Secret GCHQ spy programme 'Milkwhite' collected UK social media data to share with MI5

Since at least 2009, a number of law enforcement agencies in the UK have had access to troves of metadata collected by British signals intelligence outfit GCHQ with the use of a highly secretive spy programme called 'Milkwhite'.

The previously undisclosed programme was described in documents leaked by former NSA-contractor Edward Snowden and published by The Intercept. It reportedly involves the collection of records belonging to domestic UK citizens – including metadata from social media platforms like Facebook, LinkedIn and chat services such as WhatsApp.

What is interesting about the set-up of the program is the access it granted to other law enforcement and intelligence agencies to aid in their own investigations – including MI5, London's Metropolitan police, the Police Service of Northern Ireland (PSNI), the Serious Organised Crime Agency (now the National Crime Agency) and HMRC.

The access was facilitated by a SOCA-hosted division dubbed the "Internet Data Unit" and the document notes that SOCA and HMRC received information through "business as usual" channels. It did not elaborate further on how the data sharing was structured.

Details of the metadata collection and storage programme surfaced on the same day as the UK parliament was discussing the merits of the Investigatory Powers Bill – also known as the Snoopers' Charter – which is a surveillance bill that aims to bolster the spying powers of police and intelligence agencies while giving parliament more oversight into the actions of UK spooks.

For the first time, however, the latest Snowden revelations demonstrate the close-knit data sharing relationship already enjoyed by UK agencies. Based on one document, Milkwhite is a "support system" to internal Home Office plans to modernise its domestic interception capabilities – as part of the so-called 'Communications Capability Development Programme' (CCCP).

And business, at least in 2011/12, was booming. The document states the agency expected the programme to grow "to keep pace with increasing customer demand." As reported by The Intercept alongside publication of the confidential files, the agency was seeking £20.8m to update an "advanced analytics" section at the time.

Domestic spying

GCHQ, which is primarily charged with conducting external 'foreign intelligence' gathering, also conducts partial domestic surveillance due to a number of legal technicalities. As previously reported, the agency considers any communication that leaves the UK borders to be 'external'. Because of this, reams of UK citizen data is intercepted as it travels to data centres in Ireland or the Netherlands, for example.

In one document, the agency notes: "We also do some domestic interception as part of our SIGNIT [signals intelligence] mission." As an aside, it was revealed in 2014 that UK spies have legal backing to snoop on metadata from technology firms like Google, Facebook and Twitter – all because the information leaves the UK and is considered an external communication.

The sensitive metadata routinely collected by GCHQ – which is the information describing communications rather than the actual content – relates to phonecalls, emails and social media updates. It is this data on UK citizens that is reportedly being made available to UK law enforcement and even the taxman through Milkwhite – or at least it was at the time of the documents.

UK law enforcement and intelligence agencies have long complained that technology is hampering investigations and this is one excuse often provided for the upcoming Snoopers' Charter – which is expected to be implemented by the end of 2016 when the sunset clause expires on the current DRIPA law.

However, internal messages show that GCHQ has long known it doesn't need an enhanced law to operate effectively.

One document reveals the agency is "not dependant" on the introduction of any new surveillance law however states such powers are of "greater importance to a range of UK law enforcement agencies and HGM [Her Majesty's Government]."

Speaking about the challenges faced by passing new surveillance law in the UK, it added: "The development of the National Crime Agency (NCA) will be crucial."

It appears that Milkwhite – full title Milkwhite Enrichment Service (MES) – was brought in to serve this data sharing purpose in the meantime. It remains unclear if the politicians in parliament are even aware of its existence.

Of course, Home Office officials, including Home Secretary Theresa May, is on record claiming the upcoming Investigatory Powers Bill, in terms of bulk collection, contains no new powers and instead will merely bring various spying legislation under one umbrella with greater oversight.In any case, the truth becomes more complex with every new spy programme that is revealed.

In response to the latest Snowden release, GCHQ issued a blanket statement. It said: "It is long-standing policy that we do not comment on intelligence matters. Furthermore, all of GCHQ's work is carried out in accordance with a strict legal and policy framework, which ensures that our activities are authorised, necessary and proportionate."

IBTimes UK has contacted the Home Office and the NCA for comment and will update this post accordingly.

On the evening of Tuesday, 7 June, the Investigatory Powers Bill passed through the House of Commons after gaining support from the Labour Party once a number of proposed amendments were met. In total, 444 MPs voted in favour of the bill after the third reading with the SNP, Liberal Democrats, and the Green Party voting in opposition. It now proceeds to the House of Lords.