Top secret documents revealing that Scots police forces had access to a GCHQ spy programme collecting information on people’s communications, movements and use of social media, are published today by The Ferret.
The newly released classified documents came from US whistle-blower Edward Snowden and reveal that a previously unknown surveillance unit called the Scottish Recording Centre (SRC) was given access to a classified GCHQ project called MILKWHITE.
The SRC was a police project that allowed Scottish forces to access metadata for information about people’s phone calls and emails.
MILKWHITE was also storing data on people’s usage of smartphone apps such as WhatsApp and Viber and instant messenger services such as Jabber.
GCHQ’s definition of metadata is broad and includes location data that can be used to track people’s movements, login passwords and website browsing histories.
MILKWHITE was set up by GCHQ to allow police to spy on citizens albeit without any new legislation in place to protect civil liberties, controversial surveillance powers the UK Government is now currently seeking under the Investigatory Powers Bill, aka the snooper’s charter, which the House of Commons passed last week by 444 votes to 69.
The House of Lords will now consider the proposed the Investigatory Powers Bill and, if passed, the law will come into effect in January 2017.
As part of MILKWHITE, GCHQ made vast amounts of metadata available to MI5, the Metropolitan Police, Her Majesty’s Revenue and Customs, the Serious Organized Crime Agency (now the National Crime Agency) and the Police Service of Northern Ireland, as well as the eight former Scottish police forces.
One document said that Milkwhite is a “support system” for Home Office plans to modernise its domestic interception capabilities as part of a Communications Capability Development Programme.
The spy program was active by September 2009 and still running in 2012 but both GCHQ and Police Scotland have refused to say whether MILKWHITE is on-going.
However, the confidential files said GCHQ was seeking £20.8m to update an “advanced analytics” section around 2011/12 due to “increasing customer demand” and Police Scotland remains an interception agency.
Access to metadata was provided to Scottish police forces through an “internet data unit” hosted by the Serious Organized Crime Agency.
The project gave police the ability to sift through vast amounts of metadata to find internet “selectors” for surveillance targets, including usernames and/or IP addresses that can be used to monitor a person’s online activities.
The top secret documents were passed to a US website called The Intercept by former CIA employee Snowden who is in exile in Russia after exposing the surveillance activities of America’s National Security Agency in 2013.
The Ferret is grateful to The Intercept for sharing the source documents that have relevance to Scottish law enforcement agencies.
Another document leaked by Snowden reveals that UK spies may have put lives at risk because surveillance systems were gathering more data than could be analyzed, allegedly leading them to miss clues to potential security threats.
Politicians and civil liberty groups have expressed concern and demanded answers over who knew what about SRC.
John Finnie MSP, Justice spokesperson for the Scottish Greens, said he would raise the matter with the Scottish Government.
It's apparent that this blanket surveillance lacks any proportionality, is highly inefficient and has little, if indeed any, legal basis. John Finnie MSP
He added: “Whilst the public will readily understand the need to monitor threats to public safety, it’s apparent that this blanket surveillance lacks any proportionality, is highly inefficient and has little, if indeed any, legal basis.”
“Only this week we have seen Conservative and Labour MPs walk hand in hand through the lobby at Westminster to pass the Investigatory Powers Bill, in the face of strong, evidenced and principled opposition from Greens, SNP, Plaid and the SDLP.”
“Ironically we also learn that at a leaked report from 2012 says that GCHQ doesn’t need those new powers anyway and that tells you all you need to know about how out of hand this industrial intrusion on citizens’ privacy has become.”
“I also learn from those reports that a Scotland-based surveillance unit called the Scottish Recording Centre was part of this intrusive mix and that parliamentarians may have been misled about how this mass data has been handled.
“Everything points to this UK wide surveillance machine as being both out of control and entirely incompatible with the European Convention on Human Rights.”
Liberal Democrat Home Affairs spokesman Alistair Carmichael MP said: “Days after the Tories and the Labour party backed a snoopers charter that will see our online activity recorded for a year, we learn that a secret Scottish facility could have been trawling though our information with no real oversight as long ago as 2009.”
“Our intelligence services do vital work in keeping us safe but that does not mean they should have carte blanche to invade our privacy.”
“We need to know who within the UK and Scottish Governments was aware of this work and what safeguards – if any – were in place to ensure Scottish workers were not complicit in breaking privacy laws.”
Richard Haley of civil liberty group Scotland Against Criminalising Communities, said: “It appears that Milkwhite shares metadata from communications by British people that GCHQ acquires in the course of eavesdropping on foreign communications, for example via international cables.”
“This practice is a massive intrusion on our privacy and has been hugely controversial.
“Do Police Scotland have all this information at their fingertips? Are they free to make speculative trawls through it? Can officers access it any time they wish through their hand-held computers? If not, how is their use of it regulated?
“And what about the Scottish Government? Did it know of the involvement of Scottish Police in Milkwhite? If not, why not? And if they did, why didn’t they sound the alarm?”
GCHQ said: “It is long standing policy that we do not comment on intelligence matters. Furthermore, all of GCHQ’s work is carried out in accordance with a strict legal and policy framework, which ensures that our activities are authorised, necessary and proportionate, and that there is rigorous oversight, including from the Secretary of State, the Interception and Intelligence Services Commissioners and the Parliamentary Intelligence and Security Committee.”
“All our operational processes rigorously support this position. In addition, the UK’s interception regime is entirely compatible with the European Convention on Human Rights.”
A Scottish Government spokesperson said: “This is an operational matter for the Police Service of Scotland.”
A spokesperson for Police Scotland said: “Police Scotland does not discuss intelligence matters.”