Internet surveillance sparks court war

LONDON - Internet service providers from around the world are lodging formal complaints against the UK government's monitoring service, GCHQ, alleging it uses malicious software to break into their networks.

The claims from seven organisations based in six countries – Germany, the Netherlands, South Korea, the UK, the US and Zimbabwe - will add to international pressure on the government after Edward Snowden's revelations about mass surveillance of the internet by UK and US intelligence agencies.

The claims are being filed with the investigatory powers tribunal (IPT), the court in London that assesses complaints about the agencies' activities and misuse of surveillance by government organisations. Most of its hearings are held at least partly in secret.

The IPT is already considering a number of related submissions. Later this month it will investigate complaints by human rights groups about the way social media sites have been targeted by GCHQ.

The government has defended the security services, pointing out that online searches are often routed overseas and those deemed "external communications" can be monitored without the need for an individual warrant. Critics say that such a legal interpretation sidesteps the need for traditional safeguards.

The latest claim is against both GCHQ, located near Cheltenham, and the Foreign Office. It is based on articles published this year in the German magazine Der Spiegel, which alleged that GCHQ had carried out an attack codenamed Operation Socialist on the Belgian telecoms group Belgacom, targeting individual employees with malware (malicious software).

One technique was a "man in the middle" attack, which, according to the documents filed at the IPT, bypasses encryption software and "operates by interposing the attacker [GCHQ] between two computers that believe that they are securely communicating with each other.

"In fact, each is communicating with GCHQ, who collect the communications, as well as relaying them in the hope that the interference will be undetected."

The complaint alleges that the attacks were a breach of the Computer Misuse Act 1990 and an interference with the privacy rights of the employees under the European convention on human rights.

The organisations targeted, the submission states, were all "responsible and professional internet service providers".

The claimants are: the Chaos Computer Club in Germany; Greenhost in the Netherlands; Jinbonet in South Korea; GreenNet in the UK; Riseup Networks and May First/People Link in the US; and Mango Email Service in Zimbabwe.

Their complaint follows articles about mass surveillance in the Guardian based on material released by Snowden.

Among the programs said to have been operating were Turbine, which automates the injection of data and can infect millions of machines, and Warrior Pride, which enables microphones on iPhones and Android devices to be remotely activated.

The action has been supported by Privacy International, a UK charity that defends and promotes the right to privacy across the world. It points out that: "While the claimants were not directly named in the Snowden documents, the type of surveillance being carried out allows them to challenge the practices in the IPT because they and their users are at threat of being targeted."

Eric King, deputy director of Privacy International, said: "These widespread attacks on providers and collectives undermine the trust we all place on the internet and greatly endangers the world's most powerful tool for democracy and free expression.

"It completely cripples our confidence in the internet economy and threatens the rights of all those who use it. These unlawful activities, run jointly by GCHQ and the NSA [National Security Agency], must come to an end immediately."

Cedric Knight of GreenNet said: "Snowden's revelations have exposed GCHQ's view that independent operators like GreenNet are legitimate targets for internet surveillance, so we could be unknowingly used to collect data on our users.

"Our long-established network of NGOs and charities, or simply individuals who value our independent and ethical standpoint, rely on us for a level of integrity they can't get from mainstream ISPs. Our entire modus operandi is threatened by this illegal and intrusive mass surveillance."

Devin Theriot-Orr of Riseup.net said: "People have a fundamental right to communicate with each other free from pervasive government surveillance. The right to communicate, and the ability to choose to do so secretly, is essential to the open exchange of ideas which is a cornerstone of a free society. GCHQ must stop its illegal monitoring activities."

Yeokyung Chang, ICT policy activist at Jinbonet, said: "We are all equal users and citizens in the internet. The right to privacy of users all over the world should be protected equally and should not be infringed by any government."

Sacha van Geffen, CEO of Greenhost, said: "Outsider intrusion such as that of the GCHQ criminalises all the users of the network without legal ground and causes damage to fundamental processes that keep the network running. This illicit activity is not only a blatant violation of human rights but also endangers innocent lives. It must stop at once."

Alfredo López, co-founder of May First/People Link, said: "Using the internet for surveillance and violations of privacy is an obscene betrayal of the reasons for the internet's creation and development."

Jan Girlich at the Chaos Computer Club in Germany said: "The GCHQ's dragnet surveillance takes away all citizens' privacy rights indiscriminately. Thus, not only lawyers, doctors, journalists, and many more people are robbed of their working basis, but everybody is stripped of his or her ability to object to their government's opinion without fear of retribution.

"Monitoring all communications secretively and without any effective control nor checks and balances breaks the foundations on which our modern democracies are based. We are heading towards a police state and the only way to stop this is to bring mass surveillance to an end.