GCHQ Data Collection Violated Rights To Privacy

A mass surveillance programme by the UK government violated human rights, the European Court has ruled. It comes some-time after US whistleblower Edward Snowden disclosed British surveillance and intelligence-sharing practices. 

GCHQ’s methods in carrying out bulk interception of online communications violated privacy and failed to provide sufficient surveillance safeguards, the European court of human rights (ECHR) has ruled in a test case judgment.

But the Strasbourg court found that GCHQ’s regime for sharing sensitive digital intelligence with foreign governments was not illegal.

The judges considered three aspects of digital surveillance: bulk interception of communications, intelligence sharing and obtaining of communications data from communications service providers.

By a majority of five to two votes, the Strasbourg judges found that GCHQ’s bulk interception regime violated article 8 of the European convention on human rights, which guarantees privacy, because there were said to be insufficient safeguards, and rules governing the selection of “related communications data” were deemed to be inadequate.

The regime for sharing intelligence with foreign governments operated by the UK government did not, however, violate either article 8 or article 10.

It is the first major challenge to the legality of UK intelligence agencies intercepting private communications in bulk, following Edward Snowden’s whistleblowing revelations.

The long-awaited ruling is one of the most comprehensive assessments by the ECHR of the legality of the interception operations operated by UK intelligence agencies.

In a landmark case brought by charities including Amnesty and human rights group Big Brother Watch, the top court ruled that the "bulk interception regime" breached rights to privacy (Article 8).

The legal challenge was triggered by revelations made by Snowden in 2013, which showed GCHQ, the UK’s Government Communications Headquarters, was secretly intercepting, processing and storing data about millions of people’s private communications, even when those people were of no intelligence interest. In one of the operations, called Tempora, GCHQ was tapping into cables and communication networks to obtain huge volumes of internet data.
Snowden praised the judgment saying that governments had been pursued through the courts for five years. “Today, we won,” he said.

The former CIA employee had revealed that security services had been collecting bulk data, including telephone calls, messages and internet communication, whether or not people were suspected of a crime.
The case centred on powers given to security services under the Regulation of Investigatory Powers Act 2000 (Ripa), which has since been replaced.

In their ruling, judges declared there was insufficient monitoring of what information was being collected and that some safeguards were "inadequate".

They also found the programme breached rights to freedom of expression (Article 10) "as there were insufficient safeguards in respect of confidential journalistic material".

They wrote: "In view of the potential chilling effect that any perceived interference with the confidentiality of journalists' communications and, in particular, their sources might have on the freedom of the press, the Court found that the bulk interception regime was also in violation of article 10."

There was also not enough protection to ensure the safety of confidential journalistic sources, the judges ruled.
Three applications were joined together, from Big Brother Watch, the Bureau of Investigative Journalism, and 10 human rights charities, and were lodged after Mr Snowden's revelations.

All applicants felt their line of work meant they were more subject to having their communications intercepted by intelligence services.

The complaints centred on articles 8 and 10 of the convention of human rights, which protect a right to a private family life, and freedom of expression, with applicants saying bulk interception breached both.
The court did rule that a bulk operation on its own does not break the convention, but said that such a regime "had to respect criteria set down in its case law".

Because there was not enough independent oversight of the search and selection processes, there was a violation of the code. Judges on the case did not agree with the applicants over issues of sharing the information with foreign governments, ruling there was no evidence of abuse or significant shortcomings.

Sky:

You Might Also Read:

Cyberspies: The Secret History of Surveillance, Hacking And Digital Espionage:

Snowden Says Social Media Is Surveillance 'Rebranded':

 

« Enterprise Blockchain Struggles To Carve Out A Niche
How Hackers Skipped Through BA’s Security »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall And Why Does It Matter

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall And Why Does It Matter

See how to use next-generation firewalls (NGFWs) and how they boost your security posture.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

2|SEC Consulting (2-SEC)

2|SEC Consulting (2-SEC)

At 2|SEC Consulting, we deliver an end-to-end service of cyber and information security solutions which are tailored to each client’s exact security needs.

Cloud Industry Forum (CIF)

Cloud Industry Forum (CIF)

Cloud Industry Forum is a non-profit industry body that champions and advocates the adoption and use of Cloud-based services by businesses and individuals.

British Insurance Brokers’ Association (BIBA)

British Insurance Brokers’ Association (BIBA)

BIBA is the UK’s leading general insurance intermediary organisation. Use the ‘Find Insurance‘ section of the BIBA website to find providers of cyber risk insurance in the UK.

Hyve

Hyve

Hyve provide a wide range of managed web hosting services including private, hybrid and public VMware cloud hosting.

Magic Software Enterprises

Magic Software Enterprises

Magic provide Mobile Device Management (MDM) for Secure Enterprise Mobility. Magic MDM overcomes the challenges of mobile device management security by protecting all of your devices, data and content

Fortify Experts

Fortify Experts

Fortify Experts is a search and recruitment firm specializing in Cyber Security.

IABG

IABG

Activities include consulting services in the development of software systems in the area of secure information and data communication.

Pradeo

Pradeo

Pradeo Security offers a complete, automatic and seamless protection to mobile devices and applications, aligned with your organization security policy while preserving business agility.

TI Safe

TI Safe

TI Safe provide cybersecurity solutions for industrial networks of main critical infrastructures in Latin America.

Conviso

Conviso

Conviso is a consulting company specialized in Application Security and Security Research.

Eaton

Eaton

Eaton provides comprehensive cybersecurity services for operational technology (OT) to help keep your operations and personnel safe.

Safe Systems

Safe Systems

Safe Systems provide compliance centric IT services for community banks and credit unions, ensuring that they are kept up to date on current technologies, security risks, and regulatory changes.

nsKnox

nsKnox

nsKnox is a fintech-security company, enabling corporations and banks to prevent fraud and ensure compliance in B2B Payments.

Core Sentinel

Core Sentinel

Australia's #1 Penetration Testing Service. Make Your Systems Fully Compliant With Our OSCE CREST/CISA Certified Penetration Testing.

XpertDPO

XpertDPO

XpertDPO provides data security, governance, risk and compliance, GDPR and ISO consultancy to public and private sector organisations.

Myrror Security

Myrror Security

Myrror Security is a software supply chain security solution that aids lean security teams in safeguarding their software against breaches.