Privacy International v. Secretary of State for the Foreign and Commonwealth Office and Government Communications Headquarters (Case No. IPT/14/85/CH)
On May 13, 2014, Privacy International brought a further legal action against the GCHQ and the other security and intelligence services of the UK in the Investigatory Powers Tribunal (IPT). By contrast to its original complaint regarding the interception of communications through the Prism and upstream data collection programs, this second legal complaint concerns the widespread insertion of malware into individuals’ computers and mobile devices in order to access stored data or control the devices’ functions (for instance, activate cameras or microphones on devices without their users’ consent). In bringing this second challenge to the GCHQ’s actions in partnership with the NSA, Privacy International alleged in its Statement of Grounds that, “The use of such techniques [for infiltrating computers and other devices] is potentially far more intrusive than any other current surveillance technique, including the interception of communications. … If the interception of communications is the modern equivalent of wiretapping, then the activity at issue in this complaint is the modern equivalent of entering someone’s home, searching through his filing cabinets, diaries and correspondence, and planting devices to permit constant surveillance in future, and, if mobile devices are involved, obtaining historical information including every location he visited during the past year.” Para. 4.
Arguing that the conduct at issue violated Articles 8 and 10 of the European Convention of Human Rights, Privacy International seeks “a declaration that the matters set out in the complaint are well founded and GCHQ’s conduct has been unlawful” and an injunction “restraining any similar future conduct, an order requiring the destruction of any information unlawfully obtained and a public judgment”. (Investigatory Powers Complaint Form T2, No.8).
On February 6, 2015, the Respondents filed both Closed and Open Responses before the IPT. The Open Response, which was disclosed by Privacy International on March 18, indicated that, as with the Liberty challenge, the Intelligence Services maintained their traditional “neither confirm nor deny” (NCND) policy in regard to all factual details about their operations. To claim that NCND was compatible with the foreseeability component of the “accordance with the law” component of Article 8 of the ECHR, the Respondents invoked the IPT’s power to examine their “below the waterline” arrangements in closed hearings. In addition, the Respondents relied on the draft Equipment Interference Code of Practice (the “EI” Code) that the Home Office published on February 6, 2015, claiming that the Code “reflects the current safeguards applied by the relevant Agencies, including GCHQ.” Open Reponse, para. 66.
Notwithstanding NCND, the Open Response indicated that the EI Code allows “intended”, as well as “collateral,” “interference with the equipment” of “individuals who are not intelligence targets in their own right,” but criticized the Claimants’ “very extreme factual allegations about the scope, scale and nature of GCHQ’s activities ….” Id., paras. 27, 77.