Court finds GCHQ breached citizen's privacy with its bulk surveillance regime

The UK Government Communications Headquarters (GCHQ) used bulk interception to unlawfully breach citizens' privacy and free expression rights, Europe's highest human rights court has ruled.

The ruling is the culmination of three lawsuits that had accused the GCHQ's bulk interception regime of being incompatible with the right for people to have privacy, which arose in 2013 following revelations from Edward Snowden that the GCHQ was running a bulk interception operation to tap into and store huge volumes of data, which included people's private communications.

In addition to wrapping up those three lawsuits, the landmark judgment also marks the first ruling on UK mass surveillance since Snowden's revelations.

Bulk interception is the process of targeting and collecting communications from targeted bearers through simple selectors, such as an email address. Any communications which match the simple selectors are collected from that bulk interception process, with those that do not match the simple selectors being automatically discarded.  

According to the Grand Chamber of the European Court of Human Rights, the bulk interception regime contained "fundamental deficiencies", such as lacking independent authorisation as bulk interception was approved by UK's secretary of state; the GCHQ did not have to include categories of search terms defining what communications they would examine when applying for a search warrant; and search terms linked to an individual did not require prior internal authorisation to be used.

As such, the Grand Chamber found the regime did not contain sufficient "end-to-end" safeguards and was incompatible with the right to privacy.

With the decision, the Grand Chamber has ordered for bulk surveillance in the UK and across Europe to now require independent authorisation from the outset, which checks for adequate end-to-end safeguards, from the initial collection of data to the selection of items for storage.

The court has also ordered for all bulk interception operations to be subject to supervision and independent ex post facto review, as well as assessments at "each stage of the process" of the necessity and proportionality of the measures being taken.

While the court concluded that there was considerable potential for bulk interception, in its current form, to be abused, it disagreed with the applicants' claim that bulk interception should be banned altogether. Instead, it accepted the UK's government's claim that bulk interception is of vital importance in helping states for identifying threats to national security, a claim that was backed by the French, Dutch, and Norwegian governments in third party submissions.

In a dissenting opinion, Judge Pinto de Alburquerque said non-targeted bulk interception should be scrapped as it could target anyone as a potential suspect.

"Admitting non-targeted bulk interception involves a fundamental change in how we view crime prevention and investigation and intelligence gathering in Europe, from targeting a suspect who can be identified to treating everyone as a potential suspect, whose data must be stored, analysed, and profiled," he said.

"A society built upon such foundations is more akin to a police state than to a democratic society. This would be the opposite of what the founding fathers wanted for Europe when they signed the Convention in 1950."

Big Brother Watch director Silkie Carlo said the judgment confirmed that the UK has been mass spying citizens for decades and vindicated Snowden's whistleblowing. 

"Mass surveillance damages democracies under the cloak of defending them, and we welcome the Court's acknowledgement of this. As one judge put it, we are at great risk of living in an electronic 'Big Brother' in Europe,"  he said.

Liberty lawyer, Megan Goulding, who represented the applicants of the lawsuit, called the judgment a victory as it recognises that governments have to respect the right to privacy and freedom of expression.

"Bulk surveillance powers allow the State to collect data that can reveal a huge amount about any one of us -- from our political views to our sexual orientation. These mass surveillance powers do not make us safer," Goulding said.

"Our right to privacy protects all of us. Today's decision takes us another step closer to scrapping these dangerous, oppressive surveillance powers, and ensuring our rights are protected."

Related Coverage

• Ransomware is growing at an alarming rate, warns GCHQ chief
• Ransomware is now a national security risk. This group thinks it knows how to defeat it
  
• China could 'control the global operating system' of tech, warns UK spy chief
  
• The winged ninja cyber monkeys narrative is absolutely wrong: Former NCSC chief
  
• Smart cities are a tempting target for cyberattacks, so it's time to secure them now
  
• What is ransomware? Everything you need to know about one of the biggest menaces on the web