ISPs take legal action against GCHQ(bbc.co.uk)
bbc.co.uk
ISPs take legal action against GCHQ
http://www.bbc.co.uk/news/technology-28106815
8 comments
"While the ISPs taking the action were not directly named in the leaked Snowden documents..."
Does the UK have the same legal concept of "standing" as the US does?
"In the United States, the current doctrine is that a person cannot bring a suit challenging the constitutionality of a law unless the plaintiff can demonstrate that he/she/it is or will "imminently" be harmed by the law." [1]
The US government often uses the absence of (or the secrecy of) proof of direct harm to a person or agency to have the complaint quashed before it can ever really be argued.
[1] http://en.m.wikipedia.org/wiki/Standing_(law)
Does the UK have the same legal concept of "standing" as the US does?
"In the United States, the current doctrine is that a person cannot bring a suit challenging the constitutionality of a law unless the plaintiff can demonstrate that he/she/it is or will "imminently" be harmed by the law." [1]
The US government often uses the absence of (or the secrecy of) proof of direct harm to a person or agency to have the complaint quashed before it can ever really be argued.
[1] http://en.m.wikipedia.org/wiki/Standing_(law)
Firstly, the UK doesn't have the same concept of constitutionality.
Secondly, this isn't a normal damages action; have a look at http://www.dataprotectioncompany.co.uk/8-dpc-news-articles/1... . It's a complaint to the relevant tribunal phrased in ECHR language. If the complaint is denied, there's an appeal to the court in Strasbourg. What happens there is harder to predict, but crucially it's in no way part of the UK government.
The full complaint can be found by googling "privacy international hacking case grounds". It references R(Bancoult) http://www.blackstonechambers.com/news/cases/r_bancoult.html , in which Wikileaks was ruled inadmissible, specifically to contradict it by saying that extensive discussion of the spying means it is no longer secret.
It also references the ironically named Liberty v. United Kingdom: http://hudoc.echr.coe.int/sites/eng/pages/search.aspx?i=001-... which relates to phone hacking back in 1999 under the previous legal regime. It's worth noting that that case (a) found the surveillance unlawful but (b) ordered the UK to ... pay £7500 costs. The new case has a request for an injunction against the UK doing it again. (It shouldn't normally be necessary to enjoin people from doing things once they have been found unlawful, but this is GCHQ we're dealing with)
Secondly, this isn't a normal damages action; have a look at http://www.dataprotectioncompany.co.uk/8-dpc-news-articles/1... . It's a complaint to the relevant tribunal phrased in ECHR language. If the complaint is denied, there's an appeal to the court in Strasbourg. What happens there is harder to predict, but crucially it's in no way part of the UK government.
The full complaint can be found by googling "privacy international hacking case grounds". It references R(Bancoult) http://www.blackstonechambers.com/news/cases/r_bancoult.html , in which Wikileaks was ruled inadmissible, specifically to contradict it by saying that extensive discussion of the spying means it is no longer secret.
It also references the ironically named Liberty v. United Kingdom: http://hudoc.echr.coe.int/sites/eng/pages/search.aspx?i=001-... which relates to phone hacking back in 1999 under the previous legal regime. It's worth noting that that case (a) found the surveillance unlawful but (b) ordered the UK to ... pay £7500 costs. The new case has a request for an injunction against the UK doing it again. (It shouldn't normally be necessary to enjoin people from doing things once they have been found unlawful, but this is GCHQ we're dealing with)
Some of the ISPs in question have been directly targeted by GCHQ operations; pervasive GCHQ operations like TEMPORA and QUANTUM affect every internet user that transits through an affected point. That is no longer in dispute after Snowden.
I think they have locus to bring these actions for judicial review, yes.
I think they have locus to bring these actions for judicial review, yes.
Kennedy v UK [1] is of relevance here. In that case, the European Court of Human Rights held that an individual did not necessarily need to prove that his communications had been intercepted in order to complain that a law that permitted such interception was in contravention of Article 8 of the European Convention on Human Rights (i.e. the right to privacy).
However, the Court went on to deny Kennedy's complaint that the UK's Regulation of Investigatory Powers Act (RIPA) violates Article 8 because it was proportionate and fell under the exclusion for "national security, public safety or the economic well-being of the country, [and] for the prevention of disorder or crime". [2]
Also, if you read Theresa May's recent speech on the topic [3], you'll notice that she spends a lot of time talking about warrant approvals, oversight and so on. That is all about safeguards and proportionality, and is taken into account by the Court when they are considering whether a particular law contravenes Article 8.
