WikipediaThe UK's intelligence agencies (MI5, MI6, and GCHQ) are spying on everything you do, and with only the flimsiest of safeguards in place to prevent abuse, according to more than a thousand pages of documents published today as a result of a lawsuit filed by Privacy International.
The documents reveal the details of so-called "Bulk Personal Datasets," or BPDs, which can contain "hundreds to millions of records" on people who are not suspected of any wrongdoing.
These records can be “anything from your private medical records, your correspondence with your doctor or lawyer, even what petitions you have signed, your financial data, and commercial activities,” Privacy International legal officer Millie Graham Wood said in a statement. "The information revealed by this disclosure shows the staggering extent to which the intelligence agencies hoover up our data."
Nor, it seems, are BPDs only being used to investigate terrorism and serious crime; they can and are used to protect Britain’s “economic well-being”—including preventing pirate copies of Harry Potter books from leaking before their release date.
BPDs are so powerful, in fact, that the normally toothless UK parliament watchdog that oversees intelligence gathering, the Intelligence and Security Committee (ISC), recommended in February that "Class Bulk Personal Dataset warrants are removed from the new legislation."
These data sets are so large and collect so much information so indiscriminately that they even include information on dead people.
I see dead people
One document, entitled "SIA Bulk Personal Data Policy," states that "Whilst DPA [the Data Protection Act] refers only to 'a living individual', many bulk personal datasets will contain details about individuals who are dead.
SIA [GCHQ, MI5, and MI6/SIS] policy and processes in relation to bulk personal data is the same for both the living and the dead." The document does not state what threat decomposing corpses—or cremated remains—pose to national security. But what about safeguards? The documents show a lack of any real safeguards in place to prevent abuse of these intimate data sets beyond just "trust us." In the same document, the intel outfits write, "The Agencies must... ensure that appropriate safeguards are in place to prevent and detect inappropriate use." But what do those safeguards look like? The SIS (aka MI6), for their part, seem to think that sternly worded bold-faced warnings will be enough to prevent temptation, writing in their “SIS database Code of Practice": Whilst the database may afford you the potential to view information and/or data that you do not have a need to know, it is your duty and responsibility to avoid doing so...The database must not be a 'free for all'. SIS, the document explains, has implemented rigorous technical safeguards to prevent abuse, including a drop-down menu and a free-text field: The database users are required to fill in two mandatory fields before conducting each new search, these are: Purpose and Justification. Purpose is a drop-down field with the three statutory areas of SIS' work: NS — National Security, EW Economic Wellbeing and SC — Serious Crime. Justification is a free-text field designed for the user to provide the business need for the search, including the intelligence requirement or investigation it relates to and, where possible, a source document reference. Well, that settles it, then.
Feel better now? What happens when the secret police are naughty? The SIA Bulk Personal Data Policy indicates that UK intelligence agencies will discipline anyone who abuses this data, writing “The Agencies will take appropriate disciplinary action against any person identified as abusing or misusing analytical capabilities, BPD, or any information or intelligence derived therefrom.” But what does that discipline look like? Privacy International asked the UK intelligence services to identify how many times they disciplined officers for non-compliance with those rules.
In their submission to the Investigatory Powers Tribunal (IPT), Privacy International asked the court to order the secret police to answer the following questions: For each of the Intelligence Services and each set of Handling Arrangements, please state: (a) The number of instances of non-compliance that have been detected; (b) The number of staff members identified as responsible; (c) The number of staff who have been (i) prosecuted; (ii) dismissed; and (iii) otherwise disciplined for non-compliance; and (d) The means by which the instances of non-compliance were detected. The secret services responded, indicating that in the period of June 2014 to early 2016, no officers had been prosecuted, none had been dismissed, and only five had been "subject to disciplinary procedures"—three in the SIS, two at MI5, and none at the GCHQ.
In numerous cases, the agencies list non-compliance issues that resulted in no staff members being disciplined at all. If you build it, they will come Privacy International also expressed concern about the security of these large, sensitive data sets. "This highly sensitive information about us is vulnerable to attack from hackers, foreign governments, and criminals," Wood said. However, security researcher Nicholas Weaver of UC Berkeley disagreed, citing the real threat: the British government itself. "I actually think it would be very hard for an adversary to steal such data in bulk," he told Ars. "I think a far greater concern is phrased as 'What Would J.
Edgar Hoover [the late, corrupt FBI director] do?': What if a demagogue—Hoover, Nixon, Trump, LePen—gains power in Britain.
Such mass databases are incredibly powerful for tyrants and represent a level of potential collection and control that would make the Stasi blush." The Investigatory Powers Bill That seems to be where we’re headed in the UK with the new Investigatory Powers Bill (IPB), which would normalise this indiscriminate spying.
The new documents reveal that the UK intelligence services have been engaged in mass surveillance since at least 2001. Now they want more. "The agencies have been doing this for 15 years in secret and are now quietly trying to put these powers on the statute books for the first time," Woods said, "in the Investigatory Powers Bill, which is currently being debated in Parliament." Privacy International filed the lawsuit in June of last year, challenging the legality of Bulk Personal Datasets, which were first mentioned in a March 2015 report.
