Dedication

This report is dedicated to privacy activist Caspar Bowden, who helped us with this report and many other ORG campaigns. Caspar warned the world about online state surveillance long before the Snowden revelations. He was a tireless campaigner for the privacy rights of citizens around the world and his work will continue to inform much of what we do.

Acknowledgements

Open Rights Group would like to thank the following people for their invaluable feedback:

Ross Anderson
Paul Bernal
Owen Blacker
Ian Brown
Duncan Campbell
Adam Drew
Wendy Grossman
Eric King
Ben Laurie
Alec Muffett
Carly Nyst
Christoffer Torris Olsen

The authors

Lead writer and researcher: Javier Ruiz

Editor: Pam Cowburn

Additional content: Pam Cowburn, Jim Killock, Elizabeth Knight

Additional Research: Alexandra Stefanou

About the Open Rights Group

Founded in 2005 by 1,000 digital activists, ORG is a non-profit organisation.

As society goes digital we wish to preserve its openness. We want a society built on laws, free from disproportionate, unaccountable surveillance and censorship. We want a society in which information flows more freely. We want a state that is transparent and accountable, where the public’s rights are acknowledged and upheld.

info@openrightsgroup.org

www.openrightsgroup.org/contact

Copyright notice

Images from Powerpoints are non-copyright US government material or used in the public interest.

Text and design released by the Open Rights Group under a Creative Commons CC-By-SA 4.0 licence. You are free to:

Share — copy and redistribute the material in any medium or format

Adapt — remix, transform, and build upon the material

for any purpose, even commercially.

Set in Lato released under the SIL Open Fonts Licence

Contents

Introduction 12

About this report 13

Part One An over view of GCHQ’s capabilities and activities 15

1 What is mass surveillance? 16

1.1 Introduction 16

1.2 Surveillance and intrusion 16

1.3 Digital communications 16

1.3.1 Example 1: Internal data cables of Internet companies 17

1.3.2 Example 2: Apps data 18

1.3.3 Example 3: Private webcams 18

1.3.4 Example 4: Financial transactions 18

1.4 Content and metadata 19

1.5 When does mass surveillance start? 19

1.6 The Intelligence and Security Committee’s defence 20

1.7 Humans vs machines 21

1.8 Ambition for the further expansion of data collection 22

1.9 Conclusion 23

2 Collect it all: everyday communications turned into government intelligence 24

2.1 Introduction 24

2.2 Access to communications 25

2.2.1 Which companies are involved? 26

2.2.2 Why companies work with GCHQ 26

2.2.3 Which cables are tapped by GCHQ? 27

2.2.4 How much data is collected? 28

2.2.5 How does tapping work? 29

2.2.6 Other sources of data: satellites, radio and telephony 32

2.2.7 Bulk Personal Datasets 32

2.3 Collect and keep 34

2.3.1 Mass surveillance or bulk collection? 35

2.3.2 Evolution of Internet interception from keywords to metadata 36

2.3.3 Recording the Internet 39

2.3.4 Targets and discovery 40

2.3.5 Long term storage 43

2.3.6 Minimisation 44

2.3.7 Offensive capabilities 44

2.4 Data processing 45

2.4.1 How data is used 45

2.4.2 Tasking 47

2.4.3 Triage 47

2.4.4 Contact chaining 48

2.4.5 Location 48

2.4.6 Profiling and pattern of life analysis 48

2.4.7 Targeting 53

2.5 Dissemination of data 54

2.6 Conclusion 55

3 Invasive collection: extending the reach of the agencies 57

3.1 Introduction 57

3.2 Industrial-scale hacking 58

3.2.1 The NSA’s billion dollar hacking budget: GENIE 59

3.2.2 Hacking the target: QUANTUM 60

3.2.3 Automated delivery of malware: TURBINE 61

3.2.4 Access to the high speed backbone: TURMOIL and TURBULENCE 62

3.2.5 Malware and hacking tools 63

3.3 Breaking Internet security 65

3.3.1 Weakening standards 68

3.3.2 Corporate partnerships 68

3.3.3 Exploiting vulnerabilities 69

3.3.4 Direct attacks 71

3.4 Hacking attacks and operations 72

3.4.1 Belgacom and German satellite businesses 72

3.4.2 Gemalto SIM Card 73

3.4.3 Telecommunications companies 74

3.4.4 Tor 74

3.5 Oversight of Active Signals Intelligence 76

3.6 Conclusion 76

4 How mass surveillance is used 81

4.1 Introduction 81

4.2 Intelligence and government 82

4.3 How information is employed: the uses of mass surveillance 83

4.3.1 Law enforcement and anti-terrorism 83

4.3.2 Strategic Intelligence 84

4.3.3 Reference data 86

4.3.4 Cyber attacks and strategic dominance 87

4.3.5 Cyber defence and the digital border 87

4.4 Predictive analytics and profiling 87

4.5 Automated machine processing of information by computers 89

4.6 Social Media monitoring and open source intelligence 90

4.7 Conclusion 92

5 A Global Surveillance Network 93

5.1 Introduction 93

5.2 The Special Relationship and friends 94

5.3 Integrated systems of mass surveillance 95

5.4 British citizens’ data at risk 98

5.5 PRISM and the UK 99

5.5.1 The legal basis for PRISM 100

5.5.2 PRISM in the wider context of US surveillance 101

5.5.3 Access to PRISM data by UK intelligence agencies 102

5.6 Access to NSA Databases 103

5.7 Spying on citizens of Five Eyes countries 104

5.8 Conclusion 105

6 Beyond signals intelligence: Offensive capabilities 108

6.1 Introduction 108

6.2 Psychological operations against political activists 109

6.3 Using illegal attack techniques: denial of service 110

6.4 Appropriating enemy systems: fourth party collection 111

6.5 Take over of networks of hijacked computers 111

6.6 Conclusion 112

Part Two Analysis of the legal and policy challenges 114

7 The UK’s surveillance laws 115

7.1 Introduction 115

7.2 Are GCHQ’s activities legal? 116

7.3 The main regulation of surveillance: RIPA 117

7.3.1 Bulk collection 118

7.3.2 Internal vs external communications 118

7.3.3 Lack of judicial authorisation 119

7.3.4 Capturing everything 120

7.3.5 Safeguards, content and metadata 121

7.3.6 Targeting UK communications 122

7.3.7 Machine processing of intercepted materials 123

7.4 Access to data from providers: DRIPA 124

7.5 Bulk Personal Datasets 125

7.6 Lack of regulation of international data sharing 126

7.7 Human Rights Act and USSID-18 128

7.8 The legality of hacking 128

7.8.1 Hacking codes of practice 128

7.8.2 Industrial scale hacking 129

7.8.3 Immunity from the Computer Misuse Act
130

7.9 International law relating to cyber warfare 131

7.10 Interference with Wireless Telegraphy 133

7.11 Reading encrypted communications 133

7.12 Legal challenges 134

7.13 Conclusion 136

8 Holding our intelligence services to account 146

8.1 Introduction 146

8.2 The Executive and Ministers 147

8.3 Parliament and the Intelligence and Security Committee 147

8.4 The Commissioners 149

8.4.1 Interception of Communications Commissioner’s Office 150

8.4.2 Intelligence Services Commissioner 151

8.4.3 Reforming the Commissioners 152

8.5 The Investigatory Powers Tribunal 153

8.6 Individuals and redress 153

8.7 Admissibility of Intercepted Communications 154

8.8 Reviews of Surveillance Practices 155

8.9 Conclusion 156

9 Threats and risks 157

9.1 Introduction 157

9.2 Threats to democracy 157

9.2.1 Institutional abuse 158

9.2.2 Threats to privileged communications 159

9.2.3 Discrimination, profiling and mistrust 159

9.3 Threats to freedom of expression 160

9.3.1 The media 160

9.3.2 Writers 161

9.3.3 Activists 161

9.4 Threats to UK business and innovation 161

9.5 Threats to the security of the Internet 162

9.6 Threats to secure technology 163

9.7 Threats to personal security 164

9.8 Threats to Internet governance 165

9.9 Threats to the UK’s autonomy and foreign standing 165

9.9.1 Spying on our allies 166

9.9.2 Human rights 166

9.10 Threats from the militarisation of cyberspace 167

9.11 Conclusion 168

10 Conclusion 173

10.1 Introduction 173

10.2 Defining mass surveillance 174

10.3 Laws that cannot be exploited 174

10.4 Effective oversight 174

10.5 Transparency 175

10.6 The challenge to Parliament 175

11 Recommendations 178

11.1 Bulk collection 178

11.2 Regulation of GCHQ’s activities 178

11.3 Legal reform 178

11.4 Judicial authorisation of warrants 179

11.5 Oversight 179

11.6 Transparency 180

11.7 Internet security 180

Introduction

It is two years since NSA contractor Edward Snowden revealed through The Guardian, Der Spiegel and The New York Times that the NSA and GCHQ in the UK were collecting and analysing global communications on an unprecedented scale. As GCHQ themselves put it, their intention was to “master the Internet”, collecting data from every possible digital communications channel so they could get “all the signals, all the time”.1

The initial response of the UK Government was to refuse to acknowledge the existence of the programmes and activities described. It asserted that all surveillance conducted in the UK took places in accordance with the law, under warrants issued by secretaries of state.

Over the last two years, there has been recognition within Government and the agencies that the public expects a degree of transparency about taxpayer-funded surveillance activities, even if they relate to operations that themselves must be kept secret. The Director of GCHQ, Robert Hannigan, admitted in an opinion piece for the Financial Times that the “intelligence agencies such as GCHQ need to enter the public debate about privacy”.2

Despite these admissions, so far the Government’s primary contribution to that debate has been to argue that the state needs to extend its powers of surveillance, private companies should willingly help them do this and the public should accept that their privacy will be invaded in the name of security.

We challenge these assumptions. Powers need to exist. They also need to be restrained, so that surveillance is limited to that which is necessary and proportionate.

In this report we show that the bulk collection and processing of personal data carries many risks, not just to our privacy, but our democratic processes, Internet security, economy and foreign standing. The aim of this report is to encourage Parliament and the Executive to consider the full costs and benefits of surveillance, in order to better understand the balance that needs to be struck.

This year, three inquiries into surveillance have published their findings. All agree that surveillance law in the UK needs radical reform. While ORG agrees that legal reform is needed, the Inquiries base their assumptions on the assertion that the bulk collection of our personal data is a necessary activity that does not breach our human rights.

As this report shows, the collection, analysis and processing of data is being carried out on an unprecedented scale and in an intrusive manner. This is partly the result of the agencies taking advantage of changes in technology allowing them access to greater amounts of information. It is also the result of failures of democratic government and oversight bodies to inform Parliament of the choices that were being made.

ORG, as part of the Privacy not Prism coalition, is challenging the practice of bulk collection at the European Court of Human Rights, obliging the UK Government to explain how GCHQ’s blanket surveillance regime is foreseeable in law, and necessary and proportionate.

In autumn 2015, the Government will lay the draft Investigatory Powers Bill before Parliament. It is believed that the Government will attempt to re-insert some of the provisions of the Communications Data Bill, also known as the Snoopers’ Charter, into this new Bill – including obliging ISPs to keep even more of our personal data for use by the police. This would be wrong. None of the independent reviews have seen a strong case for new powers. Any new bill should be an opportunity to limit and restrain surveillance to what is necessary and proportionate, not an attempt to increase the state’s powers.

Targeted surveillance is necessary for law enforcement and intelligence agencies to fight serious crime and terrorism. With more transparency, accountability and proportionality, we believe that the public will have confidence in the work of the security services. The alternative is to allow the security services to “master the Internet”, causing us to lose the freedom and rights that they are here to protect.

About this report

Part 1 of this report gives a broad overview of GCHQ’s activities, looking at the range of data that is being harvested in ‘passive’ collection, invasive methods used to collect data and how the security services’ mission has expanded from passive collection to offensive capabilities. We also look at how data is processed, stored, analysed, accessed and shared with international partners.

Part 2 analyses how the legal regime has permitted these activities to take place and where the loopholes are being exploited. We also examine the problems with current oversight mechanisms, and where they are failing to hold the security services to account. Finally, we examine the threats that mass surveillance brings – not just to our privacy but to free speech, democracy, Internet security, the economy and our foreign standing.

About GCHQ

GCHQ is the UK’s signal’s intelligence agency. Over the past 20 years GCHQ has come out of the shadows of the Cold War, when its existence was not even acknowledged, and is slowly being integrated into the wider civil service.

GCHQ operates on three fronts. At the domestic level, GCHQ provides support with interception and recovery of encrypted data to a broader range of Government bodies for law enforcement, through the National Technical Assistance Centre (NTAC). NTAC was transferred from the Home Office to GCHQ in 2006, and serves the UK intelligence and security agencies and police forces, as well as HM Revenue and Customs (HMRC) and the National Crime Agency (NCA).

GCHQ is also responsible for the CESG, which is the UK’s National Technical Authority for Information Assurance (IA) – responsible for ensuring that information systems used in the public sector are properly secured. In this report, we argue that this responsibility is inconsistent with GCHQ’s other roles and recommend that the functions should be separate.

In parallel, GCHQ works as a classic external spy agency responsible for strategic intelligence, looking for potential threats to the UK.

The international side of GCHQ involves working with the UK’s Secret Intelligence Service, MI6, and the military. Critically, GCHQ also operates very closely with the US National Security Agency (NSA) and the other partners in the Five Eyes alliance of signal intelligence agencies (Australia, Canada, New Zealand, the UK and the US). This involves extensive sharing of information, techniques and resources through a series of secret agreements.

1 http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa

2 http://www.gchq.gov.uk/press_and_media/news_and_features/Pages/Director-opinion-piece-financial-times.aspx

Part One

An over view of GCHQ’s capabilities and activities

1 What is mass surveillance?

1.1Introduction

Mass surveillance means the collection, storage, analysis and sharing of personal information from large numbers of people regardless of whether they are suspected of a crime. This could be all, or the majority of, a country’s population or, as we have seen through the Snowden leaks, collection on a global scale.

The British Government has never officially acknowledged the existence of TEMPORA and other programmes that allow wholesale collection of Internet traffic. However, it has simultaneously defended the bulk collection of data in order to find the “needle in the haystack” and argued that this type of collection is targeted, not mass surveillance.

ORG rejects both of these arguments. In this chapter, we will show how GCHQ and the NSA’s programmes amount to mass surveillance.

1.2Surveillance and intrusion

When we consider surveillance, we need to ask: Is this activity intruding on an individuals’ right to privacy? How intrusive is it? Is it necessary to intrude on this individual’s privacy?

These are the questions that courts consider when judging whether surveillance is necessary and proportionate. In April 2014, the Court of Justice of the European Union ruled that the Data Retention Directive, which obliged ISPs to collect and keep personal communications data, interfered with privacy rights. The Court declared the Directive invalid because it failed to limit surveillance “to what is strictly necessary” and did, “not require any relationship between the data whose retention is provided for and a threat to public security”.1

Some state surveillance will always be necessary to tackle serious crime, but that does not justify intrusion into everybody’s lives. If people feel that their lives have been intruded upon, they will change their behaviour; they may be more cautious about what they say, even in private communications. The negative impact of this is explored in Chapter Nine.

1.3Digital communications

Advances in technology mean that the data we generate as individuals has proliferated. Through phone calls, texts, emails, web searches, apps, games, online purchases, we create huge volumes of information about ourselves on a daily basis. This is not just content, (for example, the words we write in an email) but also the associated data – when we sent it, who we sent it to, and so on.

Technological advances also mean that devices can store more and more data and that the Internet is getting faster and faster. The opportunities for collecting, processing and storing data are becoming easier and cheaper for governments to carry out.

In the next chapters, we will show how GCHQ and the NSA work closely to collect all kinds of information flowing through Internet cables, including our personal phone calls, emails, text messages and web searches. We have learnt from the leaked documents that both the scope and volumes of information collected are vast.

The agencies are constantly looking for new data streams and ways to make sense of and enrich what is already available. The Snowden documents contain many examples of activities that do not appear to be directed towards a specific security operation. We have also learnt that GCHQ carries out extensive experiments on data and many forms of analytics.

In Chapters Two and Five, we will outline the vast capabilities of the TEMPORA and PRISM programmes. Below are examples of some of the smaller programmes that show the wide range of personal and intrusive information that is being collected.

1.3.1 Example 1: Internal data cables of Internet companies

The MUSCULAR2 programme is based in Britain and mainly run by GCHQ. It intercepted the private cables that connect the data centres of some Internet companies, such as Yahoo! and Google.

In a period of 30 days, MUSCULAR collected 181 million records.3 In response to the revelations, Google’s chief legal officer, David Drummond said: “We are outraged at the lengths to which the government seems to have gone to intercept data from our private fiber networks, and it underscores the need for urgent reform”.4

With “full take” access to the internal data links of the companies, the agencies can intercept communications in real time and take “a retrospective look at target activity”.5 MUSCULAR is also fed into the global NSA system as part of the WINDSTOP programme of second party collaboration with close allies such as the UK.6

1.3.2 Example 2: Apps data

The agencies monitor the data sent by mobile phone apps about their users, such as the popular Angry Birds.7 According to leaked NSA documents, mobile apps data provides an intimate picture of people’s lives, depending on the information they have personally supplied, and the profiling information the mobile advertising platforms exchange with the handset in order to serve personalised adverts. This information can include home country, current location (through geolocation), age, gender, postcode, marital status , income, ethnicity, sexual orientation, education level and number of children.

1.3.3 Example 3: Private webcams

There are documents showing that GCHQ tapped into the private webcam communications of innocent Yahoo! subscribers without clear legal authorisation. The agency collected millions of pictures, including substantial amounts of explicitly sexual materials.8 Apparently unknown to Yahoo!, the programme OPTIC NERVE affected 1.8 million unwitting users of the service in a six month period without any form of individual targeting. The images were apparently used to improve facial recognition software. According to The Guardian, metadata and images were also fed into the NSA database and search engine XKEYSCORE9.

US senators have launched an investigation10 into these activities, accusing GCHQ of “breathtaking lack of respect for privacy and civil liberties”. GCHQ has simply provided a boilerplate response about compliance with UK laws, but this programme seems very hard to justify under current legislation. We believe this particular incident deserves full investigation as one of the most egregious privacy intrusions documented.

1.3.4 Example 4: Financial transactions

Bulk collection capabilities allow for the development of many projects not directly related to communications. German news organisation Der Spiegel revealed that the NSA, with the help of GCHQ, tracked financial transactions, including bank transfers and credit card transactions, and had collected some 180 million datasets by 2011.

This programme, referred to as “Follow the Money”, apparently led GCHQ’s lawyers to raise concerns about the collection, storage and sharing of such “politically sensitive” and “bulk data – rich personal information. A lot of it is not about our targets”.11

1.4 Content and metadata

The information captured by the agencies can be broadly split into two categories, which will be discussed throughout this report:

Content: The message itself, such as voice recordings, an email attachment, or a text message. In UK surveillance law, content is called communications.

Metadata: Associated information, such as phone numbers, email addresses, when the transmission took place, and location data. Some, but not all, of this data is regulated specifically as communications data. (We discuss this in more detail in Chapter Seven.) In addition, intercepting Internet communications unavoidably involves collecting both content and metadata.

GCHQ has a very broad legal authority to intercept most Internet communications passing through the UK, if the communication either starts or ends in the UK. In practice this means a large proportion of our communications (see Chapter Seven). GCHQ collects both content and metadata. The content of most communications is deleted after a few days, but the metadata is kept for some 30 days for further analysis.

Traditionally metadata collection was perceived as less intrusive than the interception of content – reading the envelope was not as bad as opening and reading the letter. But nowadays it is widely acknowledged that metadata can provide an intimate picture of an individual’s life. We can map social relationships and travelling patterns just from metadata, without anyone looking at the content of messages.

Combined metadata allows for intrusion that is comparable to the direct surveillance of an individual. This was illustrated by German MP Malte Spitz, who made six months’ worth of mobile phone records available to journalists. These combined with the data from social media and publicly available sources provided an incredibly detailed picture of Mr Spitz’s activities.12

At present, content and communications data are treated differently under the law but they can both be used to gain intrusive insights into our life. One of our key recommendations in this report is to give content and metadata an equal level of protection in surveillance legislation (see Chapter Seven).

1.5 When does mass surveillance start?

It has been argued that the bulk collection of data is not surveillance and that surveillance only begins when data is transferred to long-term storage to be analysed. Others have argued that surveillance does not occur until it is seen by a human eye.

The Court of Justice of the European Union ruling on the unlawfulness of the EU Data Retention Directive was unequivocal in their consideration that collection of data is in itself intrusive. How it is used may then add more layers of intrusion.

ORG supports this view that surveillance starts at the point that communications are intercepted, whether or not someone looks at or reads them. Firstly, if we know that our communications are being collected, our privacy us already breached; it will affect our behaviour and chill our free speech.

Secondly, we have no guarantee of knowing whether collected data will be looked at, leaked or shared in the future. With technological advances, it is hard to predict what particular information will become useful in the future, and how it might be used to intrude on our lives.

1.6 The Intelligence and Security Committee’s defence

In March 2015, the Intelligence and Security Committee (ISC) of the UK Parliament published Privacy and Security: A modern and transparent legal framework. This report claimed that the bulk interception of Internet data by GCHQ is not mass surveillance because only a proportion of data is collected, thanks to a combination of policy, operational and technical limitations.

It describes two completely separate physical systems of surveillance operated by GCHQ:

One is an “investigative tool”, targeted at “specific identifiers relating to a known suspect” to be analysed by intelligence operatives. This system collects data from an unspecified number of cable points they call ‘bearers’ (we discuss how these work below). According to the ISC, these comprise “a very small percentage of the ‘bearers’ that make up the Internet”. Only a small proportion of the collected information – deemed of high intelligence value – is ever seen by analysts, who have to prioritise their limited resources.

A completely different “discovery, or intelligence gathering tool” would truly provide the “‘bulk interception’ capability that has led to allegations that GCHQ are monitoring the communications of everyone in the UK”. Selected categories of data likely to be of interest are collected and then computers run “complex searches” to reduce the “odds of false positives”. The resulting list of communications is presented to analysts. This system would operate on an even smaller set of Internet bearers than the targeted tool above.13

The Snowden leaks mainly focused on the second bulk collection system, which the ISC claims is the smaller of GCHQ’s systems.

However, we are not sure if the ISC’s clear cut depiction of a main system of targeted interception and a smaller more limited, non-targeted system fully matches the actual operations. The documents leaked by Snowden show a much more dynamic picture of constant experimentation and opportunistic growth, where the lines between targeted surveillance and “discovery” are constantly redrawn, with new potential target identifiers being created all the time.

The ISC takes issue with the word “mass” in mass surveillance. Instead the report describes a funnel of data, where out of the 100,000 Internet bearers, GCHQ can only access a small percentage and only a smaller number of these are actually tapped following operational and strategic priorities. Through a number of software and analytical processes, the collected data is further narrowed, with the end result that only a tiny number of actual communications are ever looked at. This argument suggests that because GCHQ is not collecting the entire traffic running across the global Internet, mass surveillance is not taking place.

While the committee censored any actual figures in their report, they agree that the numbers involved at each stage are still large. But they argue that because there are processes in place to reduce the information at every stage we should not consider it mass surveillance. It’s all a matter of proportion.

The committee dismisses the notion that collecting large amounts of data without suspicion in itself is intrusive. They chose to focus on the limited use of content and communications at the end of the process (see 1.7 Humans vs machines below). However, they also reported that according to GCHQ the main value of mass surveillance is not reading specific communications but processing vast troves of available metadata. As we saw above, metadata analysis can be highly intrusive, and the committee’s limited acknowledgement of this fact undermines their argument that mass surveillance is not taking place.

1.7 Humans vs machines

The security services make a crucial distinction between bulk collection and the selection of a smaller volume for further “reading, looking at or listening to”. The argument is that it is acceptable and necessary to collect and process vast amounts of data as long as only a minority of it is dealt with by human operatives.

The line was first used by an unnamed GCHQ source in declarations to The Guardian at the time of the disclosures:

“Essentially, we have a process that allows us to select a small number of needles in a haystack. We are not looking at every piece of straw. There are certain triggers that allow you to discard or not examine a lot of data so you are just looking at needles. If you had the impression we are reading millions of emails, we are not.”

Sir Iain Lobban, head of GCHQ from 2008 until January 2014, used the metaphor of the “needle in the haystack” in his appearance in Parliament in November 2013, stressing:

“We do not spend our time listening to the telephone calls or reading the e-mails of the majority, the vast majority that would not be proportionate. It would not be legal. We do not do it.”

This distinction is reflected in the law. In order to access the content of materials, GCHQ needs further compliance with Section 16 of Regulation of Investigatory Powers Act 2000 (RIPA), which requires a basic case is made for why it is necessary to access the materials. Section 16 also sets out some provisions “to limit the extent to which intercepted material can be selected by reference to ‘factors’ that in essence would select communications to or from an individual who is known to be (at the time) in the British Islands”. Chapter Seven looks at RIPA and surveillance legislation in more detail.

This emphasis on protection at the end of the aquisition process is inadequate. For a start, it is not clear what level of computer processing is acceptable as long as no human “reads, looks at or listens to” the communications. When it comes to surveillance, computers are far more powerful than humans; they can find, analyse and process vast amounts of information. Data could be interrogated in ways that that do not involve “selecting communications” as such and would not trigger the section 16 safeguards mentioned above. Computers can generate new forms of intrusive information, such as social maps of people who know each other, Software such as KODA,14 patented by the NSA, reads intercepted texts and writes up short summaries of them. Facial recognition software can identify individuals.

Increasingly, it is not necessary for anyone to access communications or data, as computers can provide increasingly sophisticated analysis. This raises a whole new raft of concerns not properly addressed by current legislation. As we show in Part One of this report, the computer processing of data is largely unregulated and each stage carries privacy risks. The assertion that privacy is breached only when operatives access communications belies the complexity and sophisitication of automated analysis that takes place before human operatives make specific queries and interrogate the data.

1.8 Ambition for the further expansion of data collection

The former chief of the CIA, David Petraeus, told a conference in 2012 that the Internet of Things presented an opportunity to spies.15 Soon, they will have routine access to a wealth of data from cars and home appliances, such as smart TVs and electricity meters. Most of these new information channels can be lawfully accessed by GCHQ without suspicion if one end of the communication is abroad. Given the current strategy of GCHQ and other signals intelligence agencies to “collect it all”,16 it is to be expected that the agency will attempt to integrate any available data in their collection systems.

The Internet of Things will see many electronic goods connected to the Internet in order to exchange data with users, manufacturers and third parties. Of particular concern is the development of wearable technologies and health sensors which can track not just minute movements, but also a broad range of physiological information.

Growing numbers of cars are fitted with telematics, which are remote location tracking technologies, used for insurance and performance monitoring. The International Automobile Federation has raised concerns over who can access and control that data.17 It’s been revealed that TV sets fitted with voice recognition may transmit shared private conversations with manufacturers.18

The umbrella group of EU data protection authorities, Article 29 Working Party, has raised concerns about the potential inferences derived from such data:

“Apparently insignificant data originally collected through a device (for example, the accelerometer and the gyroscope of a smartphone) can then be used to infer other information with a totally different meaning (for example, the individual’s driving habits).”19

The amalgamation – or triangulation – of databases is a well known problem for privacy, and can provide a much richer picture of an individual’s life, or even allow for the re-identification of previously anonymous data.20

1.9 Conclusion

In their own words, the agencies describe the current situation as a “golden age” for surveillance.21 The transformation of communications created by the Internet has been matched by the proliferation of data that we generate. This is only going to grow as more and more household products, from cars to TVs, use digital technology.

Undoubtedly this data is of use to the secret services and other law enforcement agencies but this cannot justify the bulk collection of data from entire populations who are not suspected of crimes. One of the cornerstones of our justice system is the presumption of innocence until proven guilty. Bulk collection reverses this presumption and places us all under suspicion.

1 https://wiki.openrightsgroup.org/wiki/Data_Retention_Directive#ECJ_incompatibility_ruling

2 http://apps.washingtonpost.com/g/page/world/how-the-nsas-muscular-program-collects-too-much-data-from-yahoo-and-google/543/

3 http://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html

4 http://www.theguardian.com/technology/2013/oct/30/google-reports-nsa-secretly-intercepts-data-links

5 Ibid

6 https://github.com/nsa-observer/documents/blob/master/files/pdf/nsa-windstop-muscular-incenser.pdf

7 http://www.theguardian.com/world/2014/jan/27/nsa-gchq-smartphone-app-angry-birds-personal-data

8 http://www.theguardian.com/world/2014/feb/27/gchq-nsa-webcam-images-Internet-yahoo

9 http://www.theguardian.com/world/2014/feb/28/nsa-gchq-webcam-spy-program-senate-investigation

10 Ibid

11 http://www.spiegel.de/international/world/how-the-nsa-spies-on-international-bank-transactions-a-922430.html

12 http://www.zeit.de/digital/datenschutz/2011-03/data-protection-malte-spitz

13 Privacy and Security: A modern and transparent legal framework, The Intelligence and Security Committee of Parliament, March 2015

14 https://www.nsa.gov/research/_files/tech_transfers/nsa_technology_transfer_program.pdf pp34

15 http://www.wired.com/2012/03/petraeus-tv-remote/

16 http://www.theguardian.com/commentisfree/2013/jul/15/crux-nsa-collect-it-all

17 http://www.fia.com/news/planning-future

18 http://www.theguardian.com/technology/2015/feb/09/samsung-rejects-concern-over-orwellian-privacy-policy

19 http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp223_en.pdf

20 http://ico.org.uk/for_organisations/data_protection/topic_guides/anonymisation

21 https://www.ifex.org/international/2015/01/28/data_privacy_day/

2 Collect it all: everyday communications turned into government intelligence

2.1 Introduction

In June 2013, documents leaked by Edward Snowden and released by The Guardian,1 revealed that GCHQ engages in the mass collection, storage and analysis of digital communications, including both content and data. Much of this mass surveillance was alleged to take place through a secret programme codenamed TEMPORA.

The UK government and others have argued that the collected data is filtered at every stage, so only a small amount is ever acted upon. As we will see in this chapter, this argument has some basis, if nothing else due to resource constraints. It does not, however, detract from the gigantic scale and breadth of the agencies’ activities.

The fact that western intelligence agencies monitor the Internet is not new. The European Parliament report, Interception Capabilities 2000, documents how the NSA and GCHQ have operated their own international Internet-like networks since the 1980s, and were well prepared to surveil the open Internet. The NSA was monitoring Internet data at nine sites in 1995. Efforts to capture the small proportion of Internet data that had intelligence value were already in place.2

Snowden uncovered a fundamental shift in surveillance. The previous approach of capturing information of intelligence value has given way to a new approach based on the wholesale acquisition of data, through a large and complex global surveillance system run by the US, the UK and their various allies. These new systems are primarily about “discovery”, finding new unknown targets and building other forms of intelligence, such as maps of social relationships.

While rejecting accusations of “mass surveillance”, both the NSA and GCHQ have stated in leaked documents their desire to “collect all the signals, all the time”.3 In order to fulfil this aim, they want the power to collect all data generated by our daily use of the Internet, phones and other technology. They aim to do this through:

Achieving full coverage of all global communications by accessing any channels available. This is primarily through undersea fibre optic cables, but includes other channels, such as satellites, radio and telephony.

Increasing the capacity to collect and store communications content and data – both Internet and telephony – with the dual aim of having live access to communications and the ability to look back in time to reconstruct past behaviour.

Applying sophisticated computer techniques to process the vast amounts of data collected, both to deliver comprehensive knowledge about known targets, and also to perform prospective analyses that generate completely new insights.

A basic understanding of any technical system is essential for its regulation. Using the leaked documents, we give an overview of how the agencies collect and process the communications of millions of people. The current policy of keeping capabilities and procedures top secret (without considering the actual harm of disclosure) denies the public the ability to engage in a rational debate, thus undermining trust in the agencies’ accountability.

From the limited information and analysis available, it is difficult to get a complete picture of the UK mass surveillance regime. Given the close working relationship GCHQ enjoys with the NSA, US documents can shed some light on how the former functions. We can also assume that the UK will in most cases have an equivalent counterpart programme to the US, but this may not always be the case.

These systems are inherently complex. Keeping track of their own activities seems to be difficult even for the agencies themselves, and most of the leaked UK related documents published come from internal documentation systems designed to help GCHQ employees stay up to date. Any explanations will therefore be incomplete and partially arbitrary, and we do not aim to provide a technical audit of UK surveillance.

In addition, the leaked documents focus on one particular agency’s programmes and policies. There is little information on how GCHQ works with other elements of the UK security state and the actual impacts, both positive and negative, of the systems described.

2.2 Access to communications

The wiretapping of international fibre-optic cables is GCHQ’s main source of data; the communications of millions of people are intercepted every day. Since the 1990s, most communications, including voice calls, have moved to submarine cables and the Internet. GCHQ is able to intercept many international undersea communications cables largely because of the strategic position of the UK. For historical and geographical reasons, 25% of the world’s communications flow through the UK according to GCHQ,4 as shown in the map below.

This wiretapping takes place with the collaboration of telecommunications companies, as part of the GCHQ programme Global Telecoms Exploitation (GTE). Because of the way the Internet routes data around the globe, intercepting online traffic going in and out of Britain inevitably scoops up the communications of billions of people worldwide. This capacity was downplayed in the ISC’s report into surveillance, but it forms the basis of “mass surveillance” and involves huge logistical efforts. (See section 1.6 in Chapter One)

Although most of the UK’s cable taps take place in the UK, there are also cable taps overseas, such as in Cyprus, and there are plans to expand this capacity.

Leaked documents show that the NSA’s surveillance programme RAMPART-A covers access to private companies via foreign partners. These show that mass cable collection started in 1992.5

2.2.1 Which companies are involved?

Most access to cables relies on arrangements with a relatively small number of telecommunication companies that operate a large number of international cables. Documents seen by by Channel 4 News show that GCHQ will also carry out covert access operations to tap cables when required.6

In August 2013, the German newspaper Süddeutsche Zeitung7 in collaboration with the NDR channel,8 made public the names and codenames of cable companies known to cooperate with the British authorities:

Verizon Business – DACRON

British Telecommunications – REMEDY

Vodafone Cable – GERONTIC

Global Crossing – PINNAGE

Level 3 – LITTLE

Viatel – VITREOUS

Interoute – STREETCAR

These companies operate not only some of the most important Internet cables, but also other critical infrastructure such as exchange junctions and data centres.

2.2.2 Why companies work with GCHQ

The UK – like most modern states – has a long history of collaboration between government and domestic communications companies that can be traced to the first postal services.9 Companies are legally compelled to give GCHQ access to foreign communications through secret warrants, supported by multimillion pound payments of taxpayers’ money to compensate for their efforts.10 These broad warrants are meant to target communications which either start or end outside the UK. In today’s globalised society, they can cover vast amounts of information from British citizens. In Chapter Seven, we discuss the legal aspects of these agreements but more transparency is a fundamental step for reform.

Wholesale access to cables by security agencies has been documented in the US in the past, with AT&T being sued by civil rights groups for transferring bulk Internet data to the NSA from its facilities in San Francisco.11 But British operations until now have been less well publicised. The Interception Capabilities 2000 report for the European Parliament12 provided some details of how GCHQ was tapping into submarine cables around the world in clandestine operations.

2.2.3 Which cables are tapped by GCHQ?

Several documents from GCHQ relating to their access to cables at around 2009 have been released by the German newspaper Süddeutsche Zeitung.13 These show that at the time the above companies had potential access to 63 fibre optic cables around the world, in places as far apart as Malta, Japan and the Caribbean.14 By the end of 2015 there will be 299 submarine cables that are active, under construction, or at least fully funded.15 These figures are likely to have changed and do not represent effective access, but nevertheless 63 out of 200 is a substantial proportion of global cable access for a single country.

It appears that in practice GCHQ only accesses a smaller subsection of those cables, and mainly those that land in the UK. According to the leaked documents, in 2009 GCHQ had good access to 13 major cables, other types of installations, possibly exchange junctions, and other smaller scale cables. Other documents list many cables managed by partner companies where the agency claimed not to have good access.

The highest concentration of tapped cables appears to be in Cornwall, where most transatlantic cables have been located for over a century. GCHQ has a major surveillance facility in the area near Bude, the landing point for seven major cables.16 But there are tapped cables in many other parts of the UK, from Southport to Brighton.

In addition to the UK, the other geographical location with extensive collection and processing capacity is the Middle East. There are reports that GCHQ’s facility in Seeb, Northern Oman, intercepts cables running through the Persian Gulf17 and is allegedly named in several documents as one of the main processing centres for TEMPORA. British military facilities in Cyprus have also been linked to cable tapping18 and it is stated that the NSA has paid for half of the costs of UK bases in the former colony.19 One of the largest tapping operations concerns the Apollo South cable, which runs from France to the US, but the documents do not specify where exactly the cable is tapped.

In some cases, more than one company appears to be involved in the tapping. In separate documents, Süddeutsche Zeitung claimed that Vodafone and BT have helped GCHQ access a cable – TAT-14 – that routes communications to Germany.20 Leaked documents show that this cable could potentially be accessed via four companies who have ‘Direct Cable Ownership’ (DCO), that is, they own or manage the infrastructure. In other cases, access is achieved through the ‘Indefeasible Rights of Use’ that is, a partner company to GCHQ merely rents access to a cable. In these cases, physical access may be needed by the company, for instance to junction boxes and may be employed by GCHQ to gain access to other data streams.

2.2.4 How much data is collected?

Leaked documents show that it is likely that GCHQ has the potential to access every cable channel in and out of the UK, but can only collect information from a fraction at a time.

This capacity to access and collect information, is not necessarily the same as the overall capacity to process and analyse it at the same time. The leaked documents also refer to the egress capacity of each cable.

Egress refers to the amount of data can be effectively sent elsewhere for processing. GCHQ has to send data to other locations far from the tapped cable for further analysis and storage. The only realistic way to do this at the volumes required for mass collection is to use other fibre optic cables of comparable capacity to the ones being tapped. This is likely a limiting factor, and GCHQ’s reports always refer to both the access and egress capacity of each cable.

The difference between potential access and effective access is used to minimise the impact of surveillance. According to the Intelligence and Security Committee (ISC) Privacy and Security report, GCHQ has theoretical access to only a small number of cables among the many that make up the global Internet, and of those in practice they only access an even smaller number, depending on priorities and capacity.

A GCHQ document from 2010 gives some detail on the actual capacities, showing that the agency has substantial capabilities.21 GCHQ can “actually survey the majority” of the 1600 available 10Gb/s channels within the cables around the UK, and can switch their focus to those with the most intelligence value at a particular time. According to the document this translates into the following capabilities (in 2010):

GCHQ “can survey”

Approx. 1600 Gb/s bearers

“can intercept/touch”

Approx. 800

“can cyclic survey”

188

“can egress to GCHQ for processing”

87

This table shows that it is correct to say that GCHQ only practices wholesale data processing on a smaller proportion of the cables around the UK. But it also shows that they can potentially access a large majority.

According to analysis by the investigative journalist Duncan Campbell22 some of these companies also operate long distance optical fibre communications networks throughout the UK, installed and paid for by GCHQ. These networks are used to send data from the tapped cables to Bude or GCHQ’s headquarters in Cheltenham.

We shoudl note that the 2010 documents are now very likely to be outdated, with huge increases in access and overall capacity. The global capacity of undersea fibre optic cables has grown on average 36% annually since 2008. It23 is very likely that GCHQ has greatly expanded its operations since the time covered by the leaked documents. For example, in section 2.3 we discuss a massive data collection programme that in 2012 involved some 250 of those bearers.

Another leaked document named 2013 Access Vision24 states the agency planned to “be using the world’s biggest” Internet surveillance system and to grow their Internet “access” to 800 10Gb/s channels, including a growing proportion overseas. Another document states that GCHQ is hoping to more than triple its access capacity to 1,693 10Gb/s bearers.25

These figures may not mean much to the average citizen in terms of how much data we are talking about – 10Gb/s can transmit some 120,500 Web pages per second26 – but put in context claims that GCHQ have very limited access to the cables. The agency hopes to have full coverage of the UK cable infrastructure and it is only limited by resources, but over time there is no reason why this aim could not be achieved.

2.2.5 How does tapping work?

The warrants require companies to install equipment27 that allows for the information travelling through the cables to be duplicated for GCHQ with minimal interference with traffic.28

Fibre-optic cables are made of very thin glass strands that carry data through light. Within each strand light is split into different colour wavelengths to create independent channels of communications that massively improve overall capacity, for example allowing phone calls and Internet traffic to share the same cable.

Cables divide the signals using a method that is termed wavelength-division multiplexing (WDM). This technique uses different infrared light colours (wavelengths), in some cases dozens of them, to separate the channels. Each of these channels – called bearers – can usually carry some 10 Gb/s (gigabits per second) of information, although growing numbers operate at 100 Gb/s. A submarine cable will have dozens of these channels.

Once the agency has physical access to the cable itself, tapping takes place at the channel/bearer level; for each cable the agency may be able to access several channels/bearers.

According to the ISC report the first minimisation of surveillance takes place when agencies select specific cables for tapping. Recently evidence has been released that GCHQ used access to high level Internet networking equipment to “re-route selected traffic across international links towards GCHQ’s passive collection systems”.29 The actual tapping will involve installing probes that duplicate the signals for collection into specialist equipment.

As we can see in the slide below from NSA training material,30 accessing communications involves quite a complex technical process before the agencies even get to process the intercepted data and content. The objective of this process is to feed the data to the systems that can rebuild Internet packets ready for exploitation.31

Cable and Wireless/Vodafone, INCENSER and NIGELLA

Documents released as part of an investigation by Channel 4 News and several German media outlets show how Cable and Wireless – owned by Vodafone since 2012 – has been providing GCHQ with access to their cables. The company claims that it is merely complying with lawful warrants, but the documents appear to show that they went above and beyond by actively helping shape the traffic to improve collection. At some point GCHQ seconded a full-time employee to the company, which has been paid millions of pounds of taxpayers’ money for providing access to data.

The documents also suggest that Cable & Wireless/Vodafone assisted GCHQ in harvesting data from other cable companies not served by warrants. The Guardian newspaper raised concerns about this practice in 2013 but did not provide concrete evidence at the time. The operation – codenamed INCENSER – provides GCHQ with access to what appears to be an intersection of two cables connecting the Atlantic with Europe and Asia, which is itself codenamed NIGELLA.

