UK hacking powers can be challenged in court, judge rules

UK spies are no longer allowed to skip court if their choices are considered unlawful.
Written by Charlie Osborne, Contributing Writer

A five-year court battle in the United Kingdom has come to an end with the UK Supreme Court ruling that the UK's spy agencies and their hacking activities can be made subject to court challenges.

On Wednesday, the court ruled that the GCHQ's Investigatory Powers Tribunal (IPT) is subject to judicial review in the High Court, which in turn means that the intelligence tribunal's decisions can be exposed, and challenged, based on the law of the land.

The IPT is a closed-door and secretive tribunal involved in making decisions relating to the security activities and surveillance performed by UK intelligence and spy agencies, including the GCHQ, MI5, and MI6.

The case in question is based on the GCHQ's powers to hack thousands or millions of devices in the quest for intelligence, previously challenged on the basis of human rights.

Privacy International launched a legal case in 2014 questioning these powers. A subsequent ruling in 2016 by the IPT determined that the UK government held the right to launch sweeping "thematic" warrants which validated the hacking of devices en masse in the UK and abroad.

The government argued that a single warrant signed by a minister -- and not a UK judge -- was enough to do so. Such rights were not considered subject to legal challenge due to provisions made in the 2000 Regulation of Investigatory Powers Act (RIPA).

The so-called "ouster clause," based on a court case in 1968 was also raised as a means of protection against such activities being "called in question in any court of law."

See also: San Francisco bans police from using facial recognition tech on residents

Privacy International, alongside Liberty, challenged the case but lost in the High Court, leading to another defeat in an appeals court in 2017. However, after the matter reached the UK Supreme Court, the decision was overturned, news which has been welcomed by privacy advocates.

In the ruling (.PDF), Lord Carnwath, who delivered the judgment, said:

"The legal issue decided by the IPT is not only one of general public importance, but also has possible implications for legal rights and remedies going beyond the scope of the IPT's remit. Consistent application of the rule of law requires such an issue to be susceptible in appropriate cases to review by ordinary courts."

Privacy International called the decision "a historic victory for the rule of law."

TechRepublic: How to create a business-driven cybersecurity strategy: 3 tips

"Today's ruling paves the way for Privacy International's challenge to the UK government's use of bulk computer hacking warrants," said Caroline Wilson Palow, Privacy International's General Counsel. "Our challenge has been delayed for years by the government's persistent attempt to protect the IPT's decisions from scrutiny. We are heartened that our case will now go forward."

CNET: How to check your Android phone for malicious apps

However, not every party is jubilant at the news. Speaking to The Guardian, head of the Judicial Power Project at the Policy Exchange Professor Richard Ekins believes the ruling "violated the sovereignty of parliament."

"Parliament chose to limit judicial review by creating a specialist tribunal to consider complaints against the intelligence services," Ekins said. "It is not the supreme court's place to unravel this choice by way of implausible and unreasonable statutory interpretation."

How to discover and destroy spyware on your smartphone (in pictures)

Previous and related coverage

Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0

Editorial standards