The High Court in London yesterday revealed that the British Security Service MI5 has been illegally stored the private data of millions of British citizens for years. MI5 has now been placed under special measures by the country’s Investigatory Powers Commissioner’s Office (IPCO).
The case was brought by the human rights campaign group Liberty who accused MI5 of “extraordinary and persistent illegality” in their handling of retained data and the ways they obtained surveillance warrants.
An extraordinary revelation
The case centred on the way in which MI5 handled the bulk data interceptions that the agency acquired either through online surveillance or hacking operations. Their power to intercept data in bulk was greatly expanded in 2016 with the passing of the hugely controversial Investigatory Powers Act.
Under the terms of that law, law enforcement agencies are permitted to collect the online and telecommunications data of British citizens. But they have a statutory duty to only retain this data for as long as required and not to copy it any more than necessary.
The vague wording of the law allows for plenty of wriggle room, but Liberty brought the case because it was convinced that MI5 was in breach of this requirement and in practice had no idea what data is held where.
As Liberty’s lawyer, Ben Jaffey QC, said in court, there were clearly “ungoverned spaces” in MI5’s operations where it did not know what it held.
A letter from MI5 to Investigatory Powers Commissioner, Lord Justice Fulford, whose job is to ensure compliance with these laws was released by the court yesterday. It confirmed that Liberty was right and MI5 has no idea what information it has where.
“We are about to commence further scanning of [its computers] to ensure we have a full understanding of the data.,” they sheepishly wrote.
“The full scan had been challenging to action … We have also been seeking to understand working practices … so that we can take comprehensive action to improve assurance of our compliance with relevant safeguards.”
Fulford’s response to this letter was also made public yesterday. In it, he said that the way MI5 was holding and handling people’s data was “undoubtedly unlawful” and accused them of “a historic lack of compliance”.
He told MI5 that it was now in “special measures”, a damning term usually applied to failing schools and warning them that their breaches of the law were “of such gravity that [the watchdog Investigatory Powers Commissioner’s Office] IPCO will need to be satisfied to a greater degree than usual that it is ‘fit for purpose’.”
Questions for the Home Office and Government
While it is clear that MI5 has been acting in flagrant disregard of the law in their handling of people’s data, the role of the Home Office is also brought into question by this ruling.
Firstly, Home Secretary Sajid Javid, who is currently running to be Conservative Party leader and the next Prime Minister, attempted to suppress these findings by trying to have the court case held in private.
Ministers are reported to have been informed of the potential illegal retention of data earlier this year, but to date, no action has been taken to remedy the problem.
It is also believed that MI5 knew it was in breach of the law as far back as 2016 but failed to inform ministers or the IPCO.
It is clear that the safeguards championed so loudly by the government when the Investigatory Powers Act was passed have failed dismally to protect the rights and privacy of the British people.
As Megan Goulding, a lawyer for Liberty, said in the wake of yesterday’s revelations, “These shocking revelations expose how MI5 has been illegally mishandling our data for years, storing it when they have no legal basis to do so.”
“This could include our most deeply sensitive information – our calls and messages, our location data, our web browsing history.”
“In addition to showing a flagrant disregard for our rights, MI5 has attempted to hide its mistakes by providing misinformation to the investigatory powers commissioner, who oversees the government’s surveillance regime,” she added.
The revelations in court yesterday do not mark the end of the case. It will be heard in full next week and it will be interesting to see what actions the court decides should be taken against MI5 and the government after these revelations.
How to keep your data from MI5 spying
Given all the promises that were made in 2016, no-one could blame British internet users for expecting little to change regardless of the court’s final ruling.
Unless the Investigatory Powers Act is repealed or radically revised, ISPs will still be routinely collecting and storing the internet activity of all British people and making this available to UK intelligence agencies.
The only way to stop the bulk collection of your private data is to use a VPN. By connecting to a VPN such as ExpressVPN or NordVPN, you can ensure that all of your data is encrypted. This means that neither your ISP nor MI5 surveillance officers can see what you are doing online.
A VPN will also ensure your online privacy by redirecting all of your data through an external server. This changes your IP Address and makes it all but impossible for your online activity to be traced back to you.
Since the Investigatory Powers Act was first passed in 2016, VPN use in the UK has skyrocketed. In the wake of these latest revelations, the number of British VPN users is likely to rise once more.