The cables were owned by the Indian company Reliance Globalcom (now called Global Cloud Xchange). According to the documents, GCHQ hacked into the NIGELLA cable system using Cable and Wireless/Vodafone for access as ‘Landing Partner’ in Cornwall. Vodafone also helps GCHQ to send the intercepted data to the agency’s Regional Processing Centre in Bude, where the data is processed and shared with close allies under the programme WINDSTOP. The NSA names INCENSER as the fourth largest data operation in corporate partnerships, providing it with about 10% of its global collection.

2.2.6 Other sources of data: satellites, radio and telephony

Satellites still cover many parts of the world with limited infrastructure, and some strategically important niches, such as satellite phones, industrial data links from factories and power plants and all communications to ships, airplanes and oil rigs. Satellite data formed the core of the ECHELON programme of global surveillance, and it appears to be integrated into current surveillance systems.32

The US and the UK have a global network of sites33 collecting communications traffic from satellites, called FORNSAT in spying terminology. GCHQ operates stations in places like Cyprus,34 Kenya,35 Oman36 and also in Bude, Cornwall. GCHQ “at least intermittently, kept tabs on entire country-to-country satellite communication links, like Germany-Georgia and Germany-Turkey, for example, of certain providers”.37 Many of the newer cable tapping operations take place under cover of the satellite spying sites, which cannot be hidden due to the need for large antennas. The Snowden documents show that GCHQ has continued to develop and increase their satellite monitoring capabilities in recent years.38

Historically, GCHQ has also monitored a broad range of technologies, such as high frequency radio – used for diplomatic communications – and microwave radio relays connecting inter city networks and also used to connect UK communications with Ireland.39 The bulk monitoring of communications between the UK and Ireland was successfully challenged at the European Courts of Human Rights in a high profile case.40

Leaked documents also make very clear that GCHQ also target telephony networks. This includes both manipulating large telecoms infrastructure and accessing call records..41 Access to “call records” raises important questions about who had access to communications records kept by companies, as these partnerships predate data retention legislation, such as the (now defunct) Data Retention Directive and the Data Retention and Investigatory Powers Act (DRIPA).

The proportion of data coming from telephony systems is very high. Leaked NSA documents shows that during a single month the agency was collecting almost as many records from telephones as their largest Internet surveillance programme (XKEYSCORE) was capturing over the same period (40 v 41 billion records).42 In 2012, GCHQ was collecting 600 million telephone records each day.43

2.2.7 Bulk Personal Datasets

The ISC report revealed that the security services keep large “bulk personal datasets” of millions of people without a clear legal authority or proper oversight.44

The ISC did not give any further details, but the review by RUSI, A Democratic Licence to Operate,45 hinted at the kind of datasets the agencies may be handling. These include a combination of government data from public bodies such as the Passport Office, DVLA or HMRC, and commercial data. We can only assume commercial datasets might include data concerning most adults from personal data brokers such as Acxiom or Experian. It is not clear whether the intelligence agencies have used this provision to obtain bulk traffic and location data kept for billing purposes by communications companies.

The Government rushed to introduce some oversight mechanisms the day before the ISC report was published in a clear attempt to preclude legal challenges.46 The Intelligence Services Commissioner, Sir Mark Waller, was given “statutory powers of oversight of use of bulk personal datasets”. This safeguard is not sufficient and there needs to be a proper debate about these datasets. This is a very serious revelation that needs to be subject to proper scrutiny.

The TEMPORA system

TEMPORA is the codename for a British-run programme that carries out Internet surveillance involving the wholesale collection of all the information from selected large fibre optic cables. The programme was launched in 2011 after several years of trials that started in 2008. As of May 2012, the programme was in operation at three processing centres – which appear to correspond to Bude and Cheltenham in the UK and Oman outside of the UK. In 2012 TEMPORA was able to access some 46 Internet bearers of 10Gb/s each across the three main locations. Internet bearers are the individual data channels within each fibre optic cable. From the figures presented above it becomes clear that TEMPORA is not the only UK mass surveillance programme and that in terms of cable access there are many other operations.

TEMPORA is run by GCHQ, but it is also described as a component of the NSA’s global mass surveillance system XKEYSCORE, which we describe in this chapter. Most of these developments are based on shared technology implemented on a physically decentralised but highly integrated infrastructure.

Selected US analysts can seamlessly access TEMPORA data. The US relationship is a critical aspect of the UK surveillance regime, but very difficult to establish in detail due to the secrecy surrounding it. It appears that NSA staff are given some training on British regulations and thereafter have direct access to the data collected by GCHQ in TEMPORA, through the same computer interface they use for their own XKEYSCORE tool.

2.3 Collect and keep

When the collection of communications was limited to telegrams, radio and selected phone calls, searching through content using keywords was manageable. The arrival of the Internet did not trigger any changes at first, and the agencies continued applying the same techniques to emails. But as the amount and variety of traffic and the agencies’ collection capabilities grew, this approach became unwieldy.

The agencies switched their approach to traffic analysis, which had until the 1990s had been a secondary activity: traffic analysis. This involved analysing communications on the basis of patterns instead content – which in cases could not be understood – mainly to infer organisational structures and attempt to predict events. The translation of this approach to the Internet means a focus on metadata, with content taking a second place. This was a critical shift that evaded proper scrutiny until the Snowden leaks. GCHQ has developed extensive capacities to collect, store and process non-targeted metadata, or as they call it Internet “events”.47

In addition to charting enemy army combat units and looking for abnormal radio activity that might reveal imminent attacks, GCHQ is now using those techniques to analyse the communications data of billions of people – without suspicion or probable cause – looking for patterns. They have moved from building the organisational diagram of the Red Army to mapping the relationships and activity of the world’s population. This is in itself a highly intrusive activity, even if only a few people are chosen for further targeting.

The shift to traffic analysis was technically enabled by developments in the handling of Internet traffic. Abandoning the initial focus on emails, the agencies started processing and capturing other types of traffic, which were sent for analysis and longer term storage to massive databases. Eventually GCHQ built a “full take” system48 that allowed wholesale Internet traffic to be ingested, and then filtered, instead of forcing a preselection of materials for a more focused collection.

For some time the technology for the capture of Internet traffic has relied on a form of buffering sometimes called a delay flow control engine. Instead of attempting to analyse traffic at the live speed of the wire, a 30 second temporary storage is created to “slow down the Internet” to better allow the agencies to sift through and manipulate the information. This transient copying of traffic has evolved into “temporary” storage systems that keep a few days’ worth of intercepted content and up to several months of metadata. These newer “collect it all” systems have been described as time machines, and cross the line from functional buffering to data retention.

The case has been made that these newer systems actually lead to lower levels of long term data storage because the buffer allows for better analysis, instead of forwarding data “just in case”. However, this depends on how we define “temporary buffers” and “storage”. As these buffers keep data for longer periods, and further analysis is applied, they increasingly look like another storage and data mining tool.

This kind of surveillance by GCHQ is complemented by access to data from communications providers and a variety of other sources. And, while this Chapter – and most of this report – focus on Internet surveillance, the signal agencies still engage in extensive monitoring of telephone communications and work towards the convergence of all kinds of data into joint analytical systems.

2.3.1 Mass surveillance or bulk collection?

Wholesale collection, storage and analysis of data is widely perceived as constituting “mass surveillance”. Security agencies argue that they need to tap whole data cables in order to sieve through the data stream because they cannot selectively look at individual pieces of information. They label this process “bulk collection” or “bulk interception”, which in their view does not constitute mass surveillance because the collected data will be processed and analysed so only a small amount relating to suspects will be seen by human operatives.

The Royal United Services Institute (RUSI) report on Internet surveillance claims that even “bulk data is a misleading term as it most frequently refers to the interception of data in bulk rather than to the data itself (hence use of the term bulk interception)”.49 As we show throughout this report, GCHQ has data systems with billions of non-targeted records that would be disingenuous not to describe as “bulk”.

The claim that GCHQ must intercept the Internet communications of a wider pool than their targets is however true. Here it is important to understand some basic aspects of how the Internet works. Internet communications are based on what is called packet switching networking.50 This means that each message is broken into many smaller pieces called “packets”, all containing the sender and destination, which are then left to find their own way through the most optimal route to the recipient – with the help of Internet infrastructure such as the aptly called routers – where they are put back together.

Internet surveillance requires the ability to look into all individual packets in this raw flow, in order to classify them and reassemble the actual contents of messages.

However, as we saw above the essence of Internet surveillance is not reconstructing the content of targeted communications, but analysing the flow of the general Internet traffic, looking at all packets regardless of any previous suspicion. All the various reports commissioned after the Snowden leaks – from the ISC, the Independent Reviewer of Terrorism and RUSI – acknowledge the increasing role of non-targeted surveillance for so-called target discovery of unknown threats.

We accept the legitimacy of tapping cables under certain circumstances, and therefore we need to accept certain levels of intrusion and that the agencies will need to look into traffic and “see” at the very least individual packets. However, this intrusion should be minimised by reducing the degree to which traffic is captured, reconstructed and processed.

The leaked documents show that instead the guiding principle appears to be maximising every aspect of surveillance. Limited resources seem to be the main obstacle to the capturing and automated processing of everything the agencies can get hold of; not considerations of privacy, which mainly come into play once analysts start interacting with the databases.

The term “mass surveillance” better reflects the whole process of wholesale interception of data and population level analytics, while “bulk collection” is too narrow and minimises what is actually taking place. However, arguing over terminology risks distracting from the core point.

Ultimately the focus needs to be on minimising the level of intrusiveness of Internet surveillance. This will involve technical decisions at every stage as agencies work from pure electronic signals to individual packets, fragments of traffic and full messages, all the way up to rebuilding complete Internet histories and social maps. These aspects are largely absent from public discussions on surveillance reforms which tend to be focused on laws, policies and oversight processes.

2.3.2 Evolution of Internet interception from keywords to metadata

The use of keywords for targeted surveillance is still in operation, with probes connected to the cables looking at every Internet packet to see if it contains a known email, phone, number or specific target information.51 These systems will collect any relevant data and possibly some associated traffic and quickly discard the rest. This is akin to reading all the envelopes that pass through a post office conveyor belt to pick out some of them. The data and content collected in this way will be sent for further analysis and long term storage. Selected data is sent to “tipping” systems that will alert analysts or trigger other processes.

This approach works best when looking for limited types of traffic, such as emails, and require large amounts of computing capacity in order to process the initial ingestion rules for selecting and processing of packets in real time.52 GCHQ documents53 show concerns that packet processing misses materials and requires previous knowledge of emails, phones or other identifiers. It also sends too much data for long term storage with 97% of retained data being unused.

One critical step in the ability of the agencies to analyse bulk Internet traffic came in the reconstruction of full Internet sessions. These are not to be confused with the normal use of the words “Internet session” as the use of Internet for a period of time like an afternoon.54 A session involves an exchange of communications between two computers. For example, a visit to a website, a message, all involve sessions. GCHQ keeps records of billions of such sessions in their “events” databases.

Internet probes, with codenames such as TURMOIL, work towards higher levels of traffic analysis.

After an initial filtering the probes will classify the selected packets in broad categories. They can specify “ingestion rules” to capture all traffic going through the cable processor that uses a particular piece of software, is a specified data type, originates in a particular country, or any combination of these criteria.

For example, GCHQ has a programme to collect encryption-related metadata, specifically a type of data called “SSL handshakes”, transmitted whenever a user connects to a secure website, such as a bank or e-commerce site.55 The agency uses the collected data – around 10 billion records a week that are stored in a database called Flying Pig for six months – to support their work to access encrypted communications.

Traffic analysis probes of the kind used by the NSA and GCHQ can be bought from commercial companies such as IBM and Narus (Boeing), and some can be used by Internet companies for general traffic management.

Collecting masses of non-targeted metadata from large numbers of people for further analysis is more intrusive than analysing Internet traffic to look for known targets. Authorisation for each of these activities need to take into the account these different levels of intrusiveness. There should be authorisation processes for searching and accessing information as well as collecting individual records.

Black Hole

Documents published by The Intercept in September 2015 describe the architecture of GCHQ’s programme of metadata surveillance used for profiling Internet users worldwide. A key component of this system is a huge data storage system called BLACK HOLE.

BLACK HOLE forms the basis for the development of several very sophisticated data analytics platforms as we discuss in section 2.4. The agency stores collected metadata in compressed text files, which take less space and are simpler to handle, that contain up to six month’s rolling repository of non-targeted metadata from worldwide populations.

The analytics platforms are fed some 200 Gigabytes a day from bulk collection systems that collect very diverse types of metadata. In March 2012 the repository was capturing approximately 50 billion “events” – metadata records – per day that were being fed from the interception of over 25010Gb/s bearers, and was expected to grow quickly to 320 bearers and possibly 400. As we can see this dwarfs the number of cables being fed into the TEMPORA system.

2.3.3 Recording the Internet

The next step up in the drive to “collect it all” is to capture whole data streams from cables, which leads to the concept of the Internet buffer described elsewhere. This allows GCHQ to go back in time to look at past behaviour. The buffer also aims to process data at the early stage and minimise the data sent for long term storage. This might appear to be a good trade off in terms of privacy; however the problem is that earlier stage buffering collects a lot of information from people who are not suspected of any crime.

From a technical standpoint, here the systems will reconstruct not just the snippets of metadata that the agency calls “events” but full “sessions” of content. They will also tag traffic according to its characteristics – dropping non useful materials – and extract metadata in bulk to provide an index to the content.56

These newer Internet recording systems operate both as an evolution of, and also in parallel, to the metadata collection systems described above in section 2.3.2 with the aim of reconstructing, storing and classifying growing volumes of Internet communications.

These so-called “deep dive” systems, such as the codenamed XKEYSCORE, process the full 10Gb/s data stream from a cable tap. Then they weed out “high volume, low value” data, with some 30% of the traffic being fed into the buffer. The front end filter selects packets and reconstructs sessions, then selects the most useful traffic for retention, through a rule-based filtering of reassembled sessions, based on keyword, country code or type of type of application being used.

These processes – packet analysis, session reconstruction, and filtering – are required in any Internet surveillance system. They receive different names at times. For example, GCHQ has a tool called TERRAIN that covers at least some of these aspects. Several sources refer to the initial filtering as Massive Volume Reduction (MVR), while a separate tool called POKERFACE provides data “sanitisation”.57

The agencies are currently able to keep a cache of three days of content and thirty days of metadata. Collecting such amounts of Internet content requires a massive increase in storage capacity. It also requires larger amounts of data to be send from the cable taps to separate locations with powerful computers, called by GCHQ processing centres. As we discussed in section 2.2 this requires the capacity to “egress” large amounts of data via cables.

These systems make the distinction between targeted and not targeted surveillance activities more difficult to establish. Several types of data collection and processing can be in place simultaneously at a particular cable access. Bulk collection in a buffer system can sit alongside a probe supporting live searches for strong selectors.58 Targeted systems appear to be able to carry out broader searches, while discovery bulk collection is used to promote targeted collection.

The agencies aim to have access to real time analytics of Internet activities, but this seems currently out of their technical capacity. According to leaked documents, the agencies have progressed from “batch processing” giving them results in 24 hours using big data techniques to the so-called XKEYSCORE system having a “streaming” capability to give results within the hour.59

Both the existing “time machine” and the aspiration to have real time access to Internet communications raise huge civil liberties concerns.

2.3.4 Targets and discovery

The level of intrusiveness of surveillance is usually linked to the degree of targeting, which is normally justified on the basis of suspicion. For example, civil society groups such as the Don’t Spy on Us coalition demand “no surveillance without suspicion”.

The case has been made by the Intelligence and Security Committee among others that GCHQ has two separate main approaches to Internet surveillance: one “targeted” and another one – much smaller – based on “discovery” and involving “bulk collection” (see section 1.6). The Committee’s description even appeared to indicate that these are completely unrelated physical systems that could almost be ring fenced and regulated separately. This distinction between targeted surveillance and bulk collection is useful from a conceptual point of view, and from a legal perspective. As we can see the reality appears to be a more mixed picture of systems that combine both functions.

In addition to analysing everyone’s communications to look for specific targets, there is plenty of documented activity purely based on non-targeted processing of data. For example, some of those sensors will capture special kinds of traffic such as Voice over IP and encrypted Virtual Private Networks for separate processing,60 including breaking encryption. The Optic Nerve programme collecting webcam images is another example.

The security services’ portrayal of intrusion presents a simple relation between intrusiveness and targeting. Once you have been ‘selected’ as a target, genuine intrusion takes place. Regarding the targeting of those selected as a completely separate activity from harmless “discovery” of the potential targets does not reflect the complexity of the processes described in the leaked documents. It has left too many gaps in understanding and regulation.

XKEYSCORE

XKEYSCORE is an NSA tool also used by GCHQ, operational since at least 2007,61 that can encompass various activities in the surveillance workflow. The platform involves both the back-end storage and processing of collected content and metadata, the Internet buffer, and also the front end search and query capabilities, including asking for new collection almost in real time. XKEYSCORE (XKS) has been thoroughly documented by The Intercept.62

XKEYSCORE could also be described as a common technology platform, initially created by the NSA but shared with the UK, the rest of the Five Eyes and several other countries including Germany and Sweden. These local instances of the tool are connected and its federated query system searches across the network, with limitations depending on policy and technical arrangements. Different implementations of this tool vary in their capabilities. According to Glenn Greenwald, the NSA calls XKS its “widest-reaching” system for collecting electronic data.63

The tool has been mentioned in the reviews but not discussed in detail, despite the wealth of related documents now in circulation. For example, RUSI provided a minimal description: “said to allow analysts to carry out a search using a search term such as an e-mail address or telephone number across three days’ worth of unfiltered data”.64

At the back end, XKS is an Internet content buffer that stores “the full-take content for 3-5 days – meta-data is saved off longer with the goal of 30 days retention – effectively “slowing down the Internet” so that analysts can go back and recover sessions that otherwise would have been dropped by the front end.”65

XKS reconstructs the sessions on everything, then selects the most useful traffic for retention, through a rule-based filtering of reassembled sessions, based on keywords, country code or so-called fingerprints identifying types of traffic. The backend processor performs strong selection (e-mail) and soft selection (content) selection and provides real-time analysis. In addition it sends alerts to other systems, also known as tipping in the jargon.66 The terms strong and soft reflect the likelihood that the search will find meaningful results, and throughout the leaked documents we find references to the inefficiency of using general content for searching.

XKEYSCORE deals with the problems of search by creating a metadata database used as scaffolding, an index to access the associated content. This forms a decentralised system mainly built from wholesale Internet traffic ingested by the cable tapping nodes. Data from Internet companies accessed via PRISM is also accessible through this unified search system. Some databases that store information in the long term are also connected, with the aim to provide a ‘one-stop-shop’ for searching and creating new leads.

XKEYSCORE is physically built around a decentralised architecture of nodes that work independently but can talk to each other. The technology also aims to achieve lower costs by using cheaper commercial computers running free software such as the operating system GNU/Linux, instead of specialised and very expensive hardware provided by military contractors. Each node is a cluster of up to hundreds of s computers. These nodes ingest bulk data from over 150 global collection points managed by the US, UK and other allies. Many of these are part of the global network of probes at the core of the Internet, including the UK’s TEMPORA programme. They also include data collected from embassies, satellites, drones and other sources.

The user interface allows analysts, to query the temporary cache of metadata and content, link local temporary records with remote intelligence databases and create new ingestion rules for the collection. This is a major aspect of the so-called “discovery” approach.

The combination of these diverse capabilities makes XKEYSCORE a very powerful surveillance tool with huge privacy risks. The XKEYSCORE system figures prominently in the leaked documents and has been repeatedly named by Snowden as a critical tool for Internet surveillance. This system allows the NSA and partners to monitor everything a user does on the Internet in real time, including the content of emails, websites visited and searches, as well as their metadata.67 There are plug-ins for searching specific types of data, or an operative can choose to replay a target’s Internet activities.

XKEYSCORE integrates quite different functions: discovering new targets, analysing previously bulk-collected data, and collecting new live data. This dynamic system can present a challenge to regulators, as most actions are self-authorised by analysts and are only checked afterwards in auditing processes.

2.3.5 Long term storage

Only a small proportion of the originally collected Internet data is stored beyond six months. In their Privacy and Security report, the ISC argue that this is another reason why the activities of GCHQ do not amount to mass surveillance, although it still involves vast amounts of information. We find this argument lacking: this is still part of a process of collecting and storing huge amounts of data from people who are not suspected of any crime.

Not enough is known about the UK’s long term storage programmes.In order to ensure the intelligence services are accountable, we need to understand what data is stored, how much and for how long. Publishing information about such broad long term capabilities should not have a negative impact on frontline live operations.

In comparison, leaked papers give a very rich picture of the data storage systems of the NSA, but the equivalent GCHQ related documents are not so complete.

US documents68 revealed that the NSA sends some 5% of the content collected by XKEYSCORE for long term storage in a database called PINWALE, which came to prominence in 200969 after an NSA analyst was investigated for snooping on the personal emails of former president Bill Clinton. PINWALE can keep the contents for five years, and it is mainly used to store emails, but it has apparently been expanded for other forms of content.70 At the time of that scandal GCHQ denied71 they were building a UK version of the system.

As we discuss in the next section, GCHQ has many databases where it keeps metadata and some content for several months and up to a few years for active analytics. The agency has a longer term database to keep targeted data called BROAD OAK. In addition, Bulk Personal Datasets of millions of people are also kept.

There is some information on how long data is stored by British agencies, but more transparency is needed. The Interception of Communications Commissioner’s Office says that specific information isn’t kept for longer than two years unless it meets strict criteria. GCHQ have not informed the public about how much such data relating to “persons of interest” is kept and for how long. The ISC report censored the details relating to this question but it is a matter of basic transparency to make this public.

2.3.6 Minimisation

The NSA optimises data to be sent for storage with the use of a tool called SCISSORS, before reaching the long term databases, such as PINWALE or MARINA.72 NSA documents describes SCISSORS in these terms: “Memorialize what you need” in contrast to the previous approach: “Order one of everything off the menu and eat what you want”.73

SCISSORS flags specific types of data that are not useful enough to be sent for immediate analysis but that are potentially useful enough not to be thrown away. For example, the NSA appears to have a problem with the proliferation of “ownerless address-books” captured in the data streams, so SCISSORS sends these to long term databases for de-duplication and storage, without clogging the precious space required for active processing. Importantly, a lot of this data is not deleted but simply stored elsewhere.

In addition to any technical issues, data minimisation allows the US agency to remove data to comply with legal and policy requirements. The agency uses so-called ‘defeat lists’, which contain specific types of data that the agencies are not meant to collect.

From the documents available and the legal and policy analysis it appears that GCHQ does not operate any form of minimisation, which for example could include UK communications to avoid, such as emails from known British companies or MPs. As we discuss elsewhere GCHQ have strict, albeit secret, data retention policies, but the leaked documents do not show any minimisation in the ingestion of data. Instead they rely on safeguards, policies and audits to stop materials being accessed. In our view it would be preferable to have data deleted in the first place.

2.3.7 Offensive capabilities

Surveillance tools also present other regulatory challenges not properly discussed in policy debates that are focused on access to personal information. Many of the sensors that signal intelligence agencies have physically placed very close to the cables can also interfere with Internet traffic.

The agencies’ systems can slow down bulk Internet traffic for a few seconds in order to “inject” packets back into the Internet pipe in almost real time. In some cases they can take out individual packets and replace them with very similar ones that contain viruses or other cyber-weapons. This “active” capacity enables many of the hacking operations described in Chapter Three. Many analyses of targeted surveillance systems fail to recognise the importance of this active dimension.

The machines that have this dual capacity to “read” and “write” directly to the Internet backbone are a fundamental building block of the global surveillance system run by the US and its allies. The UK network of such probes seems to be tightly integrated with a much larger US-run global network of these sensors called TURMOIL, which we discuss in Chapter Three.

Regulation must view surveillance systems as also a potential weapon, subject to rules of engagement for their offensive capabilities as well as a tool for intrusion and invasion of equipment.

2.4 Data processing

Processing data to generate intelligence involves a combination of technological processes and activities by human operatives. It is important to look at how these processes work because the reform of current legislation – with its focus on collection and human analysis – needs to consider technology risks and changes to the existing surveillance model.

There has been a shift from the targeted search for specific information to what the ISC and others have called “discovery”. The NSA has put it in terms of “shifting their analytic approach from a production to a discovery bias”.74

This “discovery” approach was the traditional mode of operation of radio-based signals intelligence in the military and diplomatic fields, where antennas will receive any available signal. GCHQ also engaged in bulk telephone access during the Cold War, with evidence that it tapped whole areas of Berlin.75 The application of this model to the Internet and wholesale international civilian communications is uncharted territory.

In the past inherent technological limitations restricted the agencies’ activities. Now, GCHQ, the NSA, and their allies have developed state-of-the-art technologies to enable population-level surveillance. An NSA document about the UK mass surveillance programme TEMPORA says: “We’ve all heard about Big Data; now you can get Big Access to Big Data”. Since 9/11 trillions of dollars have been spent on national security in the Five Eyes countries, mainly the US.76 The growth in resources combined with advances in computer technology mean that GCHQ can handle the communications of whole populations and profile millions of people.

GCHQ argue that even if bulk data has been collected more or less indiscriminately, it will be used to support more targeted activities, and most of it will never be looked at. But after identifying a target, surveillance systems will continue looking through collected data for new associations.

2.4.1 How data is used

GCHQ’s website contains a presentation of “how an analyst catches a terrorist,”77 which tries to show how they would identify an unknown suspect (at the time not based in the UK). The process in this case starts with a simple description of an individual meeting a known terrorist and the kind of communication devices he has: a basic mobile and a tablet. The analyst will first pull the known terrorist’s communications for analysis (tasking) in the days around the meeting looking for connections (contact chaining), which will generate lots of leads that have to be reduced (triage) by looking at their behaviour (data mining for pattern of life) or by finding their actual computer devices among the millions in the world (profiling).

At this stage, the analyst is still dealing with bulk metadata and there aren’t any real names or possibly even emails. The website explains that only once the agency has enough to build a case it will carry out a search of the content (and “content derived data” classed as content) stored in their systems. In the example presented by GCHQ this leads to further confirmation of extremist behaviour and a login for a website. Targeting starts once such an identifier is checked against separate databases, including of known suspects. In this case the login allows for the identification of the individual.

Although GCHQ’s website does not cover the policy aspects, it is worth adding that because the nationality of the person is unknown and s/he is not in the UK (and we assume neither in a Five Eyes partner country) this whole process did not require any special authorisation.78

Operatives may start with some kind of targeting or evidence. Leaked documents from the NSA79 chart the overall process for how intelligence is generated starting with an email or one of the other clear identifiers, called strong selectors. US agents will first check that there are no legal or policy obstacles to the search. They will then research through databases of stored content to look for associated information, such as other e-mails or phone numbers, called target development.80 In the next step they will check if the target has been “tasked” for surveillance in various systems. Then finally they will move to targeting proper and “querying raw traffic.”

GCHQ’s main tool to search through refined and stored intelligence information, including content,81 is called Unified Data Access and Query (UDAQ).82 The system is described as the agency’s “corporate C2C (N.B. Computer to computer) data repository”, which allows analysts to perform very broad searches that “will often contain a large number of unrelated items”.83 Its front end is a website that allows free text searches across intercepted data from the Five Eyes countries.84

In all cases the process relies mainly on the massive collection and analysis of metadata rather than content.

2.4.2 Tasking

Government officials from outside of GCHQ may make a decision to, for example, look for ISIS suspects. GCHQ operatives would then create new leads and electronic targets to be searched for and tracked. This is called tasking and the targets they create are called selectors and can be emails, phone numbers, social media user-names and so on.85

These selectors will have been obtained from: external insights; tools that generate lists from other sources; or contact chaining (see 2.6.3 below).

Tasking by spy agencies does not necessarily require direct suspicion. The NSA – under the operation codenamed AURORAGOLD86 – spies on hundreds of companies and organisations, including the UK based trade group GSM Association, in an effort to find security weaknesses in cell phone technology that it can exploit for surveillance. This has led them to include the emails of innocent employees of these organisations in their tasking systems.

2.4.3 Triage

One of the key issues with bulk surveillance is that it generates lots of potential leads. And as we have seen in recent cases, such as the Charlie Hebdo and Woolwich killings, the capacity by security forces to follow through so many targets is a lot more limited.

Triage involves categorising potential suspects flagged up by automated systems or broad searches according to the danger they may represent. This is a very important activity with important rights implications, as false positives can have very serious consequences. Failing to identify the right suspect can of course also have dire consequences.

The NSA has built a system called ECHOBASE87 that uses automation to bring down the numbers of potential targets generated by other tools to a level where they can be analysed manually. This was shared with GCHQ during the London Olympics in 2012. The tool is based on an NSA big data platform called GHOSTMACHINE88 that provides analytics capabilities for handling the huge numbers generated in bulk collection.

2.4.4 Contact chaining

Contact chaining involves discovering possible associations through the matching of many contact sources, such as address books, or location proximity to a target. This is the basis of the CO-TRAVELLER NSA programme89 which correlates mobile phone locations to see phones that may be consistently near each other.

Leaked documents shows that the GCHQ also uses Internet data mining techniques on an “unprecedented scale” to build social graphs. This goes beyond the social network of an individual to identify identify “interesting small or large groups” and “communities of potential interest from massive datasets”.90

2.4.5Location

Location is a very important aspect of surveillance, particularly with Internet data that comes through a cable from anywhere in the world. Internet traffic carries a certain amount of location data, but location tracking can be improved by associating mobile phone information with Internet data, and most of the programmes are moving towards this kind of convergence.

The NSA and GCHQ jointly operate the DISHFIRE91 bulk global database of millions of SMS messages, which we describe in more detail in Chapter Five. This data is used to establish geolocation, including border crossings, partly using messages from travel companies and partly from embedded data used by mobile technologies.

2.4.6 Profiling and pattern of life analysis

In 2013, The Guardian newspaper first discussed the activities of the NSA to track and combine individuals’ metadata in order to build “pattern-of-life” profiles.92 These combine many different data sources to reconstruct complete Internet histories, location and social relationships. This approach is the essence of modern Internet surveillance and it is becoming increasingly common in many areas, including security, in attempts to predict future behaviour.93

Leaked documents analysed by The Intercept show an array of systems designed to provide specialists insights on various aspects of the activities of millions of Internet users, such as website history, location and maps of social relationships.94

Most of these tools are primarily based on the analysis of metadata from Internet traffic via specialised databases called Query Focused Datasets (QFDs), “designed for answering a single (or few) analytic questions”.95 They rely on the bulk metadata sent to Black Hole, the flat file repository and tools we discussed in the previous section, and other cloud and big data technologies. In 2012, there were 16 QFDs with some 11 Petabytes of usable storage, a very large but not unimaginable amount (Facebook stored some 250 Petabytes in 2013).96 The documents show that the agency was working on the integration of telephony data in these systems at the time.97

With few exceptions, these databases are mainly created around events,98 a loose term for metadata that can cover anything from a single text message, an email, a Google map request, a web visit to a whole chat log. The agency use all kinds of metadata picked from the Internet, with implications for what is considered a privacy risk online. We normally see passwords and emails as the most sensitive data, but GCHQ is greatly helped by the background data used for the tracking of users’ habits by advertisers:

“environmental information and various forms of ‘Internet Pocket Litter’ (e.g. cookies, delete keys). These new capabilities and forms of data have the potential to become our most highly valued and prized data.”99

These small pieces of Internet traffic are called by the agency TDIs – Target Detection Identifier – and are extremely useful because they provide the “who, when, where”. They “are definite indicators of presence that are unique and persistent for a user/machine.” These TDIs can be associated to many other bits of information, such as emails from airlines or Yahoo! webcam images. For the agency they are the “fundamental atom of the Internet age,”100 and they store them for up to six months.101

XKEYSCORE as an analysis tool

XKEYSCORE (XKS) indexes and sorts the raw data providing search capabilities, similar to Google’s. This mass collection system allows the agencies to see everything an individual does online, including searches. Phone numbers are systematically collected, both through web pages and from telephony data that runs on the same cables.

Analysts have the capacity to look for specific keywords or phrases – content based selection – inside communications metadata, thus weeding out unwanted content such as public websites. Repetitive searches can be automated to run at specific intervals.102

Skilled operatives also have access to the raw data, where they can sift through both the unfiltered content and metadata of communications. They can also use the language to modify the ingestion rules of the buffer. The system also operates defeat lists that determine specific information to drop due to policy considerations.

XKS can also use the so-called CADENCE dictionaries, which provide high-speed content filtering, selection, and forwarding capabilities. CADENCE dates back to the days of telegraphy but it is still used today by many NSA Internet surveillance systems to scan traffic for keywords103 associated with known emails or other identifiers.

Analysts can perform very broad searches for categories of traffic. For example, according to documents, analysts can search for “people doing web searches on Jihad from Kabul” or “e-mails that mention words from various categories”.

The ability to perform broad searches is achieved by classifying all traffic ingested in broad categories through labels called “fingerprints”.104 This preprocessing and tagging also allow analysts to conduct broad searches for specific keywords. For example: “common Arabic expressions in E-mails coming from the Pakistan (tribal regions)” (sic). The NSA documents point to GCHQ for further help in building lists of keywords, showing the close collaboration between the agencies.105

According to the same documents these searches are not meant to be fishing expeditions – and for example using a single “fingerprint” looking for all iPhone users would breach the Human Rights Act. However, these discovery systems can perform such broad searches that it is hard to describe them in other terms.

The justification for such broad searches can be very flexible and adapted to the need of the analyst. For example a search “everyone in Sweden who visits a particular web forum”106 is simply justified by looking for “SwedishExtremist website visitor”.

The slide above is part of the Swedish version of XKEYSCORE. According to additional sources British operatives also have to enter a justification under the Human Rights Act, from a drop down menu.107

In order to provide some control and facilitate oversight, the analyst will also have to enter a reference code called MIRANDA reference or number, in order to demonstrate that the search supports an intelligence requirement and specific purpose from the Joint Intelligence Committee.108 The MIRANDA number is used throughout the surveillance estate of both the US and the UK.

No additional warrants are required if a GCHQ analyst believes that an individual is abroad and s/he will be covered by the broad certificates allowing international surveillance. From other leaked documents we know that in the US searches by analysts are only periodically reviewed by supervisors.109

The XKEYSCORE tool can also be used to create new targets directly. The usual risks of abuse are amplified here because this system is very fast and dynamic, capturing live Internet data at the click of a button. The leaked slide below show the interface used to task new emails.

The tasking of innocent people in bulk surveillance systems appears to be widespread as programmes try to build connections or individuals become useful in order to reach a target. Some XKEYSCORE configuration files have been leaked, showing that it is used to track broad categories of people, including thousands of users of anonymisation software.110

The main query focused databases

MUTANT BROTH
“When was my target online? Where was my target online?”
MUTANT BROTH collects mainly TDIs (target detection identifiers) such as tracking cookies from advertisers. It creates a profile of an individual’s online activities alongside telephony by providing a bulk store of all TDIs seen in last 6 months. This allows analysts to find out what other TDIs associated with an IP address at a similar time, kinds of computers a person may use (probably used in the fictitious case study GCHQ gives on its website), and what hacking opportunities there are.

KARMA POLICE
“What websites has my target visited? Who’s been visiting this dodgy websites? (SIC)”
KARMA POLICE aims to correlate every user visible in bulk Internet collection with every website they visit, hence providing either (a) a web browsing profile for every visible user on the Internet, or (b) a user profile for every visible website on the Internet. It builds correlations, bulk unselected identifiers (TDIs), and websites by comparing information about which identifiers have been seen at approximately the same time, and from the same computer, as visits to websites.

MEMORY HOLE
“Who’s been searching for these suspicious things on-line?”
This holds information about who has been using Google and similar search engines. It tracks IP addresses and then is combined with MUTANT BROTH to see who made those searches. Searches are classed as content, not metadata.

SAMUEL PEPYS
“What is my target doing online right now?!”A near real time Internet “diarisation” tool that keeps track of anything to do with a particular Internet Protocol (IP) address, the unique number that identifies a machine connected to the Internet. It enables powerful profiling by fusing all available traffic types in one place. It contains both unselected events and content.

SOCIAL ANTHROPOID
Used to search across a variety of channels: emails, social media interactions, instant messenger chats, cellphone locations, Blackberry messenger, text messages, and calls made on the Internet using “Voice over IP” technology such as Skype. It provides a history and a social map of all communications around a target for a particular range of time. It requires a starting identifier.

MARBLED GECKO
“Who’s been looking at this suspicious part of the world?”
Information about the use of Google Earth and Google Maps, such as when, where and from which IP address, particular areas of the Earth have been looked at. Combined with MUTANT BROTH, it allows the identification of those users. MARBLED GECKO has been assigned a retention period of 6 months. The Intercept have raised questions about the viability of this programme now that Google encrypts the connections to their mapping services.

ORB FINDER
Enables the identification of potential candidate Operational Relay Boxes (ORBs) for use in CNE’s active exploitation. According to Bruce Schneier “basically, these are computers that sit between the attacker and the target, and are designed to obscure the true origins of an attack.” There are other programmes looking for ORBs, such as the Canadian LANDMARK.

MOOSE MILK
A data mining algorithm to detect suspicious use of telephone kiosks in the UK.

AUTOASSOC
Bulk unselected TDI-TDI correlations with confidence scores – information about which TDIs have been seen at the same times and from the same IP addresses as other TDIs.

2.4.7 Targeting

In physical surveillance any escalation of surveillance against individuals would follow clear procedures; through identifying a suspect, collecting evidence and getting warrants. This process was laid out in the Intelligence and Security Committee report into the murder of Fusilier Lee Rigby,111 which explained how his killers had been subjected to increasing targeted surveillance by MI5 and the police. Comparable processes for the selection of targets for Internet surveillance appear to have lower safeguards, despite the potential for intrusiveness. Proper processes and safeguards are particularly important when innocent people are targeted in order to access others. Elsewhere in this report we discuss how GCHQ has variously intruded in the lives of computer engineers and employees of communications companies, people involved in climate negotiations, political activists who use technology (hacktivists), Yahoo! webcam users, EU commissioners and security experts.

This raises another important issue around targeting and how to assess the impacts of mass surveillance. Signal agencies such as the NSA and GCHQ work with other agencies, and much of the original targeting and the outcomes of the surveillance will happen elsewhere. We gained a glimpse of how UK agencies work together, and the difficult job they have, in the report on the Woolwich murder of Fusilier Rigby.112

There are few available documents from other agencies – MI5, MI6, or the CIA, where we can evaluate the impacts, such as who is marked for arrest or physical surveillance, and how exactly this is decided upon. We need more transparency about categories of targets. There is likely to be public consensus that the agencies should target terrorists and serious criminals. However, there is likelihood that we would gain consensus for GCHQ to target non-violent political activists.

2.5 Dissemination of data

This is the aspect of surveillance that has received the least attention in the debates raised by the Snowden revelations. Partly, this has to do with a lack of information about the UK in comparison with the US in the leaked documents. In addition the sensitivity of the final outputs of intelligence would mean that either Snowden didn’t have access to them, or those with access to the documents applied extra caution.

The Guardian gave some information from a direct source at the time of the first revelations of TEMPORA claiming that it directly led to the arrest and imprisonment of a cell in the Midlands who were planning co-ordinated attacks prior to the Olympics.113 This was followed by other leaks about the use of PRISM during the 2012 London Olympics – with a thwarted attack during the opening ceremony.114

There is little information in the Snowden files on any direct outcomes of mass surveillance in the UK in terms of intelligence reports. However, there is evidence that that mass surveillance programmes have made substantial contributions to presidential briefings in the US.115

The Anderson Review also reported several cases where mass collection of data had helped uncover terrorist plots and arrest child abusers.116 The exact mechanisms are shrouded in secrecy so it is impossible to know what exact contributions different stages of “bulk” collection made and what the alternatives would have been at each stage.

2.6 Conclusion

GCHQ possesses a huge breadth of collection capabilities and techniques, and unprecedented global access to data – not to mention the ambition “to collect it all, all of the time”.

GCHQ demonstrates a technological sophistication that is rare in government. They have solved many problems, such as reconstructing content, that computer scientists would have thought nearly impossible.

By collaborating with telecommunications companies, they have been able to wiretap fibre-optic cables to collect the global communications data of billions of people worldwide.

Many of the activities involved in surveillance are at least semi-automated and highly technical. This presents considerable challenges to the authorisation and oversight.

Non-targeted mass collection of data presents additional issues. Authorisation is required to tap a cable for a broad range of purposes relating to national security. There are safeguards applied by operatives looking at specific information. But the initial ingestion, processing, reduction and complex ingestion rules – based on broad classes of data rather than the targeting of specific suspects – appear to have limited external accountability.

Signal agencies such as GCHQ must have capabilities to eavesdrop military signals and intelligence required for statecraft, such as adversarial official state communications and some commercial information. Governments will also need to be able to target specific communications for law enforcement purposes, including counter-terrorism. If properly regulated and targeted, those activities are compatible with human rights and a democratic society. The activities described here however are too broad and involve millions of innocent people.

One of the many arguments used to justify mass surveillance is that the collecting of data in itself does not amount to a breach of privacy. This has been debunked many times, including by the EU Court of Justice in their ruling on data retention. When computers and operatives start processing the collected data the surveillance system can have a further serious impact on individuals, as their digital life is put under scrutiny using analytics tools.

Computers are making decisions about Internet users with little human input in the case of big data profiling, yet is argued by defenders of the staus quo that there is only a risk if that data is looked at specifically by a person, not a machine.

There is also the implication that collected data will only be looked at if there is some suspicion of illegal activity with the oft-repeated line, “if you have nothing to hide, you have nothing to fear”. We know that at least the metadata of innocent people is analysed for suspicious patterns, or anomalies that can lead to intelligence. From leaked documents relating to XKEYSCORE, this could simply mean the use of anonymous communication software, searching for suspicious materials, or simply using a language out of place for the region where the communication came from.

The programmes described in this section handle the data of many innocent people, if only to weed them out. Even with the best triage, the processes used will inevitably generate false positives and incorrectly identify individuals as potential suspects. As we will see in Chapter Eight, the rates of reported errors are very low, but these may be looking at the narrow end of the funnel only, and given the millions of records involved in other stages of the process there could be many more errors that escape scrutiny.

The US National Academy of Science has published a report on bulk surveillance that cautiously proposes some possible technical controls to restrict access to data in order to give citizens assurances against abuses, including automatically restricting the types of queries to access bulk data. They also propose automating the auditing of the queries used by analysts, which would allow for more external scrutiny without compromising the sensitive details of the search queries. Some of these proposals are already in place in the UK, as we can see in Chapter Seven.

