Press Release: Privacy International Back in Court to Challenge Bulk Government Hacking

On 5 October 2017, Privacy International will appear before the UK Court of Appeal to continue its challenge to the British government's large scale hacking powers. The case questions the decision by the Investigatory Powers Tribunal (IPT) to sanction the UK government's power to hack broad categories of people or property without any individualised suspicion.

TIMELINE AND KEY POINTS

- Privacy International began fighting bulk government hacking in 2014 at the Investigatory Powers Tribunal.*

- In May 2016, Privacy International challenged the Investigatory Powers Tribunal's decision that the UK government can use 'general warrants' to conduct bulk hacking before at the UK High Court. General warrants allow the government to hack wide categories of people or property, for example, everyone in London or all computers owned by anyone who traveled to France.

- The Government's response, rather than address why the UK government believe bulk hacking powers to be necessary, has been to argue that the UK courts should not be allowed to review Tribunal decisions. In February 2017, the UK High Court agreed with the UK government's position, despite one of the judges expressing serious reservations.

- PI is now appealing the UK High Court's decision at the UK Court of Appeal. We have been fighting the UK government's bulk hacking powers for three years and face significant potential costs. If Privacy International loses, we may be ordered to pay the UK government's legal expenses.

If we lose this case, PI may be ordered to pay the government's legal costs. We currently have a 'Protective Costs Order', which caps the potential costs to £25,000. In conjunction with the hearing, we are mobilising our supporters and launching a major crowdfunding campaign to cover these legal costs. The appeal will be at www.crowdjustice.com/hacking.

Government hacking is quickly becoming the new frontier of government surveillance. The UK Government hacks by finding and exploiting security weaknesses in our computers, phones, and other internet connected devices. By hacking, the government chooses to perpetutate the insecurity of our devices, which millions of its citizens may widely use, and may therefore be susceptible to similar attacks by other actors. UK government hackingleaves us and our devices less secure. Privacy International believes the government shouldinstead be in the business of securing people, devices and networks.

Scarlet Kim, Legal Officer at Privacy International said:

• "The Tribunal unlawfully sanctioned the UK government's use of sweeping powers to hack hundreds or thousands of people's computers and phones with a single warrant. Rather than debate the necessity and proportionality of their expansive hacking powers, the government is instead arguing that the UK courts should have no jurisdiction to review the legality of the Tribunal's decisions. Too often, the government justifies intrusive surveillance powers by telling the public that 'if you have nothing to hide, you have nothing to fear'. We throw that mantra back to the government - 'if you have nothing to hide about your hacking, you have nothing to hide from our courts'.

The hearing will take place on 5 October at the Royal Courts of Justice, The Strand, London WC2A 2LL United Kingdom. The date has not yet been confirmed. The public can support the crowdunding appeal for our legal challenge at www.crowdjustice.com/hacking.

*BACKGROUND

Privacy International originally brought a complaint in the IPT against GCHQ hacking in May 2014. We were soon joined in our complaint by seven internet and communications providers from around the world [link to case page]. Our complaint argued that GCHQ had no authority under UK law to hack, and that such activities violated Articles 8 and 10 of the European Convention on Human Rights. Articles 8 and 10 respectively protect the rights to privacy and freedom of speech. The IPT rejected both these claims in February 2016.

In its decision, the TIPT also accepted the Government's position that it was permitted to seek "thematic warrants", which are general warrants to hack inside and outside the UK. General warrants can cover an entire class of unidentified persons or property, such as "all mobile phones in London".

In May 2016, Privacy International filed a judicial review at the High Court, challenging the part of the IPT's decision sanctioning the Government's use of general hacking warrants. This decision fundamentally undermines 250 years of English common law, which has long rejected general warrants. The common law is clear that a warrant must target an identified individual or individuals. Parliament is presumed not to have overridden such a profound and fundamental right unless it clearly and expressly states that general warrants are now permissible, which it had not.

The IPT's decision also ignores that general warrants fail to comply with international human rights law, particularly Article 8 of the European Convention on Human Rights. By permitting the Government to hack large groups of people without judicial authorisation and individualised suspicion, general warrants fail to protect against arbitrary interference and abuse. They are also, by virtue of their untargeted nature, intrinsically disproportionate.

In June 2016, the High Court determined that it would hive off, for initial consideration, the issue of whether a decision of the IPT is amenable to judicial review. In February 2017, the Court held that it lacked jurisdiction to review a decision of the IPT.