GCHQ’s Alleged Interception of Communications under PRISM

This statement was obtained from the Intelligence and Security Committee of Parliament web site, July 17, 2013.

INTELLIGENCE AND SECURITY COMMITTEE OF PARLIAMENT  Chairman: The Rt. Hon. Sir Malcolm Rifkind, MP   Statement on GCHQ’s Alleged Interception of Communications under the US PRISM Programme  Introduction  1. Over the last month, details of highly classified intelligence-gathering programmes run by the US signals intelligence agency – the National Security Agency (NSA) – have been leaked in both the US and the UK. Stories in the media have focussed on the collection of communications data and of communications content by the NSA. These have included the collection of bulk ‘meta-data’ from a large communications provider (Verizon), and also access to communications content via a number of large US internet companies (under the PRISM programme).  2. The legal arrangements governing these NSA accesses, and the oversight and scrutiny regimes to which they are subject, are matters for the US Congress and courts. However some of the stories have included allegations about the activities of the UK’s own signals intelligence agency, GCHQ. While some of the stories are not surprising, given GCHQ’s publicly acknowledged remit, there is one very serious allegation amongst them – namely that GCHQ acted illegally by accessing communications content via the PRISM programme. What is the PRISM programme? 3. PRISM is a programme through which the US Government obtains intelligence material (such as communications) from Internet Service Providers (ISPs). The US administration has stated that the programme is regulated under the US Foreign Intelligence Surveillance Act (FISA), and applications for access to material through PRISM have to be approved by the FISA Court, which is comprised of 11 senior judges. Access under PRISM is specific and targeted (not a broad ‘data mining’ capability, as has been alleged). 4. Stories in the media have asserted that GCHQ had access to PRISM and thereby to the content of communications in the UK without proper authorisation. It is argued that, in so doing, GCHQ circumvented UK law. This is a matter of very serious concern: if true, it would constitute a serious violation of the rights of UK citizens. Our investigation 5. The ISC has taken detailed evidence from GCHQ. Our investigation has included scrutiny of GCHQ’s access to the content of communications, the legal framework which governs that access, and the arrangements GCHQ has with its overseas counterparts for sharing such information. We have received substantive reports from GCHQ, including: • a list of counter-terrorist operations for which GCHQ was able to obtain intelligence from the US in any relevant area;  • a list of all the individuals who were subject to monitoring via such arrangements who were either believed to be in the UK or were identified as UK nationals;  • a list of every ‘selector’ (such as an email address) for these individuals on which the intelligence was requested;  • a list of the warrants and internal authorisations that were in place for each of these individual being targeted;  • a number (as selected by us) of the intelligence reports that were produced as a result of this activity; and  • the formal agreements that regulated access to this material.  We discussed the programme with the NSA and our Congressional counterparts during our recent visit to the United States. We have also taken oral evidence from the Director of GCHQ and questioned him in detail.  Next Steps  6. Although we have concluded that GCHQ has not circumvented or attempted to circumvent UK law, it is proper to consider further whether the current statutory framework2 7. In some areas the legislation is expressed in general terms and more detailed policies and procedures have, rightly, been put in place around this work by GCHQ in order to ensure compliance with their statutory obligations under the Human Rights Act 1998. We are therefore examining the complex interaction between the Intelligence Services Act, the Human Rights Act and the Regulation of Investigatory Powers Act, and the policies and procedures that underpin them, further. We note that the Interception of Communications Commissioner is also considering this issue.   1 There are other matters arising from the leaks that we are considering, although we note that none alleges – as the PRISM story did – any illegality on the part of GCHQ.  2 The Intelligence Services Act 1994, the Human Rights Act 1998 and the Regulation of Investigatory Powers Act 2000.