The authors raise the problem that even if the best practices were to be adopted, this may not be enough to allay public concerns, because nobody outside the agencies fully understands their internal processes. Indeed this is a fundamental obstacle to building trust; any technical measures may not be sufficient without changes to the wider practices and attitudes towards transparency.

In addition, as we discuss in Chapter Seven, transparency is a basic step to making surveillance compliant with human rights obligations. The UK Government has increased the information available about certain aspects of surveillance in an attempt to preclude human rights challenges, but unfortunately technical processes are still completely secret. This is one of the areas where more transparency is needed.

1 http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa http://www.theguardian.com/uk/2013/jun/21/gchq-mastering-the-Internet

2 http://www.duncancampbell.org/menu/surveillance/echelon/IC2000_Report%20.pdf

3 http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa

4 http://theintercept.com/document/2015/09/25/200g-iris-access/

5 http://www.statewatch.org/news/2014/jun/US-nsa-ramparts-2.pdf

6 http://www.channel4.com/news/spy-cable-revealed-how-telecoms-firm-worked-with-gchq

7 http://www.sueddeutsche.de/digital/Internet-ueberwachung-snowden-enthuellt-namen-der-spaehenden-telekomfirmen-1.1736791

8 https://www.tagesschau.de/ausland/geheimdienste114.html

9 http://www.statewatch.org/analyses/no-244-gchq-intercept-commissioner.pdf

10 http://www.ibtimes.co.uk/gchq-paid-millions-spy-uk-submarine-data-cables-edward-snowden-reveals-1476664

11 https://www.eff.org/nsa/hepting

12 http://www.duncancampbell.org/menu/surveillance/echelon/IC2000_Report%20.pdf

13 http://international.sueddeutsche.de/post/103543418200/snowden-leaks-how-vodafone-subsidiary-cable

14 https://edwardsnowden.com/wp-content/uploads/2014/11/partner_cables.pdf

15 https://www.telegeography.com/telecom-maps/submarine-cable-map/index.html

16 https://www.telegeography.com/telecom-resources/submarine-cable-landing-directory/index.html

17 http://www.theregister.co.uk/2014/06/03/revealed_beyond_top_secret_british_intelligence_middleeast_Internet_spy_base/?page=2

18 http://espresso.repubblica.it/inchieste/2013/11/04/news/the-history-of-british-intelligence-operations-in-cyprus-1.139978

19 http://www.theguardian.com/uk-news/2013/aug/01/nsa-paid-gchq-spying-edward-snowden

20 http://www.sueddeutsche.de/politik/nachrichtendienst-gchq-briten-schoepfen-deutsches-Internet-ab-1.1704670

21 http://theintercept.com/document/2015/09/25/200g-iris-access/

22 http://www.theregister.co.uk/2014/06/03/revealed_beyond_top_secret_british_intelligence_middleeast_Internet_spy_base/

23 http://www.terabitconsulting.com/downloads/2014-submarine-cable-market-industry-report.pdf

24 http://theintercept.com/document/2015/09/25/access-vision-2013/

25 https://search.edwardsnowden.com/docs/CableMasterList20141125

26 http://www.geek.com/chips/10-gigabit-ethernet-its-all-about-the-gigabitz-552978/

27 http://www.pcpro.co.uk/news/security/382666/how-spies-could-tap-fibre-cables

28 http://www.theguardian.com/uk-news/2013/oct/25/leaked-memos-gchq-mass-surveillance-secret-snowden

29 https://firstlook.org/theintercept/document/2015/06/22/gchq-warrant-renewal/

30 https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/index/assoc/HASH0143/caffe2d3.dir/doc.pdf

31 https://theintercept.com/document/2015/07/01/xks-cipher-detection/

32 https://upload.wikimedia.org/wikipedia/commons/d/d9/Xkeyscore-hierarchy.jpg

33 https://upload.wikimedia.org/wikipedia/commons/7/74/NSA_Primary_FORNSAT_Collections.jpg

34 http://www.telegraph.co.uk/news/worldnews/europe/cyprus/10427890/British-military-base-in-Cyprus-used-to-spy-on-Middle-East.html

35 http://www.spiegel.de/international/world/snowden-documents-show-gchq-targeted-european-and-german-politicians-a-940135-2.html

36 https://www.privacyinternational.org/sites/privacyinternational.org/files/file-downloads/eyes_wide_open_v1.pdf

37 http://electrospaces.blogspot.co.uk/2015/01/how-gchq-prepares-for-interception-of.html

38 http://nautilus.org/napsnet/napsnet-special-reports/expanded-communications-satellite-surveillance-and-intelligence-activities-utilising-multi-beam-antenna-systems/

39 http://www.duncancampbell.org/menu/surveillance/echelon/IC2000_Report%20.pdf

40 http://hudoc.echr.coe.int/sites/eng/pages/search.aspx?i=001-87207#{“itemid”:[“001-87207”]}

41 http://www.statewatch.org/news/2014/jun/usa-nsa-ramparts-2.pdf

42 https://nsa.gov1.info/dni/boundless-informant.html

43 http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa

44 http://bit.ly/1Bm00QD (p. 55)

45 https://www.rusi.org/downloads/assets/ISR-Report-press.pdf

46 http://www.theguardian.com/world/2015/mar/12/david-cameron-close-intelligence-oversight-loophole

47 http://theintercept.com/document/2015/09/25/events/

48 http://www.spiegel.de/netzwelt/netzpolitik/Internetueberwachung-so-maechtig-sind-xkeyscore-tempora-und-prism-a-914300.html

49 https://www.rusi.org/downloads/assets/ISR-Report-press.pdf (p.18)

50 http://labs.rs/en/packets/

51 https://www.eff.org/files/2015/02/03/20150117-spiegel-apex_method_of_combining_passive_with_active_methods_to_exfiltrate_data_from_networks_attacked.pdf

52 http://arstechnica.com/information-technology/2013/08/building-a-panopticon-the-evolution-of-the-nsas-xkeyscore/

53 http://theintercept.com/document/2015/09/25/next-generation-events/

54 http://techterms.com/definition/session

55 http://www.spiegel.de/media/media-35512.pdf

56 http://theintercept.com/document/2015/09/25/next-generation-events/

57 this needs editing with the next section, there is overlap

58 https://www.documentcloud.org/documents/1200860-odd-s3-overviewnov2011-v1-0-redacted-information.html

59 https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/index/assoc/HASH0143/caffe2d3.dir/doc.pdf

60 https://robert.sesek.com/2014/9/unraveling_nsa_s_turbulence_programs.htm

61 http://www.theguardian.com/world/2013/jul/31/nsa-top-secret-program-online-data

62 https://theintercept.com/2015/07/01/nsas-google-worlds-private-communications/

63 Greenwald, G., 2014. No Place to Hide, Metropolitan Books.

64 https://www.rusi.org/downloads/assets/ISR-Report-press.pdf p48

65 https://firstlook.org/theintercept/document/2015/07/01/xks-sigdev-tool/

66 https://firstlook.org/theintercept/document/2015/07/01/deepdive-readme/

67 Ibid.

68 https://www.documentcloud.org/documents/894406-nsa-slides-xkeyscore.html

69 http://www.wired.com/2009/06/pinwale

70 https://en.wikipedia.org/wiki/

71 http://www.theguardian.com/technology/blog/2009/jun/18/nsa-pinwale-email-snooping

72 https://firstlook.org/theintercept/document/2015/07/01/utt-config-readme/

73 http://cryptome.org/2013/10/nsa-sso-overview.pdf

74 http://cryptome.org/2013/11/nsa-sigint-strategy-2012-2016.pdf

75 Aldrich, R.J., 2010. GCHQ: the uncensored story of Britain’s most secret intelligence agency,

76 Priest, D. & Arkin, W.M., 2011. Top Secret America, Hachette UK.

77 http://www.gchq.gov.uk/what_we_do/how_does_an_analyst_catch_a_terrorist/Pages/index.aspx

78 http://theintercept.com/document/2015/06/22/tsi-legal-flowcharts/

79 https://theintercept.com/document/2015/07/01/dni101/

80 http://theintercept.com/document/2015/09/25/hra-auditing/

81 https://fveydocs.org/document/udaq-item-referenced-auto-results/

82 https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/index/assoc/HASH019b/107887fc.dir/doc.pdf

83 https://cryptome.org/2015/02/gchq-pcs-harvesting-intercept-15-0219.pdf

84 http://theintercept.com/document/2015/06/22/operational-legalities-gchq-powerpoint-presentation/

85 https://fveydocs.org/document/prism-tasking-process/

86 https://firstlook.org/theintercept/2014/12/04/nsa-auroragold-hack-cellphones

87 https://www.aclu.org/files/natsec/nsa/ghostmachine-identifier-lead-triage-with-echobase.pdf

88 https://www.aclu.org/files/natsec/nsa/20140130/2013.12.10%20Ghost%20Machine.pdf

89 https://www.washingtonpost.com/world/national-security/nsa-tracking-cellphone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_story.html

90 http://theintercept.com/document/2015/09/25/cloud-developers-exchange-july-2011/

91 http://www.theguardian.com/world/2014/jan/16/nsa-collects-millions-text-messages-daily-untargeted-global-sweep

92 http://www.theguardian.com/world/2013/sep/30/nsa-americans-metadata-year-documents

93 http://www.channel4.com/news/nsa-spying-pattern-of-life-data-analysis-intelligence

94 hhttps://theintercept.com/2015/09/25/gchq-radio-porn-spies-track-web-users-online-identities

95 http://theintercept.com/document/2015/09/25/gchq-analytic-cloud-challenges/

96 http://venturebeat.com/2013/09/16/facebook-explains-secrets-of-building-hugely-scalable-sites/

97 http://theintercept.com/document/2015/09/25/add-sd-black-hole/

98 http://theintercept.com/document/2015/09/25/events/

99 http://theintercept.com/document/2015/09/25/access-vision-2013/

100 http://theintercept.com/document/2015/09/25/tdi-introduction/

101 http://theintercept.com/document/2015/09/25/data-stored-black-hole/

102 https://theintercept.com/document/2015/07/01/xks-workflows-2011/

103 https://firstlook.org/theintercept/document/2015/07/01/cadence-readme/

104 https://firstlook.org/theintercept/document/2015/07/01/intro-context-sensitive-scanning-xks-fingerprints/

105 https://firstlook.org/theintercept/document/2015/07/01/xks-tech-extractor-2010/

106 http://cryptome.org/2013/12/nsa-se-fra-xkeyscore-slide.pdf

107 http://www.theguardian.com/world/2013/oct/03/edward-snowden-files-john-lanchester

108 http://theintercept.com/document/2015/09/25/hra-auditing/

109 http://www.theguardian.com/world/2013/jul/31/nsa-top-secret-program-online-data

110 http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html

111 Report on the intelligence relating to the murder of Fusilier Lee Rigby, The Intelligence and Security Committee of Parliament, November 2014

112 Report on the intelligence relating to the murder of Fusilier Lee Rigby, The Intelligence and Security Committee of Parliament, November 2014

113 http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa

114 http://www.bbc.co.uk/news/uk-23195283

115 https://search.edwardsnowden.com/docs/SpecialSourceOperationsoverview20131104

116 A Question of Trust, Report of the Investigatory Powers Review David Anderson Q.C. Independent Reviewer of Terrorism Legislation, June 2015

GCHQ and mass surveillance

3 Invasive collection: extending the reach of the agencies

3.1 Introduction

In Chapters One and Two, we looked at how we all generate data by using the Internet, phones, apps and even wearable technology, and the techniques the NSA and GCHQ use to collect anything that passes through wires or radio waves. However, the agencies gather even more information through a range of intrusive techniques to extract data from machines. They call this ‘Active Signals Intelligence’.

Interfering with equipment is not new. GCHQ has always carried out clandestine operations. During the 1950s and 1960s it was routine to plant listening devices in foreign embassies and other targets as part of the Cold War.1

Most people will broadly understand operations targeting clear military, diplomatic or security objectives, for example, hacking into a terrorist’s phone. The Snowden documents show that in recent times more invasive activities have expanded, with the potential to affect everyone who uses modern communications.

The Internet has provided a completely new model for equipment interference called Computer Network Exploitation (CNE). The basic principle is simple: the connection of nearly every communications device to the Internet, has greatly enhanced the opportunities for interference. Whenever a device can be communicated with, it becomes a potential target for hacking. The result is to open up much greater potential for access to overseas networks, systems and devices. The term is also used in a recent public consultation by the Home Office on equipment interference.2

The direct access to the Internet backbone described in the previous section on data collection, is central to invasive activities.

Previously, interference would require physical access to the premises and devices, posing risks and costs that kept activities cautious and targeted. Today interference can happen at scale. As we show below, the agencies have built centralised ‘command and control’ systems capable of hijacking millions of computers worldwide from a single computer terminal.

There are a number of concerns. For a start, the capability to carry out such attacks in the digital age must always rely on an unfixed vulnerability (bug). This may be because the bug is known to NSA/GCHQ but has not been disclosed, or it may be because the bug has been disclosed, but the target has not been fixed. The agencies also rely on softening the infrastructure of the Internet, by weakening widely used security systems, which opens these weaknesses for exploitation by other actors, such as cyber criminals, who will be able to exploit these weaknesses as well. This has consequences for everyone’s online safety, as our banking, commerce and many other industries all rely on digital security.

In addition, there is now evidence that the agencies develop hugely complex operations that encompass a very broad range of organisations and individuals, including innocent civilians, in order to get to their target.

The Snowden documents revealed that the NSA and GCHQ have systematic campaigns to attack Internet encryption, and have successfully managed to break into some of the key technologies used to secure the Internet. They break encrypted connections to online banking and VPN connections that may be used for trade secrets.

It has been reported that when the agencies discover security problems in consumer devices, such as the infamous Heartbleed vulnerability, they keep them to themselves rather than reporting them, leaving attack vectors open for discovery by criminals.

As the Intelligence Security Committee (ISC) acknowledged in its report: “This exposes the public to threats from foreign intelligence agencies and cyber criminals, risks undermining trust in digital services generally, and may have a commercial impact on UK communications companies”.3

These actions seem to be in direct conflict with GCHQ’s responsibility for information assurance.

Finally, the scale of these potential activities has grown excessively. The NSA and GCHQ are able to target millions of computers using CNE. Essentially, the agencies are building a global machine capable of hacking on an industrial scale. The agencies appear to be working together to exploit different nations’ laws to open up information that they can not legally access at home.

3.2 Industrial-scale hacking

The NSA and GCHQ run a very complex global infrastructure that allows them to hack into millions of computers worldwide. This “industrial scale exploitation”4 – in their own terms – allows the agencies to obtain information from these millions of machines. However they are also able to remotely control the computers, including those of innocent people, which are used to enable as accessories to other covert operations. Many attacks target basic Internet infrastructure such as routers and switches.5

Traditional interception attacks on individuals required either direct physical access to plant bugs, or targeted techniques that required considerable effort. Recently the US, UK and other Five Eyes countries, have developed the capacity to automate remote hacking attacks, allowing mass computer infection on an industrial scale. The UK is heavily involved in the development and implementation of these mass hacking systems.

Leaked US budget details show the use of such techniques has expanded in the last decade. In 2004 the NSA were able to infect some 25 computers a day and handle remotely on an ongoing basis some 100 to 150 active “implants”.6 By 2014 the US had infected tens of thousands of machines with malicious software,7 with up to 100,000 computers being controlled at any time in order to act as platforms for hacking attacks8 on third parties. We do not know how many computers are directly infected and controlled by GCHQ.

It is generally accepted that spy agencies must have some properly regulated targeted hacking capabilities, but it is concerning that the NSA and GCHQ are building systems capable of targeting millions of people. The legal basis for this is unclear.

The top-level components of this system have been extensively described in leaked documents. These programmes for mass hacking9 involve many interconnected subsystems.

The scale of operations is staggering, and in many cases there is a blurring between mass surveillance and hacking, with access being used to plant malware in network infrastructure that is then used to enable new channels for bulk collection.

The following limited descriptions are based on the available information10 and analyses put together by security experts. Given that new revelations continue to appear, it is likely that this information will quickly become outdated.

3.2.1 The NSA’s billion dollar hacking budget: GENIE

The NSA’s GENIE programme appears to be a massive umbrella for a very broad range of activities for exploiting computer equipment:

“The GENIE Project plans, equips, and conducts Endpoint operations that actively compromise otherwise intractable targets and complement Midpoint programs that passively eavesdrop on communications links. GENIE Endpoint activities use surreptitious virtual or physical access to create and sustain a presence inside targeted systems or facilities. Targeted systems are compromised electronically, typically providing access to system functions as well as data. System logs and processes are modified to cloak the intrusion, facilitate future access, and accomplish other operational goals. Data of interest is harvested directly or pushed (shaped) to Midpoint collectors (a form of active-passive integration) and can also assist HUMINT, law enforcement, and DoD Information Operation activities as authorized.”11

This is a major component of the activities of the NSA. According to the above leaked documents, the NSA allocated more than $650 million in 2013 alone; and the budget is projected to pass the billion-dollar mark in 2017. Many, but not all, of the programmes described in this section are part of GENIE.

Some of the documents about GENIE contain information marked for sharing with the Five Eyes countries, and are evidence of a very close working relationship among these partners. We include GENIE in our analysis about UK activities because, from the leaked documents, it appears highly likely that the UK directly benefits from the activities and technologies developed as part of GENIE while avoiding any form of independent oversight.

3.2.2 Hacking the target: QUANTUM

QUANTUM is a new tool used by the NSA and GCHQ to hack into target computers, phones or Internet infrastructure.

QUANTUM depends on the NSA and GCHQ having direct access to the Internet backbone through the TURMOIL network, which also provides much of their ability to intercept and divert communications.

It should be made clear from the outset that these hacking techniques are not used against random people. However, as evidenced in leaked documents the targets may be innocent people working for the wrong company or may simply be in the right country to be used as ancillary support for attempts to reach a high value target.

Like many of these security codenames, QUANTUM describes a complex system with several components. The system enables an operative to task the hacking of specific computers, but also gives them the ability to interfere with Internet traffic in real time in order to infect target equipment. Another component provides the ability to introduce malware into a very broad range of equipment. The agencies have developed many tools (see slide below) that specialise in impersonating particular types of websites or computer equipment. By fooling the target’s computer or mobile phone into believing it is communicating with a genuine source they can trick it (or its user) into accepting malicious software.

The process starts when a senior analyst sends a request for an operative to hack a target’s equipment. This involves providing emails or other data associated with the target, acquired by various means, including database searches and other monitoring tools.

Once identified and authorised, the target’s information is sent to the global network of machines at key choke points of the global Internet infrastructure involved in bulk collection. These computers will keep an eye out for the target to appear, and when activity is detected this will trigger a so-called “man on the side attack”. There is evidence that these implants are also aided by the hacking of Internet infrastructure such as routers.12

These attacks are mainly aimed at making the target’s equipment believe it is communicating with a genuine source of information through the technical impersonation of software and hardware. Unsuspecting targets browsing Facebook13 or LinkedIn will not realise that the NSA may have impersonated the servers of those companies to serve fake pages that will add some computer code that will infect their computers. This is how GCHQ infected engineers working for Belgacom. In the past few years these companies have implemented default web encryption (HTTPS), so it is unclear how effective the previous techniques currently are. The evidence of basic web encryption being broken is unclear, and we discuss it in more detail in section 3.4.

There are many documented types of QUANTUM tools.14 These are not the actual software that will spy on the target or disable the equipment, but the tools that enable its delivery. Instead, these include tools for impersonating any computer, hijacking online messenger sessions, and even controlling networks of zombie computers, called botnets.

The UK’s Menwith Hill is named in documents as one of the bases where QUANTUM15 is used to target Yahoo and Hotmail. There is evidence of GCHQ’s involvement in QUANTUM, and the expansion of the programme to include other allies, such as Sweden.16

3.2.3 Automated delivery of malware: TURBINE

TURBINE is an artificial intelligence system that automates remote hacking by tailoring the attacks to a target’s computer or phone and their specific activities. For example, if a person of interest is trying to access Facebook using Firefox version 12 in a Macbook model 2010, TURBINE will find the appropriate software tools.

The system also automates the retrieval and collection of information from the infected computers.

The predecessor programmes to TURBINE under GENIE were able to control some 85,000 implants in strategically chosen machines around the world in 2011. With over 1,000 dedicated staff the NSA was able to use only some 6,000 of those.17 By removing human intervention, the new ‘command and control’ tool allows for a huge scaling up of this kind of operations, which is described in documents as one of the greatest challenges in this area of activity. While many of those affected will certainly be considered legitimate targets, there is evidence we discuss elsewhere in this report that the agencies will attack third parties in order to get to their objectives. In addition, the automation of any processes removes friction that sometimes serves to stop abuse. More efficient systems are riskier and require more oversight.

Once a target has been confirmed and TURBINE has chosen one of the many tools in the NSA/GCHQ arsenal of spying software, the latter is sent back to the target. In order to do this the agencies use another set of tools called QUANTUM, as above.18

3.2.4 Access to the high speed backbone: TURMOIL and TURBULENCE

The TURMOIL network is composed of the points of direct access to the global communications system, such as cables and satellites, based on agreements with telecommunications companies (see Chapter Two).

This unchecked capacity for inspecting Internet traffic on such a huge scale forms the basis for most of the agencies’ mass surveillance activities. Critically, TURMOIL also provides support for the injection of malware to selected targets as part of the QUANTUM process.

The components of TURMOIL are involved in bulk collection and processing of data, and many are part of the XKEYSCORE system. In addition they allow the agencies to not only monitor Internet traffic for specific targets, but also to perform targeted attacks against them.

TURMOIL is connected with a huge apparatus dedicated to breaking encryption as part of the NSA’s TURBULENCE programme.19 TURBULENCE connects TURMOIL to tools that allow operatives to bypass encryption in certain types of traffic such as virtual private networks (VPNs).

TURBULENCE is also used by the US to defend against foreign cyberattacks. It is possible that similar activities take place in the UK.

3.2.5 Malware and hacking tools

The combination of all these systems described in this chapter – TURMOIL detecting, TURBINE deciding and QUANTUM delivering the attacks – provides a comprehensive, state-of-the-art industrial-scale hacking machine. The system is completed by a huge array of actual malware.

Leaked documents show that the NSA and GCHQ have an extensive arsenal of malware, computer viruses and hacking tools to convert any computer or mobile phone into a spying machine.20 The development of such extensive capabilities has not been matched by appropriate oversight, as we show in section 3.5.

Security researcher Claudio Guarnieri21 gives an excellent overview of the main technologies and programmes available to the NSA and GCHQ.

The agencies begin by using a tool called VALIDATOR to gather basic information about the target device and prepare for further infection. VALIDATOR comes in many varieties and uses sophisticated techniques to get the data out of the infected machine undiscovered.

Under the programme UNITEDRAKE, the agencies also have a system of modular plugins for accessing different parts of a machine. These include the following:

GUMFISH takes over webcams to record images.

CAPTIVATEDAUDIENCE turns on the microphone to record audio.

FOGGYBOTTOM collects all Internet activities, including passwords for websites and email accounts.

GROK will log all keystrokes entered into a device.

In addition, a similar but more sophisticated programme called STRAITBIZARRE allows for infected machines to be used to direct further attacks at third parties via QUANTUM.

A similar system, WARRIORPRIDE, was developed in a joint effort by the Five Eyes.22 GCHQ’s slides show that WARRIORPRIDE has been used to target iPhones alongside a specifically developed QUANTUM vector tailored to the Safari browser.23 WARRIORPRIDE allowed the extraction of contacts, messages, call logs, notes, location history and photos.

GCHQ developed a series of plugins to extract information from mobile devices, targeting both Android and iPhones. Under names such as NOSEY SMURF, these tools can retrieve almost any content from a phone.24

Researchers from security firm Kaspersky have found evidence that the Regin malware involved in the hacking of Belgacom and EU computers is in all likelihood part of this project.25

3.3 Breaking Internet security

Encryption technology used to be used exclusively by governments and large companies, but it is now widespread and essential for the functioning of the modern Internet. Encryption forms the basis for securing many online commercial activities such as banking and shopping. It is becoming increasingly common in other private communications, such as social networks and email traffic, whenever some level of confidentiality is sought. Without encryption, search terms inputted into Google are sent transparently online, including any potentially embarrassing searches such as “sexually transmitted diseases”. Without encryption, emails are just like postcards.

The Snowden documents revealed that the NSA and GCHQ have successfully managed to break some of the key encryption technologies used to secure the Internet.26 The reports based on the leaked documents are quite vague on how exactly the agencies defeat encryption – no doubt because the same documents stress that the technical details must be kept top secret, even by the standards of intelligence agencies. The documents have little direct evidence of spies successfully breaking fundamental encryption, and most documents point to indirect attacks based on the installation of malware, protocol attacks and key harvesting as the main means for agencies to access encrypted information. The documents and Snowden himself make clear that, overall, properly implemented strong encryption remains solid against cryptographic attacks, although the agencies may find other ways to get round it.

Despite this, the revelations of such systemic campaign against security technologies have caused major consternation among Internet experts and the technical community. The fundamental problem is that once a weaknesses has been created in a security system there is no guarantee that it will only be used by Western agencies for legitimate purposes. Criminals and other agencies can discover and use the same techniques.

In January 2014, over 50 of the world’s foremost experts on computer security signed an open letter,27 in which they urged the US government:

“to reject society-wide surveillance and the subversion of security technology, to adopt state-of-the-art, privacy-preserving technology, and to ensure that new policies, guided by enunciated principles, support human rights, trustworthy commerce, and technical innovation.”

Documents released by The Guardian28 newspaper and other media in 2013 brought to light the existence of the NSA’s BULLRUN programme to break privacy and security technologies. These documents show that the UK has access to BULLRUN and that there are plans to integrate the other Five Eyes partners.

GCHQ’s similar programme, EDGEHILL, is dedicated to breaking specific Internet encryption systems. The leaked documents show that its initial purpose was to decode encrypted traffic from three main Internet companies and 30 types of VPN. GCHQ was also working to break the encryption used by the main providers of consumer email and private messaging, named in the document as Hotmail, Google, Yahoo and Facebook. However, GCHQ has primarily focused on Google “due to new access opportunities being developed”. The Guardian reported in 2013 that by 2015 GCHQ hoped to have “cracked the codes used by 15 major Internet companies and 300 VPNs”.29 It is unclear what exactly this cracking means, and what methods it would involve.

Many leaked documents covering these NSA and GCHQ activities were published by the German magazine Der Spiegel in December 2014.30 These provide a much richer picture of the state of the agencies’ war on Internet security. The released documents show that, among many other things, the agencies:

Are able to access encrypted Skype conversations;

Planned to be able to break into 20,000 VPN communications per hour by the end of 2011;

Consider recording private Facebook chats a minor task;

Find that different email providers present varying levels of difficulty depending on the level of encryption they use;

Routinely break through the SSL used to secure access to websites, with the NSA aiming to crack 10 million intercepted https connections a day by late 2012.

The agencies appear to have problems with a number of technologies:

Truecrypt file encryption;

OTR chats;

Tor anonymous browsing;

ZRTP video and audio conferencing;

Open source projects in general, which tend to be more robust.

According to the leaked documents, the agencies overcome encryption through a combination of approaches. The main documented avenues for the agencies to break Internet security are:

Weakening standards, policies and specifications.

Building backdoors through corporate partnerships.

Exploiting existing vulnerabilities instead of reporting them.

Actively attacking technologies.

Weakening the security of cryptographic systems has long been commonplace in the world of spying agencies. In a well-documented case from the 1980s, GCHQ and the NSA subverted the operations of Swiss company Crypto AG, a provider of strong crypto tools that could be bought by third party countries. While those operations remained within traditional diplomatic and spy circles, the agencies’ current activities affect anyone and everyone, as we all rely on secure computer systems to run and participate in our societies and economies.

3.3.1 Weakening standards

Many attacks are successful because the agencies have previously worked to weaken the underlying technologies and standards. In some cases, this takes place during the design and development stage, even before the technologies have been implemented, for example through the infiltration of projects to create backdoors. This is dangerous because it can make all Internet users more susceptible to criminal attacks.

Computer systems are full of issues and vulnerabilities, as attested by the constant upgrading of systems. The majority of these faults are accidental and hard to discover due to the growing complexity of digital systems. A minority appear to be intentional. The existence of suspicious weaknesses has been known for some time, but it is generally hard to prove they were intentionally created. However, released documents confirm “the fact that NSA/CSS makes cryptographic modifications to commercial or indigenous cryptographic information security devices or systems in order to make them exploitable”.31

Leaked documents from GCHQ show that NSA agents were involved in discussions at the Internet Engineering Task Force (IETF), the technical body in charge of ensuring the functioning of the Internet. In one case, the agents discussed the opportunities presented by new technical developments in Voice Over IP (VOIP) to improve their ability to target communications.32

Although interference in the development of protocols has long been suspected, the emergence of proof has raised concerns among the Internet technical community. The IETF runs an open process based on the understanding that all contributors share a common purpose of improving the Internet and its functioning. The NSA has participated in the IETF and associated bodies for some time and there is no question that in most cases they have participated as bona fide stakeholders, but it is clear that in some cases they were looking at ways to use standards bodies for their own purposes. It is understood that company representatives may try to promote their commercial interests (and these efforts may be openly resisted).

The possibility of actively seeking to generate or perpetuate weaknesses in the Internet’s infrastructure in order to be able to obtain secured data has generated huge controversy. There have been calls to remove key NSA staff from certain positions of responsibility in these Internet governance bodies.33

3.3.2 Corporate partnerships

The NSA spent some $250 million a year working with Internet companies to insert backdoors into encryption products.34 At the very least it seems likely that GCHQ directly benefits from these activities. However, these backdoors create vulnerabilities that could be exploited by other agencies or criminals.

These practices have long been documented. Microsoft, Lotus and Netscape all provided a backdoor for the NSA to access the encrypted communications of non-US customers.35

In 2012, the US security company RSA denied accusations that it was paid $10M by the NSA for introducing some recently discovered flaws into their products, which are used by thousands of companies and governments worldwide. The company argued that it collaborated with the NSA in good faith, trusting it would provide secure technologies.36 Whatever the truth, security companies that up until now have co-operated with the agencies may be less trusting of the NSA and GCHQ in future. This is a problem for GCHQ because it needs trust if it is to be effective in its mission. (See Chapter Nine).

The agencies also try to obtain the open collaboration of technology companies. There are reports that the NSA has asked directly for the master keys that would allow it to decrypt all the secured HTTPS traffic from Yahoo! And Gmail.37 Internet companies strenuously deny providing any such keys.

When they run out of other options, the agencies can attempt traditional infiltration. Leaked documents show that GCHQ has a human intelligence operations team (HUMINT) responsible for identifying and recruiting covert agents in the global telecoms industry.38

3.3.3 Exploiting vulnerabilities

GCHQ appears to make use of existing vulnerabilities in software and hardware at the expense of creating risks to the wider Internet community. The agency uses these as opportunities to gather data without a robust framework of authorisation and external oversight, as not even the ministerial staff are informed unless GCHQ believes that there are high risks, according to the ISC report (p. 68).39 It is unclear how the agency analyses the risks, and whether these include the wider societal costs of these acts and omissions.

Security problems are generally made public in a controlled process, sometimes called ‘responsible disclosure’. The people who discover these problems tell the creators of the original product at a reasonable but flexible time before making them public. This allows the manufacturer or developer to provide a fix at the same time that it warns customers of the issue. The delay until the fix is implemented by customers is often exploited by criminals and hackers. It is sometimes a matter of minutes for attacks to take place, as within the first 24 hours many vulnerable systems will have been fixed.

The vulnerabilities with highest risk, and consequently highest value, are “zero day exploits”.40 Originally, these were exploits that were published without being disclosed to the manufacturer or developer first. The term is now also used to include exploits that haven’t been publicly disclosed. There is a thriving market in these vulnerabilities, which can be sold for hundreds of thousands of dollars. Unfortunately, instead of discouraging this unethical market, security agencies and military businesses are becoming its main customers.41 To help understand the dubious nature of these purchases, one might ask how the public would react if government agencies used public funds to buy and keep secret knowledge about safety faults in automobiles or civil aviation systems. The impacts of secret faults in ubiquitous software depend entirely on who is using it and for what purpose, making it extremely hard to understand the consequences of failing to fix them.

Purchases of privately discovered vulnerabilities are termed “community investment”, according to leaked US documents.42 In 2013, the NSA spent some $25 million on such software vulnerabilities. From the leaked documents it is clear that the UK must at least benefit from these purchases and may even have access to them through shared technology platforms.

In 2014, when the Heartbleed bug surfaced,43 Bloomberg reported that the NSA had been exploiting it for two years, instead of trying to fix it.44 If the report is true – and it was widely challenged by experts and officially denied45 – it would mean that the agency has put its internal mission ahead of the security of hundreds of millions of companies, banks and individuals. If the NSA was benefiting from Heartbleed, it is very likely GCHQ would have as well.

In its report, the ISC raises some of these concerns and quotes GCHQ’s explanations, which avoid saying anything concrete about how the agency uses vulnerabilities or manages the risks involved. GCHQ claim that they play their part by contributing to the reporting of vulnerabilities, and that the majority of thoese it uses for exploits are known to manufacturers.46 Even this will cause dilemmas, as GCHQ may at times recommend software to UK systems as safe, when also knowing that known problems may be exploited by others. More transparency is needed about how GCHQ uses zero-days and what accountable protocols are used for obtaining, exploiting and disclosing them.

As evidenced elsewhere in the ISC report, there is no external involvement in the risk analysis of the technical options the agencies use to attack encryption or other technologies.

Both US and UK agencies have a wider and potentially conflicting public responsibility to provide Internet security through their information assurance offices. In the UK, this is CESG. This work involves collaborating with many companies,47 in some cases obtaining prior notification of vulnerabilities.

When asked by the ISC how GCHQ manages the risks involved, the agency referred to its information assurance role. Without giving any further detail, it admitted its main priority: “nevertheless *** our goal is to be able to read or find the communications of intelligence targets”.

While this may be an acceptable reply for the offensive side of GCHQ, it shows that information assurance is a secondary priority for the organisation.

This dual role of agencies such as GCHQ and the NSA creates a well known conflict of interest – called the “equities issue” in the world of security – that has been going on for decades48 and is embedded in their overall remit. Given the funding and scale of collection activities, it is hard to believe that defensive measures are certain to be given the weight they deserve.

A completely new system for authorising these activities – with much greater levels of transparency and oversight – is required as part of an overhaul of the regulation of technical processes within surveillance. Knowledge of vulnerabilities should be mainly used to protect the public’s security and not exploited for other activities without a proper risk assessment by an independent information assurance body with the relevant expertise and sufficient powers.

3.3.4 Direct attacks

In addition to the techniques described in the previous sections, the agencies engage in direct attempts to break encryption technologies. These activities may seem more legitimate and somehow “fair”, but they are also problematic. They are not carried out in isolation but as part of comprehensive programmes to undermine security, and they rely on massive monitoring of the use of these technologies by innocent people. As in the cases above, weaknesses exploited through these direct attack programmes will probably not be reported and fixed, so these also can be exploited by criminals.

The documents leaked by Der Spiegel in 2014 provide evidence of the many complex techniques used by the NSA and its allies to attack encryption. A detailed analysis is beyond the scope of this paper.

The Der Spiegel documents provide a summary of BULLRUN’s main elements:

Computer network exploitation (being able to intercept and modify traffic)

Collaboration among agencies

High performance computers

Development of advanced mathematical techniques.

GCHQ collects billions of cryptographic exchanges between Internet users and the services they access, such as Google, Facebook or Yahoo!,49 which it stores in the FLYING PIG database. This information – collected from millions of Internet users – is then used to build intelligence on these technologies to help target efforts. The fact that this project is associated with BULLRUN shows that GCHQ is not just receiving US technology, but actively collaborating in its development.

GCHQ runs joint experiments with the NSA to try to break website encryption. Among other techniques, these efforts have included using hardware-accelerated decryption and use of resources from Certificates Authorities50, which are supposed to guarantee the authenticity of websites, among other techniques. The image below shows the architecture of one such experiment. It is unclear whether it was successful.

It is important to understand the difference between encryption itself, which is the mathematical scrambling of information, and the protocols and tools used for the processing and exchange of encrypted information. Most sources and experts, including Snowden, stress that it is the latter that have been mainly affected. Strong pure mathematical cryptography remains viable in many cases and many encryption technologies remain out of the reach of the security services, as noted above.

3.4 Hacking attacks and operations

In this section we look at some of the best-known cases of intrusive hacking operations that show how interference with equipment has been put into practice.

3.4.1 Belgacom and German satellite businesses

The Belgian telecommunications company Belgacom was targeted by GCHQ from 2010 in order to gain access to important international telecommunications infrastructure.51 This is the first documented government-sponsored cyberattack by one EU member state against another.52

Belgacom operates an important mobile phone roaming exchange that enables travellers to use their handsets in other countries. This was the main objective of the attack, but GCHQ also planned to access the company’s international cables. Thanks to this attack, GCHQ had potential access to the communications of all European institutions based in Brussels, although there is no documented evidence that these were targeted. The motivation for the attack is not completely clear but it seems that it was intended to provide access to mobile handsets belonging to suspects in the Middle East.

Operation Socialist, as GCHQ codenamed it, began by creating fake LinkedIn webpages in order to infect the computers of individual Belgacom engineers with malicious software. The software infections eventually reached the core of the company’s internal network, and even now it is unclear whether its systems have been completely cleaned.

The malicious software (malware) used in the attack has been identified as a very sophisticated programme called Regin, which has also been found on EU computers targeted by the NSA.53

As of March 2015 there was a criminal investigation in Belgium into the attack54 but it appears to have little activity, with both the Belgian government and Belgacom keen to hush up such an embarrassing diplomatic incident. Hacking into a legitimate commercial business of a close ally will clearly have implications for trust and long-term cooperation between the UK and Belgium. There are proper channels that authorities can use to talk to each other.

3.4.2 Gemalto SIM Card

In another well documented case, GCHQ attacked the Dutch company Gemalto, a major manufacturer of SIM cards used in mobile phones worldwide. The aim of the hacking operation was to steal encryption keys for mobile phones.55

Encryption keys are needed to intercept mobile traffic between handset and station, as that is the only moment when it is encrypted, and then with a very weak and outdated encryption.56 Once the conversation enters the main telephony system past the base station (phone mast) it generally travels without encryption, despite being technically possible, and could be harvested through one of many corporate partnerships.57 This appears to indicate that the objective was targeted interception rather than mass surveillance, but the actual capacity of GCHQ to eavesdrop over mobile calls is unclear.58 As the slide above shows, the operation was part of a wider campaign against the mobile industry, including billing and customer services.

The documents also state that the agencies targeted other SIM card providers as part of the campaign but were unsuccessful at the time. It is not known whether those were infiltrated at a later date, to give GCHQ potential access to many other mobile phones around the world.

GCHQ does not need access to security keys to access the communications of millions of people as it can simply intercept these in transit. These attacks are geared towards building capabilities for attacking high-value targets. For example, these keys would allow the agency to imitate operators and authenticate and push mobile phone software updates to devices with their own malware. The main risk of these operations is undermining the rule of law and bypassing international governance of communication networks.

3.4.3 Telecommunications companies

In a joint operation with the NSA, GCHQ also attacked three German providers of satellite data services: IABG, Cetex and Stellar.59 This operation targeted exchange points linking satellites with the broader Internet, and identified ‘important’ customers of the German providers.

According to leaked documents, in 2013 the NSA had obtained legal authorisation under the FISA court system to monitor “Germany”. In principle, GCHQ would have similar authorisation under the Intelligence Services Act 1994 to carry out these attacks. But as we have seen, such authorisations are very broad, covering classes of activities and whole countries, and according to the ISC report, the agencies don’t always keep detailed records.60 It is unclear whether ministers or anyone outside the agency knew of such operations in any detail. We would need specific hacking legislation as detailed as intercept legislation if is to be done at all.

The NSA and GCHQ also infiltrated several global telecom companies including German providers in order to gain access to the data flowing over their networks.61 The aim was to produce intelligence on the architecture of the Internet in order to prepare other interventions. The attacks involved targeting individual employees within the companies.

3.4.4 Tor

The GCHQ programme EGOTISTICAL GIRAFFE targets the Tor anonymous communications network.62 Tor, (The Onion Router), is instrumental in enabling hundreds of thousands of political dissidents to access the Internet anonymously, and thus communicate without fear of repercussions in places like Iran and China. It is also increasingly used by regular Internet users in Western countries wishing to avoid snooping by commercial Internet companies. The Tor project has also helped domestic abuse survivors to protect their privacy.63 Tor’s development has been substantially financed by the US and Swedish governments.64

Tor has two elements: anonymous browsing, and Tor Hidden Services, which makes it possible to host hidden websites that are only accessible via Tor. The two are often confused; Tor Hidden Services accounts for only about 2% of total Tor traffic. Tor has received media attention because Hidden Services, which provides security and anonymity to human rights activists wishing to blog anonymously, has also been used by criminals, including child abusers, and has enabled an underground market in illicit goods such as drugs.

The current debates about Tor are reminiscent of similar debates about anonymous email in the early days of the Internet, when it was perceived as an unregulated “electronic frontier”; an almost completely parallel discussion in 2000 took place about Freenet, which also enables anonymous browsing of a hidden network. Most freedom of information advocates agree that on balance Tor is a force for good, despite the potential for abuse by unscrupulous criminals – much like the Internet as a whole. The Human Rights Council report of the Special Rapporteur David Kaye on the right to freedom of opinion and expression stated that tools like Tor, “may be the only mechanisms for individuals to exercise freedom of opinion and expression securely, access to them should be protected and promoted”.65

Interfering with Tor may give the security agencies an edge over some serious criminal conspiracies, but it would also give them access to the secure communications of an estimated hundreds of thousands of people worldwide.66 In addition, attempts to weaken Tor, by for example marking its traffic for easier tracking, could also be exploited by the governments of repressive regimes whose citizens use Tor to circumvent censorship.

According to the NSA’s own documents, GCHQ and NSA staff expressed their dislike for this tool in a presentation slide set called “Tor Stinks”.67 Leaked source code from the XKEYSCORE system68 shows that operatives systematically track Tor activity and potential users. Despite their best efforts, the agencies acknowledged they have not yet been able to fully crack the Tor network to de-anonymise its users.