The court then heard the case in secret, barring Privacy International from sending legal counsel and, after secret deliberation, ordered these documents to be released. Our requests for comment to the collective UK intelligence services went to /dev/null.
The Home Office press office, which handles media requests for MI5, did not answer our phone calls.
The FCO press office, which handles media enquiries for the SIS, did not answer our e-mailed request for comment.
GCHQ did not answer our e-mail requesting comment. J.M. Porup is a freelance cybersecurity reporter who lives in Toronto. When he dies, his epitaph will simply read, "assume breach." You can find him on Twitter at @toholdaquill. This post originated on Ars Technica UK
SIA [GCHQ, MI5, and MI6/SIS] policy and processes in relation to bulk personal data is the same for both the living and the dead." The document does not state what threat decomposing corpses—or cremated remains—pose to national security. But what about safeguards? The documents show a lack of any real safeguards in place to prevent abuse of these intimate data sets beyond just "trust us." In the same document, the intel outfits write, "The Agencies must... ensure that appropriate safeguards are in place to prevent and detect inappropriate use." But what do those safeguards look like? The SIS (aka MI6), for their part, seem to think that sternly worded bold-faced warnings will be enough to prevent temptation, writing in their “SIS database Code of Practice": Whilst the database may afford you the potential to view information and/or data that you do not have a need to know, it is your duty and responsibility to avoid doing so...The database must not be a 'free for all'. SIS, the document explains, has implemented rigorous technical safeguards to prevent abuse, including a drop-down menu and a free-text field: The database users are required to fill in two mandatory fields before conducting each new search, these are: Purpose and Justification. Purpose is a drop-down field with the three statutory areas of SIS' work: NS — National Security, EW Economic Wellbeing and SC — Serious Crime. Justification is a free-text field designed for the user to provide the business need for the search, including the intelligence requirement or investigation it relates to and, where possible, a source document reference. Well, that settles it, then.
Feel better now? What happens when the secret police are naughty? The SIA Bulk Personal Data Policy indicates that UK intelligence agencies will discipline anyone who abuses this data, writing “The Agencies will take appropriate disciplinary action against any person identified as abusing or misusing analytical capabilities, BPD, or any information or intelligence derived therefrom.” But what does that discipline look like? Privacy International asked the UK intelligence services to identify how many times they disciplined officers for non-compliance with those rules.
In their submission to the Investigatory Powers Tribunal (IPT), Privacy International asked the court to order the secret police to answer the following questions: For each of the Intelligence Services and each set of Handling Arrangements, please state: (a) The number of instances of non-compliance that have been detected; (b) The number of staff members identified as responsible; (c) The number of staff who have been (i) prosecuted; (ii) dismissed; and (iii) otherwise disciplined for non-compliance; and (d) The means by which the instances of non-compliance were detected. The secret services responded, indicating that in the period of June 2014 to early 2016, no officers had been prosecuted, none had been dismissed, and only five had been "subject to disciplinary procedures"—three in the SIS, two at MI5, and none at the GCHQ.
In numerous cases, the agencies list non-compliance issues that resulted in no staff members being disciplined at all. If you build it, they will come Privacy International also expressed concern about the security of these large, sensitive data sets. "This highly sensitive information about us is vulnerable to attack from hackers, foreign governments, and criminals," Wood said. However, security researcher Nicholas Weaver of UC Berkeley disagreed, citing the real threat: the British government itself. "I actually think it would be very hard for an adversary to steal such data in bulk," he told Ars. "I think a far greater concern is phrased as 'What Would J.
Edgar Hoover [the late, corrupt FBI director] do?': What if a demagogue—Hoover, Nixon, Trump, LePen—gains power in Britain.
Such mass databases are incredibly powerful for tyrants and represent a level of potential collection and control that would make the Stasi blush." The Investigatory Powers Bill That seems to be where we’re headed in the UK with the new Investigatory Powers Bill (IPB), which would normalise this indiscriminate spying.
The new documents reveal that the UK intelligence services have been engaged in mass surveillance since at least 2001. Now they want more. "The agencies have been doing this for 15 years in secret and are now quietly trying to put these powers on the statute books for the first time," Woods said, "in the Investigatory Powers Bill, which is currently being debated in Parliament." Privacy International filed the lawsuit in June of last year, challenging the legality of Bulk Personal Datasets, which were first mentioned in a March 2015 report.
The court then heard the case in secret, barring Privacy International from sending legal counsel and, after secret deliberation, ordered these documents to be released. Our requests for comment to the collective UK intelligence services went to /dev/null.
The Home Office press office, which handles media requests for MI5, did not answer our phone calls.
The FCO press office, which handles media enquiries for the SIS, did not answer our e-mailed request for comment.
GCHQ did not answer our e-mail requesting comment. J.M. Porup is a freelance cybersecurity reporter who lives in Toronto. When he dies, his epitaph will simply read, "assume breach." You can find him on Twitter at @toholdaquill. This post originated on Ars Technica UK