08:27, October 17 82 0 theguardian.com

2017-10-17 08:27:03
UK spy agencies may be circumventing data-sharing law, tribunal told

MI5 and MI6 may be “circumventing” legal safeguards when they share bulk datasets with foreign intelligence services and commercial partners, a court has been told.

Most of the bulk personal datasets relate to UK citizens who are not of “legitimate intelligence interest”, the investigatory powers tribunal (IPT) has heard.

The system of independent commissioners, usually retired judges, who were supposed to maintain independent oversight over these procedures had been inadequate and was a “blatant failure”, Ben Jaffey QC, for Privacy International, told the IPT.

While GCHQ has said it insists its partners adopt equivalent standards when processing bulk data, Jaffey said, neither MI5 not MI6 adopt a similar approach.

“The effect will be the circumvention of the UK legal regimes,” he added. “Protections will be avoided.”

The challenge brought by Privacy International alleges that data-sharing regimes and the legal oversight system are illegal.

Bulk personal datasets contain highly sensitive personal information such as social media sites or online dating sites, the tribunal heard. “Such datasets are very intrusive,” Jaffey said. “They contain information that goes right to the core of an individual’s private life.”

The IPT, which is sitting at Southwark crown court this week, hears claims about the legality of surveillance and complaints against the intelligence services.

One important industry partner of GCHQ, the tribunal has been told, is the University of Bristol. Documents revealed by Edward Snowden, the US whistleblower, indicate that researchers are given access to GCHQ’s entire raw unselected datasets, including internet usage, telephone call logs, websites visited, online file transfers and others.

Researchers are also given access to GCHQ’s targeting database, supposedly delivered at least once a day, the tribunal has been told. That, it was said, is an exceptionally sensitive dataset.

Jaffey said analysts at GCHQ were supposed to record their reasons for searching bulk datasets, yet those statements were not seen by the oversight commissioners.

Outside the court, Millie Graham Wood, a solicitor at Privacy International, said: “The intelligence agencies’ practices in relation to bulk data were previously found to be unlawful.

“After three years of litigation, just before the court hearing we learn not only are safeguards for sharing our sensitive data nonexistent, but the government has databases with our social media information and is potentially sharing access to this information with foreign governments.

“The risks associated with these activities are painfully obvious. We are pleased the investigatory powers commissioner’s office is keen to look at these activities as a matter of urgency and the report is publicly available in the near future.”

The hearing continues.