Privacy Rights Group Files Legal Challenge To GCHQ's Extensive Hacking Activities

from the one-of-the-better-uses-of-normally-useless-anti-hacking-laws dept

Indispensable organization Privacy International has filed a legal challenge against GCHQ’s hacking of computers and devices, seeking to use the UK government’s own Computer Misuse Act against its national security agency.

Much like the (frequently maligned) CFAA (Computer Fraud and Abuse Act) here in the US, the CMA prohibits unauthorized access of computers as well as knowingly impairing computers and devices with malicious software. Privacy International argues that GCHQ (in conjunction with the NSA in many cases) has done both — multiple times.

The extent of GCHQ’s capabilities was revealed by the Snowden documents, which detail how GCHQ and NSA are using malware to conduct surveillance that is potentially far more intrusive than any other current surveillance technique, including the interception of communications. GCHQ’s hacking capabilities are so advanced that they are able to surreptitiously:

  • take over a device’s microphone and record conversations taking place near the device (NOSEY SMURF);
  • take over a device’s webcam and snap photographs (GUMFISH);
  • record Internet browsing histories and collect login details and passwords used to access websites and email accounts (FOGGYBOTTOM);
  • log keystrokes entered into a device (GROK);
  • extract data from removable flash drives that connect to an infected computer (SALVAGERABBIT);
  • identify the geographic whereabouts of the user (TRACKER SMURF); and
  • retrieve any content from a phone, including text messages, e-mails, web history, call records, videos, photos, address books, notes, and calendars.

Because the leaks have made these programs public knowledge, there’s very little GCHQ can do to deny the claims. Instead, it will most likely invoke its “legal authority” to perform these acts, granted to it (albeit not in those specific words) by the UK’s Intelligence Services Act of 1994, as PI’s Caroline Wilson explains.

Section 5(1) of the ISA provides: “No entry on or interference with property or with wireless telegraphy [by GCHQ] shall be unlawful if it is authorised by a warrant issued by the Secretary of State under this section.” In other words, so long as GCHQ is acting under a warrant then its interference with computer and mobile devices may be authorised under Section 5, even if its otherwise against the law.

This assertion rests on the presumption that these acts are always carried out under a warrant. And even if not, the broad reading of the law has allowed GCHQ to declare its operations are completely legal. The CMA itself also provides another loophole for GCHQ, nullifying the stipulations of Section 1 of the act if performed under government authority.

This may not look all that promising for Privacy International, but the UK can’t rely solely on its own laws to protect GCHQ from this legal action. It also has to answer to the European Union.

[T]he law authorizing GCHQ’s hacking must at the least set out the nature of the offenses that might lead GCHQ to intrude on our personal devices, define that categories of people who might be affected, limit the duration and extent of any intrusion, set out the procedure for examining, using and storing any information obtained, prescribe how that information will be secured and shared with other parties, and define when the data collected will be erased or destroyed. The ISA’s bare bones authorisation most certainly does not meet these basic requirements.

[GCHQ’s] hacking is so intrusive, giving GCHQ unlimited control over any target device, that it is hard to imagine how it could made proportionate […] This intrusion is only compounded when it is indiscriminately deployed to potentially millions of devices.

Privacy International argues that it is the breadth of GCHQ’s activities that make it run afoul of both UK and EU law. Leaked documents have shown several programs instituted under the title of anti-terrorism that have failed to prohibit abusive use or even hold the agency to a reasonable definition of “relevant.” Much like the NSA, the capabilities have outstripped the narrowly-defined goal, providing the agencies with unprecedented levels of intrusion.

Privacy International has filed its complaint with the UK’s Investigatory Powers Tribune, the only body with the power to hear challenges of GCHQ’s activities. The legal authority GCHQ claims gives it the permission to sabotage and infiltrate computers on a widespread basis is far from clear. Much of what’s been granted to the agency has been done in complete secrecy and, as the leaks have been unleashed, its oversight has been exposed as completely worthless.

This legal battle (joining others filed by citizens and Amnesty International) will also likely end up being fought in the dark, obscured by cries of “national security.” But at least one of the combatants will be making an effort to publicize every detail of the fight.



