Q&A: PI case – UK High Court judgment on general warrants and government hacking explained
EDRi member Privacy International (PI) explain in some detail what their case involving UK intelligence services using general warrants is about.
Achieved result
Privacy International won their judicial review challenge to a 2016 decision by the Investigatory Powers Tribunal (IPT). The UK High Court has held that the security and intelligence services can no longer rely on ‘general warrants’ to interfere with property, including computers.
Design by: Mika Baumeister on Unsplash
On 8 January 2021, the UK High Court issued a judgment in the case of Privacy International v. Investigatory Powers Tribunal. The Secretary of State for Foreign and Commonwealth Affairs and Government Communication Headquarters (GCHQ) appeared as interested parties to the case.
After PI’s initial reaction, below they answer some of the main questions relating to the case.
What’s the ruling all about?
In this case, the UK High Court quashed a previous decision by the Investigatory Powers Tribunal (IPT), the tribunal primarily responsible for hearing complaints against the intelligence agencies. Specifically, it held that section 5 of the Intelligence Services Act (ISA) 1994 does not permit the security and intelligence services to rely on non-specific warrants – otherwise known as general warrants – to authorise their wide-ranging hacking and property interference powers.
The UK High Court ruling signals that UK fundamental constitutional principles still need to be applied in the context of surveillance and that government agencies cannot circumvent traditional protections afforded by the common law.
Importantly, the ruling re-states an important principle underpinning centuries of the UK common law: a warrant cannot be so broad that it leaves significant matters of judgment and discretion to the person executing the warrant.
What are thematic warrants?
Thematic warrants are general warrants covering an entire class of property, persons or conduct, such as “all mobile phones used by a member of a criminal gang”, without specifying the names or locations of the members.
Is this a privacy ruling?
Not exactly. Although PI made arguments based on the right to privacy, their Article 8 ECHR claims were not considered by the High Court. Its ruling is largely founded on UK constitutional principles relating to the proper approach to be applied by courts when interpreting statutory provisions. In brief, the High Court’s reasoning was that s.5 of ISA 1994 was so broadly phrased that, according to the well-established common law principle of legality, it could not be read as overriding fundamental rights.
Does this case stop government hacking?
No. The scope of PI’s challenge was strictly limited to the lawfulness of general warrants as set out in ISA 1994 and the Regulation of Investigatory Powers Act 2000. The latter statute was largely superseded by the Investigatory Powers Act (IPA) 2016, which was not within the scope of their legal challenge. So while the Court agreed that s. 5 ISA 1994 could not be read to permit security and intelligence services to rely on non-specific warrants, it did not pronounce itself in relation to other statutes or provisions which allow government hacking to take place, such as the IPA 2016.
The hacking powers introduced by the IPA are currently the subject of a separate legal challenge.
Ok, so what happens next?
If not appealed, today’s High Court judgment will go back to the IPT for execution.
How did we get here?
The High Court’s ruling is the latest milestone in a five-year journey through the UK courts.
The case started in 2016, when Privacy International challenged a decision by the Investigatory Powers Tribunal (IPT) which held that GCHQ hacking is lawful under UK law and the European Convention on Human Rights. The IPT further held that GCHQ may hack inside and outside of the UK using “thematic warrants.” This challenge raised an important preliminary question: whether IPT decisions were subject to judicial review in the first place. PI’s substantive challenge was effectively suspended pending the resolution of this issue.
The government argued that the IPT was not subject to judicial oversight. In February 2017, the High Court sided with the government. In November 2017, the Court of Appeal upheld the decision of the High Court.
In 2019, PI won their appeal to the Supreme Court. It reversed the Court of Appeal’s decision and ruled that the Investigatory Powers Tribunal’s (IPT) decisions were subject to judicial review in the High Court. The Supreme Court’s judgment was a major endorsement and affirmation of the rule of law in the UK. The decision guarantees that when the IPT gets the law wrong, its mistakes can be corrected.
To find out more about the Supreme Court judgment see here.
Following the Supreme Court ruling, Privacy International resumed its challenge at the High Court to the IPT’s decision regarding the UK Government’s use of general warrants to interfere with property, including by hacking.
What was our initial IPT challenge about?
PI’s initial claim in the Investigatory Powers Tribunal (IPT) in 2014 was about GCHQ’s computer hacking operations. We argued that GCHQ hacking violates UK law and Articles 8 and 10 of the European Convention on Human Rights, which respectively protect the right to privacy and the right to freedom of expression. In February 2016, the IPT held that GCHQ hacking is lawful under UK law and the European Convention on Human Rights. The IPT further concluded that GCHQ may hack inside and outside of the UK using “thematic warrants.”
Nice. How can I help?
Having strong laws and technology which protect privacy is incredibly important, but the most important thing is that people are aware of the issues and are able to influence powerful companies and governments. You can read more about the case, how such surveillance works, and some of the issues it raises here.
To keep up to date on the case and all PI’s work, you can sign up to their mailing list here – don’t worry, you can choose the topics you are most interested in… and proper care of your data is taken!
As PI is a charity with limited funds, any support you can give them through a donation would be most appreciated – you can do so here.
To reiterate however, to really ensure that we don’t sleepwalk into a world of ubiquitous state and corporate surveillance, it is essential that people put pressure on governments and corporations – so if there’s one thing you can do, it’s make your voice heard!
This article was first published by PI and may be updated here.