U.K. Court Says NSA-GCHQ Data-Sharing Was Illegal

A U.K. court has for the first time ruled that intelligence sharing activities between the NSA and the equivalent government intelligence agency in the U.K., GCHQ, were unlawful in the past on the grounds that they breached European human rights law.
The court case was heard by the U.K.’s Investigatory Powers Tribunal (IPT), the judicial oversight body which handles complaints relating to domestic intelligence agencies. The complainants were four pro-privacy and civil liberties groups: Privacy International, Liberty, Amnesty International and Bytes for All.
The data sharing in the frame refers to the NSA’s Prism (where it collects data direct from U.S. Internet companies) and Upstream (where it taps directly into Internet cables to gather data) programs, and to the U.K.’s use of RIPA (Regulation of Investigatory Powers Act) warrants to tap into U.S.-gathered signals intelligence. The existence of the NSA programs was revealed by documents released into the public domain by whistleblower Edward Snowden, back in 2013.
In a press release following today’s IPT judgement Privacy International notes it is the first time the court has ruled against the intelligence and security services in its 15 year history.
However, in a twist that can only be described as Kafka-esque, the IPT still deems U.S.-U.K. dragnet surveillance data-sharing activities to be legal now — and since December 2014, when it ruled in another judgement that GCHQ access to NSA data-gathering was legal from then on — on the grounds that the disclosure of the data-sharing programs (which, let us not forget, only came to light as a result of Snowden’s whistleblowing) has allowed for “adequate signposting” of the secret policies governing how data flows between international spy agencies, and for “adequate arrangements” to ensure legal compliance.
Some of these secret governance policy disclosures were made to the court in an earlier case brought to the IPT by Privacy International et al. But as The Guardian notes, some of the most sensitive evidence about interceptions was heard in private court sessions — which excluded the rights groups, and prevented wider public scrutiny. But that’s judicial oversight, in the IPT’s eyes — hence its finding of “adequate arrangements”.
The IPT’s judgement notes:

…prior to the disclosures made and referred to in the Tribunal’s Judgment of 5 December 2014, the regime governing the soliciting, receiving, storing and transmitting by UK authorities of private communications of individuals located in the UK, which have been obtained by US
authorities pursuant to Prism and/or (on the Claimants’ case) Upstream, contravened
Articles 8 or 10 ECHR [European Convention on Human Rights], but now complies.
…
(i) Having considered the arrangements below the waterline, as
described in this judgment, we are satisfied that there are
adequate arrangements in place for the purpose of ensuring
compliance with the statutory framework and with Articles 8
and 10 of the Convention, so far as the receipt of intercept from
Prism and/or Upstream is concerned.
(ii)This is of course of itself not sufficient, because the
arrangements must be sufficiently accessible to the public. We
are satisfied that they are sufficiently signposted by virtue of
the statutory framework to which we have referred and the
Statements of the ISC and the [Interception of
Communications] Commissioner quoted above, and as now,
after the two closed hearings that we have held, publicly
disclosed by the Respondents and recorded in this judgment.”

Commenting on the judgement, Privacy International takes issue with the court’s conclusion that a “forced disclosure” of a “limited subset of rules” is enough to make GCHQ’s surveillance activities lawful since last December.

And says it will be challenging the IPT’s ruling by appealing to the European Court of Human Rights, along with Bytes for All.
The pair note:

While we welcome today’s decision, Privacy International and Bytes for All disagree with the tribunal’s earlier conclusion that the forced disclosure of a limited subset of rules governing intelligence-sharing and mass surveillance is sufficient to make GCHQ’s activities lawful as of December 2014. Both organisations will shortly lodge an application with the European Court of Human Rights challenging the tribunal’s December 2014 decision.
While that appeal is pending, GCHQ will retain unfettered access to this material intercepted by the NSA. The two agencies by default share intelligence gleaned from PRISM and UPSTREAM, sometimes with few or no safeguards. Secret policies divulged during Privacy International’s case revealed that British intelligence services can request or receive access to bulk data from foreign agencies like the NSA without a warrant whenever it would “not be technically feasible” for the government to obtain it themselves.

Commenting further in a statement, Eric King, deputy director of Privacy International, adds: “For far too long, intelligence agencies like GCHQ and NSA have acted like they are above the law. Today’s decision confirms to the public what many have said all along — over the past decade, GCHQ and the NSA have been engaged in an illegal mass surveillance sharing program that has affected millions of people around the world.
“We must not allow agencies to continue justifying mass surveillance programs using secret interpretations of secret laws. The world owes Edward Snowden a great debt for blowing the whistle, and today’s decision is a vindication of his actions.
“But more work needs to be done. The only reason why the NSA-GCHQ sharing relationship is still legal today is because of a last-minute clean-up effort by Government to release previously secret “arrangements”. That is plainly not enough to fix what remains a massive loophole in the law, and we hope that the European Court decides to rule in favour of privacy rather than unchecked State power.”
In another statement, James Welch, legal director for Liberty, says: “We now know that, by keeping the public in the dark about their secret dealings with the National Security Agency, GCHQ acted unlawfully and violated our rights. That their activities are now deemed lawful is thanks only to the degree of disclosure Liberty and the other claimants were able to force from our secrecy-obsessed Government.
“But the Intelligence Services retain a largely unfettered power to rifle through millions of people’s private communications – and the Tribunal believes the limited safeguards revealed during last year’s legal proceedings are an adequate protection of our privacy. We disagree, and will be taking our fight to the European Court of Human Rights.”
The IPT judgement can be read here.