Filed Under: , , , , ,
Companies: privacy international

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Privacy Rights Group Files Legal Challenge To GCHQ's Extensive Hacking Activities”

Subscribe: RSS Leave a comment
3 Comments
Anonymoussays:

i wonder if Rifkin will be included? i seem to remember him being involved with the two so-called ‘interrogations’ of the heads of GCHQ, MI5 and MI6. he couldn’t rap that up quick enough, giving them a ‘clean bill of health’ so as to be able to carry on what they had been doing unabated. i also wonder if the NSA involvement will be exposed as well as how much influence it and other USA security forces have had on GCHQ. i suspect that there has been a lot!

Anonymoussays:

Retro to the Rescue

“This assertion rests on the presumption that these acts are always carried out under a warrant.”

They can always retroactively issue a warrant later. Or even retroactive change the law. GCHQ manager to underlings: “Don’t worry if it’s legal or not. Just do it. We can always get it made legal later”.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Report this ad??|??Hide Techdirt ads
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...
Older Stuff
12:25 Australian Privacy Commissioner Says 7-Eleven Broke Privacy Laws By Scanning Customers' Faces At Survey Kiosks (6)
10:50 Missouri Governor Doubles Down On 'View Source' Hacking Claim; PAC Now Fundraising Over This Bizarrely Stupid Claim (45)
10:45 Daily Deal: The All-in-One Microsoft, Cybersecurity, And Python Exam Prep Training Bundle (0)
09:43 Want To Understand Why U.S. Broadband Sucks? Look At Frontier Communications In Wisconsin, West Virginia (8)
05:36 Massachusetts College Decides Criticizing The Chinese Government Is Hate Speech, Suspends Conservative Student Group (71)
19:57 Le Tigre Sues Barry Mann To Stop Copyright Threats Over Song, Lights Barry Mann On Fire As Well (21)
16:07 Court Says City Of Baltimore's 'Heckler's Veto' Of An Anti-Catholic Rally Violates The First Amendment (15)
13:37 Two Years Later, Judge Finally Realizes That A CDN Provider Is Not Liable For Copyright Infringement On Websites (21)
12:19 Chicago Court Gets Its Prior Restraint On, Tells Police Union Head To STFU About City's Vaccine Mandate (158)
10:55 Verizon 'Visible' Wireless Accounts Hacked, Exploited To Buy New iPhones (8)
10:50 Daily Deal: The MacOS 11 Course (0)
07:55 Suing Social Media Sites Over Acts Of Terrorism Continues To Be A Losing Bet, As 11th Circuit Dumps Another Flawed Lawsuit (11)
02:51 Trump Announces His Own Social Network, 'Truth Social,' Which Says It Can Kick Off Users For Any Reason (And Already Is) (100)
19:51 Facebook AI Moderation Continues To Suck Because Moderation At Scale Is Impossible (26)
16:12 Content Moderation Case Studies: Snapchat Disables GIPHY Integration After Racist 'Sticker' Is Discovered (2018) (11)
13:54 Arlo Makes Live Customer Service A Luxury Option (8)
12:05 Delta Proudly Announces Its Participation In The DHS's Expanded Biometric Collection Program (5)
11:03 LinkedIn (Mostly) Exits China, Citing Escalating Demands For Censorship (14)
10:57 Daily Deal: The Python, Git, And YAML Bundle (0)
09:37 British Telecom Wants Netflix To Pay A Tax Simply Because Squid Game Is Popular (32)
06:41 Report: Client-Side Scanning Is An Insecure Nightmare Just Waiting To Be Exploited By Governments (35)
20:38 MLB In Talks To Offer Streaming For All Teams' Home Games In-Market Even Without A Cable Subscription (10)
15:55 Appeals Court Says Couple's Lawsuit Over Bogus Vehicle Forfeiture Can Continue (15)
13:30 Techdirt Podcast Episode 301: Scarcity, Abundance & NFTs (0)
12:03 Hollywood Is Betting On Filtering Mandates, But Working Copyright Algorithms Simply Don't Exist (66)
10:45 Introducing The Techdirt Insider Discord (4)
10:40 Daily Deal: The Dynamic 2021 DevOps Training Bundle (0)
09:29 Criminalizing Teens' Google Searches Is Just How The UK's Anti-Cybercrime Programs Roll (19)
06:29 Canon Sued For Disabling Printer Scanners When Devices Run Out Of Ink (41)
20:51 Copyright Law Discriminating Against The Blind Finally Struck Down By Court In South Africa (7)
More arrow