3.5 Oversight of Active Signals Intelligence

This chapter has shown how Active Signals Intelligence has vastly changed and expanded in recent years, leaving regulation behind. Many of these GCHQ programmes operate without effective oversight from our government. The ISC report, referred to in this and previous chapters, explains how such interferences with equipment and the activities to break encryption are regulated under Sections 7 and 3(1)a of the Intelligences Services Act 1994, respectively.

In February 2015, the UK’s Home Office published the Equipment Interference Draft Code of Practice69 to regulate equipment interference. In light of what we have seen in the Snowden documents, it is too little too late and not designed to cope with the large scale operations carried out by GCHQ in partnership with the NSA.

The ISC report describes a shockingly lax system of authorisation and oversight for activities to break encryption under section 3(1)a of the Intelligences Services Act 1994:

“No additional Ministerial Authorisation is required for these activities. There are internal procedures: ***.188 There is no legal requirement to inform Ministers: however, GCHQ have said that they would ask the Foreign Secretary to approve a specific operation of this kind “where the political or economic risks were sufficiently high”(although, in practice, they manage their operations to avoid this level of risk).”

GCHQ told the Committee that:

“The FCO is aware of the activity and the possible political risk, but individual legal authorisations are not required for each operation. The FCO could assess the political risk of a compromise, it is not well‐placed to assess the complex technical risk.”70

As this chapter demonstrates, breaking encryption and other hacking activities carry significant risks. ORG is calling for a new regime to ensure that there is proper and technically sound regulation and oversight. This must include more transparency about the cost benefit analyses behind these activities.

3.6 Conclusion

Security is central to all of our online activities. However, as we have seen in this chapter, the security services want to exploit weaknesses, making the Internet less safe for everyone. Equipment interference is no longer limited to accessing a device directly: it can be applied to anything that can be “seen” on the Internet. For equipment to be successfully invaded, it has to be insecure. This invasive collection affects innocent bystanders – in this case companies or computers that become part of GCHQ botnets or compromised networks.

The consequences of the expansion of invasive activities have not been debated in Parliament or addressed by the ISC. The fundamental aim of the agencies – our security – is being undermined by the way they operate. In Chapter Nine, we look at the serious risks caused by weakening Internet security.

Industrial-scale hacking also blurs the line between intelligence and the use of hacked equipment for offensive purposes. The same techniques can be used for different purposes; anything that is hacked can also be switched off, made to malfunction, or depending on what the equipment is controlling, be weaponised. In Chapter Six, we look in more detail at the offensive capabilities that GCHQ possesses.

The mass surveillance infrastructure GCHQ has, in particular access to cables, is being used for network injection techniques to enable equipment interference. This represents another huge form of leveraging our strategic position on the international Internet network with profound implications. GCHQ has the unique ability to intercept a great deal of Internet traffic which gives it the ability to target specific communications, spoof results and exploit vulnerabilities in users’ systems. There is also the implication that the UK is conducting activities for the NSA that may not be fully authorised under US regulations.

The agencies may argue that equipment interference is justified when the target is an actual enemy or person of interest. This is a different situation from using such capabilities when legal regimes prohibit it simply because it is hard to gain cooperation.

1 Aldrich, R. (2010) GCHQ: The Uncensored History of Britain’s Most Secretive Agency, Harper Press, London

2 https://www.gov.uk/government/consultations/interception-of-communications-and-equipment-interference-draft-codes-of-practice

3 Privacy and Security: A modern and transparent legal framework, The Intelligence and Security Committee of Parliament, March 2015 p68

4 https://firstlook.org/theintercept/document/2014/03/12/industrial-scale-exploitation/

5 http://www.wired.com/2013/09/nsa-router-hacking/

6 https://firstlook.org/theintercept/document/2014/03/12/thousands-implants/

7 http://www.washingtonpost.com/world/national-security/us-spy-agencies-mounted-231-offensive-cyber-operations-in-2011-documents-show/2013/08/30/d090a6ae-119e-11e3-b4cb-fd7ce041d814_story.html

8 http://www.nytimes.com/2014/01/15/us/nsa-effort-pries-open-computers-not-connected-to-Internet.html?_r=1

9 https://firstlook.org/theintercept/document/2014/03/12/nsa-gchqs-quantumtheory-hacking-tactics/

10 https://nex.sx/blog/2015-01-27-everything-we-know-of-nsa-and-five-eyes-malware.html

11 http://www.spiegel.de/media/media-35660.pdf

12 https://firstlook.org/theintercept/document/2014/03/12/five-eyes-hacking-large-routers/

13 https://firstlook.org/theintercept/2014/03/15/nsa-facebook-malware-turbine-non-denial-denial/

14 http://www.spiegel.de/netzwelt/netzpolitik/quantumtheory-wie-die-nsa-weltweit-rechner-hackt-a-941149.html

15 https://www.aclu.org/files/natsec/nsa/menwith-hill-station-leverages-xkeyscore-for.pdf

16 http://notes.rjgallagher.co.uk/2013/12/gchq-quantum-hacking-surveillance-legality-nsa-sweden.html

17 http://www.washingtonpost.com/world/national-security/us-spy-agencies-mounted-231-offensive-cyber-operations-in-2011-documents-show/2013/08/30/d090a6ae-119e-11e3-b4cb-fd7ce041d814_story.html

18 https://firstlook.org/theintercept/2014/03/12/nsa-plans-infect-millions-computers-malware/

19 https://robert.sesek.com/2014/9/unraveling_nsa_s_turbulence_programs.html

20 https://firstlook.org/theintercept/2014/03/12/nsa-plans-infect-millions-computers-malware/

21 https://nex.sx/blog/2015-01-27-everything-we-know-of-nsa-and-five-eyes-malware.html

22 http://www.spiegel.de/media/media-35688.pdf

23 http://www.spiegel.de/media/media-35662.pdf

24 https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/index/assoc/HASH0129/4a1e88b7.dir/doc.pdf

25 http://securelist.com/blog/research/68525/comparing-the-regin-module-50251-and-the-qwerty-keylogger/

26 http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html

27 http://masssurveillance.info/

28 http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security

29 http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security

30 http://www.spiegel.de/international/germany/inside-the-nsa-s-war-on-internet-security-a-1010361.html

31 http://www.spiegel.de/international/germany/bild-1010361-793524.html

32 https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/index/assoc/HASH01f2/4d5034e3.dir/doc.pdf

33 http://arstechnica.com/security/2014/01/nsa-employee-will-continue-to-co-chair-influential-crypto-standards-group/

34 http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security

35 http://www.duncancampbell.org/menu/surveillance/echelon/IC2000_Report%20.pdf

36 http://www.reuters.com/article/2014/03/31/us-usa-security-nsa-rsa-idUSBREA2U0TY20140331

37 http://www.cnet.com/uk/news/feds-put-heat-on-web-firms-for-master-encryption-keys/

38 http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security

39 http://isc.independent.gov.uk/files/20150312_ISC_P+S+Rpt(web).pdf

40 http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret-software-exploits/

41 http://securityaffairs.co/wordpress/14561/malware/zero-day-market-governments-main-buyers.html

42 http://www.spiegel.de/media/media-35660.pdf

43 http://heartbleed.com

44 http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html

45 http://www.nytimes.com/2014/04/12/us/us-denies-knowledge-of-heartbleed-bug-on-the-web.html?_r=1

46 ISC, p. 69

47 http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-to-swap-data-with-thousands-of-firms.html

48 http://www.forbes.com/sites/bruceschneier/2012/05/30/the-vulnerabilities-market-and-the-future-of-security/

49 http://www.spiegel.de/media/media-35512.pdf

50 http://www.spiegel.de/media/media-35509.pdf

51 http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html

52 https://firstlook.org/theintercept/2014/12/13/belgacom-hack-gchq-inside-story/

53 https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/

54 http://www.rjgallagher.co.uk/2015/03/operation-socialist-gchq-belgacom-hack.html

55 https://firstlook.org/theintercept/2015/02/19/great-sim-heist/

56 http://blog.cryptographyengineering.com/2013/05/a-few-thoughts-on-cellular-encryption.html

57 http://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c20.pdf (p.611)

58 http://electrospaces.blogspot.co.uk/2015/02/nsa-and-gchq-stealing-sim-card-keys-few.html

59 http://www.spiegel.de/international/germany/gchq-and-nsa-targeted-private-german-companies-a-961444.html

60 Privacy and Security: A modern and transparent legal framework, The Intelligence and Security Committee of Parliament, March 2015 p66

61 http://www.spiegel.de/international/world/snowden-documents-indicate-nsa-has-breached-deutsche-telekom-a-991503.html

62 https://www.torproject.org/about/torusers.html.en

63 http://boingboing.net/2014/05/07/tor-network-security-for-dome.html

64 https://en.wikipedia.org/wiki/Tor_%28anonymity_network%29

65 http://www.ohchr.org/EN/Issues/FreedomOpinion/Pages/CallForSubmission.aspx

66 https://metrics.torproject.org/userstats-relay-table.html

67 http://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document

68 http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html

69 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/401863/Draft_Equipment_Interference_Code_of_Practice.pdf

70 Privacy and Security: A modern and transparent legal framework, The Intelligence and Security Committee of Parliament, March 2015 p68

4 How mass surveillance is used

4.1 Introduction

In this chapter we look at how the information collected is put to use by the security services. It also describes some of the technical processing that determines whether computers or analysts analyse data further. This is the moment when the surveillance system can have a major impact on individuals as their digital life is put under scrutiny using further analytics tools.

One of the many arguments used to justify mass surveillance is that the collecting of data in itself does not amount to a breach of privacy. Only if that data is looked at specifically by a person, not a machine, is there a risk. There is also the implication that collected data will only be looked at if there is some suspicion of illegal activity with the oft-repeated line, “if you have nothing to hide, you have nothing to fear”.

In reality, there are real privacy concerns over how our data is stored, analysed and looked at. The processes used will inevitably generate false positives and incorrectly identify individuals as potential suspects. There are also questions about who has access to this data, which is explored in Chapter Five on data sharing methods.

This chapter focuses on bulk data processing, rather than targeted surveillance. We know that legitimate surveillance is needed and expect that GCHQ and the NSA mostly target people who are suspected of wrong doing. However, the lack of transparency and due process makes it impossible to verify how often it is done correctly. There are many examples that show that surveillance is used to silence and harass.

This has been well documented in the case of people put on no travel lists without explanation, who have little recourse. This was the case for Laura Poitras, the director of the Oscar-winning documentary about Edward Snowden, Citizen Four, who had been repeatedly detained at the US border even before the film was made.1

Another problem is the apparent expansion of legitimate categories of targets. We would expect that any escalation of surveillance against individuals would follow clear procedures; through identifying a suspect, collecting evidence and getting warrants. This process was laid out in the Intelligence and Security Committee report into the murder of Fusilier Lee Rigby,2 which explained how his killers had been subjected to increasing targeted surveillance by MI5 and the police. We need more transparency on whether any comparable process exists for the selection of targets for Internet surveillance and hacking.

This is particularly important when innocent people are targeted in order to access others. For example, we have shown how GCHQ has variously intruded in the lives of computer engineers and employees of communications companies, people involved in climate negotiations, political activists who use technology (hacktivists), Yahoo! webcam users, EU commissioners and security experts.

These are only the best documented cases in relation to GCHQ. The NSA has been found monitoring well respected US Muslim leaders in collaboration with the FBI, among others.3

This raises another important issue around targeting and how to assess the impacts of mass surveillance. Signal agencies such as the NSA and GCHQ work with other agencies, and much of the original targeting and the outcomes of the surveillance will happen elsewhere. There are no leaked documents from these agencies – MI5, MI6, or the CIA, where we can see the impacts, such as who is marked for arrest or physical surveillance, and how exactly this is decided. We received a glimpse of how UK agencies work together, and the difficult job they have, in the report on the Woolwich murder of Fusilier Rigby.4

We know that in the case of the NSA, surveillance can be used for targeted assassination by drone strike, with the target’s exact location provided by their mobile phone.5 These attacks have been criticised among other things for the high numbers of civilians killed – an average of 28 for each targeted killed according to analysts.6 There is growing concern about the role of the UK in supporting these operations, with calls for the Government to disclose its policy.7

In the rest of this chapter, we focus on the handling of mass surveillance and how this touches many people who may not even be specifically targeted: the proverbial haystack required to find the needles.

4.2 Intelligence and government

Although the Home and Foreign Secretaries are directly responsible for the Intelligence and Security Agencies, the agencies’ priorities are established by the National Security Council (NSC) and the Joint Intelligence Committee (JIC).

The relationship between intelligence and policy making has been under reform, following the Butler Report into the intelligence on weapons of mass destruction that led to the Iraq War in 2003.8 The JIC, which works under the auspices of the Cabinet Office, has been established for a long time and agrees intelligence reports before they get circulated to ministers; its information is then filtered through the Joint Intelligence Organisation.9

The previous coalition government brought in sweeping reforms. The NSC was established in 2010 and it is supported by the National Security Secretariat, which provides coordination on security and intelligence across government.10 The NSC’s weekly meetings are chaired by the Prime Minister and gather important Government figures, but the work is led by the National Security Adviser, currently Sir Mark Lyall Grant. The JIC can be asked by departments to produce intelligence, but it is mainly directed by the NSC, which sets priorities according to current policy issues.

The agencies can only generate intelligence for the purposes determined in the Intelligence Services Act: national security, the economic well-being of the UK, and serious crime. The National Security Strategy11, produced every five years, sets out broad directions. Every surveillance operation must relate to some priorities and objectives, as we can see in some leaked GCHQ policy documents.12 The RUSI report13 explains in detail how the intelligence priorities operate:

“The NSC process for Priorities for Intelligence Collection (PICs) sets out the priorities of SIS and GCHQ. The PICs are divided geographically and thematically and are set with a three-year outlook. They are reviewed annually. The intelligence agencies can also be set mid-year requirements in the form of a Temporary Intelligence Watch, ordered by the chairman of the JIC, in response to events unforeseen by existing PICs (such as the Ukraine crisis, Arab Spring or the emergence of ISIL). This ensures the process can be flexible when necessary. The PICs are informed by statements of demand from government departments, and take the form of detailed questions that align with specific policy objectives. They do not dictate what specific resources should be allocated; however, the intelligence agencies use the PICs to prioritise and guide their own resourcing decisions.”

4.3 How information is employed: the uses of mass surveillance

Below we outline the main uses of material collected through mass surveillance. Most discussions about mass surveillance only mention terrorism and other serious crimes, but we know that the collected materials will be used in many other ways, for example spying on foreign companies for economic reasons. For the purposes of this report we have attempted to categorise these uses, but since the end of the Cold War, there has been a problematic blurring of the boundaries between criminal justice and national security, particularly in relation to terrorism. This has implications for the arguments used to justify mass surveillance.

The 2000 report14 by Duncan Campbell for the European Parliament described the Five Eyes’ global system of communications interception ECHELON – a forerunner of the programmes described in this report. This report gave insights into the use of these kind of surveillance materials that are very relevant to the Snowden leaks.

The report raised concerns about the complicated relationship between law enforcement, national security and communications intelligence, which is increasingly blurred. This affects how we understand the territorial scope of surveillance. In the past, law enforcement was mainly domestic and intelligence was mainly foreign facing, with strong regulatory differences. Now global networks such as ISIS simultaneously operating as armies in foreign theatres of war, while mobilising UK civilians at home make these distinctions harder to maintain. Yet maintaining some separation is critical to determine the necessity and proportionality of each programme. Some of the uses of mass surveillance data revealed by Snowden are very innovative and not foreseen by surveillance legislation.

4.3.1 Law enforcement and anti-terrorism

As we explained above, most of the scenarios depicted by defenders of mass surveillance are based on the tactical use of data under the law enforcement model to find terrorists, criminals and child abusers, who are described as ‘needles’ in the haystack. The report on mass surveillance by the ISC described the activities of the agencies almost exclusively under this framework and leaked documents claim that the XKEYSCORE tool has been used to capture some 300 terrorists.15

Traditional law enforcement involves targeted surveillance, or at least starting with some concrete suspicion or report. This may be exploited inappropriately or lead to mistakes, but law enforcement operates within a framework of accountability that assesses the necessity and proportionality of surveillance. In practice, this accountability is undermined by the growing use of closed courts and secret evidence. This has long been criticised by human rights organisations,16 with the UK singled out in a EU report for its systematic use of secret evidence, which does not meet EU case law requirements for fair trials.17

Data can be used in several ways for law enforcement. In its most basic form, Internet data can support traditional investigations involving the collection of data on known individuals or groups. The ISC report into the murder of Fusilier Lee Rigby gave a good idea of how agencies use data to track potential and actual terrorists.18

On occasions targeted interception can be stretched beyond what is reasonable. The ISC report on Privacy and Security19 stated that the Interception of Communications Commissioner (IoCC) has raised serious concerns about the use of “thematic warrants”, which target “any organisation or any association or combination of persons”. The IoCC found that the warrants had been applied too broadly and had even recommended that some warrants be cancelled.

Increasingly, data is used in a very different way with regard to fighting terrorism and serious crime. Rather than starting with reports or leads on suspects, the agencies take a data driven approach to intelligence, one which looks at every piece of information available, without a predetermined suspicion, to see what patterns or interesting materials appear. This is a common aspect of Big Data analytics.

The ISC report states that GCHQ analysis can conduct complex searches but cannot search freely and “cannot conduct fishing expeditions”. Yet this is somewhat at odds with the picture that comes from the leaked documents. While certainly the agencies have some legal and technical constraints, they appear to be able to conduct fairly broad analytics.

Another important angle in the use of data for law enforcement is retrospective analysis in order to look at the past activities of suspects. As we discuss in Chapter Seven, the development of these new mass surveillance systems has run in parallel to the creation of data retention laws, forcing communications providers to keep a history of their customers’ activities.

4.3.2 Strategic Intelligence

Strategic intelligence involves looking for new potentially unforeseen information to advance the national interests of the state, such as dealing with adversarial countries or monitoring global commodities. Historically, this was mainly about diplomatic, military and economic issues and completely removed from law enforcement, but increasingly criminal activities such as terrorism are defined as existential threats to the country that require forecasting and strategic monitoring.

There is a tension between focusing on tactical policy priorities – the here and now – and strategic intelligence about future issues that may never materialise. The ISC in their 2012 report20 give the example of the spread of the Arab Spring, which apparently caught the intelligence community off-guard because they had been focused on lower level priorities.

The recent Snowden leaks confirm mass surveillance is used for this kind of prospective intelligence relating to economic and diplomatic issues, for example, the NSA has been found spying on Brazilian oil company Petrobras, while the UK has spied on the G20 summit and regularly targets strategic industries – energy companies, financial organisations and airlines – as well as foreign governments.21

Spying on foreign companies is not new. The use of communications monitoring for economic purposes was well documented in Duncan Campbell’s report on ECHELON around the battle between Boeing and Airbus for contracts in Saudi Arabia in the early 1990s. By monitoring faxes and phone calls between Airbus and the Saudia Arabia, the NSA discovered that Airbus agents were offering bribes to a Saudi official. US officials used this to get Boeing Co and McDonnell Douglas Corp. to win in the $6 billion tender.22

Increasingly, strategic forecasting involves the direct monitoring of the global populace to make predictions about uprisings, crises and other political and economic changes. The “strategic monitoring” of mass civilian communications for discovery purposes was challenged at the European Court of Human Rights in 2006, which decided that it could be justified under certain circumstances.23 But in that case the rationale – by the German Federal Government – was based around national security and/or the prevention of crime, not the economic wellbeing of the nation.

The regulation of strategic intelligence poses a challenge from a human rights perspective, as it is far removed from the usual notions of suspicion, due process and fairness involved in criminal justice.

In addition there are two specific issues, which were already raised in Campbell’s ECHELON report 15 years ago, that need to be revisited today.

The first issue relates to the separation of the national interests as representing the well-being of the citizens, and the interests of British companies operating abroad. The report found that at the time governments would of course advance national companies, but private companies were not able to “task” the systems in order to advance their commercial interests, for example deciding what specific competitors were to be targeted.

At the time of the report, the tasking of economic intelligence fell on the Joint Intelligence Committee, the Treasury and the Bank of England. Since then, the influence of the private sector in public policy, and indeed in intelligence operations, has only grown in importance, which raises the question of whether this separation is still in place.

The second issue relates to the ability to control the outputs of intelligence. Collecting information is not the same as disseminating and exploiting intelligence. The decision on the latter was not previously made by the agencies, but by the Government. Given the vast amount of information collected and the increasing use of automated systems, does this separation still stand? Do controls on dissemination work today with the myriad security agencies sharing data as part of the global US-led coalition? After all Snowden himself was able to access highly sensitive materials.

4.3.3 Reference data

Mass surveillance systems also provide reference data. Computer analytics systems looking for abnormal patterns of behaviour need to know what is ‘normal’. They do this by looking at innocent people.

In other cases the agencies use data from innocent people to research and analyse how Internet technologies work, so they can develop ways to break into them. We saw this in the cases of GCHQ collecting cryptological data from secure websites. The private images collected from webcams were used mainly to train computers in facial recognition. In other cases, they may simply collect ancillary information, as we saw in the hacking of companies to map Internet infrastructure. The agencies are always planning the next steps to build their strategic capabilities.

Importantly, all the data that is not flagged up as relating to any individual of interest is used to build the basis for statistical comparison and other analytics. Understanding anomalies requires an understanding of normal behaviour, and the latter is built through the systematic analysis of the data of regular people.

4.3.4 Cyber attacks and strategic dominance

As we discuss in Chapter Six, the capacity to access the Internet backbone for mass collection of data enables computer network attacks and other ‘cyber operations’. In the long run the global system of access to the global network of submarine cables provides the US, UK and allies with strategic dominance of cyberspace in the case of armed conflict.

This strategy poses risks to Internet security and simultaneously undermines our foreign policy objectives of a global free and open Internet. This is discussed in more detail in Chapter Nine.

4.3.5 Cyber defence and the digital border

NSA documents leaked to Der Spiegel show that the agency uses the pervasive monitoring of Internet traffic in and out of the country as a kind of ‘digital border’ to prevent foreign cyber-attacks.24 The NSA codename this defensive system Tutelage.25 The UK has similar capabilities and integrates its own Internet monitoring with cyber-defence.26 This may not necessarily be a negative development, but there needs to be a broader debate on the subject. For example, there are unanswered questions about whether the governments of the UK or the US could use this technology to implement a kill switch to cut off their countries from global communications in an extreme crisis.

Here it would be important to keep in mind that the UK Government is not just accessing cables that come into the country, but also cables that pass through British land or territorial waters. The obligations of states in relation to undersea cables are laid out in international treaties. These include protecting cables from damage, but they do not prevent the tapping of cables.

4.4 Predictive analytics and profiling

We often hear that bulk collection is necessary in order to find the “needle in the haystack”. Sir Iain Lobban, head of GCHQ from 2008 until January 2014, used these words extensively in his appearance in Parliament27 in November 2013. This is a misleading argument, because modern profiling systems do not operate with such clear categories. Instead everyone is analysed and subjected to dynamic risk analyses that treat every innocent citizen as a potential suspect. There is rarely absolute certainty about who may be a needle.

The details of most systems used by GCHQ remain secret, but academics have been studying profiling systems in other areas of national security such as borders and detention orders.28 These systems are based on data mining techniques that have been developed in commercial applications, such as at casinos and in fraud detection.

Border controls are a good example of security profiling. Here we could imagine actual lists of dangerous people who will be prevented from entering the country or possibly taking a plane. The Home Office describes the National Border Targeting Centre (NBTC) – responsible for border profiling – in these simple terms:

“More than 100 million passenger movements in and out of the UK were checked against UK Border Agency and police watch lists last year.”29

This does not fully reflect the way the newer border controls operate for everyone. There are indeed secret watch lists with named individuals, which raise their own questions about accountability and due process. However, the computers at NBTC perform more complex real-time risk assessments of all airline passengers, where those with a substantial risk score are flagged when they cross the border.

This score is not fixed but it will be constantly recalculated. Buying a ticket in cash, or having taken a previous trip to a troublesome country, when combined with other factors could trigger an alert.

Each individual element of a security risk alert may be completely lawful innocent behaviour. This has been evidenced in security deportation orders. In the words of a defence lawyer at one such case at the Special Immigration Appeals Commission:

“Neither we nor our clients were given the ‘ingredients’ of the mosaic – we were only given conclusions, expressed in the form ‘we assess that X has been involved in attack planning’. This is the way it operates, piecing together fragments which in themselves are innocent.”30

Another complication for the narrative of the needle in the haystack is the new risk models developed since 9/11. There is a wealth of research on how the unimaginable events of 9/11 fundamentally changed security risk calculations.31 The new basic premise is that the mere possibility of a high impact event should be enough to trigger a security response, as outlined in the UK National Security Strategy:

“(...) this strategy must allow the Government to make choices about the risks we face. Of course, in an age of uncertainty the unexpected will happen...”32

The fixed categories of innocent and suspect become more blurred when we are not trying to establish probabilities, but simply possibilities. For example, in the period around Christmas 2012-13, the NBTC issued 4,900 alerts to border agencies, who carried out 237 arrests: a 5% conversion rate.33 These may seem reasonable figures, but the same logic applied to Internet would see many thousands of innocent people flagged up as potential suspects.

The sophisticated mass surveillance programs of the NSA and GCHQ treat all Internet users like international airplane passengers. After the needles are found, the haystack is not discarded but used to build databases of evolving risks. For example, the lawful use of encryption in emails or use of TOR will increase your risk score.34

In the context of air travel or border controls there could be an argument that this intrusion is necessary for the safety of the flight, and limited to that context, but mass surveillance programmes are permanently tracking what we do online.

In fact, The New York Times reported that the NSA actually monitors airline information data as part of their profiling and analysis of social networks, including of American citizens,35 for which they have no legal mandate.36

4.5 Automated machine processing of information by computers

Advances in machine learning and artificial intelligence have changed the current focus on human activities in surveillance legislation and policy. The argument that there is no mass surveillance if nobody reads, looks or listens to the collected information is out of touch with the capacities of modern digital systems.

When giving evidence to Parliament,37 Sir Iain Lobban, head of GCHQ from 2008 until January 2014, said:

“We do not spend our time listening to the telephone calls or reading the e-mails of the majority, the vast majority that would not be proportionate. It would not be legal. We do not do it.”

The need to read emails is reduced by technology that can process text content. The NSA markets tools to process natural language texts under its technology transfer program; these do not require a human operative to actually read them.38 The NSA also licenses technologies for handling voice recognition:

“NSA’s acoustic technologies include methods for identification, extraction, and analysis of voice and voice signals. Additional technologies include foreign language voice recognition, duplicate voice identification, and methods of measuring voice enhancement.”39

Documents leaked by The Intercept show that while

“perfect transcription of natural conversation apparently remains the Intelligence Community’s “holy grail,” the Snowden documents describe extensive use of keyword searching as well as computer programs designed to analyze and “extract” the content of voice conversations, and even use sophisticated algorithms to flag conversations of interest”.40

Computer analysis is just another kind of intrusion on privacy and the agencies have extensive capabilities with little external regulation. As a general rule, if it is an intrusion for the agencies to hire a person to carry out a task, it should be an intrusion for them to make a computer do the same.

In recent years facial recognition has also reached maturity. Despite the lack of publicly available information on their operational effectiveness in the field,41 facial recognition systems are being rolled into production in many countries.

There are documents showing that GCHQ engages in computerised facial recognition. As we showed above, GCHQ has tapped into the private webcam communications of innocent Yahoo! subscribers. In its own documents, the agency explains it did this as an experiment to improve facial recognition.

State of the art machine-learning tools are capable, not just of recognising a specific individual’s face, but of learning to classify faces based on attributes such as hair style or expression.42

These developments have far-reaching implications for regulating surveillance. Claims that intrusion only takes place when humans are involved in reading, listening to, or looking at are hard to sustain, given the information that can be gleaned by computers alone.

4.6 Social Media monitoring and open source intelligence

NBC news has reported that GCHQ uses a variety of tools for their real time analysis of social media, including commercially available software.43

The SQUEAKY DOLPHIN programme gives GCHQ the ability to monitor Facebook, Twitter and YouTube in real-time and collect web addresses and other user information, on a daily basis.

The programme is nominally focused on the general analysis of social media trends. The reports mention protests in Bahrain as one of the scenarios used in the project. The majority of the data used may be publicly available, but it is the capacity to intercept and collect bulk raw Internet data that makes this analysis possible.

The analysis appears to have largely been of social media sources that were not encrypted, such as Twitter, Facebook, Blogger and Youtube. Since the reports were published several of these services have started encrypting their traffic, and overall encrypted web traffic more than doubled in the year after Snowden came out.44

In addition it has been reported that GCHQ carries out targeted automated monitoring of known social media accounts. The case relates to known security experts being targeted under the project LOVELY HORSE.45 In such cases it seems likely that a targeted warrant should be used.

According to the leaked presentation, this programme currently is an experiment in mass psychology and socio-cultural research. The objective seems to be understanding trends, rather than building individual profiles. But there are ethical problems with any non-consensual research of this kind, a problem compounded by the involvement of security services instead of accredited institutions with a clearer organisational mandate to use social research for the public interest.

In addition, GCHQ is expanding this programme into more targeted forms of intervention. They are using social media for the targeted enrichment of profiles, for example by, adding geolocation. The agency, is also using these tools to identify specific individuals, such as top Twitter users in an area.

GCHQ has several programmes dedicated to monitoring other social media, such as Google+, LinkedIn, bulletin boards and online fora.46

The newer kinds of communications data that the intelligence agencies can access to paint an intimate picture of our lives. Researchers have confirmed that simple endorsements in social media reveal likely political opinions, sexual preferences, lifestyle preferences, social circles, personal habits and patterns of behaviour. Many of these attributes are considered sensitive data that can lead to discrimination under UK data protection law and must be treated with special caution. This is just based on clicking activities, without the target providing any personal details.47 As such, programmes using publicly available data should be tightly regulated.

The security services call this kind of publicly available information “open source intelligence” and appear to believe that it is fair game for monitoring. There is a well developed support industry around this practice, with concerns being raised about the role of unregulated private companies.48 Police forces follow some internal regulations that attempt to bring these activities under the Human Rights Act and other legislation, and include rules on the use of fake accounts and unattributable computers.49 The situation is not completely satisfactory and more external oversight is needed, but at least it is a step in the right direction. In contrast to the police, GCHQ’s collection of publicly available information appears to be under little external scrutiny.

4.7 Conclusion

Profiling techniques are powerful and can easily be misdirected. It is hard to justify profiling large numbers of people without suspicion, but that is in effect what is happening. The systems provide constant risk analysis of each citizen whose data is contained in the database.

Machine processing is a major threat to citizens’ privacy. Arguments that humans do not examine material are inadequate when compared with the power of computers to analyse and sort.

Private data is not the only source of information for GCHQ, who harvest public information as well. There are still ethical and legal issues when using public sources of data. Just because personal information is publicly available, does not mean that anyone has the right to do whatever they like with it.50This is especially true for governments, because of the power they wield. The very least we deserve is an honest debate about how and when agencies can use public data.

1 http://www.salon.com/2012/04/08/u_s_filmmaker_repeatedly_detained_at_border/

2 Report on the intelligence relating to the murder of Fusilier Lee Rigby, The Intelligence and Security Committee of Parliament, November 2014

3 https://firstlook.org/theintercept/2014/07/09/under-surveillance/

4 Report on the intelligence relating to the murder of Fusilier Lee Rigby, The Intelligence and Security Committee of Parliament, November 2014

5 https://firstlook.org/theintercept/2014/02/10/the-nsas-secret-role/

6 http://www.theguardian.com/us-news/2014/nov/24/-sp-us-drone-strikes-kill-1147

7 http://www.reprieve.org.uk/press/2014_11_27_gchq_uk_publish_policy_us_drone_strikes/

8 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/61935/nsc-study.pdf

9 https://www.gov.uk/government/organisations/national-security/groups/joint-intelligence-organisation

10 https://www.gov.uk/government/organisations/national-security

11 Aldrich, R.J. et al., 2014. Spying on the World,

12 http://theintercept.com/document/2015/09/25/hra-auditing/

13 https://www.rusi.org/downloads/assets/ISR-Report-press.pdf p51

14 http://www.duncancampbell.org/menu/surveillance/echelon/IC2000_Report%20.pdf

15 http://www.theguardian.com/world/interactive/2013/jul/31/nsa-xkeyscore-program-full-presentation

16 https://www.liberty-human-rights.org.uk/human-rights/justice-and-fair-trials/closed-courts-and-secret-evidence

17 https://www.thebureauinvestigates.com/2015/01/19/european-parliament-criticises-uk-courts-secret-evidence/

18 Report on the intelligence relating to the murder of Fusilier Lee Rigby, The Intelligence and Security Committee of Parliament, November 2014

19 Privacy and Security: A modern and transparent legal framework, The Intelligence and Security Committee of Parliament, March 2015 p21

20 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/211559/ISC-2011-12.pdf

21 http://www.theguardian.com/world/2013/sep/09/nsa-spying-brazil-oil-petrobras

22 http://www.europarl.europa.eu/RegData/etudes/etudes/join/1999/168184/DG-4-JOIN_ET(1999)168184_EN.pdf

23 http://hudoc.echr.coe.int/eng?i=001-76586#{“itemid”:[“001-76586”]}

24 http://www.spiegel.de/international/world/new-snowden-docs-indicate-scope-of-nsa-preparations-for-cyber-battle-a-1013409-2.html

25 http://www.spiegel.de/media/media-35685.pdf

26 http://theintercept.com/document/2015/09/25/cyber-defence-operations-legal-policy/

27 http://www.bbc.co.uk/news/uk-politics-24848186

28 Amoore, L. (2013). The Politics of Possibility. Risk and Security Beyond Probability, Duke University Press

29 http://www.mynewsdesk.com/uk/pressreleases/home-office-government-ramps-up-passenger-screening-382694

30 Amoore, L. (2013). The Politics of Possibility. Risk and Security Beyond Probability, Duke University Press

31 Amoore, L., & de Goede, M. (2008). Risk and the War on Terror. Taylor & Francis.

32 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/61936/national-security-strategy.pdf

33 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/311126/PartnerBulletinFebruary.pdf

34 http://www.theguardian.com/world/interactive/2013/jun/20/exhibit-b-nsa-procedures-document

35 http://www.nytimes.com/2013/09/29/us/nsa-examines-social-networks-of-us-citizens.html?pagewanted=all&_r=1

36 https://www.aclu.org/nsa-spying-americans-illegal

37 http://www.bbc.co.uk/news/uk-politics-24848186

38 https://www.nsa.gov/research/_files/tech_transfers/nsa_technology_transfer_program.pdf

39 https://www.nsa.gov/research/tnw/tnw193/article2.shtml

40 https://theintercept.com/2015/05/05/nsa-speech-recognition-snowden-searchable-text/

41 https://www.nyu.edu/projects/nissenbaum/papers/facial_recognition_report.pdf

42 https://www.facebook.com/publications/225061261024135/

43 http://investigations.nbcnews.com/_news/2014/01/27/22469304-snowden-docs-reveal-british-spies-snooped-on-youtube-and-facebook?lite

44 http://www.wired.com/2014/05/sandvine-report/

45 http://cryptome.org/2015/02/gchq-lovely-horse-intercept-15-0204.pdf

46 https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/index/assoc/HASH2ba6.dir/doc.pdf

47 http://www.pnas.org/content/110/15/5802.full.pdf+html

48 http://www.statewatch.org/analyses/no-119-open-source-intell-industry.pdf

49 http://www.sussex.police.uk/policing-in-sussex/transparency/policies-and-procedures/force-policies/open-source-online-research-and-investigation-policy-(sussex-and-surrey)

50 http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2013/wp207_en.pdf

5 A Global Surveillance Network

5.1 Introduction

Close collaboration between British and American signal intelligence agencies since World War II has long been known, but it has been much more substantially documented through the Snowden documents. The NSA and GCHQ operate so closely that, in many respects, they resemble a single organisation, with an extremely close relationship with the other three members of the Five Eyes pact: Canada, Australia, New Zealand.

Since the end of the Cold War, the network of collaboration around the Five Eyes has grown to the point where we can speak of a global surveillance complex, with most countries willing to be part of the club. According to security experts, this is driven by the same network effects that create the Google monopoly.1 In other words, as each partner contributes their resources, the resources of each of the partners become more powerful. Given that many details of these arrangements remain secret, it is hard to see how parliament and courts in one country can ever hope to hold them to account.

This alliance has some critical implications for the regulation of surveillance in the UK. Any attempts to bring British intelligence agencies under full democratic control will be incomplete and often unenforceable without consideration of the international collaboration.

This regulatory problem is deeper than concerns about the agencies potentially creating loopholes in their accountability frameworks by doing each other’s work, which is still a real risk. The recent revelations that the German BND agency was spying on EU firms on behalf of the US should be of concern in the UK. Aircraft manufacturing giant Airbus is pressing charges of industrial espionage against those involved.2

There is evidence of widespread data sharing, which creates practical problems for understanding the extent of intrusiveness of any surveillance, because we do not know who has access to the information. It is possible that the US agencies that work closely with the NSA, such as the FBI, have access to more information from GCHQ than British police.

In the other direction, as UK agencies receive US data, , the British intelligence services are not constrained by any publicly available legislation in obtaining unsolicited intercepted material from other countries. This is true even where the communications in question belong to people within the UK.

The collaboration between the Five Eyes agencies is not confined to optimising operational matters or the sharing of intelligence. At every stage of the mass surveillance process we struggle to completely establish strict separations between them, whether on the development of interception technologies or the breaking of encryption etc. This creates additional regulatory problems.

This level of collaboration is not matched by a similar approach to establishing common safeguards. The problem is compounded by the exceptionalist approach to rights by the US, where citizens from other countries are not given sufficient legal protections from surveillance. This situation may have worked in the past when spying was more restricted and targeted. The growth of the Internet and the central position of the US means that millions of people are now subjected to surveillance without legal recourse.

Despite assurance from the agencies and parliament, it is difficult to see how there can be proper oversight given the extent of data sharing exposed by the Snowden documents.

5.2 The Special Relationship and friends

The UK has a closer relationship with the US than any other country. There is a well documented extensive exchange of information in both directions, with many pooled resources, making it hard to tell who is the owner the information.

The NSA has paid GCHQ some £100m in the three years running to 2013.3 This is a fairly small proportion of the overall budget of the NSA, which was $10.8 billion in 2013.4 The payments have covered infrastructure for raw data gathering – for example, £15.5m towards redevelopments at GCHQ’s site in Bude, Cornwall, which intercepts cable communications – but also support for NATO operations in Afghanistan.

The leaked documents make clear that the money is not negligible and has “protected (GCHQ’s core) budget” during several years of cuts. The papers also make clear that this is not a charitable donation: the NSA expects to get their investment back. Despite the payment, the UK is heavily reliant on the US, with over 60% of the UK’s high value reports based on NSA intelligence.5 One possible additional explanation for the payments could be that, besides protecting GCHQ’s core capabilities and the interests of the NSA, they also provide some form of legal and information ownership structure for certain joint activities.

Both countries are part of the Five Eyes alliance. The intelligence sharing pact – formally called the UKUSA agreement – covers the US, the UK and Canada, Australia and New Zealand – referred to as the Second Parties. The pact was started after the Second World War, but only officially acknowledged in 2010.6 The agreement was so secret that even some prime ministers were unaware of its existence.7 Many of the NSA documents leaked by Edward Snowden are marked FVEY, meaning they can be shared within the alliance.

The five eyes countries share raw data from bulk collection, hacking technology and tools for analysis. However, the Snowden leaks give the firm impression that the UK is the partner in the alliance that works the most closely with the US. The NSA and GCHQ have many joint programmes, including a programme for joint experiments to break encryption.8 As we discuss elsewhere, hundreds of NSA analysts are working within GCHQ on TEMPORA/XKEYSCORE.

NATO countries like Germany and Sweden and other close US allies, such as Israel, have traditionally formed part of a wider intelligence sharing network. This has now expanded hugely to over 35 countries, including countries with appalling human rights records, such as Saudi Arabia.9 Our spies have shown no restraint in collaborating with such regimes. The rendition of exiled dissidents to Libya under Gaddafi should make policymakers consider what kind of information sharing may be taking place.

5.3 Integrated systems of mass surveillance

Leaked documents paint a picture not just of comprehensive sharing of raw data from bulk collection between the US and the UK, but of completely integrated systems. For example, as discussed in chapter 2, NSA documents refer to TEMPORA as the world’s largest XKEYSCORE, giving instructions for US agents to get an access account, including an induction on the UK legal system.

This is a problem because, as we have demonstrated in the previous chapters, surveillance regulation needs to reach into the details of systems, technologies, operations and processes. Right now the law in most countries, including the UK, focuses on legal authorisations for collection, safeguards for access by operatives and oversight mechanisms. The actual developments of capacities and operations are escaping effective control because they are wrongly considered details internal to the agencies. Regulating these aspects would be hard enough at the national level, but will be very challenging given the current international agreements and their opacity.

An added problem is technological dependency. As Richard Aldrich has documented, the US has long used the sharing of intelligence technology under “free licensing” to stop the development of competing alternatives.10 The vast resources the US dedicates to military and surveillance technology and the access to global cables make the UK more dependent on its larger ally.

The technological basis for TEMPORA comes from the US, as we saw in the previous chapters, and it is almost certain that there has been close collaboration since its inception. But at the operational level, US analysts only obtained full access to TEMPORA in 2012.11 Analysts that have completed training in the UK legal requirements – and have achieved a certain level of proficiency in using XKEYSCORE – are automatically given TEMPORA access. TEMPORA appears as another database in the analysts’ software tool “XKS Central” that gives them access to the system. Cross searches are meant to be compliant with the legal requirement of both jurisdictions.

Around 250 NSA operatives have direct access to manipulate TEMPORA12 and a further 850,000 US personnel have access to the data it generates. According to The Guardian, Americans were given some guidelines on accessing TEMPORA, but were told by GCHQ that when it came to carrying out their own searches they were responsible for assessing the human rights balance of necessity and proportionality: “it’s your call”.13

GCHQ contributes several nodes to the US-led network of XKEYSCORE systems, and have their own manual in their internal wiki.14 The other Five Eyes countries also have access to the system. But it is unclear precisely what access they have to US data.

These tools for mass surveillance are shared more widely. Under the codes Special Source Access and Foreign Partner Access, leaked NSA documents describe the global system for accessing communications networks.15 The US spent around $192 million between 2011 and 2013 supporting these particular collaborations. The Guardian reported between 2009 and 2013 the NSA had paid GCHQ some £100m.16 This gives an idea of the importance of the UK in the network of partnerships.

