing with the NSA. But this was only a partial capitulation. The IPT went on to say that this was once illegal but now was not, thanks to its December 2014 ruling. In some bizarre way, the legal complaints brought against the GCHQ managed to legalize its once-illegal partnership with the NSA.

However, its February decision makes it clear that operations prior to December 2014 were illegal, and provides an opening for UK citizens to force a bit more transparency on their intelligence community.

Because the IPT found the intelligence sharing to be illegal, anyone, inside or outside the UK, can file a complaint to the IPT and ask if their communications were part of that illegal sharing, and be legally entitled to an answer. [Privacy International's Eric] King explained, “If they don’t find anything, it’s likely they respond ‘no determination’. If they do find something, the IPT is obliged to give a declaration to the individual that their communications were illegally interfered with.”

This is far more transparency than has been granted by the NSA, which still responds to similar inquiries about files on citizens (from those citizens themselves) with its omnipresent Glomar declaration, neither confirming nor denying the collected results of its domestic surveillance programs.

So, anyone in the world will be allowed to ask -- and receive an answer -- about being swept up in shared GCHQ-NSA dragnets, provided the query only involves shared data and occurred before the IPT's legalization of this partnership in December of last year. And there are even more restrictions. The data has to be something collected by the NSA and shared with the GCHQ, not vice versa, and must still be retained and accessible at the point the GCHQ receives the inquiry.

While there are many specifics limiting the public's involvement, there will be no specifics forthcoming from the UK's spy agencies.

Despite this apparent narrowness, the number of people that could get a yes could be in the hundreds of millions. However, The IPT will not reveal the granularity of information GCHQ kept on you. “People will never find out if it was their phone records that GCHQ had, or just a specific email,” said King, “They only answer they’ll get is a broad one of yes, GCHQ had data about you illegally from NSA.”

Privacy International will be funneling these requests in to the IPT via a submission form at its site. The selectors (email address, name, telephone number) will be handed over to the GCHQ to be used to search for matching, NSA-originated shared data. If found, requestors will be given their detail-free "yes" answer and the illegally-obtained data will be destroyed. It's not a huge step forward but it's a start.

What this will do, however, is open up the GCHQ to many more legal challenges -- something that may result in even further accountability and curtailing of its powers. Privacy International is basically creating a class action suit against the UK spy agency. It's not money the group is after, but more transparency. It hopes to force the GCHQ into revealing more details about its domestic surveillance and its partnership with the NSA.

Privacy International's Eric King admits this won't be an easy -- or short -- process. It's very likely the GCHQ will mount its own challenge against the IPT's decision, and will resort to its usual opacity and obfuscation to avoid giving members of the public the yes/no answer the tribunal has declared they're entitled to. (And losing the illegally-obtained data in the process...) But in terms of reactions to the Snowden leaks, this decision (potentially) demands more accountability from the UK's spy agency than all of the administration's weak NSA reforms combined.

Filed Under: gchq, ipt, nsa, surveillance, uk
Companies: privacy international

UK's Secretive Court Says Intelligence Sharing Between NSA And GCHQ Was Unlawful In The Past -- But Now It Isn't

from the power-of-transparency dept

Techdirt has written about the Investigatory Powers Tribunal (IPT), which reviews complaints about surveillance in the UK, a number of times, noting that in addition to being secretive, it is pretty toothless, and generally approves of everything that the UK's secret services get up to. Against that background, a ruling released today by the IPT is pretty surprising:

British intelligence services acted unlawfully in accessing millions of people's personal communications collected by the NSA, the Investigatory Powers Tribunal ruled today. The decision marks the first time that the Tribunal, the only UK court empowered to oversee GHCQ, MI5 and MI6, has ever ruled against the intelligence and security services in its 15 year history.

The Tribunal declared that intelligence sharing between the United States and the United Kingdom was unlawful prior to December 2014, because the rules governing the UK’s access to the NSA’s PRISM and UPSTREAM programmes were secret. It was only due to revelations made during the course of this case, which relied almost entirely on documents disclosed by NSA whistleblower Edward Snowden, that the intelligence sharing relationship became subject to public scrutiny.

As that explanation by Privacy International -- one of four claimants in this case -- mentions, the IPT found that sharing intelligence between the NSA and GCHQ was illegal, but now isn't. Here's why:

In a previous December 2014 ruling, the IPT held that GCHQ's access to NSA data was lawful from that time onward because certain of the secret policies governing the US-UK intelligence relationship were made public during Privacy International's case against the security services. Yet that belated disclosure could not remedy the lack of transparency regarding the UK-US sharing prior to December 2014, meaning that all UK access to NSA intelligence material was unlawful before the Court’s judgement.

Rather bizarrely, the complaint about GCHQ's illegal actions in the past has made subsequent actions legal, at least according to the IPT. Two of the claimants in the case now hope to build on this judgment by asking the IPT to confirm that communications were collected unlawfully before December 2014, and to demand their deletion. Parallel to that, they also intend to appeal against the ruling that since then, intelligence sharing between the NSA and GCHQ has been legal:

While we welcome today's decision, Privacy International and Bytes for All disagree with the tribunal's earlier conclusion that the forced disclosure of a limited subset of rules governing intelligence-sharing and mass surveillance is sufficient to make GCHQ's activities lawful as of December 2014. Both organisations will shortly lodge an application with the European Court of Human Rights challenging the tribunal's December 2014 decision.

