A new Investigatory Powers Tribunal (IPT) ruling has exposed the inadequacy of current oversight mechanisms meant to keep the surveillance state in check, and the willingness of telecoms firms to hand over customers’ data to GCHQ, according to a leading rights group.
Privacy International (PI) claimed victory today after a tenacious legal investigation which had forced GCHQ to make “substantial corrections” to evidence it originally gave to the court mid-case.
Its job was made harder by the fact that the IPT relies heavily on closed hearings where claimants like PI can’t see or challenge evidence presented by the government, and only progressed after the “extraordinary” decision was taken to allow the group to cross-examine a GCHQ witness.
The IPT’s decision held that successive foreign secretaries unlawfully delegated to GCHQ decisions about what data to acquire from telecommunication companies — effectively rendering 10 years’ worth of secretly collected data illegal.
"In theory the agency [GCHQ] could have used the general form of such directions to impose on the CSP a requirement to produce communications data which extended beyond the scope of any data requirement which had been sanctioned by the Foreign Secretary,” the IPT apparently ruled.
The judgement also casts an unforgiving light on the telcos themselves, which appeared to have handed over highly sensitive data on their customers without question in response to verbal requests.
“The foreign secretary was supposed to protect access to our data by personally authorizing what is necessary and proportionate for telecommunications companies to provide to the agencies. The way that these directions were drafted risked nullifying that safeguard, by delegating that power to GCHQ — a violation that went undetected by the system of commissioners for years and was seemingly consented to by all of the telecommunications companies affected,” argued PI solicitor, Mille Graham Wood.
“It is proof positive of the inadequacy of the historic oversight system; the complicity of telecommunications companies who instead of checking if requests were lawful, just handed over customers' personal data as long as their cooperation was kept secret; and the scale of the task facing the new investigatory powers commissioner, Sir Adrian Fulford.”