Privacy experts are celebrating after the High Court ruled against the intelligence agencies’ use of bulk hacking for domestic targets.
In 2014, Edward Snowden first revealed the use of hacking techniques to target large numbers of users simultaneously. The government relied on the issuing of “general warrants” under section 5 of the Intelligence Services Act 1994 to do so.
Non-profit Privacy International challenged the practice in the Investigatory Powers Tribunal (IPT), a secretive court set-up to handle cases involving the intelligence agencies. However, the IPT ruled in the latter’s favor, back in 2016.
Although the government then tried to block a High Court challenge to the ruling, by claiming the tribunal’s decisions can’t be subject to judicial review, it lost, and the case went ahead.
On Friday, the High Court agreed with Privacy International, quashing the IPT decision.
It cited 250 years of common law precedent whereby individuals have a right not to not have their property searched without lawful authority, even in cases of national security. As general warrants don’t apply to individuals, the authorities are wrong to take this approach, it found.
“The aversion to general warrants is one of the basic principles on which the law of the United Kingdom is founded,” the court noted. “As such, it may not be overridden by statute unless the wording of the statute makes clear that parliament intended to do so.”
Privacy International legal director, Caroline Wilson Palow, argued the ruling brought legal precedent into the modern age, where searching “property” could mean remotely spying on users’ digital lives.
“General warrants are no more permissible today than they were in the 18th century. The government had been getting away with using them for too long. We welcome the High Court's affirmation of these fundamental constitutional principles,” she said.
However, some government hacking powers are now governed by a newer law, the controversial Snooper’s Charter, or Investigatory Powers Act.
There are also various legal challenges underway to this legislation. In October last year, campaigners received a boost when the Court of Justice of the European Union (CJEU) ruled that bulk collection and retention of citizens’ data must be brought into line with EU privacy law, even in cases of national security.
The UK has a vested interest in rowing back from its position on bulk surveillance, as it seeks an “adequacy decision” from the EU on data handling that is vital to seamless cross-border data flows in the new post-Brexit era.