Following a landmark legal ruling earlier this month that, prior to December 2014, the U.K.’s spy agency GCHQ acted illegally by receiving data from the NSA’s surveillance dragnets, privacy advocacy organization Privacy International has set up an online form where people can submit a request to be informed whether they were spied on in the past.
This only applies to retrospective snooping by the British — which is what the court in question, the Investigatory Powers Tribunal (IPT), deemed GCHQ to have improperly engaged in. So no, you can’t use this campaign to ask whether the U.K. intelligence agencies are spying on you now.
And it also only applies specifically to the NSA’s Prism surveillance program, where it collects data direct from U.S. Internet companies, and to Upstream, where it taps directly into Internet cables to gather data — and where the data from those programs was passed on to the British. So any GCHQ-initiated snooping also isn’t covered here.
But you don’t have to be British or live in the U.K. to file a request. Anyone can ask whether their data was improperly accessed.
Privacy International writes:
The implications of our recent legal victory against GCHQ in the Investigatory Powers Tribunal means that all intelligence sharing from NSA to GCHQ was unlawful. Because people located all over the world are affected by illegal intelligence sharing, not only British citizens, but anyone in the world, can ask if their records collected by NSA were unlawfully shared with GCHQ.
To make a request, Privacy International is asking people to submit an email address and phone number at this point — although its FAQ notes that this is likely to only scratch the surface of the “selectors” GCHQ uses to data-mine its various databases. (It adds that those wanting “the most comprehensive records searched” would need to provide “much more personal information” — so the organization suggests they might be better off submitting an individual complaint via the IPT’s own form.)
Those joining Privacy International’s group action are asked to agree to authorize its legal team to pass their email and phone number to GCHQ and the IPT “in order to seek a declaration my rights under Article 8 and Article 10 [of the U.K. Human Rights Act] have been violated and to request my records to be deleted”. Submitted data will only be used for the stated purpose of determining whether illegal spying went on, and GCHQ can only store it for the duration of any IPT investigation. So yes, you are handing over data to spy agencies — but only for a very bounded purpose.
Why is Privacy International conducting this campaign? It’s a clear avenue to bring additional publicity to the IPT’s ruling, and apply pressure on secretive government intelligence agency practices at the point where their clandestine processes have been officially ruled illegal. So basically this is about shining more light into the military industrial surveillance complex with the aim of having a wider disinfectant effect on how secretive government agencies operate. And that’s a cause which anyone who supports due legal process in a functioning democracy can get behind.
If the IPT does find communications data was illegally shared with GCHQ, Privacy International notes it has “a statutory obligation to investigate any complaint made against GCHQ”.
While the process of joining the campaign is very quick — a case of simply submitting a few pieces of data and clicking the confirmation email you’re sent — Privacy International notes that the actual requests may well take a long time (“count on it being many months, and likely years before this action is completed”) to deliver a confirmation that you were indeed snooped on.
But this is breaking new ground, given the IPT has never before ruled against the intelligence and security services — in its entire 15 year history. And as Privacy International adds, “Nothing worth doing is easy!”