High Court slams HMRC for unlawful concealing of information surrounding export of spyware FinFisher
In a damning judgment today the Administrative Court declared that Her Majesty’s Revenue and Customs (HMRC) acted unlawfully and “irrationally” in issuing blanket refusals into the status of any investigation into the potentially illegal export of the spyware FinFisher to repressive regimes by UK-based Gamma International.
The case arises from Privacy International’s long-running campaign to bring transparency and accountability to the secretive surveillance technology industry. As part of this in November 2012 Privacy International had submitted a dossier of evidence to HMRC that suggested that Gamma International had illegally exported surveillance technology to governments with records of human rights abuse, such as Bahrain, Ethiopia, Egypt and Turkmenistan. This included both technical evidence[fn]Gamma International’s FinFisher products work by covertly installing software onto a target’s computers and mobile phone without his or her knowledge, usually by tricking the user into thinking he or she is opening an attachment or downloading fake updates from seemingly legitimate sources. Once the user installs the software, the victim’s computers and mobile devices can be taken over, the cameras and microphones remotely switched on, emails, instant messengers and voice calls (including Skype) monitored, and locations tracked. A recent Citizen Lab report asserted that Gamma’s surveillance technology, FinFisher, and its servers has been found in at least 36 countries, including Bahrain, Ethiopia, Egypt, Turkmenistan and other repressive regimes with histories of human rights abuses.[/fn] as well as evidence from activists whose computers were targeted with FinFisher.
Despite requests HMRC refused to provide any information on what if any investigation they were conducting.
Today’s decision marks a significant turning point in this effort, as Mr Justice Green, in his carefully-reasoned judgment, found that HMRC had committed a serious error in not providing information about whether it was investigating British company Gamma International for illegal exporting spyware to repressive regimes. Describing the actions of HMRC as “irrational” and “simply inconsistent with the legislation”, the judgment quashed HRMC’s decision and ordered it to again consider Privacy International’s request.
The judgment provides clear authority that the public is entitled to know what HMRC is doing to investigate and if appropriate prosecute companies that are sending dangerous surveillance technologies to countries where it is likely to be used for human rights abuses.
It also establishes the important principle that NGOs and pressure groups such as Privacy International, just like the press, “act as guardians of the public conscience” and play a significant role in ensuring transparency and enforcing legal rights in court. As such, Mr Justice Green remarked, “the rationale which justifies the provision of information by HMRC to the press applies in large measure to disclosure of information to pressure groups and other NGOs”.
The Court considered the evidence of two activists who contend that they had been subjected to surveillance by governments of countries to which FinFisher had allegedly been exported. Dr Ala’a Shehabi, a Britsh-born citizen and pro-democracy activist in Bahrain, and Mr Tadesse Kersmo, an Ethiopian political refugee living in the UK, both spoke of their distress at HMRC’s refusal to disclose information about whether they were considering instituting criminal proceedings against Gamma.
Privacy International’s Deputy Director, Eric King, said
For two years we have been asking Government to come clean on what they are doing when it comes to the illegal export of FinFisher and to stand up for victims targeted by surveillance technology made on British soil. Today’s ruling is an important victory, and a step in the right direction to holding Gamma International, and the rest of this secretive industry, to account.”
Dr. Ala'a Shehabi said:
Now that the High Court has rightfully said that HMRC’s actions were unlawful, I hope that Government takes action to bring justice to all of the victims whose rights have been violated because of this intrusive spyware. More broadly it should take responsibility for all dual-use exports that are knowingly sent to repressive governments that will likely use them for criminal activity including human rights violations such as Bahrain."
Tadesse Kersmo said:
After I found out that Ethiopians in Diaspora were spied on through my computer, I wanted to know what UK Government was doing to protect my rights and prevent the spread of technologies like FinFisher around the world. I believe this ruling is critical to finally bringing accountability to the likes of Gamma who sell their technologies to repressive regimes like the Ethiopian government.”
Mark Scott of Bhatt Murphy Solicitors said,
The judgment provides an important reminder of the significant and important role that NGOs such as Privacy International have in enforcing legal rights in court.”