A proposed "electronic interference" code for spooks will sanction pervasive hacking powers without judicial or parliamentary scrutiny, experts and campaigners have warned.
The government slipped out its consultation documents on "equipment interference" and "interception of communications" last month – on the same day the Investigatory Powers Tribunal ruled that GCHQ's snooping programmes had been illegal prior to December 2014.
It intends to provide a legal framework for how intelligence services tamper with equipment.
Caroline Wilson Palow, legal officer at campaign group Privacy International, said the code is the first time the UK intelligence services have admitted they engage in hacking.
Responding to the consultation she said: "The draft code grants the intelligence services incredible powers to hack into people's phones, computers, and communications infrastructure," she said.
"The power to hack should be closely controlled and governed by legislation, as communications interception has been. Sanctioning such incredible powers in a code of practice does not pass democratic muster," she said.
David Cook, cyber crime and data security solicitor at law firm Slater & Gordon, said the code is "extremely worrying", particularly as it has not been subject to parliamentary or judicial scrutiny.
"[This] seems to be a method of seeking a veneer of lawfulness over an approach which is, at its core, absolutely abhorrent," he said.
There are parts of the code which give the security services wide-ranging powers to "self-authorise", Cook added. "This would mean that, unlike an operation to put a bug in a particular house, they would not necessarily need a specific warrant to do the same thing by hacking a computer."
"This gradual erosion of our civil liberties is occurring at a time of vast improvements in the technological capabilities of our security services to intrude into every facet of our digital lives [and] should be resisted at all costs," he continued. "Once this genie is out of the lamp it will be very difficult to get it back in."
Renate Samson, chief executive of civil liberties group Big Brother Watch, warned that the code will provide pervasive powers to hack anyone, arguing that it is "not just a case of targeting a suspect, but people who are entirely neutral, too".
The consultation will end next week. ®