GCHQ Data Collection Violated Rights To Privacy

A mass surveillance programme by the UK government violated human rights, the European Court has ruled. It comes some-time after US whistleblower Edward Snowden disclosed British surveillance and intelligence-sharing practices. 

GCHQ’s methods in carrying out bulk interception of online communications violated privacy and failed to provide sufficient surveillance safeguards, the European court of human rights (ECHR) has ruled in a test case judgment.

But the Strasbourg court found that GCHQ’s regime for sharing sensitive digital intelligence with foreign governments was not illegal.

The judges considered three aspects of digital surveillance: bulk interception of communications, intelligence sharing and obtaining of communications data from communications service providers.

By a majority of five to two votes, the Strasbourg judges found that GCHQ’s bulk interception regime violated article 8 of the European convention on human rights, which guarantees privacy, because there were said to be insufficient safeguards, and rules governing the selection of “related communications data” were deemed to be inadequate.

The regime for sharing intelligence with foreign governments operated by the UK government did not, however, violate either article 8 or article 10.

It is the first major challenge to the legality of UK intelligence agencies intercepting private communications in bulk, following Edward Snowden’s whistleblowing revelations.

The long-awaited ruling is one of the most comprehensive assessments by the ECHR of the legality of the interception operations operated by UK intelligence agencies.

In a landmark case brought by charities including Amnesty and human rights group Big Brother Watch, the top court ruled that the "bulk interception regime" breached rights to privacy (Article 8).

The legal challenge was triggered by revelations made by Snowden in 2013, which showed GCHQ, the UK’s Government Communications Headquarters, was secretly intercepting, processing and storing data about millions of people’s private communications, even when those people were of no intelligence interest. In one of the operations, called Tempora, GCHQ was tapping into cables and communication networks to obtain huge volumes of internet data.
Snowden praised the judgment saying that governments had been pursued through the courts for five years. “Today, we won,” he said.

The former CIA employee had revealed that security services had been collecting bulk data, including telephone calls, messages and internet communication, whether or not people were suspected of a crime.
The case centred on powers given to security services under the Regulation of Investigatory Powers Act 2000 (Ripa), which has since been replaced.

In their ruling, judges declared there was insufficient monitoring of what information was being collected and that some safeguards were "inadequate".

They also found the programme breached rights to freedom of expression (Article 10) "as there were insufficient safeguards in respect of confidential journalistic material".

They wrote: "In view of the potential chilling effect that any perceived interference with the confidentiality of journalists' communications and, in particular, their sources might have on the freedom of the press, the Court found that the bulk interception regime was also in violation of article 10."

There was also not enough protection to ensure the safety of confidential journalistic sources, the judges ruled.
Three applications were joined together, from Big Brother Watch, the Bureau of Investigative Journalism, and 10 human rights charities, and were lodged after Mr Snowden's revelations.

All applicants felt their line of work meant they were more subject to having their communications intercepted by intelligence services.

The complaints centred on articles 8 and 10 of the convention of human rights, which protect a right to a private family life, and freedom of expression, with applicants saying bulk interception breached both.
The court did rule that a bulk operation on its own does not break the convention, but said that such a regime "had to respect criteria set down in its case law".

Because there was not enough independent oversight of the search and selection processes, there was a violation of the code. Judges on the case did not agree with the applicants over issues of sharing the information with foreign governments, ruling there was no evidence of abuse or significant shortcomings.

Sky:

You Might Also Read:

Cyberspies: The Secret History of Surveillance, Hacking And Digital Espionage:

Snowden Says Social Media Is Surveillance 'Rebranded':

 

« Enterprise Blockchain Struggles To Carve Out A Niche
How Hackers Skipped Through BA’s Security »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

NICE Systems

NICE Systems

NICE Systems provide software solutions to ensure compliance, fight financial crime, and safeguard people and assets.

LexisNexis Risk Solutions

LexisNexis Risk Solutions

LexisNexis Risk Solutions provides technology solutions for Anti-Money Laundering, Fraud Mitigation, Anti-Bribery and Corruption, Identity Management, Tracing and Investigation.

Momentum

Momentum

The Cyber Security team at Momentum offers a professional and specialist recruitment service across Cyber & IT Security.

CERT-AM

CERT-AM

CERT-AM is the national Computer Emergency Response Team for Armenia.

AVG Technologies

AVG Technologies

AVG is focused on providing home and business computer users with the most comprehensive and proactive protection against computer security threats.

EY Advisory

EY Advisory

EY is a multinational professional services firm headquartered in the UK. EY Advisory service areas include Cybersecurity.

CSO GmbH

CSO GmbH

CSO GmbH provide specialist consultancy services in the area of IT security.

Cyber Security Raad (CSR) - Netherlands

Cyber Security Raad (CSR) - Netherlands

The Cyber Security Council (CSR) is a national, independent advisory body of the Dutch government undertaking efforts at strategic level to bolster cyber security in the Netherlands.

Data Terminator

Data Terminator

Data Terminator provide a comprehensive range of secure data destruction equipment and services are in compliance to US Department of Defense (DoD) and National Security Agency (NSA) standards.

Forgepoint Capital

Forgepoint Capital

ForgePoint Capital is a premier venture investor for early stage cybersecurity companies.

Bradley-Morris

Bradley-Morris

Bradley-Morris is a leading recruiting firm specializing in transitioning military and veteran talent into civilian careers including Cybersecurity.

ClearHub

ClearHub

The aim of ClearHub is simple: to give businesses like yours access to the best talent, all screened and technically tested by Clearvision’s expert team.

SecurIT360

SecurIT360

SecurIT360 is a full-service specialized Cyber Security and Compliance consulting firm.

Kobalt.io

Kobalt.io

Kobalt are bringing the monitoring capabilities of enterprise-class security teams to smaller organizations.

Unisys

Unisys

Unisys is a global information technology company providing industry-focused solutions integrated with leading-edge security to clients in the government, financial services and commercial markets.

Securadin

Securadin

Securadin - Defending Your Data Security. We will assist you in learning how to maintain the confidentiality, integrity, and availability of your organization's assets.