GCHQ allows spying on Facebook, Twitter

Britain’s top counter-terrorism official says the country’s espionage rules allow its electronic spy agency to routinely intercept online communications between Britons who use US-based platforms such as Facebook, Twitter and Google.

A witness statement by the Office for Security and Counter-terrorism chief Charles Farr said data sent on those services was classed as “external” rather than “internal” communications because the companies were based outside Britain.

Britain’s Home Office confirmed the document was genuine.

It was written in response to a legal action by civil liberties groups who are seeking to curb cyber-spying, and was published by the groups yesterday.

Britain’s electronic intelligence agency, GCHQ, has broad powers to intercept communications outside the country, but needs a warrant and suspicion of wrongdoing to monitor Britons.

In the document, Farr said some internal communications were intercepted under the external rules, but they “cannot be read, looked at or listened to” except in strictly limited circumstances. He said that was a “significant distinction”.

He says: “Any regime that … only permitted interception in relation to specific persons or premises, would not have allowed adequate levels of intelligence information to be obtained and would not have met the undoubted requirements of intelligence for the protection of national security.”

Civil liberties organisations say the rules were too vague and allowed for mass surveillance.

“The security services consider that they’re entitled to read, listen to and analyse all our communications on Facebook, Google and other US-based platforms,” said James Welch, legal director of Liberty — one of the groups involved in the legal action. “If there was any remaining doubt that our snooping laws need a radical overhaul, there can be no longer. The agencies now operate in a legal and ethical vacuum; why the deafening silence from our elected representatives?”

Farr said that emails sent between two people in Britain would usually be classed as internal even if they travelled by a route outside the country.

But Facebook and Twitter posts or Google searches that went to data centres outside Britain would fall under the external category.

GCHQ did not immediately respond to a request for comment.

The rights groups launched their legal action after leaks about cyber-snooping from former US National Security Agency (NSA) contractor Edward Snowden.

He revealed details of a program called Prism, giving the NSA access to internet companies’ customer data, and a British operation, Tempora, that allows GCHQ to harvest data from undersea cables.

The extent and mechanics of the programs are not fully clear.

Farr would not confirm or deny the existence of Tempora or say whether GCHQ had received information from Prism.

Michael Bochenek, senior director of international law and policy at Amnesty International, said: “British citizens will be alarmed to see their government justifying industrial-scale intrusion... The public should demand an end to this wholesale violation of their right to privacy.”

Meanwhile, the GCHQ said it would start to share classified cyber threat information with private companies amid concerns over increasingly sophisticated targeting of businesses by hackers.

The announcement came a day after a cabinet minister revealed that a “state-sponsored” group had recently hacked into the British government’s own internal network.

Britain regards cyberspace as “a top-tier national security priority” and key sectors, including finance, energy and transport, have been told to improve their defence against disruption to essential services by hackers.