GCHQ HQ
Cheltenham-based GCHQ faces legal challenge. (Reuters) Reuters

The government's eavesdropping agency, GCHQ, faces a legal complaint by a privacy campaigning group that claims it illegally hacked into users' computers or mobile phones without their consent.

Privacy International filed a claim at the UK's investigatory powers tribunal demanding a halt to GCHQ and the American counterpart NSA's "unlawful" hacking techniques.

The scope of GCHQ's digital intruding was revealed by whistleblower Edward Snowden, who leaked documents detailing how the government's monitoring agency and the NSA was using malware to conduct surveillance far more intrusive than the interception of communications.

Among the agency's capabilities listed by Privacy International are:

  • take over a device's microphone and record conversations taking place near the device (NOSEY SMURF);
  • take over a device's webcam and snap photographs (GUMFISH);
  • record Internet browsing histories and collect login details and passwords used to access websites and email accounts (FOGGYBOTTOM);
  • log keystrokes entered into a device (GROK);
  • extract data from removable flash drives that connect to an infected computer (SALVAGERABBIT);
  • identify the geographic whereabouts of the user (TRACKER SMURF); and
  • retrieve any content from a phone, including text messages, e-mails, web history, call records, videos, photos, address books, notes, and calendars.

Privacy campaigners argue that these forms of invasive surveillance are "the modern equivalent of wiretapping" or "entering someone's house, searching through his filing cabinets, diaries and correspondence, and planting devices to permit constant surveillance in future".

The intrusion also leaves the devices "more vulnerable to attack by third parties (such as credit card fraudsters)". "It is the modern equivalent of breaking in to a residence and leaving the locks broken or damaged afterwards," Privacy says.

The activities of GHCQ are alleged to be in breach of article 8 and 10 of the European Convention on Human Rights (ECHR) which protects the rights to privacy and freedom of expression.

Hacking is also a criminal offence in the UK under the Computer Misuse Act 1990, although Privacy International "accepts that, in principle, surveillance may be conducted for legitimate aims such as national security".

"The issue is therefore whether the interference is 'in accordance with the law' or 'prescribed by law', and whether it is necessary and proportionate," it said.

The IPT, a partially secret court, has extensive powers to demand to see all relevant intelligence and evidence, the Guardian reports.

Related
Hacking