1: http://hudoc.echr.coe.int/sites/eng/pages/search.aspx?i=001-...
2: http://en.wikipedia.org/wiki/Article_8_of_the_European_Conve...
3: https://www.gov.uk/government/speeches/home-secretarys-defen...
However, the Court went on to deny Kennedy's complaint that the UK's Regulation of Investigatory Powers Act (RIPA) violates Article 8 because it was proportionate and fell under the exclusion for "national security, public safety or the economic well-being of the country, [and] for the prevention of disorder or crime". [2]
Also, if you read Theresa May's recent speech on the topic [3], you'll notice that she spends a lot of time talking about warrant approvals, oversight and so on. That is all about safeguards and proportionality, and is taken into account by the Court when they are considering whether a particular law contravenes Article 8.
1: http://hudoc.echr.coe.int/sites/eng/pages/search.aspx?i=001-...
2: http://en.wikipedia.org/wiki/Article_8_of_the_European_Conve...
3: https://www.gov.uk/government/speeches/home-secretarys-defen...
I'm indeed familiar with her speech of last week. I can't say I find it particularly helpful to any debate. It is intentionally confusing and obfuscatory, as you might expect from a senior politician with a lot to lose on a sensitive topic she hopes she can bury with an election coming up.
I don't know about you, but despite having (unknowingly at the time) walked past a live IRA bomb in my childhood which detonated a few hours later, I feel far more threatened by mass surveillance than by any other state or non-state actor by any means. Mass surveillance has a truly chilling effect upon democracy, upon speech, upon the way we think. It is actively poisonous to freedom. And it is happening - her denials aside, these are not mere assertions: thanks largely to Snowden (and the other, not-so-publicised leakers), they are strongly and undeniably evidenced. Other evidence is available and can be obtained. This action - and Snowden's leaks - is the external oversight intended, and needed, to stop mass surveillance - any system of "oversight" in place has clearly failed.
Thing is, GCHQ have operated for over two decades now under the understanding that they have authority to actually conduct SIGINT operations at large - but that it's the responsibility of analysts internal, external (TSS/SIS/NCA/MoD/etc) and extraterritorial (NSA and the rest of the Five Eyes, etc) that query GCHQ about the results of those operations with specific targeted selectors (search queries; email addresses, names, IP addresses, website names, et al) to obtain sufficient clearance and authority to do so. (Broadly the same doctrine NSA have: that the interception itself isn't spying, the search/analysis of the intercepts is. Convenient for them, but questionable at best.)
The operations themselves, however, are frequently in much murkier territory; sometimes without any oversight or accountability at all, and a good number are conveniently obscured; from internal and external oversight, and even from Government Cabinet ministers such as Ms May, because it's too sensitive! Doesn't matter if you're TOP SECRET//STRAP1 or how many orange and purple forms you wave around, unless you're actively part of the individual SCI compartment in question, you're probably not even aware it exists, except maybe by a vague probably-two-word cover name (which is supposed to be arbitrary, but the newer guard loves their cute buzzwords too much). This is long-standing, if low-key, practice, spanning multiple governments - infrastructure and inertia outlasts governments which come and go, after all. Indeed, that was the entire basis under which the "Mastering The Internet" initiative was able to be set up in the first place; to my own knowledge this broad, general doctrine actually dates back a longer way in GCHQ than NSA, at least to the early 80s and the SystemX exchange intercept circuits. (It stands in stark contrast to their search policies, which they're obviously much happier to parade around before oversight.)
Can she honestly say that she knew of the actual modus operandi of, for example, the infamous OPTIC NERVE database - a very large collected archived corpus of images (quite a number of them explicit, as you'd expect from a huge recorded cache of intimate conversations the participants believed private) collected via mass passive interception of Yahoo! webcam chats of all user streams transiting the interception points - and believed that was a lawful, necessary and proportionate infringement of human rights justifying a warrant?! (If she could, I doubt she'd want to.) Who did? Probably no-one. Sir Anthony May: Did you see that? No, I thought not. It seems plainly wrong to me, as obvious an unjustifiable operation as one could be, to no actual useful intelligence purpose, and a clear sign that the boys from Cheltenham had indeed gone rogue - and one entirely unreported, until Snowden.
Thanks, Snowden, Greenwald, the Guardian, Jacob, et al. Your work is incredibly valuable and you deserve those awards. Now maybe we can have a conversation about all of this - but such a conversation obviously can't be effective when we're still being so profoundly, patronisingly whitewashed.