The NSA operates two separate umbrella programmes for collaboration with other countries to facilitate the tapping of international communications and sharing the data. These are the very top level and will include the collaboration under TEMPORA, MUSCULAR and other programmes mentioned elsewhere:

1. WINDSTOP involves all Five Eyes countries, but is primarily a partnership with the UK, “to develop a well-integrated over-arching architecture to utilize unprecedented access to communications into and out of Europe and the Middle East”.17

2. RAMPART-A integrates a broader group of third party countries in the network of high speed access to the Internet backbone by providing them with the TURMOIL technology we discussed above. This provides a lower level of access to the data in cables than XKEYSCORE.

In some cases the NSA also share access to XKEYSCORE system with Germany’s18 BND and Sweden’s FRA.19 We need more clarity on what is the role of the UK in these arrangements and what exact access these agencies have to British data.

There are also concerns over the lack of safeguards protecting the information once it reaches the US. At least some of the information collected by the NSA through cable intercepts in partnership with third parties is shared with the Five Eyes through the TICKETWINDOW programme and common protocols for sending intercepted metadata and some content.20

TICKETWINDOW data is obtained by the US under the regulation of Executive Order 12333, which covers external data, which in turn means that it has very limited privacy safeguards in relation to other laws. For example, in 2011 the type of full take collection of Internet data from cables in and out of the country, as practiced by GCHQ in the UK, had been ruled illegal in the US21 under the Foreign Intelligence Surveillance Act (FISA 1978). Despite denials, the NSA appears to bypass these restrictions by getting GCHQ to collect the data in the UK and then send it to the US under the less restrictive arrangements of Executive Order 12333. The NSA are then free to search and process under the broad capabilities provided by the Order.22

US civil liberties groups have criticised23 the lack of safeguards in EO 12333. The NSA did not deny the existence of the operations – for example intercepting data from Google’s internal network connecting their data centres – but stated24 that they only focused on foreign targets and applied “Attorney General-approved processes to protect the privacy of US persons – minimizing the likelihood of their information in our targeting, collection, processing, exploitation, retention, and dissemination”.

This system raises similar questions to other forms of data sharing, but its flexibility and live access bring added complications in terms of oversight and accountability.

In addition, leaked documents show that the NSA is sharing data from the Five Eyes with the wider US intelligence community, and in 2007 were building a search tool called ICREACH that other agencies can use to trawl through large amounts of communications metadata amounting at the time to some 850 billion records about phone calls, emails, cellphone locations, and Internet chats.25

Parliament must ask what exact mechanisms are available for the overseeing of access to data by US security services in the many available channels. For example, security sources have stated that when UK systems identify sensitive data of interest for further investigation, this is noted and passed on to the intercept commissioner. Is this also the case with US operatives?

5.4 British citizens’ data at risk

Several close collaboration programmes have raised particular concerns, due to weak regulation or because they appear to be avoiding restrictions under a country’s jurisdiction. These programmes have been described in more detail in the previous chapters and here we mainly focus on the international collaboration aspects.

The MUSCULAR programme accesses cables from Google and other Internet companies (see Chapter One) In contrast to many of the other UK related documents revealed by Snowden, the leaked documents about MUSCULAR are marked for access only by the US and the UK, and not the other Five Eye partners. MUSCULAR is fully integrated in the US surveillance system under the codename DB-200.

INCENSER is the codename for the GCHQ hacking operation into the intersection of two cables connecting the Atlantic with Europe and Asia (see Chapter Two).

The sharing of bulk data from the UK to the US in the INCENSER programme has been documented in detail by security researchers.26 This takes place under the US WINDSTOP sharing framework we described above.

INCENSER traffic – codenamed by the NSA as DS-300 – is fed into the classified category TICKETWINDOW, meaning that it is potentially shared with Five Eyes countries. Although the operation is nominally run by GCHQ, it is considered the NSA’s fourth-largest cable tapping programme in collected volume. Information from INCENSER – and other GCHQ sources – is used to write presidential briefings.

These programmes provide large amounts of data. Between December 10th 2012 and January 8th 2013, the WINDSTOP programme collected more than 14 billion metadata records, of these DS-300 (INCENSER) contributed 14100 million and DS-200B (MUSCULAR) 181 million.

As discussed in Chapter Seven, there is no formal legal basis for these data sharing operations, and any safeguards to protect British citizens are based on secret agreements among agencies. The collection of data by GCHQ is almost certainly covered by a RIPA section 8(4) warrant for the interception of external communications, potentially the same one authorising Tempora. By what means the personal information of British citizens is protected during processing by the NSA, has not been properly explained.

5.5 PRISM and the UK

The PRISM programme gives the US government access to the internal systems of the largest US Internet companies (including Google, Facebook, Apple, Yahoo! and Microsoft) to collect data related to specific users, keywords and more. PRISM was one of the first major programmes disclosed by Snowden, and the one that has come to symbolise the US surveillance regime.

The legal basis for PRISM – FISA 702 – is a crucial building block of the US surveillance regime which removes most protections for foreigners using US communications systems. This has immense implications beyond PRISM, including for the global technology industry.

The programme operates via the FBI, which acts as intermediary between the NSA and the Internet companies. The role of the FBI raises additional questions about the potential access to data on UK citizens by US domestic law enforcement agencies. The new director of GCHQ has complained extensively that the agency suffers from a lack of access to data from US Internet companies. However as we show below it appears that the agency has had some access via PRISM. It is possible that the Snowden leaks have triggered a change in the access to PRISM by GCHQ as US authorities become more stringent.

5.5.1 The legal basis for PRISM

Section 702 of FISA Amendments Act27 (shortened here to FISA 702) provides the legal basis for PRISM. FISA 702 legalised warrantless wiretapping with some restrictions to safeguard the interests of Americans under the US constitution, but gives no protection for non-US persons. It is one of the most important elements in modern US surveillance legislation.

This law has introduced a huge increase in the amount of data collected, by removing the need for probable cause and individual prior warrants for communications data and content that is held on US soil, but which involves foreigners abroad. These are technically called NON-US-PERSONS, and the authorisations are targeted at the communications where at least in one end is abroad and the person affected is not a US citizen. NSA operatives are required to have a 51% confidence that they are not targeting US citizens or residents. Any US Internet business and cloud provider may have to make bulk data on their foreign customers available under FISA 702.

The implications of the FISA reforms that enabled PRISM were slow to sink in before the Snowden leaks, with only a few privacy experts, such as Caspar Bowden,28 fully grasping their significance. A 2012 report for the European Parliament on the security of cloud computing raised concerns that this law, “for the first time created a power of mass-surveillance specifically targeted at the data of non-US persons located outside the US”.

Importantly, the FISA reforms also extended surveillance from “communications” as in data in transit, to data stored in cloud computers in the US.29 A study from the Netherlands raised additional concerns about the repurposing of private sector data for state surveillance in the context of the FISA Amendments of 2008.30

The exact mechanisms for PRISM’s operation are disputed. Technology companies named in the report have denied any knowledge of PRISM (only to be rebuffed by NSA lawyers),31 and reject the notion that the NSA has full access to their systems. Google for example, claims that they just use a simple secure file transfer server.

It may be that the NSA has not been given full direct access to server, but a certain level of automated access must be in place to enable the kind of real-time queries and searches described in some documents. It is unclear how much data is extracted into NSA systems for analysis, and how much analysis takes place by piggybacking resources from the companies. According to the original leaked documents published by The Guardian, PRISM is very cheap to run, costing some $20 million a year. This, in principle, would point at the use of company resources. The Washington Post has published documents claiming that the agencies have placed equipment inside the companies.32

Analysis of 160,000 actual pieces of surveillance material33 collected under FISA 702 and leaked by Snowden showed that 90% are related to innocent people caught in the dragnet, and not the targets. The materials included photographs of children. According to the US Director of National Intelligence Transparency Report around 90,000 people were subjected to FISA 702 searches in 2013,34 some 800,000 innocent people could have subjected to surveillance under this programme. The slides published by the Washington Post show that there were 117,675 active surveillance targets in PRISM’s counterterrorism database.

5.5.2 PRISM in the wider context of US surveillance

PRISM is not the only source of bulk data obtained by the NSA in US soil, but it has become the most important source for intelligence reports. As we explained elsewhere, the NSA has collaborated with communication providers – for example Verizon and ATT – to obtain Internet and telephony data under the programme name UPSTREAM. When this data collection takes place in the US it is also generally authorised by FISA.

Around 9% of the NSA’s 50 million “Internet communications”35 come from UPSTREAM, while PRISM provides 91%. FISA allows materials intercepted to be stored for two years and PRISM data and contents for five.

This gives some idea of the importance of PRISM, but it is not the total of collected communications. As we saw above, the NSA also uses Executive Order 12333 for obtaining additional UPSTREAM data abroad, including from partners, and also collects information from satellites. In collaboration with the CIA, via a unit called Special Collections Service,36 data is also obtained at clandestine interceptions around the world.

After 9/11 the US passed the infamous ‘Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act’ of 2001 (USA PATRIOT Act), which has been heavily criticised by civil liberties groups for giving too much power to the security services. It has a very broad reach, ranging from financial controls to immigration.

The PATRIOT Act is also part of the US surveillance regime, mainly to allow for the mass collection of metadata of domestic communications including telephone calls of American citizens. Britons calling the US will have seen the details of their communications recorded. The PATRIOT Act does not seem to be directly involved in PRISM, but it is part of a joined up system.

According the American Civil Liberties Union, Section 215 of the PATRIOT Act “vastly expands the FBI’s power to spy on ordinary people living in the United States”.37 The PATRIOT Act is mainly geared towards domestic surveillance. Snowden documents show that section 215 was used to compel Verizon to give the NSA details of all US domestic and international phone calls, “on an ongoing basis”.38 According to some analysts, the metadata obtained via section 215 and stored by the NSA in their main database for telephony metadata called MAINWAY,39 which was then used to generate leads for the further collection of content under FISA 702.40.

5.5.3 Access to PRISM data by UK intelligence agencies

GCHQ has access to PRISM data, but the exact terms are unclear despite some initial discussions in Parliament in July 2013.41

The Intelligence and Security Committee stated, after an investigation,42 that GCHQ did not circumvent any laws when accessing content via PRISM. General access is authorised under the Intelligence Services Act 1994, and when GCHQ sought information from the US, a warrant was in already in place under the RIPA.

The Government has explained in court that communications relating to people based in the UK but using US Internet services can be intercepted using RIPA Section 8(4) warrants because those communications are classed as foreign in nature. RIPA warrants are discussed in more detail in Chapter 7, but are very broad and do not need to mention named individuals, so it is unclear precisely what information has been sought.

RIPA warrants allow for the interception of content and associated metadata, but we do not know if these are treated differently when obtained under PRISM. We do not know if any measures designed to protect excessive intrusion when the data is collected by GCHQ are also in place here.

It is also unclear what happens to data that has been volunteered without GCHQ asking for it. In some cases it may be urgent information to stop an imminent attack. Given that 60% of refined information comes from the US, the volume must surely include a lot of material that is incorporated into ongoing investigations or simply filed. There is a need to regulate its use.43

Since the initial revelations about PRISM, we have learnt that GCHQ had direct access to PRISM during the 2012 London Olympics, with 100 operatives generating some 11,500 extracts in a six day period.44 More recently GCHQ have requested a permanent arrangement for full unsupervised access to PRISM under the above mentioned FISA 702. It is not clear whether this request has been approved, and how it would work in practice.

The NSA have stated that they can only share PRISM data with agencies that have minimisation processes to weed out the data of US persons. However, it is not clear whether they require any limitations on access to data from nationals of those countries, let alone third parties. This could create a situation where different countries spy on each other’s citizens, except the US.

5.6 Access to NSA Databases

The NSA maintains huge amounts of collected data in a complex system of storage and retrieval. Specialised databases keep content and metadata for every type of communication imaginable. For example, the database MARINA45 is used to store Internet metadata of millions of web users for a year, allowing for “pattern of life” analysis. FASCIA46 collects five billion mobile phone data records from around the world, including location47 that allows the tracking of millions of individuals and groups, through the CO-TRAVELER programme.48 Several systems collect phone calls, videos, VOIP calls, etc.

GCHQ and other Five Eyes partners have some access to MARINA,49 but what the arrangements are for all the other such databases and associated tools has not been revealed. For example, we don’t know what kind of direct access GCHQ has to CO-TRAVELER. Given that the related documents are marked for Five Eyes access, and some of the components were developed by the Australian Signals Directorate, we would expect GCHQ to be able to access and possibly contribute to the system.

In several cases there is concrete evidence that GCHQ is accessing NSA systems.

DISHFIRE is a text message collection database operated jointly by the NSA and GCHQ since 2012. It collects 200 million text messages from across the world on a daily basis,50 in bulk and not limited to intelligence targets. It uses this data to extract a remarkable amount of information: contact-chaining analysis, border crossings (roughly 1.6m a day), names from electronic business cards, financial transactions and geolocation, partly using messages from travel companies.51 However, communications from American telephone numbers are minimised or removed.52 It is unclear whether this is the case with UK numbers.

GCHQ has access to the database. They use the metadata to see to view the contact history of UK numbers,53 but cannot read text contents without a warrant.54

This system is quite unique, according to leaked documents: “In contrast to [most] GCHQ equivalents, DISHFIRE contains a large volume of unselected SMS traffic ... this makes it particularly useful for the development of new targets, since it is possible to examine the content of messages sent months or even years before the target was known to be of interest.”55

5.7 Spying on citizens of Five Eyes countries

The Snowden documents have raised questions over the extent that the US, UK and the other members of the secret Five Eyes agreement – Canada, Australia, New Zealand – spy on each other’s citizens.

Privacy International have lodged a claim at the European Court of Human Rights demanding the agreements are publicly released,56 and have carried out a detailed analysis based on the available information.57

The Five Eyes appears to be the main alliance for intelligence cooperation including joint staffing of facilities, sharing of technology, and a distribution of tasks and geopolitical target areas. However, there is nothing to suggest that there is anything like an absolute no-spy pact and indeed according to the above analyses the documents explicitly suggest that spying on partners is an option. Despite the lack of an official pact, there appears to be an understanding that citizens of second parties to the agreement should not generally be targeted, although this is possible, albeit that the use of any incidentally collected information should be minimised.

This situation has generated mixed messages and confusion. Former US Secretary of State Hillary Clinton has claimed that blanket no-spy agreements do not exist,58 explicitly mentioning Britain; a claim repeated by President Obama himself.59 This has been denied by a former intelligence operative, who stated that the Five Eyes countries were off limits.60

A draft NSA memo from 2005 explains that in some cases it will be legitimate to secretly target Five Eyes citizens.61 Given the excellent relationships between the agencies it is unclear to what extent this targeted surveillance without the knowledge of the UK government has been put in practice.

What seems more significant is a document from 2007 outlining changes that enabled the routine analysis by the NSA of raw data of UK citizens caught in the dragnet of mass surveillance.62

There is less information on how the British agency operates, but in documents seen by The Guardian, UK officials have apparently boasted of their light oversight regime compared to the US.63

Leaked UK documents give some information on how the NSA handles queries to the US counterpart of TEMPORA, XKEYSCORE.64 According to these documents, targeting “US/Five Eyes” citizens is a violation, but their information could be used as part of a “defeat list” that is used to automatically reduce the volume of information processed.65 It is unclear how these procedures work with direct queries to the British system, if indeed there is a completely separate system instead of procedural distinctions over the same databases.

In 2009 the NSA was slammed by the US Foreign Intelligence and Security Court (FISC) – responsible for authorising certain surveillance operations for inappropriately storing information in databases accessible to other US agencies:66 “NSA has generally failed to adhere to the special dissemination restrictions originally proposed by the government, repeatedly relied upon by the Court in authorizing the collection of the PR/TT metadata, and incorporated into the Court’s orders... as binding on NSA.” It is possible this affected the data of British citizens.

The activities of the other members of the club have received little scrutiny. According to leaked Five Eyes documents,67 the Australian Signals Directorate proposed sharing “bulk, unselected, unminimised metadata” with the Five Eyes surveillance alliance, “as long as there is no intent to target an Australian national. Unintentional collection is not viewed as a significant issue.” This raises important questions for Australian citizens, but also for the UK government, if the offer was followed through. It also shows the disregard for privacy that seems to permeate these institutions.

Snowden has claimed that New Zealand has shared XKEYSCORE data from its own citizens with other partners in the alliance.68 In summary, membership of the Five Eyes alliance does not offer full immunity from US spying.

Third party countries do not have guarantees that their citizens will not be targeted. For example, there is a RAMPART-A programme69 involving access to cables in partnership with countries such as Germany and Denmark. According to Snowden any limitations in access to data about nationals in a country are bypassed by the NSA simply collecting the data at the other end of the cable in a different country.

In separate leaked documents the US is shown to be sharing raw intelligence data with Israel while acknowledging that both countries target each other.70 In the memorandum of understanding, Israel is expected to extend the measures designed to handle data of US persons, to persons of Five Eyes countries. However, there is little detail and any protections appear to be mediated by the US, with no direct relationship between Israel and the UK. In addition, there is no information regarding if an obligation to immediately destroy data relating to the US Government also applies to the Five Eyes.

5.8 Conclusion

Inter-agency co-operation has become integration. It is hard to see how UK interests and UK citizens’ privacy can be protected given the levels of data sharing and common analytics tools.

When looking at the vast integration of personal data and spying tools, it is also obvious that there are questions of sovereignty and foreign policy. It is hard for the UK to separate its own interests from those of the US. It also provides potential leverage for the US if the UK is obstinate about a particular policy. The possibility of collusion in other people’s crimes emerges as we secretly share intelligence systems with a broad groups of countries with uneven human rights compliance.

This is a very difficult area for politicians. There are different standards of law in different Five Eyes countries and entrenched views of what rights are extended to non-citizens. In the US’s case, their views of the rights of foreign citizens are strikingly low. The UK needs to ensure protection of the innocent and ensure people’s human rights can be protected to the standards we would expect domestically, whatever the legal regime of our allies.

The UK has an ethical responsibility to promote and uphold human rights everywhere, and it should pay particular attention to alliances with countries with lower protections. There are now some guidelines for intelligence officers and other personnel when collaborating with other countries in order to avoid being complicit in the torture or mistreatment of detainees.71 If analysts believe intelligence has been obtained through torture or other similar human rights violations they are meant to raise concerns. This covers both the receipt and passing of information. Similar arrangements should be in place for the exchange of electronic surveillance information.

Finally, we need a complete overhaul of the secrecy of these arrangements to ensure that any reforms carried out in the UK to bring the surveillance system under the human rights framework are not undermined through collaboration with other countries.

Sometimes views will seem difficult to shift: why should the US decide to honour foreigners’ privacy and sacrifice their ability to spy for security, political and economic ends? However, there is also political and economic pressure for reform. The US’s ability to spy through data acquisition depends on the position of their IT industry and Internet platforms particularly. These companies in turn need the trust of foreign consumers.

The same underlying problems with GCHQ’s essential approach that we have seen in the previous chapters resurface here. As the Internet and digital technologies have made communications central to the operation of most of our daily lives, we all become targets and implicated, in this case by international data sharing and common analytics tools.

1 http://weis2014.econinfosec.org/papers/Anderson-WEIS2014.pdf

2 http://www.dw.de/airbus-to-press-charges-on-nsa-bnd-spying-claims/a-18422548

3 http://www.theguardian.com/uk-news/2013/aug/01/nsa-paid-gchq-spying-edward-snowden

4 http://apps.washingtonpost.com/g/page/national/inside-the-2013-us-intelligence-black-budget/420/

5 http://www.theguardian.com/uk-news/2013/aug/01/nsa-paid-gchq-spying-edward-snowden

6 https://www.nationalarchives.gov.uk/ukusa/

7 https://www.privacyinternational.org/reports/eyes-wide-open/understanding-the-five-eyes

8 http://www.spiegel.de/media/media-35509.pdf

9 http://electrospaces.blogspot.co.uk/2014/09/nsas-foreign-partnerships.html

10 http://people.exeter.ac.uk/mm394/Richard%20James%20Aldrich%20GCHQ%20The%20Uncensored%20Story%20of%20Britains%20Most%20Secret%20Intelligence%20Agency%20%202010.pdf

11 http://www.spiegel.de/media/media-34090.pdf

12 http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa

13 Ibid.

14 http://www.spiegel.de/media/media-34105.pdf

15 https://s3.amazonaws.com/s3.documentcloud.org/documents/1200866/foreignpartneraccessbudgetfy2013-redacted.pdf

16 http://www.theguardian.com/uk-news/2013/aug/01/nsa-paid-gchq-spying-edward-snowden

17 Ibid.

18 http://www.spiegel.de/international/world/german-intelligence-worked-closely-with-nsa-on-data-surveillance-a-912355.html

19 http://www.svt.se/ug/fra-has-access-to-controversial-surveillance-system

20 https://nsa.gov1.info/dni/2014/no-place-to-hide/sso/5.jpg

21 http://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html

22 http://www.archives.gov/federal-register/codification/executive-order/12333.html

23 https://www.accessnow.org/blog/2014/07/22/rightscon-secret-law-and-the-democratic-process

24 http://www.washingtonpost.com/world/national-security/nsa-statement-on-washington-post-report-on-infiltration-of-google-yahoo-data-center-links/2013/10/30/5c135254-41b4-11e3-a624-41d661b0bb78_story.html

25 https://firstlook.org/theintercept/2014/08/25/icreach-nsa-cia-secret-google-crisscross-proton/

26 http://electrospaces.blogspot.co.uk/2014/11/incenser-or-how-nsa-and-gchq-are.html

27 http://apps.washingtonpost.com/g/page/world/fisa-amendments-act-of-2008-section-702-summary-document/1141/

28 https://orgcon.openrightsgroup.org/assets/files/pdfs/presentations/How_to_wiretap_the_Cloud_without_anybody_noticing_ORGcon_8.6.2013.pdf

29 http://www.europarl.europa.eu/RegData/etudes/etudes/join/2012/462509/IPOL-LIBE_ET(2012)462509_EN.pdf

30 http://www.ivir.nl/publicaties/download/977

31 http://www.theguardian.com/world/2014/mar/19/us-tech-giants-knew-nsa-data-collection-rajesh-de

32 http://www.washingtonpost.com/wp-srv/special/politics/prism-collection-documents/

33 http://www.washingtonpost.com/world/national-security/in-nsa-intercepted-data-those-not-targeted-far-outnumber-the-foreigners-who-are/2014/07/05/8139adf8-045a-11e4-8572-4b1b969b6322_story.html

34 http://icontherecord.tumblr.com/transparency/odni_transparencyreport_cy2013

35 https://www.eff.org/sites/default/files/filenode/fisc_opinion_-_unconstitutional_surveillance_0.pdf

36 https://en.wikipedia.org/wiki/Special_Collection_Service

37 https://www.aclu.org/free-speech-national-security-technology-and-liberty/reform-patriot-act-section-215

38 http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/dv/briefingnote_/briefingnote_en.pdf

39 https://en.wikipedia.org/wiki/MAINWAY

40 https://www.emptywheel.net/2013/07/16/hiding-the-215-index-from-defendants-too/

41 https://www.openrightsgroup.org/ourwork/reports/prism-the-nsa-surveillance-and-the-uk-remaining-unanswered-questions-for-parliament

42 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/225459/ISC-Statement-on-GCHQ.pdf

43 http://www.theguardian.com/uk-news/2013/aug/01/nsa-paid-gchq-spying-edward-snowden

44 https://firstlook.org/theintercept/article/2014/04/30/gchq-prism-nsa-fisa-unsupervised-access-snowden/

45 http://www.theguardian.com/world/2013/sep/30/nsa-americans-metadata-year-documents

46 http://www.theguardian.com/world/2013/dec/04/nsa-storing-cell-phone-records-daily-snowden

47 http://www.washingtonpost.com/world/national-security/nsa-tracking-cellphone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_story.html

48 http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10/new-documents-show-how-the-nsa-infers-relationships-based-on-mobile-location-data/?commentID=washingtonpost.com/ECHO/item/1386720327-479-532#whitepaper

49 https://www.spiegel.de/images/image-583972-galleryV9-mmeg.jpg

50 http://www.theguardian.com/world/2014/jan/16/nsa-collects-millions-text-messages-daily-untargeted-global-sweep

51 Ibid.

52 Ibid.

53 http://www.channel4.com/news/intercept-text-messages-spy-nsa-gchq-british-phone

54 http://www.theguardian.com/world/2014/jan/16/nsa-collects-millions-text-messages-daily-untargeted-global-sweep

55 Ibid.

56 http://www.theguardian.com/world/2014/sep/09/five-eyes-surveillance-pact-appeal-disclosure-human-rights

57 https://www.privacyinternational.org/?q=node/301

58 http://www.spiegel.de/international/world/hillary-clinton-interview-on-german-us-ties-and-presidential-plans-a-979812.html

59 http://www.nationaljournal.com/tech/obama-we-do-not-have-a-blanket-no-spy-agreement-with-any-country-20140502

60 http://thelead.blogs.cnn.com/2014/07/08/former-cia-operative-hillary-clinton-is-wrong-on-u-s-no-spy-agreement/

61 http://www.theguardian.com/world/2013/nov/20/us-uk-secret-deal-surveillance-personal-data

62 http://www.theguardian.com/world/2013/nov/20/us-uk-secret-deal-surveillance-personal-data

63 http://www.theguardian.com/uk/2013/jun/21/legal-loopholes-gchq-spy-world

64 https://firstlook.org/theintercept/document/2014/02/18/discovery-sigint-targeting-scenarios-compliance/

65 https://epic.org/foia/doj/pen-reg-trap-trace/EPIC-FISA-PEN-REGISTER-FOIA-RELEASE-08082014-25.pdf

66 http://www.lawfareblog.com/2013/11/the-november-nsa-trove-iv-the-Internet-metadata-collection-story-develops/

67 https://www.privacyinternational.org/?q=node/479

68 Snowden claimed that New Zealand uses it to monitor

69 https://firstlook.org/theintercept/2014/06/18/nsa-surveillance-secret-cable-partners-revealed-rampart-a/

70 http://www.theguardian.com/world/2013/sep/11/nsa-americans-personal-data-israel-documents

71 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/62632/Consolidated_Guidance_November_2011.pdf

6 Beyond signals intelligence: Offensive capabilities

6.1 Introduction

The global surveillance infrastructure and hacking tools described in the previous chapters are commonly understood to exist in order to obtain information to be fed into intelligence reports and tracking terrorists. However, they also support work by the agencies to develop cyber-warfare capabilities, with the NSA taking the lead within the US armed forces.

Cyber-warfare involves one state infiltrating another state’s computer networks and infrastructure in order to inflict damage. In 2011, the US intelligence services carried out 231 offensive cyber-operations, such as placing covert implants on computers or networks.1 The UK’s National Strategic Defence and Security Review from 2010 made hostile attacks upon UK cyberspace a major priority.2 It is fair to assume that many other countries are also building cyber-warfare capabilities.

Documents released by German magazine Der Spiegel provide a much richer picture of the offensive activities of the NSA and its allies, including the UK’s GCHQ.3 One article terms the development of these aggressive hacking tools as “Digital Weapons”, which should join the ABC (Atomic, Biological and Chemical) weapons of the 20th century because of their indiscriminate nature.

Here lies a fundamental problem. The modern world with its connected global communications networks means that non-state actors, such as civilians and businesses, are now affected by the agencies’ activities much more frequently than before. The Internet is used by everyone for nearly every kind of activity – and the opportunity for collateral damage is huge.

The papers leaked to Der Spiegel suggest that the signal agencies have limited regard for the security and well-being of anyone who gets caught in the path of their operations. According to the documents, the agencies generally use the equipment of third parties – including innocent Internet users – for exfiltration, that is sending back home the information they have obtained in their operations. They even call these people “unwitting data mules”,4 and while in some cases they could be employees of key companies, in other cases they appear to be quite random. This way the agencies cover their tracks and avoid being detected. But of course the unwitting victim could end up suspected of wrongdoing.

Some of the activities that GCHQ has been reported to carry out, such as Denial of Service (DoS) attacks, were illegal at the time they took place. In a democracy, the security services must uphold the law even if they are fighting those who break it.

The Tallinn Manual on the international law applicable to cyber warfare is an academic study into cyber warfare and international law, which we look at in more detail in Chapter Seven. It sets out that cyber attacks on civilians are unlawful in principle.5 The agencies, oversight bodies and Parliament need to acknowledge that GCHQ has the capability to launch cyber attacks and confirm that procedures are in place to ensure that international laws of war are followed. These aspect should be part of the public debates on mass surveillance and making the agencies fit for purpose in post-Cold War democracies.

Below we outline some of the most controversial documented practices involving the UK.

6.2 Psychological operations against political activists

According to the Snowden documents, proactive actions6 now represent 5% of GCHQ’s “business”.7 Some of these actions will involve the hacking and disabling of target systems described in the previous sections. But GCHQ also engages in psychological manipulation programmes.8 The unit leading these efforts is called the Joint Threat Research Intelligence Group (JTRIG) with 150 staff trained in online covert operations, which they see as a third pillar of activities, complementary to signals intelligence and computer network exploitation.9

Some of these operations10 are designed to intimidate and “pull groups apart”11, for example, deleting a target’s online presence and spreading false information.

GCHQ has used these techniques against groups not involved in terrorism or serious crime, such as the ‘hacktivists’ of Anonymous.12 GCHQ has also targeted supporters of Wikileaks, using less aggressive activities.13

Members of lawful organisations or groups who are not engaged in criminal activity should not have their privacy or freedom of expression disproportionately interfered with.

6.3 Using illegal attack techniques: denial of service

GCHQ has engaged in disabling remote systems through Denial of Service (DoS) attacks. This involves flooding the capacity of a networked computer system with external communications until it stops working properly. This normally also involves triggering an existing dormant software malfunction and causing the system to crash, or simply forcing the target to use up all available resources servicing those requests, so normal operations are not possible.

According to documents published by NBC,14 Anonymous’s chat rooms were shut down by GCHQ’s own hacking operation, called Rolling Thunder, in 2011, with the effect of pushing away some 80% of visitors. The report claimed that this is the first time that a Western government has been found carrying that sort of attack, one which is normally attributed to Chinese and Russian covert operations. The report also pointed out the impact on other websites and servers in the vicinity:

“A DDoS15 attack against the servers hosting Anonymous chat rooms would also have shut down any other websites hosted by the same servers, and any other servers operated by the same Internet Service Provider (ISP), whether or not they had any connection to Anonymous. It is not known whether any of the servers attacked also hosted other websites, or whether other servers were operated by the same ISPs”.16

Denial of Services attacks are criminal acts in the UK.17 We can only assume that one of the main reasons why GCHQ attacked these ‘hacktivists’ was because they themselves used this kind of techniques to shut down websites.18 These attacks can have negative effects on computer systems in the vicinity, so other websites can be taken down as well, affecting many other people.19 A basic tenet of democracy is that security services must uphold the law when fighting those who break it. Security services will always be able to do things that the rest of the population cannot do. However, these exceptions to the rule, are not exceptions to the rule of law, and must be properly legislated and subjected to oversight.

In March 2015, after these events took place, the Computer Misuse Act was re-written to include amendments that create an exception for GCHQ and law enforcement agencies to hack without criminal liability. There was no public debate about these changes, which introduced without proper consultation20 – see section 7.7.2 for more details.

6.4 Appropriating enemy systems: fourth party collection

The NSA routinely piggy backs on cyber offensive operations of other nations to steal data – for example, there are leaked documents that show how the NSA managed to extract information from North Korean equipment that had been bugged by South Korea.21 Internal documents from Menwith Hill station in the UK describe how they use Kurdish intelligence activities to obtain information in Iraq and Iran.22

As we showed above, spy agencies routinely use innocent people to exfiltrate data from their operations. This could lead to serious consequences – for example, those people could be suspected of collaborating with GCHQ and the NSA. Being accused of spying for a foreign power is normally treated harshly in all countries, but it is particularly risky in countries with poor human rights records.

There should be clear, public regulations to ensure these operations do not give innocent civilians or businesses unwarranted exposure to risks.

6.5 Take over of networks of hijacked computers

Leaked documents show the NSA has programmes dedicated to the acquisition of command and control capabilities over large networks of hijacked computers.23 These so-called botnets, as in networks of robots, have previously been built by criminals or other organisations, including government sponsored groups. Those running botnets will take over each computer through virus infections and use them for a variety of purposes, ranging from sending unwanted spam email to helping to hack into systems.

The NSA operations under their programme DEFIANTWARRIOR rely on extensive support from GCHQ and use all the TURMOIL, TURBINE and XKEYSCORE technologies described in Chapter Three to discover and hack into the systems.

The controlled computers can then be used for further Internet monitoring or for hacking operations. The leaked slides warn operatives not to show too much skill to avoid being identified as ‘state actors’.

The owners of infected computers in almost all cases would not have known that their computers had been infected and controlled by third parties, and will not notice the change in ownership of the botnet that means that their computers are now involved in NSA/GCHQ operations instead. The NSA seems to limit takeovers to foreign botnets, which may provide them with some legal cover. The Intelligence Services Act may provide legal justification for the involvement of GCHQ in such intrusive activities, particularly when directed at targets abroad, but this practice is unethical.

6.6 Conclusion

Cyber-warfare and offensive capabilities are highly problematic. These offensive capabilities are completely connected with the basic elements of mass surveillance: the ability to access and control key infrastructure of the Internet such as cables and exchange points (Chapter Two) and the creation of capabilities to control other people’s equipment and networks for intelligence purposes (Chapter Three). This is aided by the intense integration of capabilities and technology between the US and UK.

The problem however, with GCHQ controlling these offensive capabilities, is that they are highly secretive. We would expect a higher level of public oversight when discussing other non-conventional weapons Parliament would normally examine the ethical, legal and strategic questions associated with our offensive weaponry, especially those that are most likely to affect non-combatants.

The use of cyber-offensive capabilities against civilians is particularly concerning. Any law-breaking activities by political activist networks that may be disruptive, but that are at their core non-violent social movements, such as anti-fracking groups, should be dealt with by the criminal justice system, not a secretive spy agency.

Cyber-warfare capabilities of course have profound implications. The uses they can be put to are potentially horrific, and likely to implicate the general population. Since nearly all modern systems are computerised, nearly anything connected to the Internet can potentially be weaponised. Therefore cyber-warrfare could be used against national infrastructure that is controlled by specific civilians as military equipment, for example, an electricity grid, a nuclear power plant or transportation controls.

We should clearly limit the scope of what is understood as cyber-warfare. The framing of many issues around digital security in these terms has been criticised by scholars, such as Myriam Cavelty.24 She argues that the excessive use of war-like language to talk about complex phenomena – where traditional enemy lines are unclear – can hinder a proper analysis and trigger disproportionate responses.

There are open questions surrounding the need for specific international law to govern cyber-warfare. While our Government believes there is no need for new treaties, it is Parliament’s job to consider whether it currently understands the capabilities we are developing in secret and whether our clandestine approach supports or undermines that view.

1 http://www.washingtonpost.com/world/national-security/us-spy-agencies-mounted-231-offensive-cyber-operations-in-2011-documents-show/2013/08/30/d090a6ae-119e-11e3-b4cb-fd7ce041d814_story.html

2 https://www.gov.uk/government/news/strategic-defence-and-security-review--3

3 http://www.spiegel.de/international/world/new-snowden-docs-indicate-scope-of-nsa-preparations-for-cyber-battle-a-1013409.html

4 http://www.spiegel.de/international/world/new-snowden-docs-indicate-scope-of-nsa-preparations-for-cyber-battle-a-1013409-2.html

5 Schmitt, M. N. (2013). Tallinn manual on the international law applicable to cyber warfare New York: Cambridge University Press

6 https://firstlook.org/theintercept/document/2014/04/04/full-spectrum-cyber-effects/

7 http://msnbcmedia.msn.com/i/msnbc/sections/news/snowden_cyber_offensive2_nbc_document.pdf

8 http://msnbcmedia.msn.com/i/msnbc/Sections/NEWS/snowden_youtube_nbc_document.pdf

9 https://www.eff.org/files/2014/04/09/20140224-intercept-training_for_covert_online_operations.pdf

10 http://msnbcmedia.msn.com/i/msnbc/sections/news/snowden_cyber_offensive1_nbc_document.pdf

11 https://www.eff.org/files/2014/04/09/20140224-intercept-training_for_covert_online_operations.pdf

12 http://msnbcmedia.msn.com/i/msnbc/sections/news/snowden_anonymous_nbc_document.pdf

13 https://firstlook.org/theintercept/article/2014/02/18/snowden-docs-reveal-covert-surveillance-and-pressure- tactics-aimed-at-wikileaks-and-its-supporters/

14 http://www.nbcnews.com/feature/edward-snowden-interview/war-anonymous-british-spies-attacked-hackers- snowden-docs-show-n21361

15 DDoS stands for Distributed Denial of Service, and it generally involves a network of hijacked computers attacking the target at unison. It could also involve individuals volunteering their computers as in the case of Anonymous. Most DoS instances will be distributed and the terms are often used interchangeably.

16 http://www.nbcnews.com/feature/edward-snowden-interview/exclusive-snowden-docs-show-uk-spies- attacked-anonymous-hackers-n21361

17 http://www.out-law.com/page-9592

18 http://www.techdirt.com/articles/20140205/09440926098/those-convicted-ddos-attacks-uk-wondering-why- gchq-was-allowed-to-ddos-them.shtml

19 http://www.infosecurity-magazine.com/view/36789/gchq-used-ddos-attack-on-anonymous-communications/

20 https://www.privacyinternational.org/?q=node/584

21 http://www.spiegel.de/media/media-35679.pdf

22 http://www.spiegel.de/media/media-35680.pdf

23 http://www.spiegel.de/media/media-35689.pdf

24 https://ccdcoe.org/publications/2012proceedings/2_6_Dun%20Cavelty_TheMilitarisationOfCyberspace.pdf

Part Two

Analysis of the legal and policy challenges

7 The UK’s surveillance laws

7.1 Introduction

The activities of GCHQ we described in the previous sections are mostly regulated by the Regulation of Investigatory Powers Act 2000 (RIPA) and the Intelligence Services Act 1994. The Government also relies on other legislation such as: the Security Service Act 1989; Data Retention and Investigatory Powers Act (DRIPA) 2014; and the Counter-Terrorism Act 2008.1 In February 2015, the Counter-Terrorism and Security Act 2015 was also approved by Parliament.

Following the Snowden revelations, it has become clear that surveillance is not covered by adequate legislation, existing laws are outdated and there are serious weaknesses in the processes designed to provide oversight and accountability. Some activities appear to be taking place at the margins of the law. It is not always obvious how the laws might be interpreted or applied, making it difficult to understand the powers the agencies have been granted by Parliament.

The Independent Reviewer of Terrorism Legislation, David Anderson QC, said: “The current law is fragmented, obscure, under constant challenge and variable in the protections that it affords the innocent. It is time for a clean slate.”2 In his report, A Question of Trust, Report of the Investigatory Powers Review, Anderson called for: “A comprehensive and comprehensible new law should be drafted from scratch, replacing the multitude of current powers and providing for clear limits and safeguards on any intrusive power that it may be necessary for public authorities to use.”3 Two other reviews, by the Intelligence and Security Committee (ISC) and the Royal United Services Institute (RUSI) respectively, also recommended that a new law was needed to regulate the use of investigatory powers.

In May 2015, the Government announced its intention to pass a new Investigatory Powers Bill, with a draft expected to be laid before Parliament in the autumn of 2015. While a new law is needed, there are concerns that it will extend surveillance powers, allow even more personal communications data to be retained and limit encryption.

The law and courts are the bedrock of accountability for both the agencies and government more widely. The agencies’ interpretation of the law is also important for the day-to-day practice within the agencies and for legitimising activities which may not actually be permitted.

However, legal frameworks are not perfect. They may fail to anticipate all possibilities, especially in technological areas where technical developments make it hard for the legal framework to cope, for example, the exponential growth in the power of computing, sources and volumes of data and storage. The Internet, too, has capabilities for communication and espionage that reach much further than previous electronic ‘signals’.

Since the publication of the Snowden allegations, there have been a number of legal challenges. These have raised questions over the clarity of the law, proportionality, and the applicability of EU law to the UK’s data retention laws. In this chapter, we ask whether mass surveillance is legal and examine whether existing laws and authorisation frameworks are adequate to regulate GCHQ’s activities.

7.2 Are GCHQ’s activities legal?

The Government refuses to acknowledge that mass surveillance programmes exist, while simultaneously claiming their activities are within the law.4 There is very limited public oversight so it is difficult to assess whether practices comply with the law. Where the law is cited, there are loopholes that are being exploited.

Recently, the security services have been shown to have acted unlawfully. On 6 February 2015 the Investigatory Powers Tribunal (IPT) issued a second judgment in the case brought by Liberty, Privacy International, Amnesty International and others.5 It found that the secret intelligence sharing arrangements between the UK and the US were unlawful prior to December 2014, because the policies governing these arrangements were secret before their disclosure during the IPT proceedings.6 On February 18, 2015 the Government admitted the policies that oversaw the security agencies’ capacity to spy on lawyer-client communications were also unlawful, as the result of another case.7

The Liberty, Privacy International and Amnesty International case has shed unprecedented light on the legalities of bulk data collection and mass surveillance.8 The Government refused to officially confirm the existence of any programmes but confirmed suspicions9 that authorisation for any systems, if they ever existed, would take place under Section 8(4) of RIPA, which allows the Secretary of State to sign general warrants for external communications (sent or received outside the British Islands). The arguments presented by the security agencies for why this is all lawful centre around two key points.

1. Firstly, they extend the definition of ‘external communications’ to include communications via web-based platforms that are not to another person, but to a wide audience. This means communications that are posts on Facebook walls, Google plus and Tweets (even if only one person can see them) are communications with the platform, not with another person or people, and thus are considered to be a communication that ends outside the UK.10 The Code of Practice for interception11 makes clear that even if communications leave the country, as long as both ends are in the UK they do not fall under Section 8(4). But the security agencies have built a legal construct to bypass these provisions.

Admitting that not all Internet traffic would fall under this category, the Government argues that if any internal communications are captured, this would be allowed as long as it is collateral and necessary for the collection of external communications, under RIPA Section 5(6)(a). Furthermore, the Government argues that if any inappropriate information was ever seen by an operative, not an “active intrusion”, they would not act on it and would quickly forget it anyway. This means that in reality the intelligence agencies could be collecting almost everything.

