The Scottish Government is under pressure to reveal what it knew about the unlawful collection of people’s data by Scots police forces through a secret GCHQ spy project called MILKWHITE.
A landmark ruling by the European Court of Human Rights (ECHR) this week said that GCHQ’s methods in carrying out bulk interception of online communications, violated privacy and failed to provide sufficient surveillance safeguards.
In 2016 we published top secret documents from Edward Snowden revealing that a shadowy surveillance unit called the Scottish Recording Centre (SRC) was given access to a secret GCHQ spy project called MILKWHITE.
MILKWHITE was set up by GCHQ to allow police to spy on citizens albeit without any new legislation in place to protect civil liberties.
As part of MILKWHITE, GCHQ made metadata available to MI5, the Metropolitan Police, Her Majesty’s Revenue and Customs, the Serious Organized Crime Agency (now the National Crime Agency) and the Police Service of Northern Ireland, as well as the eight former Scottish police forces.
The SRC was a police project that allowed Scottish forces to access metadata for information about people’s phone calls and emails.
This week, however, the ECHR ruled after considering three aspects of digital surveillance by the state: bulk interception of communications, intelligence sharing, and obtaining communications data from communications service providers.
By a majority of five to two votes, the Strasbourg judges found that GCHQ’s bulk interception regime violated article 8 of the European convention on human rights, which guarantees privacy.
The judges said there were insufficient safeguards and rules governing the selection of “related communications data” were deemed to be inadequate.
The ruling was welcomed by civil liberty campaigners who had challenged the UK Government in court.
They included The Bureau of Investigative Journalism (The Bureau) which said it would force the UK Government to review how it intercepts journalists’ communications, and to put better safeguards in place to ensure that a journalist can properly protect their sources.
Questions have now been raised over what the Scottish Government knew about MILKWHITE and if any action would be taken against senior police officers working with SRC and involved in privacy breaches.
Scottish ministers have never disclosed what, if anything, they knew about Milkwhite. They and the police should clarify if there has been assessment of whether the data processed by the Scottish Recording Centre was acquired lawfully.
Liam MacArthur, Scottish Liberal Democrats
Scottish Liberal Democrat justice spokesperson Liam McArthur MSP said: “The security services do critical work in keeping us safe but this verdict indicates that they majorly overreached on this occasion.
“It is essential that all law enforcement bodies comply with human rights legislation and that police in Scotland aren’t complicit with any activities that would undermine civil liberties.
“To my knowledge, Scottish ministers have never disclosed what, if anything, they knew about Milkwhite. They and the police should clarify if there has been assessment of whether the data processed by the Scottish Recording Centre was acquired lawfully.”
Richard Haley, chair of civil liberties organisation, Scotland Against Criminalising Communities, welcomed the ECHR judgement.
He said: “Scottish police should have recognised from the outset that this kind of surveillance was likely to turn out to be illegal, and was in any case just plain wrong. Police Scotland now need explain what use they made of their access to data acquired through GCHQ’s bulk interception programme, and how that use was regulated.
“Action needs to be taken against senior police officers who authorised the use of data gathered by GCHQ. The Scottish Government also has questions to answer. How much did it know about all this?
The Bureau said that ECHR’s ruling would force ministers to review how it intercepts journalists’ communications, and to put better safeguards in place to ensure that a journalist can continue to protect their sources.
The Bureau was specifically concerned about the chilling effect that mass surveillance may have on whistleblowers seeking to reveal wrongdoing to investigative journalists, and the difficulty of guaranteeing a source’s anonymity when communications are being monitored in such a “pervasive way”.
Rachel Oldroyd, The Bureau’s managing editor, said: “The Bureau believes the freedom of the press is a vital cornerstone of democracy and journalists must be able to protect their sources.
“We are particularly concerned about the chilling effect that the threat of state surveillance has on whistleblowers who want to expose wrongdoing, and this ruling will force our government to put safeguards in place. It is an extremely good day for journalism.”
Although the UK government replaced the contested Ripa powers with the Investigatory Powers Act (IPA) in November 2016, campaigners said the judgement would provoke questions about the spying capabilities granted by the more recent legislation.
A UK Government spokesperson said the IPA provided better privacy protections than Ripa, but it would give “careful consideration” to the European court’s findings.
The ruling comes as part of a five-year challenge to the UK’s broad and intrusive spying powers, which were first revealed by the US whistleblower Edward Snowden in 2013.
The case was brought by Amnesty International, Liberty, Privacy International and 11 other human rights and journalism groups – as well as two individuals – based in Europe, Africa, Asia and the Americas.
Police Scotland ordered to improve after probe into covert work
Police Scotland was created on 1 April 2013 and is an interception agency as described within the Regulation of Investigatory Powers Act (RIPA) 2000 and associated Code of Practice.
The force is subject of inspection and oversight by the Investigatory Powers Commissioners Office.
Police Scotland said in a statement: “Police Scotland does not comment on matters relating to intelligence agencies.”
A Scottish Government spokeswoman said: “The data-sharing arrangements entered into by the Police Service of Scotland and its partners are an operational matter for the parties concerned. This legislation is reserved to the UK Government and the UK Investigatory Powers Commissioner provides independent oversight of the use of these powers.”
