The Intelligence Services Act 1994 (ISA) provides the core legal basis for the surveillance activities of the Government Communications Headquarters (GCHQ). [1] As detailed in the Act, GCHQ’s first statutory function is “to monitor or interfere with electromagnetic, acoustic and other emissions and any equipment producing such emissions and to obtain and provide information derived from or related to such emissions or equipment and from encrypted material” (section 3 (1)(a)).
GCHQ’s Director must ensure “that there are arrangements for securing that no information is obtained by GCHQ except so far as necessary for the proper discharge of its functions and that no information is disclosed by it except so far as necessary for that purpose or for the purpose of any criminal proceedings” (section 4(2)). These functions can be exercised ‘in the interests of national security, the economic well-being of the UK,’ and ‘in support of the prevention or detection of serious crime’ (section 3(2)).
The “interests of national security” have been broadly interpreted in UK law. In a leading case, the Court of Appeal agreed with a government submission that national security “is a protean concept, ‘designed to encompass the many, varied and (it may be) unpredictable ways in which the security of the nation may best be promoted’.”[2]
In relation to gaining unauthorised access to computer networks and systems outside the UK, the Intelligence Services Act 1994 provides:
- 7 Authorisation of acts outside the British Islands.
- (1) If, apart from this section, a person would be liable in the United Kingdom for any act done outside the British Islands, he shall not be so liable if the act is one which is authorised to be done by virtue of an authorisation given by the Secretary of State under this section…
- (9) For the purposes of this section the reference in subsection (1) to an act done outside the British Islands includes a reference to any act which—
- (a) is done in the British Islands; but
- (b) is or is intended to be done in relation to apparatus that is believed to be outside the British Islands, or in relation to anything appearing to originate from such apparatus.
ISA also provides the basis for interference with property to add a surveillance mechanism – when access to transmitted data is complex, another means of access is to carry out surveillance at endpoints. This must be authorised by the Secretary of State under s.5 of the ISA for MI5, MI6 or GCHQ.
[1] Accessible at: www.legislation.gov.uk/ukpga/1994/13/contents.
[2] United Kingdom, Court of Appeal (2003) Secretary of State for the Home Department v Rehman [2003] 1 AC 153.