MI5 and MI6 may be circumventing legal safeguards when they share bulk datasets with foreign intelligence services and commercial partners, a court has been told.
Most of the bulk personal datasets relate to UK citizens who are not of “legitimate intelligence interest”, the investigatory powers tribunal (IPT) heard.
The system of independent commissioners, usually retired judges, who were supposed to maintain independent oversight over these procedures had been inadequate and was a “blatant failure”, Ben Jaffey QC, for Privacy International, told the IPT.
While GCHQ has said it insists its partners adopt equivalent standards and safeguards when processing bulk data, Jaffey said, neither MI5 nor MI6 have a similar approach. “The effect will be the circumvention of the UK legal regimes,” he added. “Protections will be avoided.”
The challenge brought by Privacy International alleges that data-sharing regimes and the legal oversight system are illegal. The case has been running for three years but continues to unearth fresh details about the way in which the intelligence services handle data.
Bulk personal datasets contain highly sensitive personal information such as social media sites or online dating sites, the tribunal heard. “Such datasets are very intrusive,” Jaffey said. “They contain information that goes right to the core of an individual’s private life.”
The IPT, which is sitting at Southwark crown court this week, hears claims about the legality of surveillance and complaints against the intelligence services.
One important industry partner of GCHQ, the tribunal has been told, is the University of Bristol. Documents revealed by Edward Snowden, the US whistleblower, indicate that researchers are given access to GCHQ’s entire raw unselected datasets, including internet usage, telephone call logs, websites visited, online file transfers and others.
Researchers are also given access to GCHQ’s targeting database, supposedly delivered at least once a day, the tribunal has been told. That, it was said, is an exceptionally sensitive dataset.
Another partner with which GCHQ shares its data is HMRC. The tax collection agency has access to a datastream called Milkwhite Enrichment Service, submissions reveal.
Jaffey said analysts at GCHQ were supposed to record their reasons for searching bulk datasets, yet those statements were not seen by the oversight commissioners.
Bulk communications data and bulk personal datasets are shared in two ways – either by sending out information on disks or by allowing outside organisations to access the agency’s databases remotely.
Once that information has been handed over, Jaffey and Thomas de la Mare QC argued in their written submissions, control over it is lost: “It could be deployed in support of an unlawful detention or torture programme, in the violent interrogation of a suspect, or used to identify a target for a lethal operation. It may be (overtly or covertly) passed on to another country, even though the UK would be unwilling to share directly with that state. There is no evidence that the control principle is operated or respected by the partners with whom data is shared.”
There are no published arrangements governing the safeguards to be applied when considering sharing of data with foreign intelligence services or other UK law enforcement agencies, the IPT has been told.
One of the documents disclosed to the hearing was a letter from the new Investigatory Powers Commissioner’s Office which is critical of a former intelligence services commissioner, Sir Mark Waller.
It said: “Sir Mark Waller (ISCom) remained wholly resistant to acquiring any inspector resources (or indeed technical/legal resources) to assist him in his duties despite being advised by the then head of [the Interception of Communications Commissioner’s Office], Jo Cavan, and the interim head that succeeded her of the benefits of such resourcing.”
Outside the court, Millie Graham Wood, a solicitor at Privacy International, said: “The intelligence agencies’ practices in relation to bulk data were previously found to be unlawful.
“After three years of litigation, just before the court hearing we learn not only are safeguards for sharing our sensitive data nonexistent, but the government has databases with our social media information and is potentially sharing access to this information with foreign governments.
“The risks associated with these activities are painfully obvious. We are pleased the Investigatory Powers Commissioner’s Office is keen to look at these activities as a matter of urgency and the report is publicly available in the near future.”
James Eadie QC, who represents the Foreign Office, Home Office and intelligence agencies, denied in written submissions that any data-sharing was illegal.
“It is neither confirmed nor denied whether the [agencies] share or have agreed to share bulk personal data and bulk communications data with foreign partners and [other agencies] or (in the case of [MI6] and MI5) with industry partners,” Eadie maintained. “However, were they to do so such sharing would be lawful.”
The UK faces serious security and terrorist threats, he added. Use of bulk data is becoming more important. Analysis of bulk data communications, patterns of communication and potential subjects of interest, Eadie explained, “enables identification of specific individuals without first having to carry out more intrusive investigations into a wide range of individuals”.
The hearing continues.
