The British Government Are Struggling to Spy
Inside the war between British civil rights activists and the state
Last month, after a five-year legal challenge brought by human rights charity Privacy International, the UK High Court ruled that British intelligence services (MI4, MI5, and GCHQ) can no longer engage in bulk surveillance based on one generic warrant known as a ‘general warrant’.
Until now, it has been shockingly easy for the intelligence services to get permission from the Home Office to spy on large groups of people. In 2014, the Edward Snowden disclosures revealed that UK intelligence services were using mass-hacking techniques to access potentially millions of devices. Ministers could issue broad general warrants to allow intelligence services to spy on, for instance, every member of a criminal gang, without approval by a judge or individual grounds for suspicion.
At an Investigatory Powers Tribunal bought by Privacy International in 2016, the government even argued that it would be lawful in principle to hack every mobile phone in one UK using a single warrant. The tribunal found in the government’s favour.
In the High Court last month, these warrants were banned because they contradict fundamental UK common law principles. The court emphasized that “the aversion to general warrants is one of the basic principles on which the law of the United Kingdom is founded”.
“General warrants are problematic because they do not specify the subject of the search or the hack,” Ioannis Kouvakas, Legal Officer at Privacy International, says. “They can be very vague; they don’t include someone’s name or particular address. They leave it up to the authority executing the warrant to decide.”
“These provisions were open to misinterpretation and there were not enough checks, balances, or safeguards for independent authorities to examine,” he says. “Many things were left up to the discretion of the intelligence services.”
“With hacking specifically, it’s not just intercepting someone’s communication or going through their meta-data (which is already quite intrusive and should involve a whole series of safeguards), it’s one of the more intrusive, if not the most intrusive, forms of surveillance. It allows an intelligence agency to spy on you in real-time.”
That, considering how digitally saturated society has become, is like opening all aspects of your life to the government. “It contradicts human rights principles,” Kouvakas says, “it contradicts the very essence of our rights — not just privacy or data protection, but a whole series of other rights as well.”
The legal case delved back to the 18th century for precedent. In the Huckle v Money case in 1763, the then Secretary of State, Lord Halifax, had to pay £300 in damages (about £60,000 in today’s money) to the printers and publishers of a London-based newspaper who was detained for six hours accused of committing “seditious libel” by running a nasty article about King George III. The government lost because it had used a general warrant with no name on it, and that was deemed unlawful.
The case was hailed a major win for civil liberties. “What a victory,” Edward Snowden tweeted. He added: “Though it may take decades, the courts are coming around on mass surveillance. We all owe an enormous debt to @PrivacyInt for suing to end the practice of using a single generic warrant to spy on an unlimited number of people.”
Thanks to the ruling, the British intelligence services can no longer use section 5 of the 1994 Intelligence Services Act to grant a general warrant facilitating mass surveillance, but there are other similar warrants they can use under the Investigatory Powers Act.
This, too, is subject to a current legal challenge from human rights charity Liberty. On their website, they say the Investigatory Powers Act [also known as ‘The Snoopers’ Charter’] gives the police and security services “powers to spy on everyone whether or not we’re suspected of wrongdoing”.
“We’re arguing these ‘bulk powers’ violate rights to privacy and freedom of expression,” they continue. “And there are insufficient safeguards in the Act to protect confidential journalistic sources and legal material.”
In 2018, the High Court ruled that the Act was “incompatible” with EU law because it allowed state agencies to have access to data held by telecommunications operators. As a result, it was amended. In 2019, however, the Court said the so-called ‘bulk powers’ do not breach privacy and free expression rights.
It also ruled that sufficient safeguards for journalistic and legal communications are in place. Liberty are now in the process of appealing that decision with a development expected this year.
“I think [the Privacy International ruling] was a landmark success for the High Court to have judged that these sweeping powers are not aligned with long-standing rights within British law,” Anjuli R. K. Shere, a doctoral researcher in cyber security at the University of Oxford, told me.
“These general warrants were potentially being used in a way that seems to be unmitigated, I did not think that was a particularly positive thing.”
However, Shere warned that the ruling could actually empower intelligence services. “I don’t think this is going to hinder the intelligence services,” Shere says. “In my opinion, increasing the vigour by which agencies and state agencies are able to exercise their power so that they have to really target the warrants that they use, is only going to make their legal cases stronger. And also make people in the UK feel more confident that their government is capable of using these capabilities.”
Shere is currently researching how emerging technologies could threaten press freedom. One threat she’s noted is UK intelligence services’ lawful ability to modify documents once they have hacked into a device. “If [a journalist] is working on an article and using source materials which are swapped, that can look really damning if it looks like they are propagating disinformation,” she says.
The level of intrusion that these general warrants allowed intelligence services to carry out is shocking. We’re not just talking about accessing the content of your device, although that would be within scope. It’s also accessing meta-data (location history, for example), your activity in real-time, your webcam, marking documents so that they can be tracked, or removing documents completely.
“This is a really important step forward, but it’s not going to change everything,” she continued. “I think the issue with the capabilities as they existed before and as they still kind of exist now, is if there is some kind of breach of confidentiality or a new public-private data sharing channel that emerges – a collaboration between the government and industry in some way.”
“This bulk data collection could really negatively affect any one person; one example that I give is that it could cause insurance premiums to rise if someone’s got a medical condition picked up by their device [such as a Fitbit, for instance] and their insurance provider gets wind of it.”
Shere believes that there’s a growing idea that our electronic devices don’t really belong to us anymore, in the sense that they serve interests that are not always our own. “You’ve got egregious amounts of information stored on them,” she notes. “And you’ve got potential control of them shared not just with the companies that make and run them but also with the government. That undermines the principle of privacy.”
%22%3E){kind=link}