How to improve the oversight of GCHQ
(Guardian Web Via Acquire Media NewsEdge) "Stronger oversight" is frequently demanded as a way of reassuring people about the spying activities and conduct of GCHQ. The problem is that trust has been lost in the current mechanisms: parliament's intelligence and security committee (ISC) lacks the necessary knowledge and experience and is woefully under-resourced; the interception and intelligence commissioners have a limited remit and are also reluctant to challenge the spooks; senior politicians who sign warrants are unlikely to have the necessary background to ask tough questions, particularly in relation to the effects of changing technologies.
Some tightening of UK and EU data protection laws may be desirable but, in the end, who wants to be going to the courts all the time?
The key bits of the two most important pieces of legislation in this area, the Regulation of Investigatory Powers Act (Ripa) and the Intelligence Services Act, will always require flexible interpretation. There is no perfect oversight solution – any new regime will still lack total transparency – and will involve individuals, almost certainly with high levels of security clearance, sitting in secret.
But it is important to ask: what do we want oversight to achieve? Similarly, it is necessary to test the current assessment of the threat and whether this justifies the levels of agencies current intrusion (and expenditure).
It is worth noting there have been fewer than 60 mainland deaths from domestic terrorism since 1989. In 2005, when 52 people died in the London bombings, another 3,201 died in traffic accidents. Is terrorism the persistent existential threat so often used to justify whole-population surveillance?
While it might be desirable for GCHQ to "master the internet", the range and extent of material now available for harvesting, plus the ease of large-scale data mining, changes the intrusion equation. Is "you never know, all this data might be useful someday" a good enough reason to initiate large schemes for mass collection? And do we really think that intrusion only occurs when globally collected data is actually searched?
There are circumstances when encryption must be broken but, after Edward Snowden's revelations, trust in e-commerce, e-banking and routine business confidentiality precautions, all reliant on crypto and all essential to the economy, is under threat. Who understands and tests GCHQ's judgments on the balance of risk in these matters?
There is probably not a perfect oversight regime to satisfy all the competing interests, but there is great scope for improvements. In my view, ministers should retain operational authorisation for agency activities – but warrants for interception, including the broad-based section 8(4) Ripa "certificated" warrants – should be passed for approval to a court, with short-term provision for retrospective warrant-granting in emergencies. The government should publish an annual fact-based national threat assessment rather than the current simplistic references to "moderate", "substantial" and "severe".
The ISC should become a proper select committee of the Commons and Lords with no pre-nomination by the prime minister and preferably with a robust chair person. It should have extended permanent staff, including a privacy advocate and academic technical experts not drawn from the intelligence community. And the ISC should hold at least one public session a year with the heads of the agencies and also with key ministers who should provide full, candid information in secret sessions.
In addition, all future annual ISC reports should cover the changing strategic objectives of agencies and address issues such as transparency, value for money, impact of technological change and commentary on intrusion limitation. The committee should have powers to demand access without the current limitation of potential ministerial veto, as well as the power of no-notice visits.
The intelligence service commissioners should be given more resources and be authorised to publish the types, purpose and quantity of the interception warrants that have been approved. Meanwhile, GCHQ should also follow the NSA and appoint a civil liberties and privacy officer to advise on all aspects of strategy. Snowden's documents provided details of what the agencies can and are seeking to do. Now that some of that detail is in the public domain GCHQ can, paradoxically, be more candid in discussing some of its activities and judgements. And, rather than concentrating on Snowden's "traitorous" nature, perhaps the debate should now turn on ways to achieve greater public support and legitimacy.
(c) 2013 Guardian Newspapers Limited.
[ Back To Technology News's Homepage ]