The Investigatory Powers Tribunal has reruled that GCHQ, MI5 and MI6 engaged in indiscriminate and illegal bulk cable-tapping surveillance for 15 years – and has once again refused to do anything about it.
In a 113-paragraph judgment handed down today filled with assurances that he was "anxious to assist in achieving improvements" in spying practices, Sir Michael Burton, president of the IPT, found that for a decade and a half, the spy agencies were operating outside section 94 of the UK's 1984 Telecommunications Act.
In a previous judgment from last October, the IPT said the law-breaking period ended in March 2015. Today's judgment extends that period to October 2016, although the IPT said "no declaration [of unlawfulness] will be made, nor any further relief granted" to victims of this illegal surveillance.
Privacy International, the charity which first brought this case two years ago, lost its attempt to overturn an earlier ruling that legal oversight of GCHQ's bulk spying regime was fit for purpose. It also failed to have the agencies' dragnet surveillance practices declared incompatible with Article 8 of the EU Convention on Human Rights, which is a privacy right.
Needling the law in a haystack
Section 94 of the Telecommunications Act 1984 is the legal key to British governmental snooping on phone and internet networks. The Foreign Secretary, to whom GCHQ and MI6 must report, makes a legal "direction" every six months under section 94.
UK Supreme Court to probe British spy court's immunity from probingREAD MORE
That direction forces telcos and ISPs to let the spy agencies slurp up copies of every single piece of data that passes over their networks, whether voice calls, emails, Skype chats, your web browsing history, and everything else in between. This process is known as bulk data collection. Snippets from that then get passed around British and foreign law enforcement agencies.
Crucially, section 94 states that only the Foreign Secretary can authorise such snooping. By law the Foreign Sec cannot delegate that power and let, for example, the head of GCHQ decide what kind of data to grab or how much of it they wish to browse through. However, in practice, what was happening, the IPT ruled, was that the Foreign Sec rubber-stamped a "general direction" prepared by the spy agencies themselves that included a very broad form of words authorising them to do whatever they liked. The IPT stated in its judgment: "In form a general direction was a carte blanche."
Having received its carte blanche, GCHQ would then send telcos a "trigger letter", which set out precisely (or not) what it wanted. Privacy International argued that the trigger letters' contents were what should have been signed off by the Foreign Secretary in his section 94 directions.
"We conclude that most of the relevant directions made between 29 November 2001 and 7 November 2012 were not lawfully made under s.94," said Sir Michael in his judgment, to which his fellow IPT judges Mr Justice Edis, Sir Richard McLaughlin, Charles Flint QC and Susan O'Brien QC also contributed.
Yeah, they broke the law. And?
Remarkably, although Sir Michael stated that "there had been an unlawful delegation of the power conferred by s.94(1)" from the Foreign Sec to the agencies, he also ruled that there was no need to do anything about it because "the Foreign Secretary had from 2010 imposed a requirement that any variation in the scope of data to be provided under a direction required his approval". By 2015, said the IPT's judgment, "there was in substance no delegation of power from the Foreign Secretary".
Put another way, when Conservative minister William Hague was appointed Foreign Sec in 2010 following that year's general election, it appears he took one of the first steps to bring the agencies to heel – notwithstanding that for two years after that he allowed them to break the law, whether knowingly or not. His successor in 2014, Philip Hammond, tightened this up to ensure the spies gave him a detailed review of what they wanted and why every six months before he would sign it off, giving him direct control over what types of bulk data they were slurping.
Revealed: UK.gov's 'third direction' to keep tabs on spies' potentially criminal activitiesREAD MORE
Privacy International first took the spy agencies and their masters at the Home Office and Foreign Office to the IPT two years ago, broadly arguing that their hacking and indiscriminate spying was illegal. The case, which has dragged on over two years, saw the government's position change substantially from saying "all is well, nothing to see here" to admissions that, in fact, all was not well in terms of obeying the law of the land.
The tribunal's public judgment today contained few criticisms of the Peeping Tom agencies themselves, though Sir Michael went as far as to say he was "disappointed that inaccurate information was given to the tribunal" about the number of contractors with admin privileges working at GCHQ. The agencies also had to amend their witness statements several times after it became obvious that their original contents, claiming they and the Foreign Secretary obeyed the law in full, were simply not true; something that forced the IPT to allow cross-examination of a GCHQ witness in open court.
The IPT hinted obliquely that its closed (non-public) judgment contained some criticisms of the spy agencies. This document will never be seen by the public. The public judgment is IPT/15/110/CH dated 23 July 2018 and should be available on the IPT website in due course.
There is no legal way to appeal against an IPT ruling. Privacy International tried and failed in the High Court and Court of Appeal to establish a precedent allowing it, and the issue is now set to be heard by the Supreme Court in December this year. ®