When Edward Snowden was thrust into the limelight just under two years ago, even the most cynical and paranoid were probably surprised by the all-encompassing nature of the NSA's global Internet surveillance he revealed. What he told us about the UK's activities in this area was particularly shocking: "It's not just a US problem. The UK has a huge dog in this fight," Snowden told The Guardian. "They [the UK's spy agency Government Communications Headquarters, GCHQ] are worse than the US."

Indeed, the more we learned about the UK government's online surveillance capabilities, the more disturbing it became. According to Snowden, as reported by The Guardian, a secret operation codenamed "Tempora" allowed GCHQ and the NSA to capture and analyse "recordings of phone calls, the content of email messages, entries on Facebook and the history of any internet user's access to websites—all of which is deemed legal, even though the warrant system was supposed to limit interception to a specified range of targets."

In the face of these detailed revelations about the way in which most of our online activities are monitored, analysed and stored, the UK government has refused to comment, providing only one standard response, repeated ad nauseam: "Our work is carried out in accordance with a strict legal and policy framework which ensures that our activities are authorised, necessary and proportionate, and that there is rigorous oversight, including from the secretary of state, the Interception and Intelligence Services Commissioners and the Intelligence and Security Committee."

Faced with this stonewalling, it might have seemed a hopeless task to obtain any information from the UK government about how it was spying on the public's online activities, let alone an admission that some of its actions were illegal. And yet over the last 24 months, a number of small but determined civil liberties organisations have brought multiple legal challenges to the UK's surveillance programmes. Remarkably, those moves have forced the UK government to provide hitherto unsuspected details about its digital spying and even acknowledgements that it had broken the law.

Taking up the challenge

The first challenge was made in July 2013, by three UK groups—Big Brother Watch, the Open Rights Group, and English PEN—together with the German internet activist Constanze Kurz. It was prompted by one of the earliest and most important Snowden leaks published by The Guardian on 7 June, 2013: "The NSA access is part of a previously undisclosed program called Prism, which allows officials to collect material including search history, the content of emails, file transfers and live chats, the document says."

Prism remains one of the most controversial revelations from Snowden. The documents he gave to The Guardian seem to indicate that key US companies, including Microsoft, Yahoo, Google, Facebook and Apple, have been complicit in providing direct access to their customers' data—something the companies have denied.

Soon after NSA's Prism and GCHQ's Tempora programmes were first revealed, the civil rights activists announced that they would be bringing a judicial challenge, alleging that the UK's spy agency had acted illegally. As a blog post on their site "Privacy not Prism", set up on October 2013, explains, "the [UK] Government said an action in the English Courts was barred and that the groups should complain to the Investigatory Powers Tribunal [IPT], the secretive body that hears complaints about the intelligence agencies and from which there is no appeal to the courts."

However, the IPT is unsatisfactory because "proceedings before the tribunal would not permit the public examination of these important issues, nor are they capable of providing the remedy the applicants seek: a new legislative framework respectful of British and European citizens’ privacy rights."

Despite this fact, another group of NGOs—including Privacy International, Liberty, Amnesty International, the American Civil Liberties Union—filed challenges with the IPT later in July 2013, concerning both GCHQ's Tempora system and its access to data from the NSA's Prism programme.

The legal trick

The UK government's main witness before the IPT was Charles Farr, the Director General of the Office for Security and Counter Terrorism. In May 2014, he made a long and unprecedented statement about surveillance activities in the UK (PDF). Farr prefaced his remarks with the following comment: "I... neither confirm nor deny that either the Security Service [MI5] or the SIS [MI6] has obtained, from the US Government, information that has been obtained under the Prism programme." He also refers throughout to the "alleged Tempora operation," a rather absurd thing to say in the light of the extremely detailed information provided by Snowden's leaks. Despite this, Farr's statement is important. Privacy International explains why:

