Karma Police: From Facebook to porn, GCHQ surveillance tool tracked browsing history of every web user

A mass surveillance operation undertaken by a UK intelligence agency that recorded the web browsing habits of "every visible user on the internet" has been disclosed. According to documents obtained by National Security Agency (NSA) whistle-blower Edward Snowden, the Karma Police operation saw Government Communications Headquarters (GCHQ) store up to 100 billion metadata records on people's internet habits – tracking everything from porn sites visited, to mobile phone locations.

The documents, published on 25 September by The Intercept, reveal for the first time the details of the UK government's online spying capabilities. Having been drawn up in 2007 or 2008, the Karma Police operation built profiles through analysing browsing habits, emails, calls, text messages, social media interactions and geolocation data.

Roughly 50 billion metadata records about browsing activity and online communications were stored in 2012, with documents revealing that GCHQ intended to boost this to 100 billion by the end of the year. GCHQ has previously stated that it does not comment on matters relating to practices exposed by Snowden's leaks and it is unclear whether the operation is still live.

The latest revelations have already drawn condemnation and raised concerns about the Investigatory Powers Bill announced earlier this year in the Queen's Speech. Privacy advocates criticised the opaque legal regime that allows GCHQ to monitor people across 185 different countries without the need for a court order or judicial warrant.

"These latest revelations confirm that, despite the government's denials, the security services are engaged in mass surveillance and the law is failing to protect our privacy," Javier Ruiz, policy director of Open Rights Group, told IBTimes UK.

"Legal reform is needed urgently to close down loopholes that allow the wholesale collection and analysis of our personal metadata, which can be as revealing as the content of our private communications. The new Investigatory Powers Bill should be an opportunity to bring in proper safeguards – not an attempt to increase the state's surveillance powers."

The Investigatory Powers Bill is expected to include elements of the previous Communications Data Bill and could well give new internet surveillance powers to intelligence agencies. Following the terror attacks in Paris in January, UK prime minister David Cameron pledged to extend UK data surveillance laws in the country, while the loophole in the law that allows mass online surveillance to take place without criminal repercussions is yet to be closed.