I don't know about you, but despite having (unknowingly at the time) walked past a live IRA bomb in my childhood which detonated a few hours later, I feel far more threatened by mass surveillance than by any other state or non-state actor by any means. Mass surveillance has a truly chilling effect upon democracy, upon speech, upon the way we think. It is actively poisonous to freedom. And it is happening - her denials aside, these are not mere assertions: thanks largely to Snowden (and the other, not-so-publicised leakers), they are strongly and undeniably evidenced. Other evidence is available and can be obtained. This action - and Snowden's leaks - is the external oversight intended, and needed, to stop mass surveillance - any system of "oversight" in place has clearly failed.
Thing is, GCHQ have operated for over two decades now under the understanding that they have authority to actually conduct SIGINT operations at large - but that it's the responsibility of analysts internal, external (TSS/SIS/NCA/MoD/etc) and extraterritorial (NSA and the rest of the Five Eyes, etc) that query GCHQ about the results of those operations with specific targeted selectors (search queries; email addresses, names, IP addresses, website names, et al) to obtain sufficient clearance and authority to do so. (Broadly the same doctrine NSA have: that the interception itself isn't spying, the search/analysis of the intercepts is. Convenient for them, but questionable at best.)
The operations themselves, however, are frequently in much murkier territory; sometimes without any oversight or accountability at all, and a good number are conveniently obscured; from internal and external oversight, and even from Government Cabinet ministers such as Ms May, because it's too sensitive! Doesn't matter if you're TOP SECRET//STRAP1 or how many orange and purple forms you wave around, unless you're actively part of the individual SCI compartment in question, you're probably not even aware it exists, except maybe by a vague probably-two-word cover name (which is supposed to be arbitrary, but the newer guard loves their cute buzzwords too much). This is long-standing, if low-key, practice, spanning multiple governments - infrastructure and inertia outlasts governments which come and go, after all. Indeed, that was the entire basis under which the "Mastering The Internet" initiative was able to be set up in the first place; to my own knowledge this broad, general doctrine actually dates back a longer way in GCHQ than NSA, at least to the early 80s and the SystemX exchange intercept circuits. (It stands in stark contrast to their search policies, which they're obviously much happier to parade around before oversight.)
Can she honestly say that she knew of the actual modus operandi of, for example, the infamous OPTIC NERVE database - a very large collected archived corpus of images (quite a number of them explicit, as you'd expect from a huge recorded cache of intimate conversations the participants believed private) collected via mass passive interception of Yahoo! webcam chats of all user streams transiting the interception points - and believed that was a lawful, necessary and proportionate infringement of human rights justifying a warrant?! (If she could, I doubt she'd want to.) Who did? Probably no-one. Sir Anthony May: Did you see that? No, I thought not. It seems plainly wrong to me, as obvious an unjustifiable operation as one could be, to no actual useful intelligence purpose, and a clear sign that the boys from Cheltenham had indeed gone rogue - and one entirely unreported, until Snowden.
Thanks, Snowden, Greenwald, the Guardian, Jacob, et al. Your work is incredibly valuable and you deserve those awards. Now maybe we can have a conversation about all of this - but such a conversation obviously can't be effective when we're still being so profoundly, patronisingly whitewashed.
There is a quote in this article (which is actually comparing Scots and English legal systems in this area) suggesting:
Public law is not at base about rights, even though abuses of power may and often do invade private rights; it is about wrongs – that is to say misuses of public power; and the Courts have always been alive to the fact that a person or organisation with no particular stake in the issue or the outcome may, without in any sense being a mere meddler, wish and be well placed to call the attention of the Court to an apparent misuse of public power.
http://www.jonathanmitchell.info/2010/06/13/standing-in-publ...
Public law is not at base about rights, even though abuses of power may and often do invade private rights; it is about wrongs – that is to say misuses of public power; and the Courts have always been alive to the fact that a person or organisation with no particular stake in the issue or the outcome may, without in any sense being a mere meddler, wish and be well placed to call the attention of the Court to an apparent misuse of public power.
http://www.jonathanmitchell.info/2010/06/13/standing-in-publ...
Great work by all involved.
Shameful that larger ISPs are not taking similar action.
Shameful that larger ISPs are not taking similar action.
The action makes repeated reference to the European Convention of Human Rights, and UK lawyers have already questioned [2] the legality of revelations around GCHQ's activities in relation to ECHR.
The current legislation [3] covering GCHQ's activities is from 1994.
1: https://www.privacyinternational.org/blog/stop-breaking-the-...
2: http://www.theguardian.com/uk-news/2014/jan/28/gchq-mass-sur...
3: http://www.legislation.gov.uk/ukpga/1994/13/crossheading/the...