2. Secondly, the security services and the law make a crucial distinction between bulk collection and the selection of a smaller selection, to be “read, looked at or listened to”, and to which extra safeguards apply in Section 16 of RIPA.12 It appears that the Government may wrongly believe it is only when this happens that the substantive interference with privacy arises. In this step, GCHQ needs further compliance with Section 16 of RIPA, which requires a basic case is made for why it is necessary to access the materials. Section 16 also sets out some provisions, “to limit the extent to which intercepted material can be selected by reference to “factors” that in essence would select communications to or from an individual who is known to be (at the time) in the British Islands”.

These arguments are not satisfactory. For a start, it is not clear what level of computer processing is acceptable as long as no human “reads, looks at or listens to” the communications. Computers nowadays can do all these things (see the patented NSA’s KODA software13 for ‘text summarisation’) and carry out other forms of processing and analytics that generate new forms of intrusive information, such as social maps of people who know each other.

The Government states in its open response14 that intercepted material that does not fall under Section 16, cannot be read, looked at or listened to by anyone. (§ 131.3) It sets out in length what the law says about the controls over intercepted materials. But it does not explain any concrete policies to ensure compliance. Recently leaked internal documents from GCHQ show that the agency follows a thorough process of authorisation for targeted surveillance, but when it comes to broad collection of data and content the staff are simply asked to consider “proportionality” in very vague terms.15 Publishing these documents would enhance GCHQ’s accountability as they give a very clear picture of their internal procedures.

In addition, it is not clear whether these restrictions cover the hundreds of NSA officials working directly on British interception programmes. It is possible that these officials process the raw intercepted materials under a different authorisation and oversight regime, not accessible to UK citizens. The Government’s line is simply that “as a matter of principle, a power to share intelligence with a foreign intelligence agency must plainly be capable of being “necessary” for the purposes of Art. 8(2)” of the European Convention on Human Rights.

As we show below, the UK, US and other countries’ intelligence agencies have entered into classified bilateral and multilateral arrangements that are beyond the supervision of any independent authority – making it almost impossible to assess whether or not they are legal.

7.3 The main regulation of surveillance: RIPA

RIPA was originally intended to bring UK surveillance in line with the Human Rights Act 1998 (HRA), but its poor drafting and opaque structure have enabled a massive expansion in the scope of surveillance powers in the last 15 years.

The Anderson review found that: “RIPA, obscure since its inception, has been patched up so many times as to make it incomprehensible to all but a tiny band of initiates. A multitude of alternative powers, some of them without statutory safeguards, confuse the picture further. This state of affairs is undemocratic, unnecessary and – in the long run – intolerable.”16

The ISC’s report, Privacy and Security: A modern and transparent legal framework, also accepted that the legal framework is “unnecessarily complicated” and expressed “serious concerns about the resulting lack of transparency, which is not in the public interest”. The key recommendation of the ISC’s Privacy and Security report is that “the current legal framework be replaced by a new Act of Parliament governing the intelligence and security agencies. This must clearly set out the intrusive powers available to the Agencies, the purposes for which they may use them, and the authorisation required before they may do so.”17

It is worth noting that RIPA regulates a much broader set of activities than those described in this report in relation to GCHQ. For example, RIPA has been used in the past by local authorities to spy on residents’ dog fouling and school admissions.18

7.3.1 Bulk collection

The bulk collection of Internet communications and phone calls relies on the use of warrants for the interception of “external communications” (see 7.3.2 below) under Section 8(4) RIPA. These also cover the bulk collection of communications data.

There is no requirement for a warrant made under Section 8(4) to be restricted in any way to a particular person or premises. The Government has admitted that a Section 8(4) warrant could include the interception of all communications between the United Kingdom and a particular city abroad, or even a whole country or region. So although people in the UK are not the targets,19 these warrants are used to authorise the bulk collection and processing of our daily communications, including phone calls, texts, emails and web searches. The ISC revealed in its report that there are fewer than 20 such warrants in place, which authorise the bulk interception programme.20 Leaked GCHQ materials state that one single “global” warrant covers three of their main surveillance bases in Bude, Menwith Hill and Cyprus.21 Such broad warrants cannot be compliant with the proportionality requirements set in human rights legislation.

7.3.2 Internal vs external communications

The only real requirement of these 8(4) warrants is that they must target external communications, which either begin or end outside the UK.22 The Code of Practice for interception23 makes clear that even if communications leave the country, as long as both ends are in the UK, they do not fall under Section 8(4).

However, the Government admitted in May 2014 that it understands the definition of ‘external communications’ to include communications via web-based platforms that are not to another person but to a wide audience. This means communications that are posts on Facebook walls, Google plus and Tweets (even if only one person can see them) are communications with the platform, not another person or people, and thus are considered to be a communication that ends outside the UK.24 As a matter of principle, the UK must afford all individuals – no matter their nationality or location, regardless of who they communicate with or how – the basic protections required by the rule of law.

The Government has also admitted that technically it cannot distinguish between ‘internal’ and ‘external’ communications, so it just captures everything.25 In an age when communications between people in the UK routinely take place on US social media platforms any meaningful distinction between ‘internal’ and ‘external’ communications makes little sense. Because of the way the Internet works, many internal messages may be routed via other countries. This creates a peculiar situation that highlights a fundamental anomaly in the current legislation. It is generally understood that if the security services want to obtain the communications data of UK citizens they would need to use the provisions in Chapter 2 of RIPA, Section 22.26 But because the same communications can now be classed as external, the same data can be collected as collateral under a general warrant, following Section 5 of RIPA for interception of communications. This lowers the protections awarded to the communications data of UK citizens, as Chapter 2 contains more stringent provisions.

Leaked internal legal guidance from GCHQ27 shows that GCHQ staff struggle with these issues, with location of targets being a major source of queries to their legal departments. Targets of surveillance who move into the UK from abroad can continue under surveillance for five days, after which a different warrant is required. The same document explains that nationality is not covered in legislation and it is largely a matter of internal policies. Most of these appear to regulate access to the communications of ‘second party’ nationals – the Five Eyes countries – who can be targeted but require special treatment.

7.3.3 Lack of judicial authorisation

Unlike most other democratic countries, in the UK, Secretaries of State and senior staff authorise surveillance. There is some qualified provision for judicial authorisation in respect of intrusive surveillance by police (but not the intelligence services), requests for encryption keys, and for local authorities seeking access to communications data. This arrangement allows the Executive to use surveillance powers without the need for any judicial authorisation.

English law has long recognised the need for a judicial warrant before a person’s home can be searched by the police. There is no longer any meaningful distinction between the quantity and nature of personal information that can be collected during a premises search and that collected via the targeted surveillance practices permitted under RIPA.

The European Court of Human Rights recognised the desirability of prior judicial authorisation for surveillance as long ago as 1978 in Klass v Germany, citing the benefits of independence and impartiality. The court stated: ‘The rule of law implies, inter alia, that an interference by the executive authorities with an individual’s rights should be subject to an effective control which should normally be assured by the judiciary, at least in the last resort, judicial control offering the best guarantees of independence, impartiality and proper procedure.’The UK’s process of political authorisation is completely lacking in independence and impartiality.

GCHQ documents show that the agency has an ongoing concerted effort for building relationships with staff at the Foreign and Commonwealth Office in order to get warrants approved.28 This is not illegal but it shows the risks involved in the lack of impartial authorisation. In other documents related to oversight, the agency stresses that judicial controls are their main concerns, among other reasons because, “Senior High Court judges (they) are INDEPENDENT, non govt (sic) and not openly swayed by personal contact”.29

The ISC considered the issue of judicial authorisation in its Privacy and Security report. Whilst the ISC recognised concerns about public trust, it concluded that responsibility for authorising warrants should remain with Ministers. Their argument was that Ministers can assess the diplomatic and political context and the wider public interest whereas judges are not held accountable or asked to justify their decisions to Parliament and the public.30 This is not a convincing conclusion. Judges often have to assess public interest arguments and Ministers do not have to justify their surveillance decisions to the public or Parliament.

The Anderson review recommended that, “Judicial Commissioners, who should be serving or retired senior judges, ISIC should also take over the judicial authorisation of all warrants and of certain categories of requests for communications data”.31 While this is a step in the right direction, it would be preferable for warrants to go through the courts and be signed by serving judges independent of any influence by the executive. This would not require a new constitutional arrangement. The authorisation should fall to the judiciary with appropriate levels of seniority, depending on the specifics of the cases. There should be transparent, merit-based procedures for appointments to any special tribunals. An additional problem with creating a single oversight mechanism, as proposed by Anderson, is that this would bring authorisation and oversight into one body. A separation of these functions would be a more robust arrangement.

Aside from the lack of judicial authorisation for surveillance warrants, in practice most day to day activities of GCHQ appear to be authorised internally by specially designated officers. Tasking, searches and even some types of data mining activities can be self-certified by the operatives – with additional post auditing – providing justifications for the type of intelligence activity and human rights compliance.32

7.3.4 Capturing everything

RIPA33 makes a clear legal distinction between communications – the content of calls and emails – and communications data – the logs of who has communicated with whom, when and where, also known as metadata. But in new forms of digital communications, such as social media, they can be very hard to separate, as we explain below.

The documents revealed by Snowden show that GCHQ collects everything. The law does not provide for any clear limitations on collection once a Section 8(4) warrant is in place. Section 5(6)(a) of RIPA states:

“The conduct authorised by an interception warrant shall be taken to include (a) all such conduct (including the interception of communications not identified by the warrant) as it is necessary to undertake in order to do what is expressly authorised or required by the warrant;(b) conduct for obtaining related communications data”

The complications brought by access to raw data streams in international cables are exemplified by the particularly problematic case of the recording of images of Yahoo! Webcams, in a programme called Optic Nerve.

Parliament should seek clarification from GCHQ on the exact legal basis of the Optic Nerve programme, and should be informed of any other similar undisclosed programmes. In addition GCHQ should clarify what measures, if any, it took to filter out any webcam users in British soil. The programme highlights the need for a new warrantry system that increases the threshold for authorising surveillance.

GCHQ documents show that these warrants cover the collection of data for all kinds of purposes, including cyber attacks. Enhancing GCHQ’s capabilities is classified as a national security purpose allowing the use of the same warrants for all kinds of internal purposes. GCHQ even have a particular intelligence purpose reference code, known as Miranda number – 20141 – providing a justification for system testing.34 We discuss Miranda numbers in more detail in Chapter Two.

7.3.5 Safeguards, content and metadata

The arguments on safeguards produced by Government focus on the content, but it is not completely clear what happens to the metadata that is sieved and stored in bulk for longer periods.35

The safeguards in Section 16 of RIPA restrict the use of the content of messages intercepted by GCHQ, but they place no restrictions whatsoever on the collection of communications data by GCHQ. This is regardless of whether or not the communication was internal or external and regardless of whether the person in question is known to be in the UK or not.

By relying on the broad scope of Section 8(4) warrants to intercept millions upon millions of private communications, Section 16 has enabled GCHQ to build up a vast database of the communications data of millions of UK residents which it can search at will without any clear legal authority or effective oversight.

Collecting and analysing content and communications data carry equivalent privacy risks in the digital age. There is a qualitative difference between the data available nowadays, and the data available in the pre-Internet days. Taken together, the availability, quality and proliferation of new data sources mean communications data and content can be equally intrusive.

The law recognises the privacy risks in metadata. Article 29 Working Party of European Data Protection Commissioners argued that the now void Data Retention Directive (Directive 2006/24/EC) involved:

“an inherently high risk level that requires appropriate technical and organisational security measures. This is due to the circumstance that availability of traffic data allows disclosing preferences, opinions, and attitudes and may interfere accordingly with the users’ private lives and impact significantly on the confidentiality of communications and fundamental rights such as freedom of expression.”

The EU Privacy and Electronic Communications Directive, implemented in the UK as the Privacy and Electronic Communications Regulations,36 sets strict restrictions on what communications companies can do with traffic and location data.

The former head of of GCHQ, Sir David Omand, has argued that 37 the legal definition in RIPA of ‘communications data’ is a much smaller subset of the general metadata from Internet use and social media. According to Omand, most such metadata would probably be classified as ‘content’ in the UK, and accordingly receive stronger legal protections.

The definition of communications data in RIPA – in Section 21 – does not appear narrow at all. But it is not even clear that this is the definition that applies in the case of metadata from GCHQ’s mass surveillance programs.

A leaked GCHQ document shows that the agency has a fairly clear classification system for separating content, metadata and what they call “content derived data”, which is treated as more akin to content. It shows that the agency sees login and passwords as metadata.38 The same document explains that “the terms metadata, events and communications data are used interchangeably although only the last is defined in UK law”.

The blurring of the lines between metadata and content that David Omand refers to should be an important consideration though. The Home Office acknowledged in their evidence to the ISC: “the distinction between data and content, you can argue, is muddied in the Internet world”.39

We would recommend that in any new surveillance legislation content and metadata are afforded similar levels of protection.

7.3.6 Targeting UK communications

The Government has claimed that Section 16 of RIPA prevents the intelligence services from using Section 8(4) warrants against UK citizens and residents. However, this is misleading.

Leaked GCHQ internal guidance documents show that searching for UK persons is acceptable in relation to metadata but not content:

“If you are searching a purely Events only database such as MUTANT BROTH, the issue of location does not occur. Therefore, you may use selectors located in the UK or 2nd Party countries without further authorisation. You will still need an HRA justification for your searches.”

It is only when you are querying the content of communications obtained under a Section 8(4) warrant, or using a database where such content is available, such as XKEYSCORE, that the issue of location becomes important for legal compliance. You will still need a valid HRA justification but you will also then need to consider what authorisation is needed for targeting sensitive locations/nationalities.”40

Section 16(2) prevents GCHQ from searching the communications they intercept under Section 8(4) in terms “referable to a person known to be for the time being in the British Islands”. But until recently this did not prevent GCHQ from searching the same communications by reference to other factors, which may easily include people currently in the UK:

“Datamining for targets in the UK has been abolished. You cannot now search in Sigint intercept repositories using a term relating to an individual located in the UK unless you have a RIPA authorisation, e.g. a Section 16(3) authorisation. And if you do have one, you cannot search retrospectively, i.e. you cannot seek to retrieve material sent before the authorisation was signed. As a result, the concept of Datamining, as a distinct activity, against sensitive (N.B. located in the UK) targets has been discontinued.”41

7.3.7 Machine processing of intercepted materials

Former Director of GCHQ, David Omand, has stated a view that mass surveillance only takes place when humans are involved in accessing materials:

“Furthermore, the media fall into the category error that has crept into much of the recent public debate of not distinguishing bulk access by computers to the Internet – which the US and UK certainly do have – and so-called ‘mass surveillance’, which they do not conduct. Mass surveillance implies observers, human beings who are monitoring the population.”42

This perspective is problematic because it reduces the problem the law has to tackle to the activities of humans at the end of a long complex process. The opposite is true: the law needs to consider every single step in the surveillance process. As we argued in Chapter One, privacy is invaded from the moment of collection. Computers are far more powerful than humans; they can find, analyse and process vast amounts of information and interrogate it many times. Therefore, there are privacy risks throughout the entire process described in this report – not to mention the chilling effect of free speech that comes with the knowledge that our communications are being collected.

In principle, the intelligence services are prohibited by Section 16(1) of RIPA from examining intercepted communications by reference to a person known to be in the UK. But this Section only refers to how “intercepted material is read, looked at or listened to by the persons to whom it becomes available by virtue of the warrant”.

Unfortunately RIPA is not clear on the safeguards prior to that human intervention, including for computer processing of the content of communications. As we saw in Chapter Three, the developments in machine learning since the time when RIPA was created make the lack of strong regulations on automated processing risky.

Elsewhere the argument has been made that bulk collection only starts when data is transferred to long term storage and analytics programmes, while the tapping of cables and initial selection of data – including temporary storage of a few hours – is simply access capability. This view was repeated in the US report on technical solutions to the problem of bulk collection, under Barack Obama’s Presidential Policy Directive 28 (PPD 28).43 We fundamentally disagree with this perspective. It is impossible to separate the initial steps from the rest of the process. As we saw above the initial processing can include rules to favour types of data, but these are dynamic and cannot guarantee who is or is not included. In their submissions at the case brought forward by Privacy International about mass surveillance, the UK government admitted that the collection of data entails privacy risks.44

The Court of Justice of the European Union in their ruling on the unlawfulness of the EU Data Retention Directive was unequivocal in their consideration that collection of data in itself is intrusive.45 Regardless of any safeguards applied, the interference with the right to privacy occurs when the communication is intercepted, whether or not someone looks at or reads it. This is because intercepted data can be looked at retrospectively, there are risks of data leaks and also risks associated with future data sharing. How it is used will or will not add more layers of intrusion. Automated risk profiling in triage and social network mapping, as described elsewhere in this report, carry intrusive privacy risks.

Any reform of surveillance must provide appropriate regulation of all the stages of surveillance, not just focus on collection and use by analysts. This includes activities that at present are perceived as details to be left to internal regulations by agencies, such as the computer processing of all types of data or content directly obtained or intercepted.

7.4 Access to data from providers: DRIPA

Access by the security services to communications data stored by service providers is not based on interception warrants, but on requests to the companies that hold the data: telephone services and Internet providers. These companies were forced by the EU Data Retention Directive 2006 to keep communications records for at least 12 months in order to make them available to security and intelligence agencies.

But this legislation was ruled incompatible with human rights and struck down in April 2014 by the Court of Justice of the European Union (CJEU), thus removing the legal obligation on communication providers to retain the data.

Three months after this ruling, the Government rushed through ‘emergency’ legislation in July 2014 with only three days of debate in Parliament. This allowed the continued retention of data. DRIPA has a ‘sunset clause’, which means it expires on 31 December 2016. At the time, ORG and other rights groups argued that this should have been a six months’ sunset clause, given that a public and parliamentary debate had been denied.

The new law, DRIPA, does not address blanket data retention and the lack of independent authorisation of access, which were two of the key criteria identified by the CJEU.

One requirement of DRIPA was an independent inquiry into surveillance legislation, which was carried out by the Independent Reviewer of Terrorism Legislation, David Anderson QC. His Investigatory Powers Review was published in June 2015 and is quoted throughout this chapter and report..46

DRIPA should also be repealed and replaced with legislation that complies with fundamental human rights.

7.5 Bulk Personal Datasets

The ISC Privacy and Security report revealed that in addition to interception, the intelligence agencies also acquire ‘Bulk Personal Datasets’, which are large databases containing personal information about a wide range of people. The existence of these datasets was not previously known. As the ISC noted, “the rules governing the use of Bulk Personal Datasets are not defined in legislation. Instead, the Agencies derive the authority...from the general powers to obtain and disclose information (in support of their organisation’s functions) that are afforded to the heads of each of the Agencies under the Intelligence Services Act 1994 and the Security Service Act 1989.47

There are no legislative restrictions or safeguards in respect of these datasets. An internal policy authorisation called the Data Acquisition Authorisation (DAA) was introduced in November 2010. The purpose of the DAA is to “authorise the acquisition by GCHQ of operational data sets from external sources, where the data is personal in nature and acquisition is not otherwise authorised by warrant or other legal or policy authorisation.”48 But it is unclear what exact datasets are covered and what restrictions it places on data use.

The ISC rightly expressed concern that, “the legislation does not set out any restrictions on the acquisition, storage, retention, sharing and destruction of Bulk Personal Datasets, and no legal penalties exist for misuse of this information” and “access to the datasets – which may include significant quantities of personal information about British citizens– is authorised internally within the Agencies without Ministerial approval.49 The Anderson review quoted MI5 asking for better regulation of the use of these datasets, as part of their proposals to streamline authorisation and oversight.50

Even with the limited published information we have, the lack of a legislative framework means that this activity is likely to breach human rights obligations. The government should clarify urgently what Bulk Personal Datasets entail. We remain skeptical that such broad powers to collect and store data on millions of innocent people can ever be fully justified. The security services should not have wholesale copies of public sector databases, as this is disproportionate, and the use of commercial databases should be subjected to stronger oversight. Such intrusive powers must be explained to citizens, used sparingly – if at all – and limited by clear legislation.

The Government rushed to introduce some oversight mechanisms the day before the ISC report was published in a clear attempt to preclude legal challenges.51 The Intelligence Services Commissioner, Sir Mark Waller, was given, “statutory powers of oversight of use of bulk personal datasets” but this is not enough and there needs to be a proper debate about these datasets.

7.6 Lack of regulation of international data sharing

It has been alleged that GCHQ circumvented UK law by accessing the content of communications obtained through the NSA’s PRISM programme without proper authorisation. Having taken evidence from GCHQ, the ISC concluded that these allegations were unfounded, and that any request for intelligence from the US conformed with the requirements contained in the Intelligence Services Act 1994 and RIPA.52 The ISC stated that “in each case where GCHQ sought information from the US, a warrant for interception, signed by a Minister, was already in place”.53

However, in October 2014 it was revealed that the UK intelligence services do not require a warrant to receive unlimited “unanalysed” intelligence from foreign agencies such as the NSA, where it would “not be technically feasible” for the UK to obtain it itself.54 GCHQ was forced to reveal information about the secret internal “arrangements” during legal proceedings brought by Privacy International, Liberty and Amnesty International, discussed in Section 7.12. UK intelligence agencies can trawl through this intelligence and keep it for up to two years.55

The ISC report confirmed that there is no statute or Code of Practice governing data sharing. But it claimed that GCHQ “in practice always had an interception warrant in place for any raw intercepted material that it has sought from its overseas partners, and additionally (but voluntarily) applies the RIPA safeguards to all its data irrespective of how and under what authorisation regime it has been acquired.”

On 6 February 2015 the IPT ruled that the secret intelligence sharing arrangements between the UK and the US were unlawful prior to December 2014, because the policies governing these arrangements were secret before their disclosure during the IPT proceedings.56

This demonstrates that RIPA is inadequate to regulate intelligence agency co-operation and that the UK is able to access and analyse US gathered intelligence without complying with UK legal requirements. We may also infer that material gathered by UK agencies is likely provided to the US under similarly lax arrangements and may not be subject to sufficient protections under UK law or US law.

The UN Special Rapporteur on the protection of human rights while countering terrorism has noted that intelligence agencies have entered into classified bilateral and multilateral arrangements that are beyond the supervision of any independent authority.57 The Five Eyes agreements are a very good example. He highlighted that information “may be shared with foreign intelligence agencies without the protection of any publicly accessible legal framework and without adequate (or any) safeguards” and cited “credible evidence that some Governments have systematically routed data collection and analytical tasks through jurisdictions with weaker safeguards for privacy”. The Special Rapporteur stated that such practices “make the operation of the surveillance regime unforeseeable for those affected by it and are therefore incompatible with Article 17 of the International Covenant on Civil and Political Rights”.58

NSA analysts have restrictions on the search terms they can use when working through third party cable collection systems.59 Privacy activist Caspar Bowden, pointed out that the US regime does not give any proper rights to foreign citizens abroad, which means that GCHQ creates a fundamental lack of safeguards for British citizens in its dealings with the NSA.

The UK system also fails to provide enough safeguards. Leaked documents show that GCHQ can access the metadata held in NSA databases – although not the content – of UK citizens located either in the UK or in non Five Eyes countries.60

The ISC’s Privacy and Security report concluded that “it is inappropriate that many key capabilities – for example, the exchange of intelligence with international partners – are implicitly authorised rather than formally defined in statute”.61 As discussed below, the Investigatory Powers Tribunal has ruled that historically (but not currently), the non-statutory regime governing the receipt of intercepted data from the US was in breach of Article 8 of the European Convention on Human Rights.  ORG’s application pending at the European Court of Human Rights (also discussed below) challenges the lack of an adequate legal regime governing intelligence sharing, which we argue is not “in accordance with the law” as required by Article 8.

There is no need for this lack of legal certainty. Both the RUSI and Anderson reports agree on the need to improve the regime of Mutual Legal Assistance Treaties with international partners, and also that the UK should take a lead and start seriously considering a new international framework for data sharing “among like-minded” countries. This was recommended in an unpublished report produced by the Special Envoy on Intelligence and Law Enforcement Data Sharing.62 The report should be published and its recommendations considered in full.

7.7 Human Rights Act and USSID-18

“This system is audited for USSID 18 and Human Rights Act compliance.”63

Many NSA and GCHQ documents make reference to the USSID 18 and the HRA (Human Rights Act) in almost equivalent terms, for example in the restrictions to what type of searches can be performed. Leaked documents show that GCHQ repeatedly alludes to HRA compliance throughout its operations, from tasking to searches of collected materials.64

The partially declassified USSID 1865 (United States Signals Intelligence Directive 18) Legal Compliance and U.S. Persons Minimization Procedures was put in place in 1980 as part of the tightening of the US surveillance regime following the Watergate scandal. USSID 18 sets fairly detailed criteria for how information can be collected, processed, retained and disseminated. For example, it sets out that communications between persons in the US accidentally collected in foreign surveillance must be promptly destroyed.

Describing the UK HRA as equivalent may be useful for analysts to understand that they must act within limits, but they are not the same. The HRA only provides general principles for proportionality, in contrast to the detailed minimisation guidance in USSID 18. Without more specificity, reliance only on these general principles can result in lower standards of protection in the UK. Going back to the example above, GCHQ analysts do not have an obligation to destroy UK communications that are accidentally captured. RIPA simply says that analysts cannot look at the content of these communications without further authorisation.

All XKEYSCORE operators from GCHQ must have taken USSID-18 training, as their account gives them default access to Menwith Hill Station COMSAT data, which counts as a US site. The test, according to the agency is “really quite straightforward (it’s an open-book, multiple choice test) and passing it will also let you access numerous other useful tools and databases.”66

Surveillance reform in the UK should look at regulations such as USSID-18 and provide more detailed guidance on the application of the Human Rights Act, including the minimisation of data.

7.8 The legality of hacking

As documented in the previous sections, GCHQ is heavily involved in acts of what is normally considered hacking, interference with equipment, networks and other more aggressive forms of cyber attacks. Under the umbrella term Computer Network Exploitation (CNE) these activities are mainly authorised by the Intelligence Services Act 1994.

7.8.1 Hacking codes of practice

The Home Office has published for consultation a Draft Code of Practice on Equipment Interference.67 The draft code seeks to make lawful activities that up until now have not been publicly regulated, in violation of human rights requirements.

The code appears to bring CNE under Sections 5 and 7 of the Intelligence Services Act 1994, which have not openly been used to authorise CNE prior to the publication of the draft Code.

The ISA 1994 and the draft Code distinguish between internal (within the UK) and external hacking, much as RIPA does for interception. As we saw with RIPA, these distinctions are becoming difficult to sustain.

The safeguards proposed in the draft code are too weak, with very few limitations on what the security services can do as long as they tick all the compliance boxes. Particularly troubling are the provisions for the targeting of suspicionless third parties, separately from unintended collateral damage. As we have seen in the cases of Belgacom and Gemalto, this is common practice and a proper debate should take place on whether it is appropriate.

Highly significant proposals such as these should be set out in primary legislation, not in a code of practice, as they deserve intense scrutiny.

In order to facilitate its equipment interference, GCHQ is creatively using its purported ISA 1994 powers. For instance, documents published by The Intercept show how GCHQ obtains specific legal authorisations for “reverse engineering” software for various purposes, including CNE.68 The agency has applied for a warrant under Section 5 of the Intelligence Services Act to be allowed to violate the intellectual property rights of the software owners. The application69 explains how “Software reverse engineering (SRE) has enabled recovery of user credentials from web traffic and database content, research into vulnerabilities that can provide access into such forums, and investigation of opportunities for modifying a forum in order to mount attacks against target users.” The document appears to indicate the activities would “enable police operations,” which may be beyond the scope of a section 5 warrant designed to authorise the activities of the intelligence services.

The risk analysis in the application only includes the possibility of being found out by the owner of the copyright, not the potential privacy impact of the activities.

7.8.2 Industrial scale hacking

The mass hacking by the US, UK and their allies on the scale revealed in the Snowden documents may not be fully foreseen by the legislation we describe above and could be the one area where GCHQ – and the ministers overseeing it – may have more to answer from a legal standpoint. The US has tried to defend the practices70 but the UK government has been conspicuously silent while introducing new legislation by stealth

As we described in Chapter Four, the NSA has build the QUANTUM system for the hacking of computers through impersonation and interference. There are many references to GCHQ in relation to these hacking techniques, including their use in the Belgacom attack.

Journalist Ryan Gallagher71 has established from leaked files disclosed by Swedish broadcaster SVT72 that as recently as April 2013, GCHQ was reluctant to get involved in deploying the QUANTUM malware due to “legal/policy restrictions.”

Similarly explicit concerns were raised by GCHQ staff at international meetings discussing hacking on mobile networks:73

“An additional concern in the UK is that performing an active attack, such as the Man-in-the-Middle attack proposed in the Lawful Interception solution...may be illegal. The UK Computer Misuse Act 1990 provides legislative protection against unauthorised access to and modification of computer material. The act makes specific provisions for law enforcement agencies to access computer material under powers of inspection, search or seizure. However, the act makes no such provision for modification of computer material. A Man-in-the-Middle attack causes modification to computer data and will impact the reliability of the data.”

Despite these concerns, the agencies have continued expanding these hacking operations.

7.8.3 Immunity from the Computer Misuse Act

As GCHQ themselves appear to acknowledge in leaked documents analysed by Ryan Gallagher, some of their actions such as ‘man-in-the-middle’ attacks we discuss in Chapter Three, would have to contend with stringent provisions in UK law against computer crime74. While the law provides exemptions for the security services, not all types of actions are covered. Particularly the law allows for the security services to access equipment to obtain information, but not to modify computer materials.

Denial of Service (DoS) attacks are considered to constitute a criminal offence within Section 3 of the Computer Misuse Act 199075 (added by Section 36 of the Police and Justice Act 2006). This covers “unauthorised acts with intent to impair, or with recklessness as to impairing, operation of computer, etc.” The offence includes intentionally or recklessly preventing or hindering access to any program or data held in any computer.

There are calls by some activists for DoS attacks to be legalised as a form of protest online. DoS attacks that don’t involve hijacking third party computers nor attempt to extort money from server owners could be more akin to a sit in or picket than to malicious sabotage. On the other hand, DoS attacks can be highly damaging to computers that aren’t directly targeted as they can affect network quality. If the agencies are to be legally empowered to use these techniques, there should be a public debate. We believe that either these attacks are illegal no matter who carries them out, or we should discuss openly any harms they can cause.

The use of intrusion technology and spyware is also believed to constitute an offence under Section 3 of the Computer Misuse Act 1990 (as well as under Section 1).76 Mobile devices are thought to qualify as “computers”. An offence is committed even where the effects of the action are only temporary and causing an action to be carried out indirectly by someone else is also an offence.

The hacking of Internet and communications services was also thought to constitute an offence under the same provisions of the Computer Misuse Act.77 In the case of hacking the impairment additionally includes “undermining security features such as encryption and intrusion prevention” and impairing “the actual network infrastructure owned and operated by the Internet and communications service providers, and the services and programs run on the infrastructure”.78

In May 2014, Privacy International, along with seven Internet and communications providers filed a case with the IPT that argued hacking by GCHQ breached the Computer Misuse Act.

However, the day before the first hearing of the case was to take place, Privacy International was informed that the Computer Misuse Act had been re-written on 3 March 2015. The amendments created an exception for GCHQ and law enforcement agencies to hack without criminal liability. Privacy International state that the consequence of this change are that the law now, “grants UK law enforcement new leeway to potentially conduct cyber attacks within the UK”. They also noted that this law was amended without proper debate:

“It appears no regulators, commissioners responsible for overseeing the intelligence agencies, the Information Commissioner’s Office, industry, NGOs or the public were notified or consulted about the proposed legislative changes. There was no published Privacy Impact Assessment. Only the Ministry of Justice, Crown Prosecution Service, Scotland Office, Northern Ireland Office, GCHQ, Police and National Crime Agency were consulted as stakeholders. There was no public debate.”79

In the case of QUANTUM or other automated systems for directing attacks, Privacy International has argued that the infection of a computer device pursuant to an automated process would represent an offence by the person directing the process as there is an intrusion that impairs the target by draining battery life and using bandwidth and other computer resources. The Section 10 exception (which applies to accessing a computer for inspection, search or seizure) does not apply to modifying material under Section 3(1).80

7.9International law relating to cyber warfare

Some of the more offensive hacking actions we described in Chapter Six may even cause enough violence to fall under the definition of the laws of war. In these cases, disproportionately and purposefully targeting civilians could be very problematic. The Government should make sure that any aggressive activity is clearly regulated separately from intrusive activities ancillary to surveillance.

The extent to which and manner in which international law applies to cyber operations, both attacks and defence, “has remained unsettled.”81 The European Parliamentary Research Service has stated that, “while international law is still struggling with defining norms on state actions in cyberspace, the latter is now increasingly viewed as a fifth domain of warfare.”82 The U.S. government has publicly stated it believes that international law applies in cyberspace.83

The Tallinn manual on the international law applicable to cyber warfare provides the most authoritative and detailed guidance on the subject. This is not an official document but the work of a group of independent experts. It contains 95 rules. The manual highlights that there are no treaty provisions that directly deal with cyber ‘warfare’ and that it is sometimes difficult to definitely conclude that any cyber-specific customary international law norm exists, owing to the sparseness of state practice and expressions of belief (opinio juris).

The Tallinn experts were unanimous that both the international law governing the resort to force by states (jus ad bellum) and the international law regulating the conduct of armed conflict or international humanitarian law (jus in bello) apply to cyber operations.84 This means, for example, that the provisions of the U.N. Charter relating to the prohibition of the use of force and those relating to self-defence would apply. The fact that a computer (rather than a more traditional weapon or platform) is used would not affect whether the operation amounts to a ‘use of force’ and also would not affect whether a State may use force in self-defence.85According to the manual, the right to use force in self-defence arises if a cyber armed attack occurs or is imminent.86

The manual proposes that cyber operations executed in the context of an armed conflict are subject to the law of armed conflict87 (which includes the Geneva and Hague Conventions). The manual defines international armed conflicts and non-international armed conflicts.88 It states that “cyber operations alone might have the potential to cross the threshold of international armed conflict”.89 The manual also explains that “a cyber attack is a cyber operation, whether offensive or defensive, that is reasonably expected to cause injury or death to persons or damage or destruction to objects.” The concept of ‘attack’ is important as it is the basis for several specific limitations and prohibitions, for example, civilians and civilian objects may not be attacked.90

The manual notes that states may also be subject to treaties they have agreed. Other fields of international law, such as human rights law, may also apply and the manual does not claim to address these.

However, the Tallinn rules are not definitive and remain open to interpretation and criticism. For example, some scholars dispute the lack of distinction between cyber and kinetic attacks91 and the manual itself also discusses several differences of opinion. A second version of the Tallinn manual is due to be published in 2016. Lawfare has reported that it will consider “what international law applies to cyber activity that falls below the level of armed conflict or the use of force”.92

Computer experts such as Ross Anderson have raised concerns that the kind of malware Western agencies develop will eventually reach more careless government and other actors, and this may lead to catastrophic consequences, even in the absence of a concerted attack on infrastructure.93The government should clarify the basic rules of engagement for cyber operations and what kind of actions it would consider cyberwarfare.

7.10 Interference with Wireless Telegraphy

The ISC’s Privacy and Security report revealed that a further piece of legislation is also involved in the authorisation of the surveillance regime: the Wireless Telegraphy Act 2006. The ISC states that the Secretary of State may sign a warrant to authorise the Agencies to “interfere with property or wireless telegraphy”, under the Intelligence Services Act 1994.94 They clarify that wireless telegraphy involves “sending or receiving signals over the airwaves rather than using wires. Examples are TV/radio signals, mobile phone signals, GPS/radar/sonar signals and signals sent by remote controls of various kinds”.

The report explains that:

within the UK, action to interfere with property or wireless telegraphy is authorised by the Secretary of State under a warrant under Section 5 of ISA;95

outside the UK, operations that involve interference with property are authorised by a Secretary of State under Section 7 of ISA; and

GCHQ operations to interfere with wireless telegraphy are authorised by the Secretary of State under the Wireless Telegraphy Act 2006.96

The ISC notes that “the Foreign Secretary has signed a single authorisation covering all of GCHQ’s activities under the Wireless Telegraphy Act 2006. There is no time limit to this authorisation, although as a matter of policy the Foreign Secretary is provided with examples of the intelligence derived from this authorisation on an annual basis.”97

We agree with the ISC in calling for urgent reform of this legal anomaly. These kinds of ad-hoc warrants must be scrapped and brought into a single simplified regime of much narrower authorisations with clear expiry dates.

7.11 Reading encrypted communications

The ISC’s Privacy and Security report also clarifies the legal basis for the decrypting of communications, which it says is the general power given to GCHQ under Section 3(1)(a) of the Intelligence Services Act. This provides the power to:

“... monitor or interfere with electromagnetic, acoustic and other emissions and any equipment producing such emissions and to obtain and provide information derived from or related to such emissions or equipment and from encrypted material.”98

The ISC highlights that no additional Ministerial authorisation is required for these activities and there is no legal requirement to inform Ministers.99 GCHQ claimed to the ISC that whilst “the FCO could assess the political risk of a compromise, it is not well‐placed to assess the complex technical risk.”100

This is clearly an extremely broad power, which is not properly limited and which lacks even the inadequate safeguard of Ministerial approval. It is unlikely to meet the requirements of human rights law. The ISC recommended that “Ministers must be kept fully informed of all such work and specifically consulted where it involves potential political and economic risks”.101 We believe this recommendation does not go far enough. As we saw in the previous chapters, these are not one off operations but ongoing research programmes with irreversible consequences. The authorisation and oversight of such activities must receive appropriate technical support. Splitting the information assurance function of GCHQ into a fully independent organisation would provide the required expertise.

7.12 Legal challenges

Several legal actions have been brought against GCHQ and the security services.

Open Rights Group, English PEN, Big Brother Watch and Constanze Kurz have filed an application at the European Court of Human Rights (ECtHR). It challenges GCHQ’s TEMPORA programme and the receipt and use of data from the NSA’s PRISM programme.102 We argue these activities and the legislative regime fail the “in accordance with the law” and proportionality requirements of Article 8 ECHR. The case has been given a priority designation by the Court, but is currently on hold pending the decision of the Investigatory Powers Tribunal in the below case.

Liberty, Amnesty International and Privacy International brought a case before the Investigatory Powers Tribunal in which the arguments raised are very similar to those in the ECtHR claim. They argued there is a breach of Articles 8 and 10 ECHR. The IPT issued a judgment on 5 December 2014,103 in which it held that mass surveillance under Section 8(4) RIPA is in accordance with the law, though it has not yet ruled on proportionality. The IPT also held that UK access to NSA intelligence material is now lawful, following the disclosure during the proceedings of secret policies on intelligence sharing. The IPT considers that the Intelligence Services Act 1994 gives the authority for GCHQ to enter into intelligence sharing arrangements, then RIPA s.15 s.16 provides the framework for ensuring information is only kept for the right reasons, deleted and searched.

On 6 February 2015 the IPT issued a second judgment.104 It found that the secret intelligence sharing arrangements between the UK and the US were unlawful prior to December 2014, because the policies governing these arrangements were secret before their disclosure during the IPT proceedings.105 The ruling is highly significant as it is the first time the IPT has found the UK’s intelligence services to be in breach of human rights law.

Liberty represented Tom Watson MP and David Davis MP in a judicial review of the lawfulness of DRIPA. They argued that Section 1 of DRIPA is incompatible with Article 8 European Convention on Human Rights and Articles 7 and 8 of the EU Charter of Fundamental Rights. Open Rights Group and Privacy International were third party interveners in the case, arguing the importance of the pre-existing EU legal regime governing data retention, in particular the E-Privacy Directive, and why DRIPA fails to comply with EU law.106 In July 2015, the High Court ruled that Sections 1 and 2 of DRIPA are, “incompatible with the British public’s right to respect for private life and communications and to protection of personal data under Articles 7 and 8 of the EU Charter of Fundamental Rights.”107 These sections of DRIPA were found to be unlawful and will cease to apply from March 2016.

Privacy International (PI) is involved in several cases disputing surveillance practices. In addition to the case discussed above PI is challenging:

Intrusion technology and spyware, in the IPT (PI contends that GCHQ, with the NSA, is using spyware and Trojans to infect mobile phone and laptops in order to unlawfully gain access to users’ devices for the purposes of surveillance. They allege this is not proportionate under Articles 8 and 10 ECHR and fails the “in accordance with the law” test108 as there is no legal basis for the conduct, which would be criminal if by an individual);

Hacking of Internet and communications services, in the IPT (the case was filed by GreenNet and other companies and facilitated by PI. The complaint contends that GCHQ, with the NSA, is attacking and exploiting Internet and communications services, including core telecommunications infrastructure. They submit there is an unlawful act under the Computer Misuse Act and a contravention of Article 1 of the First Protocol to the European Convention on Human Rights, as well as Articles 8 and 10 ECHR); and

The Five Eyes arrangement, in the ECtHR (PI filed FOI requests for the details of the agreement. GCHQ invoked a blanket exemption and the same exemption was invoked in respect of mundane information such as GCHQ’s cafeteria menu. PI argues that the use of a blanket exemption has violated the right of Privacy International to freedom of expression guaranteed under Article 10 ECHR and there is no effective remedy in violation of Article 13.

The Bureau of Investigative Journalism is also challenging the failure to protect journalists’ sources and communications from government scrutiny and mass surveillance in the ECtHR.109

7.13 Conclusion

The current legal framework is plainly inadequate to regulate the breadth and scope of GCHQ’s programmes in the digital world. Existing legislation has permitted extremely broad kinds of collection.

Current legislation and practices fail to comply with international human rights law. The framework governing the intelligence agencies’ receipt of information from the NSA and other intelligence partners remain inadequate to meet the ‘in accordance with the law’ requirement of Article 8 ECHR. There must be a ‘sufficient legal basis’ and to meet the ‘quality of law’ test the law must be accessible and foreseeable. We know that GCHQ obtains unlimited “unanalysed” intelligence from foreign agencies without a warrant and relies on previously secret policies to provide the legal basis.

Section 8(4) RIPA has allowed the TEMPORA programme of mass interception of external communications under non-specific, blanket, rolling warrants. This fails to comply with the mandatory requirements of Article 8 ECHR. It does not meet the ‘quality of law’ test owing to insufficient statutory restrictions and safeguards and an absence of independent authorisation and effective oversight. Generic intercepts based only on the means of transmission (by transatlantic fibre-optic cables) is also an inherently disproportionate interference. Again this means it fails to comply with Article 8 ECHR.

