Twenty-two months after the publication of the first stories based on documents leaked by NSA whistleblower Edward Snowden, the UK’s intelligence and security committee (ISC) has acknowledged what the general public already knew: GCHQ and its allies engage in bulk collection of large quantities of online data.

UK surveillance laws need total overhaul, says landmark report Read more

The committee also judged that the UK’s laws authorising surveillance are outdated and should be reformed in the next parliament.



In the course of their 149-page report, the committee came to a variety of conclusions about what is and isn’t surveillance, what is intrusive, and what agencies should look at. We’ve examined four of them below, and set out what it means for your emails, calls records – and browser history.

Bulk collection or mass surveillance?

However, they say this only becomes surveillance when it is read by a human, and as most of the material GCHQ collects is never looked at by its staff, this cannot be said to be mass surveillance.



It’s an elegant argument, but far from indisputable. The ISC report notes on several occasions that GCHQ stores only a small percentage of what it intercepts (the exact figure is redacted).

This is true, but means less than the committee suggests: GCHQ’s internal documents discuss the fact that a huge portion of traffic it intercepts is peer-to-peer file sharing, and video streaming. These large files are of no value to the agency, and so are filtered out of its intercepts. That means the agency could be storing every bit of (say) email traffic that crosses its sensors, but still say it is not retaining the vast majority of what it intercepts.

More broadly, the question of whether collection is not intrusive if the content isn’t read is an open one: the simple fact of your communications or internet activity being stored gives the potential for it to be accessed, deliberately or accidentally, properly or not (some intelligence staff have lost their jobs for improperly accessing personal data, the report reveals).



There is also the matter of algorithmic searching: do you object to a government computer reading your email less than to a government worker doing the same?

Content versus metadata

The ISC takes an interesting stance on the issue of metadata (which it refers to as “communications data”), the term for the “envelope” of a communication. For a phonecall, for example, this means the sending and receiving phone number, the time and duration of the call, and the location of the people on the call.

Far more metadata is stored than content, and the call records of UK citizens can be accessed without individual warrants. The ISC accepts that this information is less intrusive than the contents of the call, and therefore needs fewer safeguards to collect.

It’s worth taking a look at your call history on your phone, then looking at your inbox and the frequency of your mails to regular correspondents, or your SMS inbox for the same, and deciding whether that’s true: for many of us, who we communicate with and how often is just as private as the contents of those communications.



The ISC does, however, push back a little against agency definitions of metadata, which in the internet era has blurred with content: in certain circumstances, your exact location, internet history, or even passwords can be classed as metadata.

The committee acknowledges this type of data has the “potential to reveal a great deal about a person’s private life”, and as such should have additional safeguards versus regular metadata.

This is a stark contrast to the views of the intelligence agency bosses. The report contains the following quote from Andrew Parker, the director-general of MI5:

“The suggestion that, by knowing which websites people have visited, that that is some substantial step up in intrusion, is not one I accept. Life is different these days.”

Sadly, the ISC report does not suggest whether Parker offered up his own internet history for public consumption.

‘Internal’ versus ‘external’ communications





A significant quirk in UK surveillance law centres around “internal” versus “external” communication, referring to whether a communication is within the UK, or involves a foreign country.

This used to be quite a simple distinction: if I phone a colleague on the next desk over, that’s an internal communication. If I call our US office, that’s external.



But in the internet era, such rules get far more complicated: if I email my colleague on the next desk, that travels to an overseas mail server. How about if I visit a website hosted overseas?



What about a Facebook post shared with my UK circle of friends? All are classed as external communications, rendering the distinction between external and internal messaging, in the ISC’s own words, “meaningless”. Indeed, so complex is the distinction that even the foreign secretary – who is responsible for signing off on the surveillance warrants – doesn’t understand it.

The trouble is the report then gets too reassuring: it states that UK individuals cannot be searched for without an individual warrant signed by a minister, but does not preclude UK individuals having their communications read without such a warrant.

For example, if I have an email discussion with someone in France and it is collected by GCHQ, the agency could not search for “James Ball” to read the exchange. But the rules do not bar it from finding the exact same email thread through a search for my overseas correspondent.



Additionally, even the rule that UK details can’t be searched for is not universally true. Provided the analyst is searching for metadata, not content, analysts have in the past received permission to search for UK phone numbers in their databases.

‘Bulk personal datasets’

One of the most tantalising issues raised by the ISC report is the little-discussed practice of intelligence agencies getting hold of personal data by means other than interception or warrants.

The ISC report discusses agencies’ use of “bulk personal datasets”, which it describes as “large databases containing personal information about a wide range of people”. The report than redacts the types of information such databases may contain, and how many each agency uses, and even what they may search for in them. It does, however, say the datasets vary in size, and can be as large as “millions of records”.



The description by one committee member of the datasets as being akin to phone directories gives a hint as to what these datasets are likely to be: information collected by private companies and resold to the government. Such information could potentially cover third-party information from advertisers or marketers, credit ratings information, or information from social networking apps. It could also include information like address history (to see who used to live together) or phone number history.



The connections between individuals contained within such datasets is a valuable tool for the agencies, giving them yet more way to draw connections from the other masses of data they collect.



Such is the way of the internet age: if you can’t get information any other way, you can always buy it – a good lesson to remember next time you’re looking for the tickbox saying whether or not your information can be shared with third parties, buried away in online terms and conditions: how much of it will end up with GCHQ?