GCHQ broke the law for 17 years… spying on UK citizens

Law enforcement agencies should not be above the law.

Graham Cluley
Graham Cluley
@[email protected]

GCHQ broke the law for 17 years... spying on UK citizens

For more than 17 years British security and intelligence agencies broke the law, illegally collecting vast amounts of data about UK citizens without proper oversight.

That’s the judgement of the Investigatory Powers Tribunal (IPT), the only court that hears complaints against MI5, MI6 and GCHQ, after human rights campaigners at Privacy International launched a legal complaint in June 2015.

The IPT’s ruling has declared that the agencies’ collection of bulk communications data (BCD) – the metadata, or “who, when, where and how” of telephone and internet use – was unlawful from its commencement in March 1998 until November 2015.

Sign up to our free newsletter.
Security news, advice, and tips.

Some may think that such metadata can do little harm, but that couldn’t be further from the truth as a huge amount of information can be extrapolated.


Meanwhile, the collection and retention by British security agencies of bulk personal datasets (BPD) – which might include details of innocent people’s biographical details, financial and commercial activities, communications and travel data – was also ruled unlawful between “circa 2006” and March 2015.

The revelation of BPDs was finally made public in a report by the UK parliament’s Intelligence and Security Committee.

These BPDs are “large databases containing personal information about a wide range of people”, used to “identify individuals during the course of their investigations, to establish links between Subjects of Interest, and to verify information that they have gathered through other means”.

Some of the data collection failed to comply with article 8 of the European Convention on Human Rights – the basic human right to privacy.

So, what changed in 2015 to make the intelligence agencies’ activities suddenly lawful?

Wired explains that Theresa May (then Home Secretary, and now Prime Minister) had a part to play:

When Theresa May, as Home Secretary, introduced the controversial Investigatory Powers Bill – to reform the UK’s surveillance laws – in November 2015, it was admitted that the bodies used Section 94 of the Telecommunications Act 1984 to collect data under both the BCD and BPD regimes. The tribunal said a number of opportunities to admit to this before 2015 had not been taken.

The powers put in place in 2015 were deemed lawful by the tribunal. However, it is not known what will happen to data collected under the unlawful regimes.

The full 70-page ruling can be found on the IPT’s website.

Remember this – just because you’re a law enforcement agency doesn’t mean you should be above the law.

It’s hard to imagine that anything would have been done to bring the unlawful actions of British intelligence agencies to the public’s attention if it hadn’t been for the revelations made by former NSA contractor Edward Snowden.

He was the one who blew the whistle. And once again, his actions are vindicated.

Meanwhile, the British government pushes ahead with the controversial Investigatory Powers bill – commonly known as the snooper’s charter.

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

3 comments on “GCHQ broke the law for 17 years… spying on UK citizens”

  1. David L

    Welcome to George Orwell's 1984, a little late, but not fully implemented just quite yet, but soon will be. Technology is exceeding our capacity to keep up, and thus, we as a society are loosing our grip. There are too many moving parts, and the lawmakers are woefully ill-equipped and uneducated to deal effectively with this massive machine. Thank God there are groups out there fighting for our rights. But, while they may stop, or slow down one aspect, there are several more programs working behind the scenes to get around any road block, or hurdle. My worst suspicions are that, this information can be, and or is being used against political opponents to blackmail, extort, cooperation to achieve whatever aims the power brokers deem necessary. Corruption is rampant in many jurisdictions all over the world, and it's hard to see things getting any better, anytime soon. )-:

  2. gezzerx

    Like America Government Politicians & Bureaucrats brake the law & no one is prosecuted & sent to jail ! !

  3. coyote

    'Law enforcement agencies should not be above the law.'

    But remember should isn't always reality; unfortunately those enforcing the law are above the law and more importantly those who create the laws adapt the laws as it fits their agenda. Hence ruling by decree etc. (Also there are loopholes in laws to consider). The fact it doesn't always happens is besides the point.

    Like it or not this is reality.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.