UK Spies Can Access NSA Data Without a Warrant

Government Communications Headquarters (GCHQ), the UK's main signals intelligence agency, can access bulk communications from the US National Security Agency (NSA) and store it for up to two years, all without a warrant.

This information was revealed in secret policy details provided to human rights organisations including UK charity Privacy International, Amnesty International, and Liberty. It's the first time that warrantless access to communications has been revealed.

The details were released to the groups as part of their ongoing challenge to the legality of GCHQ's mass surveillance. There was a public hearing back in July, but the details of this data sharing were discussed behind closed doors, without the organisations allowed to attend. Sections have now been passed to them and cleared for release. The full agreement between the two countries remains secret, however.

The Intelligence and Security Committee, which examines the policies of the UK's intelligence agencies, reported in July 2013, that "in each case where GCHQ sought information from the US, a warrant for interception, signed by a Minister, was already in place, in accordance with the legal safeguards contained in the Regulation of Investigatory Powers Act 2000."

The Regulation of Investigatory Powers Act 2000 (RIPA) is the law that governs warrants for communications.

But according to the new details, GCHQ can request "unanalysed intercepted communications (and associated communications data)" from the NSA without an interception warrant if it "does not amount to a deliberate circumvention of RIPA," such as if it is "not technically feasible" to get a warrant.

In its analysis of the new information, Privacy International also suggested that data collected this way might not be subject to the same safeguards as that directly intercepted by GCHQ. The wording of the arrangement suggests section 16 of RIPA—which outlines safeguards on intercepted material—might not be applied, which would give GCHQ more power to analyse and store it.

"Critically, as s16 does not apply, GCHQ are able to search through raw, unanalyzed data from foreign agencies for people known to be in British Islands without restriction, sidestepping the few safeguards and protections that exist in RIPA protecting them," Privacy International said.

Caspar Bowden, an independent surveillance law expert, told me in an email that, "Extremely diligent analysis by Privacy International has uncovered that even the safeguards of RIPA (themselves highly deceptive) do not apply to bulk data acquired 'off-warrant' outside the UK, for example from foreign governments or telcos."

A Government spokesperson said, "We do not comment on ongoing legal proceedings."

This data sharing between US and UK agencies hasn't come out of nowhere. Last year, the Guardian reported that GCHQ has had some access to data gathered by the NSA's PRISM programme since at least 2010.

According to The Intercept, GCHQ was later provided with "extensive" access to the NSA's PRISM data, as well as a wealth of metadata, during the London 2012 Olympics. A Snowden document revealed that GCHQ requested more access to NSA data in April 2013, though it was unknown if the request was granted.

Asked when this recently revealed agreement—allowing the sharing of bulk data without a warrant—came into effect, Mike Rispoli from Privacy International said in an email, "We don't know, since it's a secret arrangement [and] only scant details were released to us."