GCHQ-NSA intelligence sharing unlawful, says UK surveillance tribunal

British intelligence services acted unlawfully in accessing millions of people’s personal communications collected by the NSA, the Investigatory Powers Tribunal ruled today. The decision marks the first time that the Tribunal, the only UK court empowered to oversee GHCQ, MI5 and MI6, has ever ruled against the intelligence and security services in its 15 year history.

The Tribunal declared that intelligence sharing between the United States and the United Kingdom was unlawful prior to December 2014, because the rules governing the UK’s access to the NSA’s PRISM and UPSTREAM programmes were secret. It was only due to revelations made during the course of this case, which relied almost entirely on documents disclosed by NSA whistleblower Edward Snowden, that the intelligence sharing relationship became subject to public scrutiny.

The claimants in the case are Privacy International, Bytes for All, Liberty, and Amnesty International.

In a previous December 2014 ruling, the IPT held that GCHQ’s access to NSA data was lawful from that time onward because certain of the secret policies governing the US-UK intelligence relationship were made public during Privacy International’s case against the security services. Yet that belated disclosure could not remedy the lack of transparency regarding the UK-US sharing prior to December 2014, meaning that all UK access to NSA intelligence material was unlawful before the Court’s judgement. 

In light of today’s ruling, Privacy International and Bytes for All will now ask the court to confirm whether their communications were unlawfully collected prior to December 2014 and, if so, demand their immediate deletion.

While we welcome today’s decision, Privacy International and Bytes for All disagree with the tribunal’s earlier conclusion that the forced disclosure of a limited subset of rules governing intelligence-sharing and mass surveillance is sufficient to make GCHQ’s activities lawful as of December 2014. Both organisations will shortly lodge an application with the European Court of Human Rights challenging the tribunal’s December 2014 decision.

While that appeal is pending, GCHQ will retain unfettered access to this material intercepted by the NSA. The two agencies by default share intelligence gleaned from PRISM and UPSTREAM, sometimes with few or no safeguards. Secret policies divulged during Privacy International’s case revealed that British intelligence services can request or receive access to bulk data from foreign agencies like the NSA without a warrant whenever it would "not be technically feasible" for the government to obtain it themselves. 

PRISM and UPSTREAM, which have been in existence for nearly a decade, were made public in June 2013 by NSA whistleblower Edward Snowden. Through PRISM, the NSA has gained access to the data and content handled by some of the world’s largest Internet companies, including Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube and Apple. With UPSTREAM, the NSA intercepts bulk data via fibre optic cables that carry the world’s communications. The scope of this surveillance is unprecedented.  For instance, the top five programmes within UPSTREAM created 160 billion interception records in one month. In one day, the NSA was able to collect 444,743 e-mail address books from Yahoo, 105,068 from Hotmail, 82,857 from Facebook, 33,697 from Gmail and 22,881 from unspecified other providers.

Eric King, Deputy Director of Privacy International, said:

"For far too long, intelligence agencies like GCHQ and NSA have acted like they are above the law. Today’s decision confirms to the public what many have said all along — over the past decade, GCHQ and the NSA have been engaged in an illegal mass surveillance sharing program that has affected millions of people around the world. 

We must not allow agencies to continue justifying mass surveillance programs using secret interpretations of secret laws. The world owes Edward Snowden a great debt for blowing the whistle, and today's decision is a vindication of his actions.

But more work needs to be done. The only reason why the NSA-GCHQ sharing relationship is still legal today is because of a last-minute clean-up effort by Government to release previously secret “arrangements”. That is plainly not enough to fix what remains a massive loophole in the law, and we hope that the European Court decides to rule in favour of privacy rather than unchecked State power."

Shahzad Ahmad, Country Director, Bytes for All, Pakistan, said:

"IPT's pro-people decision sets a wonderful precedent for future rulings not only for UK courts, but also for developing countries like Pakistan which look up to developed countries for policy-making. The ruling also proves that no authority, including the military and intelligence, is beyond the purview of law, and in countries where this is not the case, the scope of law needs to be improved."

Mark Scott of Bhatt Murphy Solicitors said:

“Had Edward Snowden not made his disclosures and had our clients not pursued this litigation we can only wonder whether the security services would ever have disclosed their mass surveillance operations. However, this is only a partial victory and the litigation must now proceed to the European Court.”

James Welch, Legal Director for Liberty, said:

“We now know that, by keeping the public in the dark about their secret dealings with the National Security Agency, GCHQ acted unlawfully and violated our rights. That their activities are now deemed lawful is thanks only to the degree of disclosure Liberty and the other claimants were able to force from our secrecy-obsessed Government.

But the Intelligence Services retain a largely unfettered power to rifle through millions of people’s private communications – and the Tribunal believes the limited safeguards revealed during last year’s legal proceedings are an adequate protection of our privacy. We disagree, and will be taking our fight to the European Court of Human Rights.”

Timeline of PRISM and TEMPORA disclosures

6 June 2013: Washington Post and Guardian reveal PRISM

21st June 2013: Guardian reports on TEMPORA

8th July 2013: Privacy International files legal challenge against UK government over mass surveillance programmes

9th January 2014: Pakistan based partner organisation, Bytes for All for all joins legal challange

14th February 2014: Directions hearing to agree issues to be decided takes place

16th June 2014: GCHQ forced to reveal secret policy for mass surveillance of residents’ Facebook and Google use

13th July 2014: Week-long hearing considering the legal regime of TEMPORA and NSA intelligence sharing begins 

28th October 2014: Secret policy reveals GCHQ can get warrantless access to bulk NSA data

5th December 2014: IPT decides Tempora, and as of 5th Dec, intelligence sharing between NSA and GCHQ is in principle lawful.