“Bulk hacking” powers exploited by the intelligence services to access electronic devices represent an illegal intrusion into the private lives of millions of people, the high court has been told.
In its latest challenge to the 2016 Investigatory Powers Act (IPA), the civil rights organisation Liberty has argued that government surveillance practices breach human rights law.
Of the multiple powers authorised by the legislation – labelled by critics as the “snooper’s charter” – the ability to interfere with computers, mobiles and other equipment amounts to the greatest invasion of individuals’ privacy, the court was told.
Appearing for Liberty, Martin Chamberlain QC explained that the IPA “provides for a wide expansion of bulk secret surveillance powers”, undermining articles 8 and 10 of the European convention on human rights which guarantee privacy and freedom of expression.
He warned of the “inherent dangers” of bulk hacking powers, by which the intelligence services could take “remote control of a device, for example, to turn mobile phones with cameras into recording devices … or to log keystrokes to capture passwords,” thereby potentially overriding any encryption.
Chamberlain cautioned about “the dangers of secret surveillance regimes”, which arose from “the possibility of abuse of power necessarily exercised in secret, and the generally chilling effect on individuals’ communications and expression of ideas caused by the existence of such powers.”
Other powers in the act, he said, “permit the interception or obtaining, processing, retention and examination of the private information of very large numbers of people – in some cases, the whole population. They also permit serious invasions of journalistic and watchdog organisations’ materials and lawyer-client communication.”
He said MI5 and GCHQ could intercept data that “shows, for example, that an individual has accessed a website containing information about sexual health or abortion or suicide,” and this data “would be searchable without a warrant”.
Vulnerabilities that have been built into software to allow law enforcement access cause “real and significant risks” that third parties could exploit them. The WannaCry online attack, by which hackers infected hundreds of thousands of computers worldwide with ransomware in 2017 attack, represented “an example of the kind of unintended consequences that state bulk hacking activities … can have,” he said.
But Sir James Eadie QC, representing the government, argued that the powers provided by IPA “strike an appropriate balance between security and individual privacy”.
He said in his written submission: “The powers under challenge are of critical importance to, and are effective in securing, the protection of the public from a range of serious and sophisticated threats arising in the context of terrorism, hostile state activity and serious/organised crime.”
Last week it emerged that MI5 had lost control of its data storage operations. MI5 admitted there were “ungoverned spaces” on its computers where it did not know what it held.
In parliamentary debates about the Investigatory Powers Act, the government insisted the security services conducted only targeted searches of data under legal warrants in pursuit of terrorist or criminal activity, and that bulk interception was necessary as a first step in that process.
Compliance with the Investigatory Powers Act is overseen by the investigatory powers commissioner, Lord Justice Fulford, who has announced he is stepping down from the role in October almost six months earlier than scheduled. He is to become vice-president of the criminal division of the court of appeal.
In comments revealed during legal action last week, it emerged that Fulford had written to MI5 warning that future applications for interception warrants “will not be approved by the judicial commissioners” unless there were improvements to its storage practices.
The National Union of Journalists has intervened in the Liberty case, arguing that there are insufficient safeguards in the act to protect confidential journalistic sources.
Before the hearing, Megan Goulding, a lawyer at Liberty, said: “In creating the snoopers’ charter, the UK government has attempted to legitimise the most sweeping and intrusive mass surveillance powers to be found anywhere in the democratic world. These powers allow the state to collect the messages, location and browsing history of innocent, ordinary people without grounds for suspicion.
“We are bringing this challenge because this law has no place in any credible democracy, least of all one with such a long and proud history of defending individual liberty. The government must introduce a targeted surveillance regime that does not require its citizens to sacrifice their rights to privacy and freedom of expression.”
Responding to the legal action, the security minister, Ben Wallace, said: “We live in a world where paedophiles groom children online, terrorists continue to plot attacks and where hostile states have attempted assassination on our streets. It is therefore imperative that our law enforcement and security and intelligence agencies have the tools they need to protect us all from these very real threats to our security, prosperity and our way of life.
“Police and intelligence officers who use these investigatory powers every day do so within a strict set of rules and are overseen by ministers and the independent investigatory powers commissioner. We will continue to defend the investigatory powers regime in court.”
The hearing, at the Royal Courts of Justice in London, is expected to last five days.