It may be inevitable that technology overtakes the law, which always lags behind. It is the responsibility of the oversight bodies to remind Parliament when the law needs updating. Codes of Practice are not sufficient to regulate hacking activities that can carry significant risks (see Chapter 8).

The ISC has called for a new act of Parliament to consolidate the current “complicated” and “piecemeal” legal framework into a single piece of legislation. While a clear and comprehensible legal framework is needed, any new law must also comply with human rights law. It should also address the reality of communication in the digital age, including the extent of international collaboration among agencies. In order to be fit for purpose, a new surveillance regulation must look into the technical details of surveillance, while being flexible enough to cope with future developments. This also means ensuring that metadata and content have the same legal protections and ensuring statutory definitions of external and internal communications are adequate. Finally, it is not acceptable for a Secretary of State to be able to extend the capabilities of GCHQ by issuing broad warrants. All surveillance decisions (including the interception of communications, access to communications data and receipt of intelligence from foreign agencies) must be subject to prior judicial authorisation and ongoing judicial control, instead of authorisation by the Secretary of State.

1 Privacy International v. Secretary of State for the Foreign and Commonwealth Office et al, IPT/13/92/CH, The Respondents’ Open Response

2 https://terrorismlegislationreviewer.independent.gov.uk/a-question-of-trust-report-of-the-investigatory-powers-review/#more-2364

3 A Question of Trust, Report of the Investigatory Powers Review David Anderson Q.C. Independent Reviewer of Terrorism Legislation, June 2015 p4

4 http://www.bbc.co.uk/news/uk-politics-28006739

5 http://www.ipt-uk.com/docs/Liberty_Ors_Judgment_6Feb15.pdf

6 http://www.ipt-uk.com/docs/Liberty-Order6Feb15.pdf

7 http://www.reprieve.org.uk/press/government-concedes-polices-on-lawyer-client-snooping-were-unlawful

8 https://www.privacyinternational.org/sites/privacyinternational.org/files/downloads/press-releases/open_govt_response.pdf

9 http://www.theguardian.com/uk/2013/jun/21/legal-loopholes-gchq-spy-world

10 https://www.liberty-human-rights.org.uk/sites/default/files/Witness%20statement%20of%20Charles%20Farr%20on%20behalf%20of%20the%20Intelligence%20Services%2016th%20May%202014.pdf para 137

11 http://www.statewatch.org/news/2014/apr/interception-comms-code-practice.pdf

12 http://www.legislation.gov.uk/ukpga/2000/23/section/16

13 http://www.nsa.gov/research/_files/tech_transfers/nsa_technology_transfer_program.pdf

14 https://www.privacyinternational.org/sites/privacyinternational.org/files/downloads/press-releases/open_govt_response.pdf

15 https://firstlook.org/theintercept/document/2015/06/22/tsi-legal-flowcharts/

16 A Question of Trust, Report of the Investigatory Powers Review David Anderson Q.C. Independent Reviewer of Terrorism Legislation, June 2015 p8

17 Privacy and Security: A modern and transparent legal framework, The Intelligence and Security Committee of Parliament, March 2015 p2

18 http://news.bbc.co.uk/1/hi/uk/7369543.stm

19 Para 194.3 of the Government’s Open Response to the claims brought by Liberty and Privacy International before the Investigatory Powers Tribunal in relation to Prism and Tempora.

20 Ibid pp 39, para N

21 https://firstlook.org/theintercept/document/2015/06/22/operational-legalities-gchq/

22 Regulation of Investigatory Powers Act 2000, section 20

23 http://www.statewatch.org/news/2014/apr/interception-comms-code-practice.pdf

24 https://www.liberty-human-rights.org.uk/sites/default/files/Witness%20statement%20of%20Charles%20Farr%20on%20behalf%20of%20the%20Intelligence%20Services%2016th%20May%202014.pdf para 137

25 Statement of Charles Farr, the Director General of the Office for Security and Counter-Terrorism, 16 May 2014, at para 44-45.

26 http://www.legislation.gov.uk/ukpga/2000/23/section/22

27 https://firstlook.org/theintercept/document/2015/06/22/operational-legalities-gchq/

28 https://firstlook.org/theintercept/document/2015/06/22/fco-relationships/

29 http://theintercept.com/document/2015/09/25/jce-uk-legalities-context/

30 Privacy and Security: A modern and transparent legal framework, The Intelligence and Security Committee of Parliament, March 2015 p7

31 A Question of Trust, Report of the Investigatory Powers Review David Anderson Q.C. Independent Reviewer of Terrorism Legislation, June 2015 p7

32 https://firstlook.org/theintercept/document/2015/06/22/operational-legalities-gchq/

33 http://www.legislation.gov.uk/ukpga/2000/23/contents

34 https://firstlook.org/theintercept/document/2015/06/22/operational-legalities-gchq/

35 http://www.realprivacy.ca/content/uploads/2013/07/Metadata.pdf

36 http://ico.org.uk/for_organisations/privacy_and_electronic_communications

37 Loch K. Johnson, Richard J. Aldrich, Christopher Moran, David M. Barrett, Glenn Hastedt, Robert Jervis, Wolfgang Krieger, Rose McDermott, Sir David Omand, Mark Phythian & Wesley K. Wark (2014): An INS Special Forum: Implications of the Snowden Leaks, Intelligence and National Security, DOI: 10.1080/02684527.2014.946242

38 http://theintercept.com/document/2015/09/25/content-metadata-matrix/

39 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/225120/isc-access-communications.pdf

40 http://theintercept.com/document/2015/09/25/cyber-defence-operations-legal-policy

41 I bid.

42 Loch K. Johnson, Richard J. Aldrich, Christopher Moran, David M. Barrett, Glenn Hastedt, Robert Jervis, Wolfgang Krieger, Rose McDermott, Sir David Omand, Mark Phythian & Wesley K. Wark (2014): An INS Special Forum: Implications of the Snowden Leaks, Intelligence and National Security, DOI: 10.1080/02684527.2014.946242

43 http://www.nap.edu/catalog/19414/bulk-collection-of-signals-intelligence-technical-options

44 https://www.privacyinternational.org/?q=node/66

45 https://www.openrightsgroup.org/assets/files/pdfs/reports/data_retention_briefing.pdf

46 Ibid

47 Privacy and Security: A modern and transparent legal framework, The Intelligence and Security Committee of Parliament, March 2015 paragraph 157

48 http://theintercept.com/document/2015/09/25/cyber-defence-operations-legal-policy/

49 Privacy and Security: A modern and transparent legal framework, The Intelligence and Security Committee of Parliament, March 2015 para 158

50 A Question of Trust, Report of the Investigatory Powers Review David Anderson Q.C. Independent Reviewer of Terrorism Legislation, June 2015 p199

51 http://www.theguardian.com/world/2015/mar/12/david-cameron-close-intelligence-oversight-loophole

52 UK Parliament, Intelligence and Security Committee Standard Note, SN/HA/2178, 29 October 2013

53 ISC Statement on GCHQ’s Alleged Interception of Communications under the US PRISM Programme

54 Privacy International, https://www.privacyinternational.org/?q=node/436

55 Privacy International, Ibid

56 http://www.ipt-uk.com/docs/Liberty-Order6Feb15.pdf

57 Report of the Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism, UN Doc A/69/397, para 44

58 Ibid

59 https://s3.amazonaws.com/s3.documentcloud.org/documents/1200865/uodds2overview-v1-1-redacted-information-dk.pdf

60 http://theintercept.com/document/2015/09/25/legalities/

61 Privacy and Security: A modern and transparent legal framework, The Intelligence and Security Committee of Parliament, March 2015 p7

62 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/438326/Special_Envoy_work_summary_final_for_CO_website.pdf

63 https://firstlook.org/theintercept/document/2015/07/01/xks-workflows-2011/

64 http://theintercept.com/document/2015/09/25/hra-auditing/

65 http://www.dni.gov/files/documents/1118/CLEANEDFinal%20USSID%20SP0018.pdf

66 http://theintercept.com/document/2015/09/25/cyber-defence-operations-legal-policy/

67 Draft Code of Practice: Equipment Interference, February 2015, https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/401863/Draft_Equipment_Interference_Code_of_Practice.pdf

68 https://theintercept.com/2015/06/22/gchq-reverse-engineering-warrants/

69 https://firstlook.org/theintercept/document/2015/06/22/gchq-warrant-renewal/

70 https://firstlook.org/theintercept/2014/03/15/nsa-facebook-malware-turbine-non-denial-denial/

71 http://notes.rjgallagher.co.uk/2013/12/gchq-quantum-hacking-surveillance-legality-nsa-sweden.html

72 https://www.documentcloud.org/documents/894386-legal-issues-uk-regarding-sweden-and-quantum.html

73 http://www.scribd.com/doc/100875514/3GPP-Estonia-2010

74 http://notes.rjgallagher.co.uk/2013/12/gchq-quantum-hacking-surveillance-legality-nsa-sweden.html

75 http://www.legislation.gov.uk/ukpga/1990/18/section/3

76 https://www.privacyinternational.org/sites/privacyinternational.org/files/litigations/pi_hacking_case_grounds_0.pdf, paragraph 36

77 https://www.privacyinternational.org/sites/privacyinternational.org/files/litigations/final_grounds_-_gchq_attacking_providers.pdf, paragraph 49

78 Ibid

79 https://www.privacyinternational.org/?q=node/584

80 https://www.privacyinternational.org/sites/privacyinternational.org/files/litigations/pi_hacking_case_grounds_0.pdf, paragraph 37

81 Tallinn manual on the international law applicable to cyber warfare, p17

82 Cyber defence in the EU, Preparing for cyber warfare? European Parliament Briefing, October 2014, http://www.europarl.europa.eu/EPRS/EPRS-Briefing-542143-Cyber-defence-in-the-EU-FINAL.pdf, p 4

83 Ibid, p17

84 Ibid, p19

85 Ibid, p45

86 Ibid, p60

87 Ibid, p68

88 Ibid, rules 22 – 23

89 Ibid, p75

90 Ibid, page 92

91 Cyber defence in the EU, Preparing for cyber warfare? European Parliament Briefing

92 http://www.lawfareblog.com/tallinn-20-and-chinese-view-tallinn-process

93 https://www.lightbluetouchpaper.org/2015/05/02/meeting-snowden-in-princeton/

94 Cyber defence in the EU, Preparing for cyber warfare? European Parliament Briefing, paragraph 173

95 Ibid, paragraph 174

96 Ibid, paragraph 177

97 Ibid, footnote 178, page 65

98 Ibid, paragraph 180

99 Ibid

100 Ibid

101 Ibid, paragraph 183

102 https://www.privacynotprism.org.uk/news/2013/10/03/legal-challenge-to-uk-Internet-surveillance/

103 http://www.bailii.org/cgi-bin/markup.cgi?doc=/uk/cases/UKIPTrib/2014/13_77-H.html&query=%22privacy+and+international%22&method=boolean

104 http://www.ipt-uk.com/docs/Liberty_Ors_Judgment_6Feb15.pdf

105 http://www.ipt-uk.com/docs/Liberty-Order6Feb15.pdf

106 https://www.openrightsgroup.org/ourwork/reports/submission-filed-by-org-and-privacy-international-in-dripa-case

107 https://www.liberty-human-rights.org.uk/news/press-releases-and-statements/davis-and-watson-dripa-challenge-government-surveillance-law

108 https://www.privacyinternational.org/news/press-releases/privacy-international-challenges-gchqs-unlawful-hacking-of-computers-mobile

109 http://www.thebureauinvestigates.com/2014/09/14/bureau-files-echr-case-challenging-uk-government-over-surveillance-of-journalists-communications/

8 Holding our intelligence services to account

8.1 Introduction

Holding the security services to account should be seen as an endorsement of the democratic processes they are here to protect. Agencies are ultimately stronger if there is clear public consent and if reasonable critics believe that the services are accountable and work within clear human rights constraints.

There is a tension between transparency over the security services’ powers, and the need for operational secrecy. The balance between these is struck differently in other countries, including the US where it is accepted that surveillance must be publicly disclosed and discussed. The public should be allowed to consider the implications of mass surveillance.

In the UK, public trust has been undermined by the fact that it is only whistleblowers who have told the public, and to an extent MPs, the truth about security agency programs and powers. It is still unclear who, in any of the branches of Government, knew about the existence of mass surveillance programmes prior to the Snowden revelations.

In October 2013, ex-cabinet minister Chris Huhne confirmed that neither the Cabinet nor the National Security Council had been told about the TEMPORA programme.1 It also appears that the oversight bodies themselves did not know about the programmes. Their subsequent defence of the agencies’ activities does not suggest that oversight bodies are independent or restraining the activities of the security services. In short, there has been a clear failure of democratic accountability. It is the first job of these bodies to ensure that votes are taken before significant extensions of surveillance powers.

The Home Affairs Committee said in its Seventeenth Report, Counter-terrorism:

“We do not believe the current system of oversight is effective and we have concerns that the weak nature of that system has an impact upon the credibility of the agencies’ accountability, and to the credibility of Parliament itself’.”2

In his report of the Investigatory Powers Review, the Independent Reviewer of Terrorism Legislation, David Anderson QC said:

“Whilst the operation of covert powers is and must remain secret, public authorities, ISIC and the IPT should all be as open as possible in their work. Intrusive capabilities should be avowed. Public authorities should consider how they can better inform Parliament and the public about why they need their powers, how they interpret those powers, the broad way in which those powers are used and why additional capabilities may be required.”3

In a democracy, the mechanisms for oversight need to be independent, and capable of understanding, explaining and restraining the activities and capabilities of the agencies. Public trust can be built by introducing greater transparency and showing evidence that the agencies will be held accountable if they overstep the mark. Current structures for overseeing the security services are not designed to ensure that the agencies are truly democratically accountable. Instead, the agencies are only accountable to the Executive of the day, with some limited oversight by handpicked Parliamentarians.

In addition, the de facto powers and capabilities of the security services go considerably beyond the legal framework. This is in part due to the growth of technologies and techniques that make mass surveillance possible. The scale and reach of these programmes is much larger than that enabled by older communication technologies, such as phones, faxes or telegrams. The trend for greater use of surveillance techniques with the potential to touch ever greater numbers of people should itself be a catalyst for increased scrutiny and oversight. The complexity of the problems, for example the use of computer exploits, requires ever greater expertise if the accountability processes are to work.

An additional problem is the international collaboration of the agencies, mainly between GCHQ and the NSA. As noted in Chapter Seven, classified bilateral and multilateral arrangements are beyond the supervision of any independent authority – making it almost impossible to assess whether or not they are illegal. The UK regime may provide even lower standards of protections, with GCHQ’s internal documents stating that they “have a light oversight regime compared with US”.4

Internal documents from GCHQ5 present a three legged system of oversight covering all branches of the state: the Executive through ministers, the legislative via a parliamentary committee, and the judiciary with the commissioners (senior Court of Appeal judges acting independently) and the Investigatory Powers Tribunal. This system has so far failed to give the public a clear idea of the unprecedented levels of surveillance taking place.

8.2 The Executive and Ministers

The UK has a number of bodies that oversee the surveillance activities of the security services, and in some cases, the police. One of the key threats to full democratic accountability is that these bodies are themselves accountable to the Executive and not to Parliament. Chairs and commissioners are appointed by the Prime Minister, not by our democratically elected MPs.

The Executive also has primary responsibility for the agencies, as the ministers are ultimately responsible. In theory they provide a first line of accountability. However, as they are themselves responsible for authorising surveillance, basic governance principles would require that someone else be responsible for the oversight.

8.3 Parliament and the Intelligence and Security Committee

The Government has published a “roadmap” that sets out the regulation of surveillance in the UK,6 which is very useful but incomplete. In contrast to GCHQ’s internal guidance it leaves out parliamentary oversight in the form of the Intelligence and Security Committee (ISC). The Intelligence and Security Committee of Parliament (ISC) was created by the Intelligence Services Act in 19947 with a mandate “to examine the expenditure, administration and policy” of the secret and intelligence services. The mandate does not include the operations of the services, but in practice the committee’s reports do cover some operational aspects.

The Justice and Security Act 20138 introduced some reforms to the ISC, making it more independent from the Executive and increasing its remit, including some oversight of operational activity and the wider intelligence and security activities of Government. But the reforms may not have huge practical implications.

A recent report9 by the Home Affairs Committee in the UK Parliament was highly critical of the current oversight mechanisms of surveillance, particularly the ISC. The committee was found to be too close to the Executive, despite recent changes to its statute.

In July 2013,10 soon after the first Snowden articles appeared, the ISC quickly cleared GCHQ of any wrong-doing about PRISM. According to one of its most prominent members at the time, the Labour MP Hazel Blears,11 the ISC was previously aware of GCHQ’s mass surveillance practices, although not by the name TEMPORA, and were satisfied that they were proportionate. However, this decision has been called into question by the rulings of the IPT we discussed in Chapter Seven, and a proper clarification in Parliament has not been provided.12

In April 2015, the ISC published its Privacy and Security report in response to the Snowden leaks. Its main recommendation was for a new act of Parliament to consolidate the current “complicated” and “piecemeal” legal framework into a single piece of legislation. As outlined in Chapter Seven, the report denied that GCHQ’s activities amounted to mass surveillance while redacting the figures that would show the real scope of surveillance. The report focused on the collection of communications content and not the intrusive analysis of metadata. It made no recommendations for how GCHQ’s data-sharing with NSA and other allies should be properly regulated. It also ignored the many examples of information collected for dubious purposes – for example, webcam chats – and the widening of scope of these systems, to carry out mass hacking and other intrusive activities.

The committee has an extremely tough job. It needs to be able to assess complicated technical questions, legal and human rights questions, and also find means to assess the costs versus benefits of different approaches to secret investigations. None of the answers should be taken at face value from agencies. Thus experts in each field need to be consulted, not just through questions and evidence, but as part of the process of interrogating the secret services. This is similar for any scrutiny committee, but especially one with a particularly high level of responsibility.

There are several areas that will have been hard for the committee to fully analyse that are worth highlighting. For instance, the use of “zero day” exploits highlighted in Chapter 3 comes with consequences, including the use of the same exploits by criminals and other third-parties. Non-disclosure of exploits means that computer engineers who are trying to prevent their software from containing such exploits may be hindered in learning how and why certain rare or new kinds bugs have occurred. For the committee and GCHQ these are very tricky policy questions, that can only be properly answered through discussion with security engineers. The consequence of getting the policy wrong however is severe. It can result in insecure computing, financial or data losses from companies and individuals, and automated criminality.

Another area we have touched on in Chapter 2 and 4 is the problem of mass analytics, the power of computing and the question of intrusion. The committee has discussed this at some length in their hearings. They should, however, have examined the actual practices at GCHQ and the software capabilities directly, with the aid of computer scientists. Without understanding the technology, those in charge of oversight can’t understand the process and have to rely on the agencies themselves for interpretation. The review by the Royal United Services Institute (RUSI), A Democratic Licence to Operate, contains proposals for a new Advisory Council for Digital Technology and Engineering, but the proposed remit appears broad and vague.

Although the committee can now elect its own chair, the members of the committee still have to be nominated by the Prime Minister. The most effective committees, such as the Public Accounts Committee, tend to have a chair from an opposition party. The Prime Minister also has to approve any investigation by the ISC. He has prior sight of the committee’s reports to Parliament and may decide that matters should be excluded in the interests of national security. Secret agencies and government departments don’t have an obligation to provide information for any investigation beyond the narrow oversight set out in 1994.

As the representative of the interests of citizens, the ISC has consistently failed in its duty to challenge the intelligence agencies on behalf of Parliament and the population. As the Joint Committee on Human Rights (JCHR) in Parliament has noted, the level of redaction of ISC reports is sometimes so great that, “it can be difficult to follow the Committee’s work and to understand its reports”.13

The ISC must be fully reformed if it is to provide meaningful parliamentary oversight. The committee should be answerable directly to Parliament rather than to the Prime Minister and take its own decisions on reporting and publication. The committee must be appropriately funded and staffed with independent experts able to undertake detailed forensic investigations and an independent secretariat, including independent legal and technical advice. The committee should have strengthened legal powers to require the production of information and to compel the attendance of witnesses. The chair of the committee should be a member of the largest opposition party and the Commons members of the committee should be elected.14

8.4 The Commissioners

The two Independent Commissioners – for the Interception of Communications and Intelligence Services respectively- are the central element of the current oversight regime. They review the use of powers under RIPA and ISA by the Executive ministers by looking at the warrant system. They also check operations, visiting the agencies every six months with access to paperwork and staff. Both Commissioners produce annual reports to the Prime Minister, which are also presented to Parliament in censored form.

The Commissioners form part of a broader system15 that also includes the Information Commissioner, responsible for data protection and freedom of information; the Office of Surveillance Commissioners (OSC)16, which oversees the conduct of covert surveillance and covert human intelligence sources; the Surveillance Camera Commissioner17.

8.4.1 Interception of Communications Commissioner’s Office

The IOCCO18 provides statutory independent oversight of:

the lawful interception of communications under Part I Chapter I of the Regulation of Investigatory Powers Act (RIPA);

the acquisition and disclosure of communications data under Part I Chapter II of RIPA;

and the performance of the powers and duties conferred on the Secretary of State by Part III of RIPA (investigation of electronic data protected by encryption).

The current commissioner Rt Hon. Sir Anthony May, was appointed by the Prime Minister in January 2013.

The IOCCO has to date presented a yearly report19 which usually contains long explanations of the law, but very little detailed information. In relation to interception warrants it simply gives an overall figure of authorisations – 2,760 in 2013, down from 3,371 in 2012, with some 1,669 active on the 31st December. In 2013 there were 514,608 requests for communications data. The report does not break these down into categories, such as the precise section of the law under which they were authorised or the type of investigation.

Following the Data Retention and Regulatory Powers Act 2014 (DRIPA) the IoCC now has to report twice a year. These reports should be more detailed and extend to areas that the commissioners are not currently allowed to disclose, such as internal procedures, policies and techniques, including machine processing of data.

The last report from March 2015 shows that IOCCO provides some oversight of GCHQ’s internal audits, covering both policy and technical checks.20 IOCCO also provide oversight of the destruction of intercepted materials. They acknowledge some limitations in the current regime and propose an increased role for the Commissioner in the audit process. These are welcome proposals, but without corresponding allowances to report in more detail they may not have the desired impact.

In addition, it is unclear that the IOCCO would have the capacity to fully audit the complex technical systems described in the Snowden documents, so they may need additional resources. The RUSI report states that IOCCO are looking at how to improve their capacity for “testing the code and algorithms and having greater access to their systems”.21

8.4.2 Intelligence Services Commissioner

The Intelligence Services Commissioner, currently the Rt Hon Sir Mark Waller, is appointed by the Prime Minister. Although in principle the IOCCO has primary jurisdiction over interception, there is overlap with the Intelligence Services Commissioner. The IS Commissioner reviews the Secretary of State’s issuing of warrants that authorise intrusive surveillance and interference with property under Part II of RIPA, and the use of powers to grant authorisations to investigate electronic data protected by encryption under RIPA Part III. He also complements the Office of Surveillance Commissioners in reviewing the use of directed surveillance and covert human intelligence sources (that is agents) by the Intelligence Agencies, MOD and members of the armed forces to check compliance with RIPA..

The Justice and Security Act 2013 has given additional functions to the ISC. They can be asked by the Prime Minister to review almost any functions of the intelligence and security services, as long as this does not interfere with the IOCCO.

Importantly, they have oversight over any warrants issued under Sections 5 and 7 of the Intelligence Services Act (ISA, 1994).22 Section 5 warrants cover the interference with property referred to as “wireless telegraphy”, such as the installation of bugging devices. Section 7 warrants allow what would normally be unlawful conduct in the UK, when it takes place abroad. These could be very important in relation to the hacking activities of GCHQ (see Chapter Three).

The Intelligence Services Commissioner also monitors the agencies’ compliance with the consolidated guidance for working with overseas partners in relation to detainees, which is meant to prevent collaboration in torture and other abuses.23

The Intelligence Services Commissioner visits the agencies twice a year and examines a sample of warrants issued by the Secretaries of State authorising intrusive surveillance and interference with property. He ensures that the agencies apply the same authorisation process and the same test of necessity and proportionality. However, his report does not explain how many warrants fall under each type of authorisation, so it is hard to scrutinise.

In 201424 he looked at 16.7% of the 2032 warrants issued under both RIPA and ISA– 343 in total with some 43 errors. The only issue with GCHQ involved excessive monitoring of their own employees by mistake.

In March 2015, under section 59A of RIPA (as inserted by section 5 of the Justice and Security Act 2013), the Intelligence Services Commissioner was given statutory mandate for the oversight of the acquisition, use, retention, disclosure, storage and deletion of bulk personal datasets. There is no official definition of these and it appears to be up to the agency to define what is a personal dataset and provide a list of these. The Commissioner selects a smaller sample and in his latest report has only found minor concerns about misuse by external contractors. However, these bulk data systems are one of the most intrusive aspects of the UK’s surveillance regime. There is a need for more clarity on what these datasets are, and which agencies can access them.

The Intelligence Services Commissioner was heavily criticised, including by the Home Affairs Committee, when he appeared to say that the extent of his investigation of the Snowden allegations had simply consisted in seeking verbal assurances from GCHQ leaders, and trusting the ethos of the agency. He has since stated that he had actually carried out a more thorough investigation and still believes that GCHQ’s work is fully above board.25 In 2013 he examined 33 RIPA and ISA warrants from GCHQ.

The Commissioner has also been criticised for appearing to provide direct advice to GCHQ instead of holding them to account. A leaked warrant application under s5 of the ISA for GCHQ to engage in “software reverse engineering” (see Chapter Seven) mentions that the Commissioner had made some suggestions to make the procedure legally compliant although it had been in place for some time26. Eric King, Deputy Director of Privacy International, has pointed out that: “It is not the Commissioner’s function to provide the authoritative interpretation of any law”.27 The document appears to show that failures to follow internal procedures are simply being authorised retrospectively. It is unclear whether the IS Commissioner was aware before considering the process and giving GCHQ advice.

8.4.3 Reforming the Commissioners

The offices of the Intelligence Services Commissioner and the Interception of Communications Commissioner should be reformed. The Commissioners are currently appointed by the Prime Minister, but they should be truly independent, reporting to Parliament and insulated from undue Government influence.

Until the very recently, the Commissioners have never publicly found a warrant to be disproportionate. The first time they did so was the Interception Commissioner’s inquiry into the use of Chapter 2 of Part 1 of RIPA to identify journalistic sources. In that inquiry the Commissioner found that police forces did not give the question of necessity, proportionality and collateral intrusion sufficient consideration; and the Home Office Code of Practice does not provide adequate safeguards to prevent unnecessary or disproportionate intrusions. He recommended that judicial authorisation is obtained in cases where communications data is sought to determine the source of journalistic information.28

In the absence of prior judicial authorisation for surveillance decisions, it is vital that all decisions be subject to ex post facto scrutiny by a judge. However, the Commissioners inspect only a small proportion of warrants. The IoCC checks around one third and the ISC around 17% of the warrants under their jurisdiction.

The Home Affairs Committee in Parliament has made clear that the Commissioners simply do not have the capacity to deal with the hundreds of thousands of surveillance requests in place every year. If the Commissioners are to offer effective oversight, they must be empowered to conduct searching investigations, with adequate resources and the requirement to publish key statistics.

The Anderson review recommended that the Interception of Communications Commissioner’s Office, the Office of Surveillance Commissioners, and the Intelligence Services Commissioner be replaced with a new Independent Surveillance and Intelligence Commission (ISIC).29 This new body would be responsible for the authorisation of warrants by Judicial Commissioners as well as for certain types of request for communications data. Under Anderson’s proposals, the ISIC would also be responsible for oversight, so this arrangement would not provide a robust enough separation of these functions.

8.5 The Investigatory Powers Tribunal

The Investigatory Powers Tribunal (IPT) is the sole body responsible for handling complaints and Human Rights Act claims from individuals about the interception of communications by public authorities under RIPA. It deals with complaints about the conduct of the UK intelligence and security services and the police.

The Tribunal can hear complaints on the interception of communications, the obtaining of communications data, intrusive surveillance, directed surveillance, interference with property, and investigation of protected electronic information. For example, the IPT has been dealing with some of the human rights complaints related to the scandals about undercover police officers in political and environmental movements.

The IPT is not a true court as the term is commonly understood. It operates with utmost secrecy and only has around three public hearings a year. In March 2014 it was revealed that the IPT had operated from the Home Office building for the past 14 years.30

Before the IPT’s judgment in the claim brought by Liberty, Privacy International and Amnesty International in February 2015,31 it had upheld only 10 out of over 1,500 complaints presented by members of the public.

The Anderson review called for the IPT’s powers to be expanded so that it can rule against Communications Service Providers that have made errors and determine whether UK laws are compatible with the ECHR.

8.6 Individuals and redress

Individuals are not usually notified that they have been subject to surveillance, which makes it very difficult to seek a remedy for violations of the right to privacy.

The Anderson review stated that it had received several submissions calling for notification of those “wrongly targeted” by surveillance, and opened the possibility that the IPT could inform in such cases.32 However, it largely remained non-committal on the matter, citing the limited international precedent, despite the fact that several major countries are quoted in the report. Limiting notification to those who are “wrongly targeted” could be difficult to implement, being open to interpretation. A general presumption of notification, as part of a right to redress as described by the DSOU coalition, would be preferable.

The US has seen a mature debate on the issue of notification and oversight. The President’s Review Group on Intelligence and Communications Technologies argued for increased transparency and called for legislation that permits telecommunications companies to disclose information about the orders they receive from the Government.33 They also recommended ‘civilian’ involvement in the oversight of surveillance, alongside greater involvement for public interest advocates.

The IPT has the power to award compensation, make an order quashing or cancelling a warrant or authorisation, or an order requiring the destruction of any records of information obtained via a warrant or authorisation or held by a public authority.34 However, as discussed above, the IPT has found in favour of claimants in only a tiny proportion of cases.

Where the IPT finds against a complainant it does not give reasons for its decision. As a result, the individual will not know whether that means the activity complained about occurred, but was authorised and conducted lawfully, or that it did not occur at all. This is unsatisfactory. Importantly, there is no right of appeal against decisions of the IPT. Claimants who are unsuccessful in the IPT may have recourse to the European Court of Human Rights, but are unable to obtain a domestic remedy. In our view there should be a right of appeal to ensure individuals are able to enforce their rights. Both the ISC and Anderson have recommended that this is addressed in any new legislation.

The IPT’s procedure is also unfair and disadvantages claimants. The IPT is not obliged to hold oral hearings and even where it does, these may be ‘closed’ secret hearings. There is no special advocate to represent the claimant at closed hearings. There should be a presumption that hearings will be held in open court unless there is a compelling reason otherwise.35

We need an effective system of redress so that individuals are able to obtain a remedy for violations of their rights. Accountability means that individuals should be notified that they have been subject to surveillance after the event, unless there is a specific reason for maintaining secrecy. Otherwise, as discussed above, it is almost impossible to obtain an effective remedy.

8.7 Admissibility of Intercepted Communications

At present material gathered from intercepted communications, known as intercept evidence, is inadmissible in legal proceedings under section 17(1) of RIPA. However, Intercept evidence should be admissible in criminal proceedings because keeping the evidence out of court has the effect of making accountability for surveillance activities very hard indeed. This is a change that is supported by former Directors of Public Prosecutions, but opposed by GCHQ as doing so could publicly disclose the scale of interception activity.

From a human rights perspective there is nothing to prevent the use of intercept material, properly authorised by judicial warrant, in criminal proceedings. In fact, allowing evidence gained through interception to be used in criminal trials would enable greater judicial oversight. The European Court of Human Rights has found that the potential to exclude illegally obtained surveillance was an important safeguard that discouraged the collection of evidence by unlawful means.36 Making intercept admissible could also increase the number of possible prosecutions of serious criminal and terrorists.

8.8 Reviews of Surveillance Practices

In June 2015, the Independent Reviewer of Terrorism Legislation, David Anderson QC, completed his Investigatory Powers Review37 as mandated by DRIPA. The 373 page report had 124 recommendations, which included:

the passing of a new, comprehensive surveillance law;

combining the existing surveillance Commissioners offices into a single oversight body – the Independent Surveillance and Intelligence Commissioner (ISIC);

surveillance warrants to be signed off by Judicial Commissioners rather than government ministers;

extending the remit of the IPT and allowing the right to appeal its decisions.

Anderson also stated that extending surveillance powers – for example to include the retention of web log data – should only happen if there was an operational case, which has yet to be made.

The Royal United Services Institute (RUSI) was tasked by the Deputy Prime Minister, Nick Clegg, to conduct an independent review. Their report, A Democratic Licence to Operate was published in July 2015.38 Echoing the Anderson review, it called for legal reform and a shift to judicial authorisation. It also recommended that the Mutual Legal Assistance Treaty (MLAT) process for requesting data from foreign jurisdictions is reformed.

Both the Anderson and RUSI reviews failed to condemn bulk collection on principle but have called for comprehensive reforms.

In the UK there has been no comprehensive parliamentary inquiry, which is a missed opportunity to look at the issue from outside of the current overisght structures. In Germany, the Bundestag has specifically established a cross party committee of inquiry for the purpose and tasked it with answering specific and probing questions.39

8.9 Conclusion

Citizens must be sufficiently informed about the scope and nature of surveillance operations to be able to hold government to account. Increased transparency on the scale and reach of surveillance does not need to threaten operational secrecy.

It should be noted that GCHQ has extensive systems for the internal auditing of their activities, as reported in various reviews of surveillance, in external reports and in leaked documents. These include periodic reviews of random samples of databases to show necessity and proportionality and to check for compliance with the Human Rights Act when “targeting, tasking, searching and examining intercept for communications content or metadata”40 (see Chapter Two). Internal auditing processes, while clearly necessary and useful, will never be enough for any kind of organisation, let alone one of the largest surveillance operations in the world.

The reports from the independent commissioners only give overall figures of numbers of interceptions, authorisations and warrants, including some errors and mistakes. However, this information is not enough to understand the true picture of state surveillance. Some warrants will refer to a single individual while others could authorise wholesale surveillance or hacking affecting thousands of people. While the work of the ICC in particular seems to be improving, the commissioner system needs revisiting and it is not a replacement for judicial oversight.

The lack of an independent Parliamentary committee is well-known. From its apparent ignorance of the programmes, to its steadfast backing of the agencies, the reaction of the ISC during the last two years has not built confidence. Yet its job is crucial. It seems highly likely that it should have been able to spot the change from targeted interception to bulk collection, and the need for Parliamentary approval through new legislation, but it failed to do so. Combined with the lack of judicial authorisation for bulk collection warrants, the UK’s system of accountability has been shown to lack effective restraint. The result is a number of challenges in the European courts (see Chapter Seven).

There has been a historic refusal to contemplate transparency on the methods and capabilities of the services, with the argument that this would give away critical information to our enemies. Yet the widespread surprise and shock generated by the Snowden leaks demonstrates the need for a public debate on the scale and overall capacities of surveillance programmes. As the Anderson review states: “Trust in powerful institutions depends not only on those institutions behaving themselves (though that is an essential prerequisite), but on there being mechanisms to verify that they have done so.”41

1 http://www.theguardian.com/commentisfree/2013/oct/20/parliament-forsaken-liberty-law-last-resort

2 Home Affairs Committee – Seventeenth Report, Counter-terrorism, 30 April 2014, paragraph 157

3 A Question of Trust, Report of the Investigatory Powers Review David Anderson Q.C. Independent Reviewer of Terrorism Legislation, June 2015 p8

4 http://theintercept.com/document/2015/09/25/jce-uk-legalities-context/

5 http://theintercept.com/document/2015/09/25/jce-uk-legalities-context/

6 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/335208/Surveillance_road_map_v3_1.pdf

7 http://www.legislation.gov.uk/ukpga/1994/13/section/10

8 http://www.legislation.gov.uk/ukpga/2013/18/part/1/crossheading/oversight-by-the-intelligence-and-security-committee-of-parliament/enacted

9 http://www.publications.parliament.uk/pa/cm201314/cmselect/cmhaff/231/23108.htm

10 http://www.statewatch.org/news/2013/jul/uk-isc-gchq-surveillance-statement.pdf

11 http://www.independent.co.uk/news/uk/home-news/hazel-blears-says-security-committee-did-know-the-scope-of-gchq-snooping-8928888.html

12 http://www.theyworkforyou.com/lords/?id=2013-11-20a.957.0

13 http://www.publications.parliament.uk/pa/jt200809/jtselect/jtrights/152/152.pdf

14 Home Affairs Committee – Seventeenth Report, Counter-terrorism, 30 April 2014, para 158

15 https://ico.org.uk/media/for-organisations/documents/1042035/surveillance-road-map.pdf

16 https://osc.independent.gov.uk

17 https://www.gov.uk/government/organisations/surveillance-camera-commissioner

18 http://www.iocco-uk.info/default.asp

19 http://www.iocco-uk.info/docs/2013%20Annual%20Report%20of%20the%20IOCC%20Accessible%20Version.pdf

20 http://www.iocco-uk.info/docs/IOCCO%20Report%20March%202015%20(Web).pdf

21 A Democratic Licence to Operate – Report of the Independent Surveillance Review, Royal United Services Institute, July 2015 p84

22 http://www.legislation.gov.uk/ukpga/1994/13/section/5

23 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/62632/Consolidated_Guidance_November_2011.pdf

24 http://intelligencecommissioner.com/docs/50100_HC_225_Intel_Services_Commissioner_accessible.pdf

25 http://isc.intelligencecommissioners.com/docs/40707_HC304IntelligenceServicesCommissioner_Accessible.pdf

26 https://theintercept.com/document/2015/06/22/software-reverse-engineering-gchq

27 https://theintercept.com/2015/06/22/gchq-reverse-engineering-warrants/

28 http://www.iocco-uk.info/docs/Press%20Release%20IOCCO%20Journalist%20Inquiry.pdf, http://www.iocco-uk.info/docs/IOCCO%20Communications%20Data%20Journalist%20Inquiry%20Report%204Feb15.pdf

29 A Question of Trust, Report of the Investigatory Powers Review David Anderson Q.C. Independent Reviewer of Terrorism Legislation, June 2015 p299, recommendation 82

30 http://www.theguardian.com/politics/2014/mar/05/independence-ipt-court-mi5-mi6-home-office-secrecy-clegg-miliband

31 http://www.ipt-uk.com/docs/Liberty_Ors_Judgment_6Feb15.pdf

32 A Question of Trust, Report of the Investigatory Powers Review David Anderson Q.C. Independent Reviewer of Terrorism Legislation, June 2015 p217

33 http://www.whitehouse.gov/sites/default/files/docs/2013-12-12_rg_final_report.pdf

34 Section 67(7) Regulation of Investigatory Powers Act, http://www.legislation.gov.uk/ukpga/2000/23/section/67

35 The Supreme Court concluded similarly in Bank Mellat (Appellant) v Her Majesty’s Treasury (Respondent) (No. 1) [2013] UKSC 38, https://www.supremecourt.uk/decided-cases/docs/UKSC_2011_0040_PressSummary.pdf

36 Uzun v. Germany (application no. 35623/05)

37 A Question of Trust, Report of the Investigatory Powers Review David Anderson Q.C. Independent Reviewer of Terrorism Legislation, June 2015

38 A Democratic Licence to Operate – Report of the Independent Surveillance Review, Royal United Services Institute, July 2015

39 https://www.bundestag.de/blob/284528/a89d6006f28900c4f46e56f5e0807ddf/einsetzungsantrag_englisch-docx-data.pdf

40 http://theintercept.com/document/2015/09/25/hra-auditing/

41 A Question of Trust, Report of the Investigatory Powers Review David Anderson Q.C. Independent Reviewer of Terrorism Legislation, June 2015 p246

9 Threats and risks

9.1 Introduction

The documents leaked by Edward Snowden provide evidence that GCHQ engages in a very broad range of activities that go well beyond surveillance. Besides bulk collection programmes such as TEMPORA, there is evidence that GCHQ has exploited weaknesses in Internet security, hacked computers, carried out Denial of Service attacks, and has an ongoing programme for the infection of target computers with a variety of malware (see chapters Three and Six).

An often-repeated defence of mass surveillance is that if you have nothing to hide, you have nothing to fear. The implication of this argument is that only the guilty are negatively affected by mass surveillance; for the rest of us, undermining our right to privacy is a small price to pay for protection from terrorist groups, serious criminals and antagonistic foreign powers. However, activities that exploit weaknesses in the Internet threaten more than our privacy. They risk serious damage to Internet security, law enforcement and the economy.

Holding the security services to account is incredibly important for the legitimacy of their immediate mission to work against the most serious forms of criminality and their wider purpose of protecting our democratic society.

However, mass surveillance undermines our ability to exercise our basic democratic rights as neither we nor our MPs have a full picture of the secret services’ capabilities. We have to blindly trust that a secret system of checks and balances is working. The capacities of the intelligence agencies to monitor and manipulate online behaviours go much further than anything envisaged in the current framework of surveillance regulation.

If we allow the intelligence agencies to determine their own legal and policy agenda, there is an imbalance at the heart of our democracy, that could prove highly corrosive. Mass surveillance affects other rights, such as freedom of expression and freedom of association, and undermines the presumption of innocence that underpins our legal system.

Data collection is also inconsistent with foreign policy commitments to promote human rights and the rule of law and could threaten the UK’s foreign standing.

In this chapter, we outline the threats that GCHQ’s programmes create and ask whether Parliament has the information and the mechanisms to balance these threats against the perceived benefits of mass surveillance.

9.2 Threats to democracy

A fundamental difference between a democracy and an authoritarian state is the ability of citizens to hold their government and its agencies to account. The agencies are engaging in activities that would normally be considered illegal and very harmful. They are given powers that can potentially be abused; unchecked they could easily be used to overthrow a government, cause the wrongful arrest of citizens or destroy people’s lives for political ends.

Even in an established democracy like the UK, we cannot just assume that our agencies will never cross the line and interfere with political processes. The law and our democratically elected representatives need to hold them to account, which at present they are not fully able to do (see Chapters Seven and Eight).

