How GCHQ Justifies the Mass Surveillance of UK Social Media Users

GCHQ has given itself legal justification for sweeping up the Facebook, Google, Twitter and YouTube data of UK citizens, without warrant, by labelling that kind of information "external communications."

The secret policy, revealed by a challenge brought forward by Privacy International and human rights groups, elaborates on the legal framework in place that allows GCHQ to intercept the communications of millions of people through its mass surveillance program, TEMPORA. Charles Farr, the Director General of the Office for Security and Counter Terrorism, wrote that the intelligence agency is allowed to do this under the Regulation of Investigatory Powers Act (RIPA), because the servers of web-based platforms such as Facebook are based in the US, and hence are "external." This applies even when the two people in a conversation are based in the UK.

"Internal" communications require a warrant to be looked into, but "external" communications can be read or listened to indiscriminately. Although these communications are being collected and scanned in order to determine whether they are internal or external, GCHQ considers a "substantive" privacy issue only to occur when a person actually reads it, according to Privacy International's interpretation.

So what now? "We need to find out whether the oversight committees were aware that GCHQ were doing this," Privacy International spokesperson Mike Rispoli told me. The body in charge of this oversight is the Intelligence and Security Committee of Parliament (ISC). Made up of MPs and Lords, their job is to make sure that GCHQ is playing by the rules, and give their findings directly to Parliament. If they did know, and thought that the warrant-less surveillance of the country's social media users was okay, then perhaps there is a deeper problem.

"The next step," Rispoli continued, "is to reform RIPA, and to protect the privacy rights of people."

In the US, reforms to the NSA are happening (although not to the extent some privacy groups would like), and the debate around surveillance is a vibrant one. The UK, however has seen very little political movement. Apart from a review of GCHQ accountability launched by the Deputy Prime Minister—which Privacy International don't expect to be released until after next year's elections—most of the country's politicians have generally reacted with apathetic shrugs to the NSA/GCHQ revelations.

Another difference between the two countries is the response maintained by their respective intelligence agencies. Whereas the NSA does admit that the programs revealed by Snowden exist, GCHQ still use the "can neither confirm nor deny" response. This results in Farr using all sorts of linguistic workarounds to talk about the subject, rather than dealing with it directly, Rispoli told me.

He added that this lack of transparency may be what is leading—in part—to the country's indifference around mass surveillance, although the root of this reaction is not entirely clear. However, if any meaningful political steps are eventually going to be taken by British MPs, “pressure from voters” is necessary.

"Parliament can move on this now. They don't have to wait until the report comes out. They can demand an inquiry into this. They can demand answers from the ISC. They can demand answers from GCHQ," said Rispoli. If citizens call for this, perhaps there is a chance for reform.

"Nothing will be done until we get leadership coming from MPs […] and demand reform."