- Security service lawlessness revealed in two separate legal cases
- MI5 kept its law-breaking secret from the surveillance watchdog
- Groups demand MI5 reveal full extent of its unlawful handling of personal data
Liberty, the human rights organisation, and Privacy International, today announced a joint legal action against MI5 following revelations the intelligence agency has systematically broken surveillance laws for years and kept it secret from the surveillance watchdog.
The details of MI5’s lawlessness emerged last summer in two legal cases – Liberty’s challenge to the Snoopers’ Charter (the Investigatory Powers Act 2016) and Privacy International’s challenge to state powers to collect and store ordinary people’s data.
In Liberty’s challenge to the Investigatory Powers Act 2016 (IPA), the Government revealed that MI5 had been unlawfully retaining and mishandling the public’s data for years.
As part of that case, the Government disclosed a number of documents to the court, including correspondence between the security service and the Investigatory Powers Commissioner’s Office (IPCO, the body responsible for overseeing state surveillance practices), correspondence between the security service and the Home Secretary, and reports of inspections carried out by IPCO after they learnt of MI5’s failings.
The documents reveal that MI5 not only broke the law, they failed to report this to IPCO, despite knowing about their non-compliance for years. They also gave IPCO false information in order to obtain warrants. These revelations led the then Investigatory Powers Commissioner, Lord Justice Fulford, to conclude that the UK security service had held and handled our data in an “undoubted unlawful manner”.
In a remarkable admission to the Commissioner, a senior MI5 official acknowledged that personal data collected by MI5 might be stored in “ungoverned spaces”, while an MI5 review in 2016 found “a high likelihood [of material] being discovered when it should have been deleted”.
Liberty and Privacy International have today launched a legal bid to get MI5 to disclose the full extent of its unlawful conduct. The groups are asking the court to rule that MI5 violated our rights to privacy and free expression by unlawfully retaining and mishandling our data. The groups are also demanding that surveillance warrants granted during this unlawful activity are quashed and all record of the public’s illegitimately obtained or retained data is destroyed.
Liberty lawyer Megan Goulding said: “It’s clear we need to know the extent of MI5’s lawlessness as these court cases have revealed how our surveillance laws are not fit for purpose as well as MI5’s disregard for our rights. MI5 has unprecedented and dangerous power to spy on any one of us and collect our sensitive private information.
“It’s clear that the so-called safeguards in our surveillance laws are totally ineffective in protecting our rights. The Snoopers’ Charter needs to be torn up and the Government must create a targeted surveillance regime that protects us while respecting our rights and freedoms.”
Privacy International’s Legal Director Caroline Wilson Palow said: "For more than a decade, MI5 has been building massive datasets by systematically collecting our personal information. Such practices are a serious interference with our right to privacy and threaten democratic values. We were promised that robust safeguards were in place so that such data would never be abused. Yet it turns out that those safeguards were in some cases illusory - that MI5 held significant data in ungoverned spaces without any effective oversight. We are bringing this challenge together with Liberty to ensure that MI5 does not continue to operate outside of the law."
What we know of MI5’s wrongdoing so far
- Illegal actions: The Investigatory Powers Commissioner concluded that the way MI5 was holding and handling people’s data was “undoubtedly unlawful”. MI5 breached IPA safeguards relating to how long data is held for, how often it is copied, the number of persons to whom and extent to which material is disclosed, and how data is stored securely. The exact details of MI5’s breaches are yet unknown, but Liberty and Privacy International hope this new legal case will reveal more.
- Senior people at MI5 knew for six years before informing IPCO: Issues with MI5’s legal compliance were known to the MI5 Board in 2013, but were only brought to IPCO's attention in February 2019.
- MI5 misled judges: Senior judges (known as Judicial Commissioners) issued surveillance warrants on the understanding that MI5’s data handling obligations under the IPA were being met - when they were not, in fact MI5 gave false information to obtain the warrants. The Investigatory Powers Commissioner has pointed out that warrants would not have been issued if IPCO had been aware about the breaches. The Commissioner states that “it is impossible to sensibly reconcile the explanation of the handling of arrangements the Judicial Commissioners were given in briefings…with what MI5 knew over a protracted period of time was happening."
The “bulk” powers Liberty challenged in the case against the Snoopers’ Charter allow MI5 to scoop up the public’s personal data en masse, regardless of whether they are suspected of any wrongdoing. It is therefore unclear how many people may have had their personal information unlawfully retained and mishandled, without their knowledge, by the security service.
Notes to Editors:
- The new legal action against MI5 is being brought in the Investigatory Powers Tribunal, the independent judicial body for complaints about state surveillance.
- The Snoopers’ Charter became law in late 2016. It was intended to introduce transparency to state surveillance following Edward Snowden’s revelations of unlawful mass monitoring of the public’s communications. However, it legalised the practices he exposed and introduced hugely intrusive new powers.
- In April 2018, the High Court ruled in Liberty’s favour in the first part of its challenge to the Snoopers’ Charter, finding that Part 4 of the IPA was unlawful because it allowed state agencies to force private companies to retain our personal data without independent authorisation and for the purpose of investigating crime that is not serious.
- In September 2018, the Investigatory Powers Tribunal declared that Privacy International’s data were illegally held by MI5, among other intelligence and security agencies. The Security Service decided to delete Privacy International’s data before the on-going investigation was completed.
- The Snoopers’ Charter allows the state to collect the content of people’s digital communications and hack computers, phones and tablets on an industrial scale. The state can collect and keep data on these databases even if it does not suspect individuals of any wrongdoing.
- In July 2019, the High Court ruled that bulk powers are not unlawful. Liberty is appealing that decision, but the case is on hold pending a ruling on a case Liberty is fighting with 13 other human rights and journalism groups – see below.
- In September 2018, Liberty, along with 13 other human rights and journalism groups and two individuals, data=02|01|This email address is being protected from spambots. You need JavaScript enabled to view it.|ec332274a0d5496f437908d6ed8ed441|8aea8e714fae4a2b83fc4d84bc2355a2|1|0|636957595042555879&;sdata=96fEsuAwJ1KNl/DH3qPFRw5oCuEFabfP5Ez2Cwp7Agc=&reserved=0#_blank">won its challenge to the UK's previous surveillance regime at the European Court of Human Rights. The European Court found that the UK’s previous regime for bulk interception of data was unlawful. Liberty is currently appealing that decision to argue that all bulk surveillance powers are incompatible with human rights laws.
