GCHQ Data Collection Violated Rights To Privacy

A mass surveillance programme by the UK government violated human rights, the European Court has ruled. It comes some-time after US whistleblower Edward Snowden disclosed British surveillance and intelligence-sharing practices. 

GCHQ’s methods in carrying out bulk interception of online communications violated privacy and failed to provide sufficient surveillance safeguards, the European court of human rights (ECHR) has ruled in a test case judgment.

But the Strasbourg court found that GCHQ’s regime for sharing sensitive digital intelligence with foreign governments was not illegal.

The judges considered three aspects of digital surveillance: bulk interception of communications, intelligence sharing and obtaining of communications data from communications service providers.

By a majority of five to two votes, the Strasbourg judges found that GCHQ’s bulk interception regime violated article 8 of the European convention on human rights, which guarantees privacy, because there were said to be insufficient safeguards, and rules governing the selection of “related communications data” were deemed to be inadequate.

The regime for sharing intelligence with foreign governments operated by the UK government did not, however, violate either article 8 or article 10.

It is the first major challenge to the legality of UK intelligence agencies intercepting private communications in bulk, following Edward Snowden’s whistleblowing revelations.

The long-awaited ruling is one of the most comprehensive assessments by the ECHR of the legality of the interception operations operated by UK intelligence agencies.

In a landmark case brought by charities including Amnesty and human rights group Big Brother Watch, the top court ruled that the "bulk interception regime" breached rights to privacy (Article 8).

The legal challenge was triggered by revelations made by Snowden in 2013, which showed GCHQ, the UK’s Government Communications Headquarters, was secretly intercepting, processing and storing data about millions of people’s private communications, even when those people were of no intelligence interest. In one of the operations, called Tempora, GCHQ was tapping into cables and communication networks to obtain huge volumes of internet data.
Snowden praised the judgment saying that governments had been pursued through the courts for five years. “Today, we won,” he said.

The former CIA employee had revealed that security services had been collecting bulk data, including telephone calls, messages and internet communication, whether or not people were suspected of a crime.
The case centred on powers given to security services under the Regulation of Investigatory Powers Act 2000 (Ripa), which has since been replaced.

In their ruling, judges declared there was insufficient monitoring of what information was being collected and that some safeguards were "inadequate".

They also found the programme breached rights to freedom of expression (Article 10) "as there were insufficient safeguards in respect of confidential journalistic material".

They wrote: "In view of the potential chilling effect that any perceived interference with the confidentiality of journalists' communications and, in particular, their sources might have on the freedom of the press, the Court found that the bulk interception regime was also in violation of article 10."

There was also not enough protection to ensure the safety of confidential journalistic sources, the judges ruled.
Three applications were joined together, from Big Brother Watch, the Bureau of Investigative Journalism, and 10 human rights charities, and were lodged after Mr Snowden's revelations.

All applicants felt their line of work meant they were more subject to having their communications intercepted by intelligence services.

The complaints centred on articles 8 and 10 of the convention of human rights, which protect a right to a private family life, and freedom of expression, with applicants saying bulk interception breached both.
The court did rule that a bulk operation on its own does not break the convention, but said that such a regime "had to respect criteria set down in its case law".

Because there was not enough independent oversight of the search and selection processes, there was a violation of the code. Judges on the case did not agree with the applicants over issues of sharing the information with foreign governments, ruling there was no evidence of abuse or significant shortcomings.

Sky:

You Might Also Read:

Cyberspies: The Secret History of Surveillance, Hacking And Digital Espionage:

Snowden Says Social Media Is Surveillance 'Rebranded':

 

« Enterprise Blockchain Struggles To Carve Out A Niche
How Hackers Skipped Through BA’s Security »

Directory of Suppliers

CS Risk Management

CS Risk Management

CS Risk Management have the in-depth understanding of business and IT systems necessary to translate standards into practical, effective measures to meet your compliance requirements.

Infosys

Infosys

Infosys is a global leader in consulting, technology and outsourcing solutions.. Services include IT strategy, technical architecture and operations.

Webroot

Webroot

Webroot delivers next-generation endpoint security and threat intelligence services to protect businesses and individuals around the globe.

SecDev

SecDev

We create technical solutions for collecting and analyzing cyber intelligence. Our approach is always at the wider network level to garner the best possible understanding of cyberspace.

Grid32

Grid32

Grid32 provide penetration testing, vulnerability assessments, software code audits, training and incident response services.

Securonix

Securonix

Securonix provides Actionable Risk Intelligence by detecting high risk user activities and access in order to combat Insider Threat and Fraud.

Flexiant

Flexiant

Flexiant is the leading European provider of cloud management & cloud orchestration software.

Acuity Risk Management

Acuity Risk Management

Acuity Risk Management provides integrated Enterprise risk management and compliance software solutions and services.

Softtek

Softtek

Softtek provides comprehensive software Quality Assurance and Testing that identifies the correctness, completeness, and quality level of software products.

XBOSoft

XBOSoft

XBOSoft is a software QA and testing company. We cover the entire QA and testing life cycle including software and application security.

PacketSled

PacketSled

PacketSled automates incident response by fusing business context, AI, entity enrichment and detection with network visibility.

ComTrue Technologies

ComTrue Technologies

ComTrue Technologies is a developer and provider of personal information protection and cyber security solutions and services.

Entersekt

Entersekt

Entersekt is an innovator in push-based authentication and app security.

Vaulto Technologies

Vaulto Technologies

Vaulto protects critical business processes that are conducted via the cellular network.

KIACS Cyber Security

KIACS Cyber Security

Kuwait Industrial Automation & Control Systems Cyber Security Conference addresses the issue of cyber security threats in Industrial Control Systems for oil, gas, petrochemical and power plants.