\n
![](\"https:\/\/i0.wp.com\/rsoftsolution.com\/blog\/wp-content\/plugins\/RSSPoster_PRO\/cache\/ef978_p1040182.jpg?w=640&ssl=1\")
<\/p>\n
\n<\/p>\n
Privacy rights group Privacy International says<\/a> it has obtained evidence for the first time that UK spy agencies are collecting social media information on potentially millions of people.<\/p>\n It has also obtained letters it says show the intelligence agencies\u2019 oversight body had not been informed that UK intelligence agencies had shared bulk databases of personal data with foreign governments, law enforcement and industry \u2014 raising concerns about effective oversight of the mass surveillance programs.<\/p>\n The documents have come out as a result of an ongoing\u00a0legal challenge\u00a0<\/a>Privacy International has brought against UK intelligence agencies\u2019 use of bulk personal data collection as an investigatory power. (The group also has various other active legal challenges, including to state hacking<\/a>).<\/p>\n It says now that the Investigatory Powers Commissioner\u2019s Office (IPCO) oversight body \u201csought immediate inspection when secret practices came to light\u201d as a result of its litigation.<\/p>\n The use by UK spooks of so-called bulk personal datasets (BPDs) \u2014 aka massive databases of personal information \u2014 was only publicly revealed in March 2015<\/a>, via an Intelligence and Security\u00a0Committee\u00a0report, which also raised various concerns about their use.<\/p>\n Although the report revealed the existence of BPDs it was heavily redacted \u2014 for example scrubbing info on exactly how many BPDs are\u00a0held by the different agencies. Nor was it clear where exactly agencies were sourcing the bulk data from.<\/p>\n It did specify that the stored and searchable data can\u00a0include\u00a0details\u00a0such as an individual\u2019s religion, racial or ethnic origin,\u00a0political views, medical condition, sexual orientation, and\u00a0legally privileged,\u00a0journalistic or \u201cotherwise confidential\u201d information. It also specified that BPDs \u201cvary in size from hundreds to millions of records\u201d, and can be acquired by \u201covert and covert channels\u201d.<\/p>\n A key concern of the committee at the time was that rules governing use of the datasets had not been defined in legislation\u00a0(although the UK government has since passed a new investigatory powers framework<\/a> that enshrines various state surveillance bulk powers in law).<\/p>\n But at the time of the report, privacy issues and other safeguards pertaining to BPDs had not been considered in public or parliament.<\/p>\n While access to BPD data had been authorized internally without ministerial approval. And there were\u00a0no legal penalties for misuse \u2014 and perhaps unsurprisingly the report also revealed all intelligence agencies had dealt with cases of inappropriate access\u00a0of BPDs.<\/p>\n The documents obtained by Privacy International now put a little more meat on the bones of BPDs. \u201cNew disclosure reveals that the UK intelligence agencies hold databases of our social media data,\u201d the group writes today. \u201cThis is the first confirmed concrete example of the type of information collected by the UK intelligence agencies and held in large databases.<\/p>\n \u201cThe social media database potentially includes information about millions of people,\u201d it further writes, adding: \u201cIt remains unclear exactly what aspects of our communications they hold and what other types of information the government agencies are collecting, beyond the broad unspecific categories previously identified such as \u2018biographical details\u2019, \u2018commercial and financial activities\u2019, \u2018communications\u2019, \u2018travel data\u2019, and \u2018legally privileged communications\u2019.\u201d<\/p>\n In one of the new documents \u2014\u00a0a draft report\u00a0<\/a>from last month summarizing the findings of a 2017 audit of the operation of BPDs \u2014 the IPCO, which only took over oversight duties for UK investigatory powers last month<\/a>, makes a stated reference (below) to \u201csocial media data\u201d when discussing how agencies handle different BPD databases; indicating that content from consumer social networks such as Facebook and Twitter is indeed ending up within spy agencies\u2019 bulk databases. (Though no services are mentioned by name.)<\/p>\n Additional documents in the new bundle obtained by Privacy International show the\u00a0IPCO flagging the role of private contractors that are given \u2018administrator\u2019 access to the information UK intelligence agencies\u2019 collect \u2014 and raising\u00a0concerns that there are currently no safeguards in place to prevent misuse of the systems by third party contractors.<\/p>\n Part of the UK government\u2019s defense to the group legal challenge over intelligence agencies\u2019 use of BPDs is that there are effective safeguards in place to prevent misuse. But Privacy International\u2019s contention is that the new documents<\/a> show<\/a> otherwise<\/a> \u2014 with the IPCO stating the Commissioner was never made aware of any practice of GCHQ sharing bulk data with industry.<\/p>\n Commenting in a statement,\u00a0Privacy International solicitor Millie Graham Wood said: \u201cThe intelligence agencies\u2019 practices in relation to bulk data were previously found to be unlawful<\/a>. After three years of litigation, just before the court hearing we learn not only are safeguards for sharing our sensitive data non-existent, but the government has databases with our social media information and is potentially sharing access to this information with foreign governments.<\/p>\n \u201cThe risks associated with these activities are painfully obvious. We are pleased the IPCO is keen to look at these activities as a matter of urgency and the report is publicly available in the near future.\u201d<\/p>\n The six additional documents were disclosed to Privacy International on October 13, which also notes it is back in court today for the BPDs litigation.<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/rsoftsolution.com\/blog\/wp-content\/plugins\/RSSPoster_PRO\/cache\/a62c6_screen-shot-2017-10-17-at-3-59-57-pm.png?resize=595%2C134&ssl=1\")
<\/a><\/p>\n![\"\"](\"https:\/\/i0.wp.com\/rsoftsolution.com\/blog\/wp-content\/plugins\/RSSPoster_PRO\/cache\/a62c6_screen-shot-2017-10-17-at-4-18-29-pm.png?resize=614%2C657&ssl=1\")
<\/a><\/p>\n