It is a rare thing to bring truth to bear on the most powerful and secretive arm of the state. Never before has the Investigatory Powers Tribunal – the British court tasked with reviewing complaints against the security services – ruled against the government. Not once have the spooks been taken to task for overstepping the lawful boundaries of their conduct. Not a single British spy has been held accountable for mass surveillance, unlawful spying or snooping on private emails and phone calls.

Until today.

Privacy International has spent the past 25 years fighting back against the ever-expanding British surveillance state. Together with our allies, we’ve resisted the snooper’s charter (multiple times), mandatory ID cards and the provision of passenger name records. Yet in June 2013 we were as shocked as everyone else to learn that GCHQ, in collaboration with the NSA, had acquired the capabilities to completely control, monitor, copy, read and analyse the world’s private communications.

It was, until that point, unfathomable that the security services could have so audaciously stretched the boundaries of democratic legitimacy – and could have so severely violated the civil liberties and human rights of not only Britons, but of hundreds of millions of innocent people across the globe.

Thanks to Edward Snowden, we learned that GCHQ has access to emails and messages that the NSA siphons off directly and en masse from Google, Skype and Facebook. We discovered that the NSA collects 194m text messages and 5bn location records every day – and GCHQ can read them too. And, of course, we learned that GCHQ is operating a mass surveillance system that, combined with its access to the NSA’s own mass surveillance architecture, means it can read almost anyone’s communications, at any time, without judicial authorisation or any meaningful oversight.

In July 2013, the Intelligence and Security Committee assured us that GCHQ access to NSA surveillance material, in particular through the Prism programme, was entirely lawful. Unsurprisingly, we did not find the reassurances of a body that has consistently and blindly backed the services that it is meant to scrutinise comforting.

That’s why we decided to take GCHQ to court. Alongside Liberty, Amnesty International and human rights organisations from around the world, we argued that mass surveillance is not an acceptable activity of a democratic government, and that the cosy dealings between GCHQ and the NSA, conducted under a veil of secrecy that was only lifted by a whistleblower’s bravery, had to be brought within public control and scrutiny.

The evidence was overwhelming and the history of human rights law was in our favour, but the tribunal – which at that point had never before found that the surveillance activities of GCHQ broke the law – disagreed. Mass surveillance, it found in its decision of December 2014, was legitimate under British law. GCHQ’s access to NSA mass surveillance was also acceptable, it said, given that the government had disclosed details of its relationship with the US during the course of our case.

The decision was a disappointing one, and we’ll soon appeal to the European court of human rights. But it left us with a small glimmer of hope. The tribunal said that it was lawful for GCHQ and the NSA to swap and share surveillance material only because GCHQ has secret internal policies that it reluctantly disclosed in response to Privacy International’s case.

Now that those secret policies are no longer secret, the court reasoned, the British public know what’s going on, and that in itself must make those activities lawful. It must follow, therefore, that before those policies were public – prior to Edward Snowden’s disclosures, and our case in the IPT – GCHQ was acting outside the law.

Complicated reasoning aside, this finding was a genuine – and rare – success. The tribunal agreed, and we today have a firm statement that the intelligence services were acting completely out of bounds. It is not the judgment we would have liked – that we still hope to get from the European court of human rights in Strasbourg later this year – but it is a significant victory against an arm of the state that has rarely been forced to account for its wrongdoings.

It is a vindication of Snowden, and all those who put their careers – and even their lives – on the line to ensure the truth was told. It is a huge encouragement to civil society organisations like Privacy International, which often spend years locked in David and Goliath battles, depleting their funds and their morale to perform the essential role of holding truth to power.

In years to come we will look back on today as an essential victory against the surveillance state. Here at Privacy International, we humbly hope that perhaps we will also look back at this day as a turning of the tide; the day when the seemingly uncontrollable advancement of state intrusion into individuals’ lives was halted, and when internet users reclaimed some of the power in their fight for privacy, security and free expression.

Perhaps today will be the day that the government realises it cannot continue to expand its powers, outlaw encryption, and ban private speech in private places. Perhaps this victory will be the first of many – in the IPT, where Reprieve will soon protest the surveillance of lawyers, in the high court, where David Davis and Tom Watson are challenging blanket data retention laws, and in Strasbourg, where the European court of human rights has the opportunity to end mass surveillance once and for all. Perhaps this will spell the beginning of the end of unlawful, excessive, invasive intrusion into our private lives.