The UK government used its bulk collection powers, including sweeping up details on ordinary citizens' internet usage, illegally for over a decade, according to privacy campaigners.
On Monday, the Investigatory Powers Tribunal (IPT), a court tasked with keeping tabs on the country's surveillance powers, highlighted the intense veil of secrecy that has formed around the UK's use of bulk powers, and the lack of oversight around those powers, in a written judgment. The judgment comes when the country is just preparing for a huge overhaul in its surveillance legislation, via the Investigatory Powers Bill, which is likely to soon become law.
So-called Bulk Communications Data (BCD), which concerns metadata of both telephone and internet use, is collected by GCHQ and MI5. Bulk Personal Datasets (BPD) meanwhile, are huge archives of biographical details, financial information, travel documents, as well as communications, most of which concern people of no intelligence interest.
This latest judgement addresses those two powers. For both, the IPT writes that UK intelligence and security agencies failed to comply with European Convention of Human Rights (ECHR) principles before 2015.
According to the IPT, even the security and intelligence agencies were concerned about the public's absence of knowledge around BPD.
"In any event it seems difficult to conclude that the use of BCD was foreseeable by the public, when it was not explained to Parliament," the judgement continues.
These two powers were only officially "avowed"—that is, publicly acknowledged by the government—in 2015: March 2015 for BPD, and November for BCD. This is despite both powers being used for over ten years.
According to the IPT, "there was no statutory oversight of BPD prior to March 2015," and there was not adequate oversight of BCD either.
The IPT has the power to quash authorisations, and even order material to be destroyed. It is not clear whether any of the unlawfully obtained material will be destroyed, however, or if the agencies will face any other sort of consequence.
GCHQ usually provides the media with a boilerplate response when asked for comment on stories concerning its bulk capabilities, which alleges that the agency's work is carried out within the law. For this story, however, GCHQ directed me to the Home Office instead.
A government spokesperson told Motherboard in an email that, "The powers available to the security and intelligence agencies play a vital role in protecting the UK and its citizens. We are therefore pleased the Tribunal has confirmed the current lawfulness of the existing bulk communications data and bulk personal dataset regimes.
"Through the Investigatory Powers Bill, the Government is committed to providing greater transparency and stronger safeguards for all of the bulk powers available to the agencies," the spokesperson added.
"This judgment confirms that for over a decade UK security services unlawfully concealed both the extent of their surveillance capabilities and that innocent people across the country have been spied upon," Mark Scott, of Bhatt Murphy Solicitors, who worked on the legal challenge for Privacy International, said in an emailed statement.
Last year, the IPT found that the regime that allows the sharing of intercepted data between the UK and US was unlawful until the previous year.
Update: This piece was updated shortly after publication to add that the IPT does have the power to order material to be destroyed.