Northern Ireland

Use of GCHQ data power unlawful, tribunal finds

Private data was found on a pen drive mistakenly handed to loyalists under investigation
Private data was found on a pen drive mistakenly handed to loyalists under investigation Private data was found on a pen drive mistakenly handed to loyalists under investigation

A tribunal has found that directions for the mass gathering and sharing of communication data to the British government's GCHQ spy agency over a period of more than a decade were unlawful.

Since the 9/11 terror attack the British foreign secretary has been granted the power to direct GCHQ to obtain data from communications companies.

However, the Investigatory Powers Tribunal (IPT) has now found this power was unlawfully delegated, allowing the agency unfettered discretion on what data to demand.

It comes as a PSNI inquiry into data mistakenly given to loyalists under investigation by the Paramilitary Crime Task Force and National Crime Agency continues.

The Irish News revealed last week that a pen drive containing hundreds of pages of internet data, including details of private citizens and businesses' internet usage, was left in device handed back to loyalists.

A specialist police team has been set up to investigate the massive data breach.

The tribunal ruling came after a legal challenge by the charity Privacy International, which said it amounted to "proof positive" of the inadequacy of the oversight system formerly in place to safeguard personal privacy.

The IPT did not quash any of the directions made by successive foreign secretaries, and made no recommendations for further action on the issue.

"In theory the agency could have used the general form of such directions to impose on the CSP (communications services provider) a requirement to produce communications data which extended beyond the scope of any data requirement which had been sanctioned by the Foreign Secretary," the tribunal said in its judgment.

The GCHQ building in Cheltenham
The GCHQ building in Cheltenham The GCHQ building in Cheltenham

Phone and internet providers "would not be in any position to question the scope of the requirement communicated because the CSP would have no knowledge of the limited basis upon which the direction had been made".

But the IPT added: "In form, the general direction was a carte blanche. In practice, it was not treated as such and there is no evidence that GCHQ ever sought to obtain communications data which fell outside the scope of data which had been sought in the submission to the Foreign Secretary."

However. the tribunal unanimously ruled against challenges to the government's procedures for sharing bulk data with law enforcement agencies and industry partners.

Privacy International solicitor Millie Graham Wood said: "It is proof positive of the inadequacy of the historic oversight system; the complicity of telecommunications companies who instead of checking if requests were lawful, just handed over customers' personal data as long as their co-operation was kept secret; and the scale of the task facing the new Investigatory Powers Commissioner Sir Adrian Fulford."