So the battle to bring GCHQ's massive surveillance program under control, with proper safeguards for the public and meaningful oversight, continues. But at least a first victory has been gained from an unexpectedly helpful IPT.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data sharing, gchq, investigatory powers tribunal, ipt, nsa, privacy, surveillance, uk
Companies: privacy international

Secretive UK Court That Approves Of GCHQ Surveillance Says That GCHQ Surveillance Doesn't Violate Human Rights

from the because-to-say-otherwise-would-implicate-itself dept

For a while now, we've been covering various legal challenges in Europe related to the GCHQ's surveillance activities. One of the main cases, brought by Amnesty International and Privacy International, argued that the surveillance violated the European Convention on Human Rights (specifically article 8, on right to privacy, and article 10, on freedom of expression). While it was always expected that the case would eventually go to the European Court of Human Rights, the first step was the Investigatory Powers Tribunal in the UK -- a secretive court that reviews complaints about surveillance, but (as with nearly all "secretive courts" charged with "oversight" on the intelligence community) almost always sides with the intelligence community. Between 2000 and 2012 the IPT only sided against the intelligence community 10 times out of 1468 cases brought (about half of one percent of all cases). In other words, this is a court that (in secret) regularly okays GCHQ's surveillance efforts on UK citizens.

So take a wild guess what happened when it was asked to determine if such surveillance violated human rights? It said of course no human rights were violated when the GCHQ spied on people. This is not a surprise. Anything else would have been a surprise. To put it simply, if the IPT had ruled in favor of these groups, it would have been implicating itself, effectively admitting that its own approvals of GCHQ activity enabled the violation of human rights. And that wasn't going to happen. But that's not how surveillance state defenders are discussing this result:

A government security source told the BBC: "We are delighted that a third independent body has confirmed that GCHQ does not seek to carry out mass surveillance."

Independent body? Right. It's the "independent" body that has a history of saying the very actions now being scrutinized are perfectly fine. It may be "independent" of the GCHQ itself, but it's not "independent" of the surveillance GCHQ carried out.

The groups who brought this case say that they'll appeal to the European Court of Human Rights, which is what everyone expected to happen in the first place. This little rubber stamping by the IPT was just a procedural issue that had to be taken in the first place.

Filed Under: gchq, human rights, investigatory powers tribunal, ipt, surveillance, uk
Companies: amnesty international, privacy international

GCHQ Oversight Tribunal Has To Ask GCHQ's Permission To Reveal GCHQ's Wrongdoing

from the what-could-possibly-go-wrong? dept

One of the key themes to emerge in the debate about surveillance is the oversight of the agencies involved, and to what extent it is effective. In the US, that has been put into stark relief by news that the committee that is supposed to keep an eye on the spies was itself spied upon. And now over in the UK, we learn that things are just as bad when it comes to the equivalent oversight body, the Investigatory Powers Tribunal (IPT). Its powers sound impressive:

The Tribunal can investigate complaints about any alleged conduct by, or on behalf of, the Intelligence Services - the Security Service (sometimes called MI5), the Secret Intelligence Service (sometimes called MI6) and GCHQ (Government Communications Headquarters).

The scope of conduct the IPT can investigate concerning the Intelligence Agencies is much broader than it is with regard to the other public authorities. The IPT is the only Tribunal to whom complaints about the Intelligence Services can be directed

Unfortunately, the IPT's credibility as the public's watchdog for the intelligence services has just been seriously undermined by the following information published by The Guardian:

A controversial court that claims to be completely independent of the British government is secretly operating from a base within the Home Office, the Guardian has learned.

The Investigatory Powers Tribunal, which investigates complaints about the country's intelligence agencies, is also funded by the Home Office, and its staff includes at least one person believed to be a Home Office official previously engaged in intelligence-related work.

It gets worse:

the IPT will not say whether GCHQ had disclosed the existence of its bulk surveillance operations, which attempt to capture the digital communications of everybody -- including those people who complain to the tribunal.

Nor will it disclose whether it has issued any secret ruling on the lawfulness of those operations, on the grounds that the rules under which it operates stipulate that it cannot do so without the permission of GCHQ itself. It has not sought that permission on grounds it knows it would not be given.

So the body tasked with overseeing GCHQ has to get GCHQ's permission before it can reveal any wrongdoing by GCHQ, which it doesn't bother doing when it knows it would be refused. Isn't oversight a wonderful thing?

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: gchq, ipt, surveillance, uk

UK Government Refuses To Confirm Or Deny If Your Pronunciation Of Its Massive Surveillance Program 'Tempora' Is Correct

from the oh,-come-on,-stop-being-tiresome dept

A few weeks back, we reported that some digital rights groups were challenging GCHQ's spying at the UK's secretive Investigatory Powers Tribunal (IPT). As Wired UK reports, a first hearing has now taken place, dealing with preliminary matters before the main case in July. Here's one ridiculous problem that had to be addressed:

while the Prism programme has been officially acknowledged, the UK government will not acknowledge the existence of the operation named Tempora, as detailed in the documents released by Edward Snowden. Mr Justice Burton suggested that it might be wise to define the operation in other terms, so that it could be discussed as a factual hypothetical, rather than deal with the inevitable roadblocks that will consistently be encountered if it is called by its code name. Tempora, he said, could be referred to as the "fibre-optic interception programme" for presentational purposes.

This isn't the UK government being purely bloody-minded. By refusing to confirm or deny Tempora's existence, even though there are numerous leaked documents attesting to it, it is trying to persuade the IPT to hold a closed hearing, so as to stop the British public learning anything about what's really going on here. But as the Wired UK report reveals, it's taking this "neither confirm nor deny" policy to absurd lengths:

There was also some jovial discussion in the hearing over the pronunciation of Tempora and whether the emphasis should be on the "Tem" or the "por". When called on to advise as to whether they were pronouncing the code name correctly, government counsel could neither confirm nor deny.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: edward snowden, gchq, ipt, prism, privacy, surveillance, tempora, uk