Farr’s statement, published today by the rights organisations, is the first time the Government has openly commented on how it thinks it can use the UK’s vague surveillance legal framework to indiscriminately intercept communications through its mass interception programme, TEMPORA. The secret policy outlined by Farr defines almost all communications via Facebook and other social networking sites, as well as webmail services Hotmail and Yahoo and web searches via Google, to be ‘external communications’ because they use web-based ‘platforms’ based in the US. The distinction between ‘internal’ and ‘external’ communications is crucial. Under the Regulation of Investigatory Powers Act (‘RIPA’), which regulates the surveillance powers of public bodies, ‘internal’ communications may only be intercepted under a warrant which relates to a specific individual or address. These warrants should only be granted where there is some suspicion of unlawful activity. However, an individual’s ‘external communications’ may be intercepted indiscriminately, even where there are no grounds to suspect any wrongdoing. By defining the use of ‘platforms’ such as Facebook, Twitter and Google as ‘external communications’, British residents are being deprived of the essential safeguards that would otherwise be applied to their communications - simply because they are using services that are based outside the UK.

Farr's statement therefore revealed the crucial legal trick that GCHQ uses to spy on British residents: it simply defines their communications with all the main Internet services as "external," and therefore not covered by the usual privacy protections. It also exposes RIPA's failure to keep up with technological changes—the legislation dates back well before the Internet had become a mass medium—as one of the key reasons why UK surveillance is not subject to meaningful oversight.

Unexpected admission

In October 2014, the IPT hearings produced another unexpected admission from the UK government. As Privacy International reported: "Details of previously unknown internal policies, which GCHQ was forced to reveal during legal proceedings challenging their surveillance practices in the wake of the Snowden revelations, reveal that intelligence agencies can gain access to bulk data collected from US cables or through US corporate partnerships without having to obtain a warrant from the Secretary of State." The safeguards on how this material can be used are minimal: "On the face of the descriptions provided to the claimants, the British intelligence agencies can trawl through foreign intelligence material without meaningful restrictions and can keep such material, which includes both communications content and metadata, for up to two years."

In December 2014, the IPT ruled against the Privacy International group of human rights organisations, and "accepted the security services’ position that they may in principle carry out mass surveillance of all fibre optic cables entering or leaving the UK and that vast intelligence sharing with the NSA does not contravene the right to privacy because of the existence of secret policies."

Fortunately, in October 2013 the original group of NGOs had launched its own legal challenge at the European Court of Human Rights (ECHR) in Strasbourg, which "rules on individual or State applications alleging violations of the civil and political rights set out in the European Convention on Human Rights." Their argument was that unchecked surveillance of the kind being conducted by GCHQ was a breach of the Right to Privacy under Article 8 of the European Convention on Human Rights, not least because some of this information was shared with the NSA and others. "It is equivalent to having all the letters passing through the UK intercepted, stored, copied and capable of being read by a potentially unlimited number of intelligence agencies around the world, where this is regarded as being in the "interests of national security.'"

Any interference with the right to privacy must be proportionate and in accordance with adequate and published legal standards, and the claimants believed that the law and practice in the UK failed to meet these requirements. The remedy they requested was nothing less than new laws to govern surveillance in the UK:

The Applicants ask the Court to order the UK to adopt internet surveillance practices that recognise our rights to privacy. This means new laws that require surveillance to be proportionate; to be overseen by judicial authorities acting in public; that permit notification of persons affected by surveillance (even if after the fact); that are overseen by adequately resourced and empowered regulators. In short, a legal regime that recognises the Principles on the Application of Human Rights to Communications Surveillance.

In April 2014, the ECHR informed the civil liberties groups that the challenge was being put on hold. This was the result of the UK government asking the court to dismiss the case completely: "The UK Government asked the court to reject our application and reverse its decision to communicate the case on admissibility and merits in light of these complaints, but the court has not adopted this course." Instead, the ECHR agreed to wait until the IPT had given its judgment in the case brought by Privacy International and others, discussed above.

When that ruling was handed down in December 2014, the ECHR completed its preliminary examination of the case and sent a formal notice to the UK government, asking it to explain how GCHQ's actions complied with Article 8 of the European Convention on Human Rights. Significantly, the court also gave the case a rare "priority" designation, an indication perhaps of the important issues it raised.

Listing image by GCHQ/Crown Copyright