GCHQ is legally allowed to hack into computers, tablets and smartphones owned by the public, a tribunal has ruled, after a legal challenge was brought by Privacy International.
The Investigatory Powers Tribunal (IPT) ruled on Friday that a “proper balance” has been struck in how GCHQ uses the ability to access devices using computer network exploitation technologies.
“We are satisfied that with the new Equipment Interference Code, and whatever the outcome of Parliamentary consideration of the Investigatory Powers Bill, a proper balance is being struck in regard to the matters we have been asked to consider,” said the ruling.
Foreign secretary Philip Hammond welcomed the IPT’s findings, saying that it underlines the fact that GCHQ’s work is vital to national security.
“I welcome the IPT ruling and its judgement that a proper balance is being struck between the need to keep Britain safe and the protection of individuals’ privacy. The ability to exploit computer networks plays a crucial part in our ability to protect the British public,” he said.
“Once again, the law and practice around our intelligence and security agencies’ capabilities and procedures have been scrutinised by an independent body and been confirmed to be lawful and proportionate.”
Hammond also used the outcome to underline why the government is so keen to get more powers onto the statute books with regard to accessing communications data.
“The Draft Investigatory Powers Bill will further strengthen the safeguards for the agencies’ use of these powers, including a new double-lock authorisation process. It will provide our intelligence and security agencies with the powers they need to deal with the serious threats our country faces,” he said.
Privacy International explained that it is disappointed at the ruling and will challenge it again.
“The IPT today held that GCHQ hacking of computers, mobile devices and networks is lawful, wherever it occurs around the world. We are disappointed that the IPT has not upheld our complaint and we will challenge its findings,” said Scarlet Kim, legal officer at Privacy International, in a statement.
“Our complaint is the first UK legal challenge to state-sponsored hacking, an exceptionally intrusive form of surveillance. We contended that GCHQ hacking operations were incompatible with democratic principles and human rights standards.
“We further argued that GCHQ, which until these proceedings was hacking in secret, had no clear authority under UK law to deploy these capabilities.”
Privacy International has plenty to challenge, and will invoke European human rights as it pushes this forward through other, hopefully more receptive, courts.
“We are disappointed by the IPT’s judgement today, which has found government hacking lawful based on a broad interpretation of a law dating back to 1994 when the internet and mobile phone technology were in their infancy,” added Kim.