Institutions can find it hard to separate their own reputation and survival from their mission. For the security services, protecting their reputation and abilities can be seen as core their mission of protecting the UK’s international interests through intelligence gathering. As David Anderson QC noted in his review: “Organisations whose existence was an official secret just a generation ago are still learning to come to terms with a world which demands scrutiny, assurances and accountability at every turn.”1

We recognise that there has to be secrecy about the intelligence services’ work but there is a difference between operational secrecy and proper oversight. One of the shocking aspects of the Snowden revelations is that British MPs had little idea about the extent of surveillance being carried out. It took a foreign whistleblower for us to find out.

Fundamentally, this is an issue of trust. Since the public cannot directly oversee the work of the intelligence services, then we have to entrust our democratic representatives to do so on our behalf. This chapter outlines the threats that they must consider when doing so.

9.2.1 Institutional abuse

Historically, surveillance within democratic countries has been used against human rights organisations, environmental groups, trades unionists and political activists. Surveillance can threaten freedom of speech, freedom of assembly and the political debate expected in a democracy.2 The question for today’s politicians is whether they can be confident that people or groups are not being targeted inappropriately, and that access to the vast wealth of personal information held by GCHQ and shared with the NSA is not being abused.

In July 2015, the Investigatory Powers Tribunal (IPT) informed the human rights organisation Amnesty International that GCHQ had illegally intercepted its communications. This followed an earlier announcement that the agency had illegally spied on another human rights organisation, the South African not-for-profit Legal Resources Centre.3

Given the secrecy of the security services’ activities, it it is difficult to know how many other abuses have been committed. The NSA reported a total of 2776 surveillance violations in the twelve months leading to March 2012,4 although the majority were due to unintended errors. There are no comparable figures available for GCHQ. In the UK, there is more evidence of how surveillance has been misused by UK law enforcement – for example, the targeting of Stephen Lawrence’s family to try to discredit their campaign for justice for his racially-motivated murder.5

9.2.2 Threats to privileged communications

As well as journalists, there are a number of other professions who need to be able to communicate confidentially, including doctors, lawyers and politicians.

The right for lawyers to communicate confidentially with their clients is a fundamental human right, recognised by common law and by the European Court of Human Rights. It is seen as essential in ensuring that people have the right to a fair trial. In February 2015, the Government admitted that its policies on how the security services handle privileged communications between lawyers and their clients had breached human rights law.6

The Wilson Doctrine7 pledges to prevent the wiretapping of MPs and Peers’ phones. However, Government ministers have stated that the Wilson Doctrine only applies to the content of communications, and not to metadata,8 even though the can be as revealing as content. Caroline Lucas MP and Lady Jones of Moulescoomb raised a formal complaint9 at the Investigatory Powers Tribunal, asking for a declaration that the interception of their communications – including confidential correspondence with constituents – has been prohibited. In October 2015, the IPT ruled that the Wilson Doctrine did not offer protection to MPs and peers’ communications.10

In November 2014, the then Justice Secretary Chris Grayling apologised after it was revealed that confidential telephone calls between MPs and prisoners had been recorded.11 Grayling said that the monitoring had been accidental not intentional, which illustrates how if systematic surveillance is in place, it is difficult not to breach confidentiality.

It is difficult to see how a system of mass collection and analysis can be engineered to fully protect categories of privileged communications. The processes for accessing these communications are designed to allow access for law enforcement and other agencies with little external supervision – for example, the police and other organisations sign off RIPA requests internally.

Unless collection and requests are limited and supervised externally, abuses are hard or impossible to control.

9.2.3 Discrimination, profiling and mistrust

Psychological studies have found that surveillance can undermine trust citizens’ trust in the state, and actually undermine its authority.12

Mass surveillance could disproportionately generate loss of trust and confidence among particular groups at risk of disaffection. According to research by the Equalities and Human Rights Commission, British Muslims already appear to feel disproportionately targeted by counter-terrorism measures. Complaints include the way Muslims are treated when travelling through airports and the existence of CCTV programmes such as Champion in Birmingham, which focused on Muslim neighbourhoods.13 Pervasive monitoring of communications can only foster further mistrust.

9.3 Threats to freedom of expression

Freedom of expression is essential if we are to fully engage in society, debate ideas and participate in democratic processes. A free media holds governments and the powerful to account.

9.3.1 The media

In 2014, the UK dropped three places to 33rd in the World Press Freedom Index, compiled by Reporters Without Borders. The reasons cited for this fall included the destruction of files in The Guardian’s offices14 following the Snowden revelations and the detention of journalist Glenn Greenwald’s partner, David Miranda,15 under section 7 of the Terrorism Act. The report noted: “By identifying journalism with terrorism with such disturbing ease, the UK authorities are following one of the most widespread practices of authoritarian regimes.”16

The threat to media freedom from surveillance was demonstrated in July 2014 when it was revealed that the police had used RIPA to access the telephone records of a Sun journalist in order to identify a whistleblower. In doing so, they bypassed journalistic privilege to protect their sources. Under the Police and Criminal Evidence Act 1984 (PACE), the police need to get permission from a judge to access a journalist’s telephone records in order to identify a source. However, the police do not need judicial or ministerial authorisation for RIPA requests, merely approval by a senior officer. In March 2015, the Acquisition and Disclosure of Communications Data Code of Practice was updated to require the police to apply for a court production order under PACE to access journalists’ data in order to identify a source.17 Writing in Press Gazette, which campaigned for changes to protect the confidentiality of journalists’ sources, Nicholas Griffin QC and Robert O’Sullivan QC argue that these protections could be illusory because provisions in RIPA would prevail over PACE, which does not mention communications data.18

After other high profile cases and pressure from media groups, the Interception of Communications Commissioner launched an inquiry into the acquisition of communications data by police forces to identify journalistic sources, which concluded that: “judicial authorisation must be obtained in cases where communications data is sought to determine the source of journalistic information.”19 Despite this, potential whistleblowers, who have information that is in the public interest, may be deterred from speaking to journalists if they fear that they can be identified through surveillance.

This does not cover the surveillance of journalists by GCHQ. According to a Guardian report, documents leaked by Snowden show that GCHQ collected and shared the emails of journalists working from international news organisations, including the BBC, TheNew York Times and Reuters.20

9.3.2 Writers

A global survey of writers by PEN America on the impacts of mass surveillance showed that: “the levels of self-censorship reported by writers living in democratic countries are approaching the levels reported by writers living in authoritarian or semi-democratic countries.”21

9.3.3 Activists

Among activists it has become common to talk about the likelihood of being on the radar of the police or secret services. This speculation, whether true or not, suggests that people believe they are likely to become a target or person of interest if, for example, they have legitimate but fringe political views or join a demonstration. The Supreme Court has ruled that the police can collect information on innocent people engaged in protests.22 In December 2014, it was reported that Kent police had asked Canterbury Christ Church University to hand over a list of people that were to attend a debate on fracking.23 Incidents like this can have a chilling effect on political activism and debate.

9.4 Threats to UK business and innovation

The UK is a world leader in e-commerce, with sales of £492 billion in 2012, accounting for 18% of business turnover.24 In 2014, 74% of UK adults used the Internet to make a purchase.25

Industry leaders, such as Martin Sorrell chief executive officer of WPP Group, have raised concerns about how awareness of mass surveillance will impact on consumers.26 An Ipsos Mori poll published in February 2014 found that “68% of Britons are concerned about the way information is collected about them by government, and even more – 76% – are worried about information collected on them by companies”.27 These increased levels of concern about Internet companies is repeated in other polls,28 with one possible explanation being that awareness of government surveillance contributes to a generalised loss of confidence on ‘the Internet’, which is then identified with well known brands.

A US survey found that 47% of respondents have changed their online habits due to the activities of the NSA, with some 26% saying they have reduced their online banking and shopping.29 If this trend is copied in the UK, with our higher levels of online commerce, it could have serious economic consequences.

A survey of ICT decision-makers in France, Germany, Hong Kong, the United Kingdom and the US found that 88% are changing their buying behaviour due to surveillance revelations. 82% agree with Angela Merkel’s proposals for separating European data networks.30

US Internet firms are very concerned at the loss of business. A 2013 report estimated that the US cloud industry could lose between $22 and $35 billion over the following three years as a result of the recent revelations.31 At face value, this could be perceived as a positive effect for UK and European businesses. On the other hand, analysts Forrester have pointed out that:

“a greater understanding of this surveillance picture could have a chilling effect on all hosting and outsourcing services (not just cloud computing) in many countries.”32

9.5 Threats to the security of the Internet

GCHQ wants to have full access to everything that happens online anywhere and everywhere. Traffic data is collected and analysed as a matter of fact. Internet security mechanisms, such as encryption, that protect the privacy of users’ information create obstacles for the agency’s mission. Its response has been to increase access by breaking or circumventing these technologies.

Revelations that the NSA and GCHQ have been working to undermine widely used technologies and standards has deeply concerned security specialists and Internet businesses. There has been a drive towards the strengthening of the privacy and security of Internet communications for the general population. Internet governance organisations such as the Internet Engineering Task Force (IETF), the World Wide Web Consortium (W3C) and the Internet Advisory Board (IAB) have reacted against what they perceive as a fundamental threat. The IETF has issued a technical consensus document – RFC 7258 – declaring that “large-scale pervasive monitoring (PM) of Internet traffic represents a clear attack against Internet privacy”33. W3C and IAB have formed a working group dedicated to Strengthening the Internet Against Pervasive Monitoring, aiming to fundamentally modify the architecture of the net to prevent intrusion by security services.34

Major Internet companies are now bringing security features that will have an impact on the capacity of the security services to access their customers’ information. Yahoo! and Google are preparing to offer end-to-end encryption for emails because, in the words of one of Yahoo! security researcher Alex Stamos, “privacy is much more effective as a selling point than it used to be”.35 Messaging app WhatsApp, owned by Facebook has also started to encrypt its customers’ messages.36 This has led to media speculation that it could be ‘banned’ by the UK government.37

Most software engineers believe that people must be able to choose their own software and security measures, and it is highly undesirable to compromise equipment and software, because it inevitably creates bugs and potential exploits that are available to criminals as well as security agencies.

9.6 Threats to secure technology

Targeted intrusion is when security agencies access either networks or an individual’s equipment to gain knowledge about them. This can include intruding on innocent people and organisations’ networks in order to reach a target (see Chapter Three).

The agencies can use bugs or problems with equipment or software to gain access to a target’s communications. They must decide whether or not to report any problems to the company that produces the software or equipment. If the bug is not reported, any users of that device or programme remain vulnerable to attacks by anyone else who uncovers the same problem. If the problem is unusual and unlikely to be found by a third party, the agency may deny security researchers knowledge about new kinds of problems they need to look out for. If it is a common kind of problem, the bug is likely to be found by others, and exploited for harmful purposes. Either way, there is a likely cost to the cyber security of individuals and businesses.

Using exploits for access to equipment and devices carries many risks. No doubt the agencies understand this but feel they have no choice. How then do they make a reasonable risk assessment, given that the problems they uncover may exist in equipment and software used by millions of people across the globe? Do they consider the potential risk to UK and other citizens? Who is checking and overseeing these decisions to ensure that costs and benefits are balanced?

A different problem occurs when GCHQ decides that it needs access to networks, or perhaps encryption technology such as certification used in SIM cards, controlled by private companies. In these cases, GCHQ may make a decision to compromise a foreign network (such as Belgacom in 2010),38 a foreign company (such as Dutch firm Gemalto in 2010-11)39 or compromise a network of computers in order to gain unauthorised access to other computers in the future.

There are direct impacts on the business of the people whose equipment, networks or security are compromised. These include removing malware originating from GCHQ if they are found; protecting themselves from future attacks; losing the trust of their customers; and being liable for leaking customer data. In addition, they may find that the compromises created by GCHQ have caused further unknown security problems that they could not anticipate, as security relies on understanding the software running on your system and what it precisely does.

To the owners, the consequences of GCHQ’s attacks on foreign networks or equipment could be the same as a criminal breaking in. It will be extremely difficult for them to hold GCHQ to account for what they have done.

We would expect that GCHQ’s first recourse should try to co-operate with foreign allies before using targted intrusion to gain access to a target’s communications. If this is impractical, how does GCHQ decide that the benefits of their invasion of a network or public equipment outweigh the costs to overseas companies and their customers?

Making sure there is proper oversight of these decisions is a challenge for Parliament, the executive and judges. To understand the threats, they must understand who GCHQ is targeting, the precise methods being used to target them, the computer security risks that are generated and the potential social and economic consequences to the intermediaries whose equipment and software is invaded or exploited.

GCHQ’s CESG (Communications-Electronics Security Group)40 has responsibility for Information Assurance in government – that is removing security problems and ensuring that systems are secure – while GCHQ as a whole must ensure that SIGINT has the capability to use the same kind of problems to break into other people’s systems. There is a case for separating these functions because of the potential conflict of responsibility.

9.7 Threats to personal security

Privacy enhancing technologies are used for many legitimate purposes, including preventing human rights violations. For example, Syrian dissidents use Tor,41 software which allows anonymous communication, to protect themselves from the Assad regime.42 Tor has also been working with domestic abuse survivors.43 Other groups that need to protect their communications include human rights workers, journalists, mental and sexual health professionals, patent attorneys and technology innovators.

The knowledge that the security services are bulk collecting our data has created a market for privacy-enhancing products. For example, Apple encrypts iPhones and iPads in a manner that makes it impossible for the company to hand data to law enforcement agencies. In their Privacy statement, they state:

“On devices running iOS 8 and later versions, your personal data is placed under the protection of your passcode. For all devices running iOS 8 and later versions, Apple will not perform iOS data extractions in response to government search warrants because the files to be extracted are protected by an encryption key that is tied to the user’s passcode, which Apple does not possess.”44

There is a backlash from the security services against the spread of secure technologies, with calls to curb their use, or include backdoors or deliberate security loopholes.

The response of the UK Prime Minister, David Cameron, to the Charlie Hebdo attacks has been to promise new legislation after the elections to ensure that there are no “means of communications” which the security services “cannot read”.45 Cameron’s apparent calls to limit encryption were strongly criticised by security experts. Blogger and computer security expert, Graham Cluley, said: “Cameron is living in cloud cuckoo land if he thinks that this is a sensible idea, and no it wouldn’t be possible to implement properly.”46

If the UK restricted the use of Tor or strong encryption, it would legitimise similar actions by authoritarian states. In addition, Tor relies on peer-to-peer collaboration to provide anonymity and bandwidth.47 Restrictions on Tor usage in the UK could have a direct negative impact on citizens of non-democratic states.

Panics about access to strong cryptography have happened before. During the 1990s the ‘Crypto Wars’ saw demands for backdoors and keys to be deposited in escrow.48 Eventually cryptography became widespread and the basis for online trust, enabling online commerce and secure services.

There is no easy answer to the conundrum that privacy-enhancing technologies present for legitimate law enforcement, and certainly not from a technological standpoint. However, police detective work has proved successful in dismantling sophisticated criminal enterprises that rely on secure technologies, such as the Silk Road marketplace for illegal goods.49

9.8 Threats to Internet governance

The UK has been at the forefront of the promotion of efforts to maintain the international multi-stakeholder model of Internet regulation. Other countries, including China and Russia, favour a more top-down approach which would allow them to impose controls on Internet infrastructure that falls under their national borders. For example, Russia has recently announced plans for a ‘kill switch’ capable of cutting the country off from the global Internet.

At the Seoul Conference on Cyberspace in October 2013, former Foreign Secretary William Hague said:

“On the other side are countries calling for an international legal framework for the Internet that would enable governments to exercise exclusive control over the Internet’s content and resources.

I am convinced that placing the controls of cyberspace entirely in the hands of governments would be a drastic error that would have profound social and economic consequences.”50

GCHQ’s work undermines the stated UK position on Internet regulation and risks legitimising the behaviour of states that openly want to impose restrictions on Internet infrastructure. Any review of surveillance should consider the damage that mass surveillance inflicts on the models of Internet regulation that have so far greatly benefitted the UK.

9.9Threats to the UK’s autonomy and foreign standing

The high level of integration of the UK’s surveillance apparatus with US agencies has implications for our foreign policy and relations. While the UK is perceived to gain benefits from the ‘special relationship’, we are increasingly dependent on the US for the NSA’s technology and data.

This could mean it is difficult to separate our own strategic interests from those of the US. Our European partners may also consider how this shared intelligence infrastructure affects the UK’s foreign policy calculations. Could the UK decide to stop its mass surveillance programmes unilaterally? If there were a crisis in the relationship between the UK and the US, what risks would our shared intelligence arrangements pose?

While these may be threats that politicians are prepared to accept, we need a thorough public discussion of the consequences of close intelligence sharing and how to manage any issues that arise.

9.9.1 Spying on our allies

Revelations about mass surveillance may have weakened the UK’s standing with its allies.

Documents seen by the Washington Post show that GCHQ and the NSA had been targeting a broad range of foreign interests51 – from ally governments, such as Turkey,52 to Joaquin Almunia – the EU official charged with competition.

The Guardian newspaper published documents showing how GCHQ had spied on allied diplomats at the 2009 G20 meeting in London.53 The agency obtained calls and emails from smartphones, such as Blackberries; and set up fake Internet cafes in order to gather information. Intelligence was fed to ministers to be used during the negotiations. Similar revelations that GCHQ spied on delegations at climate talks are being investigated by the UN.54

There is evidence that agencies target elected politicians in allied countries. A senior US official admitted that the NSA was “probably” spying on members of Congress and their staff,55 and the agency refused to categorically deny this was the case.56 In addition to widespread reports of the tapping of Angela Merkel’s phone,57 German media reported that the NSA had also spied on European institutions,58 which generated widespread complaints from policymakers across Europe. According to documents released by Wikileaks, the NSA spied on three French Presidents between 2006-2012.59 We know less about GCHQ’s activities in this regard, although the GCHQ hacking of Belgacom for instance, may lead to a suspicion that the UK has aided NSA access to the EU institutions’ data.

Although spying of this kind may have taken place in the past, the gigantic mass spying capabilities of the Five Eyes place it in a new context.

9.9.2 Human rights

The 2010 UK National Security Strategy60 states that it is in Britain’s national interest to promote the rule of law and human rights abroad because it makes us safer. This is undermined by the disproportionate interference with the privacy and security of millions of people under the cover of secret intelligence sharing pacts.

In particular, British involvement in drone strikes would appear to be in direct conflict with our stated aim of promoting the rule of law and human rights abroad.

Concerns have been raised about the involvement of GCHQ in drone strikes since 2010.61 A legal opinion by a respected QC found that GCHQ workers could be complicit in war crimes if they helped strikes in undeclared conflicts, such as Yemen.62 In 2011 the relatives of a man killed by drones in Afghanistan took GCHQ to court over its role in the strikes. The case was eventually thrown out by the Court of Appeal without full consideration, because it would imply passing judgment on the sovereign acts of the US.63

The use of data analysis for drone strikes is controversial. Data analysis can provide the accurate location of a device, but there is no guarantee that the device is in the possession of the person of interest. This can lead to the killing of the wrong person. In addition there are questions about whether remote killings outside the theatre of operations fall within the definition of fighting ‘combatants’. Several human rights organisations are calling on the US government to be more transparent about drone use.64

For some time there has been widespread evidence that information from the NSA is used in drone strikes resulting in the deaths of both targets and innocent civilians.65 This has generated growing calls, including from the former head of GCHQ,66 for the UK to disclose the guidelines governing when the UK may share intelligence to help locate individuals on the US ‘kill list’.

Tom Watson MP, Chair of the All Party Parliamentary Group (APPG) on Drones, has called for:

“an informed public debate about this new era of war-making technology. Parliament should know about our own lethal operations and the various ways we support the drone programme of the United States – shared communications systems, shared data, shared assets and exports. All future action has to comply with our own understanding of human rights and the laws of war.”67

In September 2015 it was made public that the UK government had authorised the killing of two British citizens fighting for Islamic State in Syria, claiming self-defence under international law68. GCHQ had been involved in intercepting the communications of the targets69 and almost certainly was involved in tracking their location.

9.10 Threats from the militarisation of cyberspace

The line between surveillance capability and offensive weaponry has been crossed by the development of malware and Denial of Service attacks. Malware installed to control a computer or network can also be used either to harvest information or to damage or switch systems off.

This is recognised in the Snowden documents which outline the weaponisation of our surveillance capabilities. For Parliament this raises a very serious question: is it legitimate to have secret capabilities to damage foreign powers? Are we incentivising others to attempt to control our systems too? At what point should our elected representatives seek a public debate about entering into an entirely new field of war, which would inevitably be more likely to target less protected civilian systems than combatants?

There are concerns about the growing militarisation of cyberspace. This trend is mainly characterised by an excessive focus on the strategic and military aspects of cyber security, which according to policy experts “centres too strongly on national security measures instead of economic and business solutions, and wrongly suggests that states can establish control over cyberspace.”70

The UK is the first country in the world to publicly admit to developing offensive cyberwarfare capabilities,71 in a move that implies that cyberwarfare would be legitimately regulated by existing international instruments. However, there is no consensus that existing international law and ethical principles are able to deal with this new phenomenon.72 Developing the cyberwarfare narrative without a public debate denies us the opportunity for serious discussion about the moral and ethical issues that arise from these capabilities, especially surrounding their invisibility and potential lack of accountability due to the difficulties in establishing the authorship of cyber operations.

9.11 Conclusion

Throughout this report we have discussed the complexity of assessing the risks, costs and benefits of mass surveillance activities.

The leaked documents appear to show an approach where the ends justify any means, with little regard for collateral damages. Especially where innocent intermediaries are effectively targets, GCHQ needs to be highly focused in their approach, rather than finding broad-brush means of collecting data. It is unclear that hacking can be seen to be targeted, when looking at GCHQ’s actions to access bulk data at Belgacom, to steal Gemalto’s encryption keys in bulk, or to siphon off Yahoo! and Google’s data from their private cables (see Chapters Two and Three).

From a basic reading of the published Code of Practice for Equipment Interference, it is hard to believe that these external risks – rather than internal operational risks – are properly considered. Furthermore, it appears that ‘lack of access’ to data is seen as the primary threat, on the basis that not having information would mean that threats may not be detected. This leads the agencies to justify any intrusion; without the intrusion there will be a risk. Instead, the threats caused by intrusion need to be measured against targeted interference.

There are some real issues driving mass surveillance. The move from communications lines for phone and telex made it easier to engage in targeted surveillance. When you move to Internet packets it can be harder to isolate individuals without looking at the data stream in which these flow. However, wholesale global surveillance is a disproportionate response to changes in technology.

Politicians and oversight bodies need to be extremely careful about risk assessment and must ensure that they have sufficient expertise on hand to understand what risks exist, how they are managed and whether the risk assessments are reasonable. Risk assessment may be the critical component for external oversight to examine, especially in relation to equipment interference.

The threats posed by GCHQ’s activities are much wider than breaches of privacy, affecting personal liberty and security, democracy and business. It is unclear that Parliament and the Executive have fully understood these threats. Politicians need to be honest about the debate: there may be no easy answers to some questions, GCHQ may not always be striking the right balance, and it may not be possible to fully meet the desires of state security agencies while also maintaining and enhancing personal and business security. However, we still need to have a robust debate to ensure that there is democratic accountability for the security services’ activities.

1 A Question of Trust, Report of the Investigatory Powers Review David Anderson Q.C. Independent Reviewer of Terrorism Legislation, June 2015 p190

2 http://www.defendtherighttoprotest.org/supreme-courts-catt-judgment-ignores-reality-of-surveillance-and-seriously-undermines-privacy-protest-rights/

3 http://www.theguardian.com/uk-news/2015/jul/01/gchq-spied-amnesty-international-tribunal-email

4 http://www.washingtonpost.com/world/national-security/nsa-broke-privacy-rules-thousands-of-times-per-year-audit-finds/2013/08/15/3310e554-05ca-11e3-a07f-49ddc7417125_story.html

5 http://www.theguardian.com/uk/2013/jun/23/stephen-lawrence-undercover-police-smears

6 http://www.bbc.co.uk/news/uk-31526737

7 https://en.wikipedia.org/wiki/Wilson_Doctrine

8 http://www.theyworkforyou.com/search/?q=%22wilson+doctrine%22*

9 http://www.theguardian.com/uk-news/2014/may/04/greens-legal-challenge-gchq-surveillance

10 http://www.theguardian.com/world/2015/oct/14/gchq-monitor-communications-mps-peers-tribunal-wilson-doctrine

11 http://www.theguardian.com/society/2014/nov/11/prisoners-phone-calls-mps-monitored-grayling

12 http://www.theguardian.com/science/head-quarters/2013/aug/26/nsa-gchq-psychology-government-mass-surveillance

13 http://www.equalityhumanrights.com/sites/default/files/documents/research/counter-terrorism_research_report_72.pdf

14 http://www.theguardian.com/uk-news/2014/jan/31/footage-released-guardian-editors-snowden-hard-drives-gchq

15 http://www.independent.co.uk/news/uk/home-news/edward-snowden-affair-us-was-given-headsup-before-heathrow-detention-of-journalist-glenn-greenwalds-partner-david-miranda-8773642.html

16 http://rsf.org/index2014/en-eu.php/en-eu.php

17 https://www.gov.uk/government/publications/communications-data-draft-codes-of-practice-acquisition-disclosure-and-retention

18 http://www.pressgazette.co.uk/content/new-legal-protections-media-sources-may-be-illusory-why-journalists-and-lawyers-should-unite

19 http://www.iocco-uk.info/docs/IOCCO%20Communications%20Data%20Journalist%20Inquiry%20Report%204Feb15.pdf

20 http://www.theguardian.com/uk-news/2015/jan/19/gchq-intercepted-emails-journalists-ny-times-bbc-guardian-le-monde-reuters-nbc-washington-post

21 http://pen.org/global-chill

22 https://www.supremecourt.uk/decided-cases/docs/UKSC_2013_0112_PressSummary.pdf

23 http://www.theguardian.com/uk-news/2014/dec/15/police-university-list-fracking-debate

24 http://www.neighbourhood.statistics.gov.uk/HTMLDocs/dvc166/index.html.

25 http://www.ons.gov.uk/ons/rel/rdit2/Internet-access---households-and-individuals/2014/sty-digital-day-2014.html

26 http://www.theguardian.com/media/video/2014/apr/02/martin-sorrell-nsa-revelations-consumers-video

27 http://www.ipsos-mori.com/researchpublications/researcharchive/3342/Three-in-four-Britons-are-worried-about-companies-collecting-information-about-them.aspx

28 http://www.tnsglobal.com/sites/default/files/whitepaper/TNSBMRB_POMDataTables2014Feb03.pdf

29 http://www.welivesecurity.com/2014/04/02/harris-poll-nsa-revelations-impact-online-shopping-banking/

30 http://nsaaftershocks.com/wp-content/themes/nsa/images/NTTC_Report_WEB.pdf

31 http://www2.itif.org/2013-cloud-computing-costs.pdf

32 http://blogs.forrester.com/james_staten/13-08-14-the_cost_of_prism_will_be_larger_than_itif_projects

33 http://tools.ietf.org/html/rfc7258

34 https://www.w3.org/2014/strint/

35 http://www.forbes.com/sites/kashmirhill/2014/08/07/yahoo-end-to-end-encryption/

36 https://whispersystems.org/blog/whatsapp/

37 http://www.standard.co.uk/lifestyle/london-life/will-whatsapp-be-banned-10380332.html

38 http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html

39 http://www.reuters.com/article/2015/02/25/us-gemalto-cyberattack-idUSKBN0LT0MW20150225

40 http://www.cesg.gov.uk/Pages/homepage.aspx

41 https://www.torproject.org

42 Eissa, T., & Cho, G. (2013). Internet Anonymity in Syria, Challenges and Solution. In K. J. Kim & K.-Y. Chung (Eds.), IT Convergence and Security 2012 SE  – 21 (Vol. 215, pp. 177–186). Springer Netherlands. doi:10.1007/978-94-007-5860-5_21

43 http://boingboing.net/2014/05/07/tor-network-security-for-dome.html

44 http://www.apple.com/privacy/government-information-requests/

45 http://www.bbc.co.uk/news/uk-politics-30778424

46 http://www.theguardian.com/technology/2015/jan/13/david-cameron-encrypted-messaging-apps-ban

47 Running a Tor relay, bridge, exit or hidden service (http://www.bsdnow.tv/tutorials/tor)

48 http://www.nytimes.com/1994/06/12/magazine/battle-of-the-clipper-chip.html

49 http://www.usatoday.com/story/news/nation/2013/10/21/fbi-cracks-silk-road/2984921/

50 https://www.gov.uk/government/speeches/building-a-new-international-consensus-on-the-future-of-cyberspace

51 http://www.washingtonpost.com/world/national-security/nsa-gchq-targeted-broad-spectrum-of-foreign-interests-including-allies-aid-agencies/2013/12/20/b44f9314-6992-11e3-8b5b-a77187b716a3_story.html

52 http://cryptome.org/2014/08/nsa-gchq-spy-turkey-der-spiegel-14-0831.pdf

53 http://www.theguardian.com/uk/2013/jun/16/gchq-intercepted-communications-g20-summits

54 http://www.theguardian.com/environment/2014/nov/03/un-investigate-wikileaks-claims-uk-spies-infiltrated-climate-talks

55 http://www.nationaljournal.com/technology/feds-nsa-probably-spies-on-members-of-congress-20140204

56 http://www.washingtonpost.com/blogs/the-switch/wp/2014/01/04/the-nsa-refuses-to-deny-spying-on-members-of-congress/

57 http://www.spiegel.de/international/germany/cover-story-how-nsa-spied-on-merkel-cell-phone-from-berlin-embassy-a-930205.html

58 http://www.spiegel.de/international/europe/eu-officials-furious-at-nsa-spying-in-brussels-and-germany-a-908614.html

59 http://www.theguardian.com/world/2015/jun/23/francois-hollande-emergency-meeting-wikileaks-us-spied-three-presidents-france

60 https://www.gov.uk/government/publications/the-national-security-strategy-a-strong-britain-in-an-age-of-uncertainty

61 http://www.foxnews.com/world/2010/07/25/uk-spy-agency-aids-controversial-targeted-killings/

62 http://www.brickcourt.co.uk/news-attachments/APPG_Final_(2).pdf

63 http://www.brickcourt.co.uk/news/detail/drones-challenge-barred-by-act-of-state-doctrine

64 http://www.hrw.org/news/2014/04/02/joint-statement-support-targeted-lethal-force-transparency-act

65 https://firstlook.org/theintercept/article/2014/02/10/the-nsas-secret-role/

66 http://appgdrones.org.uk/wp-content/uploads/2014/08/Rt-Hon-Philip-Hammond-MP9-FINAL-3.pdf

67 http://www.tom-watson.co.uk/2014/03/drones-report-we-need-an-informed-public-debate/

68 http://www.theguardian.com/politics/2015/sep/10/syria-drone-killings-legal-justification-uk-envoy-un

69 http://www.thetimes.co.uk/tto/news/uk/defence/article4558081.ece

70 http://www.ccdcoe.org/publications/2012proceedings/2_6_Dunn%20Cavelty_TheMilitarisationOfCyberspace.pdf

71 http://www.ft.com/cms/s/0/9ac6ede6-28fd-11e3-ab62-00144feab7de.html

72 http://blogs.oii.ox.ac.uk/policy/should-we-use-old-or-new-rules-to-regulate-warfare-in-the-information-age/

Chapter 10

10 Conclusion

10.1 Introduction

Without the Snowden leaks, this report would not exist. It took a foreign whistleblower to make the both the British public and our parliamentarians aware of the extensive and intrusive nature of surveillance in the UK and around the world. Initially the reporting of these activities was limited to a few media outlets, most notably The Guardian. There was no parliamentary debate, just a single statement after the PRISM revelations. However, two years after the Snowden leaks began, the debate about privacy and surveillance has changed irrevocably.

As part of the Don’t Spy on Us coalition, which launched in 2014, ORG called for a public inquiry into surveillance in the wake of the Snowden revelations. This year, three major inquiries into surveillance legislation and activities have been published by the Intelligence and Security Committee of Parliament, the Independent Reviewer of Terrorism Legislation and the Royal United Services Institute (all of which we have quoted throughout this report).

Although these reviews varied in their recommendations, they all concluded that the law needs wholesale reform – which was also a demand of the DSOU coalition. This autumn, the draft Investigatory Powers Bill will be laid before Parliament. This is an opportunity for Parliament to ensure that the UK has a legal framework that gives the security services and law enforcement agencies the powers they need to combat terrorism and serious crime, while protecting the security, safety and privacy of citizens. As the Independent Reviewer of Terrorism Legislation, David Anderson QC said: “It’s time for a clean slate”.

The DSOU coalition has defined six broad principles for surveillance:

1.No surveillance without suspicion

2.Transparent laws, not secret laws

3.Judicial not political authorisation

4.Effective democratic oversight

5.The right to redress

6.A secure web for all

A surveillance regime based on these principles would both endorse and hold to account the work of the security services, while protecting the democratic processes that they are here to uphold. In the next chapter, our recommendations are outlined in full, Below is a summary of the issues that must be addressed if the UK is to have a surveillance regime that is fit for purpose.

10.2 Defining mass surveillance

The UK Government has consistently denied that the activities of the security services amount to mass surveillance. ORG’s definition of mass surveillance includes the acquisition and retention of personal communications data for surveillance purposes, and the processing and analysing of that data, especially to produce profiling and assessments of individuals. We accept that there is a need to “look” at data flows in order to retrieve specifics, rwhere there is suspicion of wrongdoing but this cannot extend to the mass aquisition of data for further analysis.

We do not accept that retention, collection and machine assessment are irrelevant unless the information is presented to a person. Rather, collection and retention both present a real threat to individuals. We contend that the intrusion and analysis machines are capable of achieving, presents a far greater threat than human analysis alone.

ORG believes that human rights courts should settle questions of how to see and understand intrusion. It is important that the judgments of the legal challenges outline in Chapter Seven are respected. If the UK Government tries to minimise the impact of these judgments, it would foster further mistrust, undermine the rule of law and risk future problems by failing to adequately restrain the security agencies.

10.3 Laws that cannot be exploited

The draft Investigatory Powers Bill is expected to replace the various laws that currently regulate surveillance activities, as outlined in Chapter Seven. This is welcome but the new law should be more than the consolidation of existing legislation. It must ensure that all aspects of surveillance – access, collection, technical processing, analysis and invasive activities – are properly regulated. Changes brought about by technological advances must also be recognised, in particular, ensuring that content and communications data are afforded an equal level of protection.

During the debates surrounding RIPA in 1999-2000, the Foundation for Information Policy Research (FiPR) made it plain to Parliament that bulk collection could not be prevented in law, and the warranty system for overseas information acquisition could indeed be abused to enable it. We now know that this was the case. Our politicians must ensure that our laws are sufficiently defined to ensure that they cannot be exploited.

10.4 Effective oversight

In the UK, public trust has been undermined by the sense that only whistleblowers have told the public – and to an extent MPs – the truth about agency programs and powers.

In a democracy, the mechanisms for oversight need to be independent, and capable of understanding, explaining and restraining the activities and capabilities of the agencies. Public trust can be built by greater transparency, and evidence that the agencies will be held accountable if they overstep the mark. Current structures for overseeing the security services are not designed to ensure that the agencies are truly democratically accountable. Instead, the agencies report to the executive of the day, with some limited oversight by handpicked Parliamentarians.

Within each type of oversight institution – the executive, judiciary, Parliamentary committees and commissioners – there must be a thorough technical understanding of surveillance technologies.

The Executive committees and commissioners must also have a thorough understanding of the risk models that GCHQ uses and must be able to explain this to the public. A risk model comprises the understanding of threats, the mitigations, and the adverse consequences of the mitigations. As such it is the basis for basis of the justifications for decisions and requests that GCHQ makes. We need to know that the risk model takes account of external factors, and how these are balanced.

Oversight bodies must also have a thorough understanding of the cost benefit calculations that are related to this model. Equally the oversight bodies should evaluate decisions and requests against cost-benefit analyses to assure themselves that the best use of public money is being made. GCHQ consumes the lion’s share of the intelligence budget, so it is remarkable that there is little discussion by the ISC about the spending choices and prioritisations that are being made. Such an absence of discussion of why money is being spent and with what concrete results, good or bad, could not be tolderated in relation of health or defence spending, for example.

Finally, the oversight institutions need to show their ability to constrain the services by discussing their powers and abilities in public, and explaining when and how they have called and delivered restraints.

10.5 Transparency

The secrecy currently surrounding national security and surveillance makes it impossible to provide proper public accountability for the services’ effectiveness, and their actions towards the population. There must be more transparency about the agencies’ capabilities such as we have seen in the US, where it has been accepted that capabilities must be publicly disclosed and discussed. In the same way that there are discussion of Trident from party leaders, press and the public, the public should be allowed to consider the implications of mass surveillance.

10.6 The challenge to Parliament

Snowden showed that data aquisition, analytics and a proliferation of invasive techniques have developed without any democratic discussion. It should not be down to a US whistleblower to inform our democratically elected politicians of what powers and capabilities our security services have assumed. This alone should worry Parliament, and should make MPs keen to ensure such mistakes are not repeated.

There are genuine problems that GCHQ and our police have to face, which everyone in this debate wants them to be capable of dealing with. This however does not mean that any and every power is justified.

We have traditionally drawn a distinction between people who are suspected, and those who are not, assuming that surveillane can and should be applied to suspects, while others have a right to their privacy. The current powers and new proposals reverse this position, to a state where everyone’s information should be kept, in case future suspicion arises. While that has a certain remorseless logic, it provides no sense of how to draw a line between surveillance powers that ought to be granted, and those that should not. “Necessary and proportionate” becomes “useful and works”. In an age of increasing creation of data, the result can only be a proliferation of surveillance, as every data point created ought to be kept in case it becomes relevant in the future.

The challenge is in fact to prevent our society becoming a surveillance society merely because our devices create such detailed pictures of our lives. This requires a change in our laws, but also in the style of work in our agencies. They must not treat the population as suspects; but they must be granted properly supervised, independently authorised powers of surveillance against those who mean us harm.

11 Recommendations

11.1 Bulk collection

The bulk collection of communications data without targeted suspicion is mass surveillance. The bulk collection of global communications data should end. Surveillance should be targeted, necessary and proportionate.

11.2 Regulation of GCHQ’s activities

CESG is the UK’s National Technical Authority for Information Assurance (IA), which is responsible for ensuring that information systems used in the public sector are properly secured. This is inconsistent with GCHQ’s activities that exploit Internet vulnerabilities. The responsibility for the CESG should be removed from GCHQ and held by an independent organisation.

Each stage of surveillance – access, collection, technical processing, analysis and invasive activities – should be properly regulated. Access to core communications infrastructure – cables, satellites, internet exchanges – should be subjected to more transparency and oversight separately from specific data collection activities.

A completely new system for authorising invasive activities – with much greater levels of transparency and oversight – is required as part of an overhaul of the regulation of technical processes within surveillance.

There should be clear regulations to protect civilians and businesses from the risks posed by GCHQ’s offensive activities.

The vast amounts of information collected, the increasing use of automated systems create risks around the ability of government to control the outputs of intelligence. We need greater assurances that controls on dissemination work today with the myriad security agencies sharing data as part of the global US-led coalition. After all Snowden himself was able to access highly sensitive materials.

11.3 Legal reform

RIPA and DRIPA must be repealed and replaced by new comprehensive surveillance legislation that complies with human rights law.

This legislation should:

Give communications data the same protection as the content of communications;

Ensure data retention by communications service providers is targeted and specific;

Close down loopholes, such as the inadequate criteria used to define ‘internal’ and ‘external’ communications;

End ad-hoc warrants that allow collection of Bulk Personal Datasets. These should be brought into a single simplified regime of much narrower authorisations with clear expiry dates;

Review the distinction between foreign and domestic communications. The UK must respect the human rights of non-British citizens.

The use of publicly available data should be more tightly regulated. Intelligence agencies can paint an intimate picture of our lives simply from our public online activities without any targeting. Researchers have confirmed that simply clicking endorsements in social media reveals likely political opinions, sexual preferences, lifestyle preferences, social circles, personal habits and patterns of behaviour. Many of these attributes are considered sensitive data that can lead to discrimination under UK data protection law and must be treated with special caution.

The personal information of persons in British soil processed by the NSA needs stronger protections. There is no formal legal basis for these data sharing operations, and any safeguards are based on secret agreements among agencies that do not provide sufficient guarantees around this human rights intrusion. Conversely, the use of US data, including PRISM, needs formal protections. Right now GCHQ voluntarily applies the same safeguards as for intercepted materials, but this does not provide the legal certainty required to be compatible with human rights laws.

11.4 Judicial authorisation of warrants

All surveillance decisions (including the interception of communications, access to communications data and receipt of intelligence from foreign agencies) must be subject to prior judicial authorisation and ongoing judicial control, instead of authorisation by Government Ministers. This authorisation should be by serving judges.

11.5 Oversight

The offices of the Intelligence Services Commissioner and the Interception of Communications Commissioner should be reformed so that they are truly independent, reporting to Parliament not the Executive. They need adequate resources to scrutinise more warrants, carry out searching investigations and publish key statistics. They should remain focused on oversight and not authorisations, which should fall on the judiciary broadly.

The ISC must be fully reformed. The committee should be answerable directly to Parliament rather than to the prime minister and take its own decisions on reporting and publication. The committee must be appropriately funded and staffed with independent experts able to undertake detailed forensic investigations, and an independent secretariat, including independent legal and technical advisors. The committee should have strengthened legal powers to compel the production of information and the attendance of witnesses. The chair of the committee should be a member of the largest opposition party and the Commons members of the committee should be elected.

The Investigatory Powers Tribunal should adopt a more fair and open procedure. This should include:

public hearings, unless the government demonstrates that secrecy is required in the particular case;

the disclosure of evidence and publication of judgments and reasons published, unless the government demonstrates that secrecy is necessary;

the appointment of a special advocate if a closed hearing is required; and the ability to appeal decisions.

Parliament must ask what exact mechanisms are available for the overseeing of access to data by US security services in the many available channels. For example, security sources have stated that when UK systems identify sensitive data of interest for further investigation, this is noted and passed on to the intercept commissioner. Parliament must ensure that this is also the case with US operatives.

11.6 Transparency

There needs to be greater transparency about how the agencies operate, including:

agreements between communications companies and the government that allow the tapping of fibre-optic cables to collect data;

the computer processing of bulk collected data;

how foreign security services access UK citizens’ data;

the cyber warfare capabilities of GCHQ and the basic rules of engagement for cyber operations.

11.7 Internet security

The Government should cease breaking encryption standards and undermining internet security. Such activity should be explicitly prohibited by legislation.