Privacy International, HMRC to go to trial over agency's refusal to reveal state of any investigation into Gamma International
After challenging HMRC's blanket refusal to release information about the potentially unlawful export of Gamma International's FinFisher surveillance technology, the court has said that the case should proceed to trial and the grounds of Privacy International's challenge are of public importance.
Privacy International in February filed for judicial review of a decision of HMRC, the body responsible for enforcing export regulations, claiming the department is acting unlawfully in its refusal to provide any details regarding any investigation into Gamma’s export practices. By granting permission to proceed, the court has said that Privacy International's grounds are regarded as both arguable and raising points of public importance, in particular the points raised regarding HMRC's power to disclose information about investigations. The reference to public importance is of note, given that the court does not frequently include such wording.
Despite the fact that HMRC frequently publishes press releases on investigations, the law enforcement department continues to state that it is prohibited from disclosing information about any activities relating to the potentially illegal exports of British surveillance technology by Gamma International. Other law enforcement agencies are not only permitted to keep victims updated on the progress of an investigation, but have an obligation to do so on the basis of the Code of Practice for Victims of Crime.
Eric King, Head of Research at Privacy International, said:
We welcome the court's decision, and look forward to asking the court to force HMRC to make a fresh decision and disclose what steps, if any, they are taking to hold surveillance companies to account for potentially illegal exports. The public, especially victims targeted by this invasive surveillance, have a right to know what is being done."
The case will now proceed to trial, with hearings expected to likely take place early next year.
Created by UK-based Gamma International, FinFisher products work by covertly installing software onto a target’s computers and mobile phone without their knowledge, usually by tricking the user into thinking they are opening an attachment or downloading fake updates from seemingly legitimate sources like Apple or Adobe. Once the user installs the software, victims' computers and mobile devices can be taken over, the cameras and microphones remotely switched on, emails, instant messengers and voice calls (including Skype) monitored, and locations tracked. Investigations have revealed that such technology has been used in monitoring and tracking victims who are subsequently subjected to torturous interrogations.
Gamma’s surveillance technology, FinFisher, has been found in at least 36 countries according to the latest Citizen Lab report, including Bahrain, Egypt, Turkmenistan, and other repressive regimes with a history of human rights abuses. This is part of a growing global trend, where human rights defenders, political dissidents and other vulnerable groups around the world are being targeted by increasingly sophisticated state surveillance, much of it supplied by British companies like Gamma International.
In November 2012, Privacy International provided HMRC with evidence regarding the potential unlawful export by Gamma International of their surveillance technology, FinFisher to Bahrain. On behalf of victims who had been targeted by Gamma's FinFisher, we asked for an urgent investigation. Having received no response, Privacy International wrote again on 21st December 2012 on behalf of Dr Ala'a Shehabi, a British born Bahraini pro-democracy activist whose computer had been targeted by the Bahrain authorities using technology exported by Gamma International. After having repeatedly asked HMRC if it had in fact started an investigation, HMRC responded that it is statutorily barred from releasing information to victims or complainants and refused to provide any details. It is this decision to refuse to provide both Privacy International and the victims with an update that is being judicially reviewed.