GCHQ staff, intelligence officers and police have been given immunity from prosecution for hacking into computers, laptops and mobile phones under legislative changes that were never fully debated by parliament, a tribunal has been told.

The unnoticed rewriting of a key clause of the Computer Misuse Act has exempted law enforcement officials from the prohibition on breaking into other people’s laptops, databases, mobile phones or digital systems. It came into force in May.

The amended clause 10, entitled somewhat misleadingly “Savings”, is designed to prevent officers from committing a crime when they remotely access computers of suspected criminals. It is not known what category of offences are covered.



The act is primarily deployed to provide legal cover for domestic investigations. It is thought that individual warrants are not being obtained to justify each inquiry. Different legislation – section 7 of the Intelligence Services Act, nicknamed the “James Bond clause” – is believed to permit activities abroad that would otherwise be illegal.



Addressing the Investigatory Powers Tribunal, which deals with complaints about the intelligence services and surveillance, lawyers for Privacy International said they had only been informed of the alteration earlier this week.

The effect of this amendment has passed everyone by … It was hidden in plain sight. Ben Jaffey, Privacy International

“We had previously thought [hacking] in this country to be unlawful,” said Ben Jaffey, a lawyer representing Privacy International. “The effect of this amendment has passed everyone by. Attention was not called to it during the parliamentary process, which may not have been accidental. It was hidden in plain sight.”

Hacking is more damaging than mere interception of messages, Jaffey told the tribunal, because it involves unlocking a backdoor into someone else’s computer system which was meant to be secure. It is not clear whether the damage done is always made good following a hacking attack.

Hacking into someone’s computer appears to take place under a general class permission for such activity, Jaffey said. “There’s something profoundly objectionable in bugging and burglary of computers without any [individual] authoritisation from the secretary of state,” he told the IPT.

Changes to the Computer Misuse Act were introduced by the Serious Crime Act 2015 which received royal assent on 3 March 2015. No reference to the true impact of the changes was made in the parliamentary explanatory notes that accompanied the bill, according to Privacy International.

Nor was there any public debate, the organisation claimed. “No NGOs, regulators, RIPA commissioners, the Information Commissioners Office, industry, or the public were notified or consulted about the proposed legislative changes,” it added.

“The underhand and undemocratic manner in which the government is seeking to make lawful GCHQ’s hacking operations is disgraceful,” Eric King, the organisation’s deputy director said after the hearing. “Hacking is one of the most intrusive surveillance capabilities available to any intelligence agency, and its use and safeguards surrounding it should be the subject of proper debate.

“Instead, the government is continuing to neither confirm nor deny the existence of a capability it is clear they have, while changing the law under the radar, without proper parliamentary debate.”

Professor Peter Sommer, one of the UK’s leading experts in the Computer Misuse Act, said he had also only belatedly discovered the changes to the legislation. Altering the law without proper public debate, he said, risked “building up unnecessary mistrust”.

“I wasn’t aware of it until recently,” he said. The previous clause dated from a time when police officers physically seized computers and examined them in a police station.

“Now if you have remote access,” he said, “you can hack into a computer and put in a Trojan horse program. I have looked at the government notes covering the changes and it was extremely obscure guidance. But they are giving highly intrusive powers to go into someone else’s computer.

“If this had been done properly, people would have said we want a principled debate about this. There’s a danger now that [lawyers] will say that the police or spooks have put things into their clients’ computers.”



In February, the Home Office did publish a “draft equipment interference code of practice” which explained how law enforcement officials could track down serious criminals and terrorists by hacking into their computers.

It did not, however, at that stage explain that the Computer Misuse Act was being altered.

Last May, Privacy International, along with seven internet and communications service providers, filed complaints with the IPT challenging GCHQ’s hacking activities. The full complaint is due to be heard in the autumn.

The claim asserts that GCHQ’s actions were both unlawful under the Computer Misuse Act, which criminalises hacking, and that there was not sufficiently detailed legal authority to make GCHQ’s hacking “in accordance with law” as required by Article 8 of the European Convention on Human Rights.

The removal of criminal liability for enforcement officers also, it is alleged, opens the way for the intelligence agencies to conduct cyber-attacks within the UK.

In a separate development, the Home Office has published guidance on the acquisition of communications data relating to privileged information held by lawyers, journalists, doctors and others.



A Home Office spokesperson said: “There have been no changes made to the Computer Misuse Act 1990 by the Serious Crime Act 2015 that increase or expand the ability of the intelligence agencies to carry out lawful cyber crime investigation. It would be inappropriate to comment further while proceedings are ongoing.”