Snowden leak reveals Scottish links to GCHQ spy programme

Documents revealing Scottish police had access to a GCHQ spy programme which collects information on individuals’ communications, use of social media and movements have been passed on to The Ferret.

The documents, revealing the existence of GCHQ’s project MILKWHITE, come from US whistleblower and former National Security Agency (NSA) contractor Edward Snowden and also reveal the existence of a surveillance unit – the Scottish Recording Centre (SRC) – which was granted access to the project.

The SRC had access to metadata regarding phone calls as well as emails. GCHQ defines metadata widely and it includes, among other things, passwords and website browsing histories.

MILKWHITE also retained information on individuals’ use of phone apps including WhatsApp, Viber and Jabber.

Established without any safeguards on civil liberties, MILKWHITE gave the authorities powers which the UK government now seeks to put on a statutory footing through the Investigatory Powers Bill, which was passed by 444 votes to 69 in the House of Commons last week.

If the House of Lords passes the bill, also known as the Snoopers’ Charter, it will become law next January.

It is unknown whether MILKWHITE is still in operation, however it was active between September 2009 and was still running in 2012

The project allowed police to sift through masses of metadata in order to find “selectors” for targets. These included usernames and/or IP addresses.

The documents were passed to The Intercept by Mr Snowden, who lives in exile in Russia following his 2013 revelations about the NSA’s mass spying programmes.

Speaking to Scottish Legal News, Dr Nick McKerrell, lecturer in law at Glasgow Caledonian University, called the revelations an “outrage”.

He added: “Day after day there are new revelations about two aspects of the state which should cause concern to Scottish citizens.

“One is the blanket surveillance of people and their communications which these papers show has been going on for as long as seven years. The right to privacy is not just an empty phrase here.

“Secondly it shows the continued lack of accountability of Police Scotland - although this monitoring predates the formation of the single force it has continued under their auspices.

“Further, the lack of proper scrutiny means the Scottish government can dismiss it as an operational matter and Scottish people will have no remedy or route to raise their concerns at this outrage.”

Pol Clementsmith, trainee solicitor with John Pryde & Co and advisory council member of the Open Rights Group (ORG) told SLN the UK government’s attempts to enshrine bulk collection powers in law “would make Big Brother blush”.

He also expressed caution about Police Scotland’s reticence on the issue, saying: “ORG Scotland have concerns about the SRC and MILKWHITE projects and the fact that Police Scotland are remaining tight lipped by citing ‘intelligence matters’ as their main reason for not commenting on these practices should fill us all with a real sense of dread.

“Clear lines need to be drawn in the digital sand otherwise we will find ourselves walking into a surveillance state and these recent leaks confirm that Scots might already be living in one.”

Mr Clementsmith also called for openness on the retention and use of individuals’ data and for the creation of a digital watchdog.

He said: “ORG Scotland believes that we should be asking exactly who is authorised to collect this private data farmed from Scottish citizens, how this data is being collected and who here in Scotland has access to it.

“ORG would like to see clearer checks and balances with the formation of a Scottish Digital Watchdog which operates independently of our overstretched police force and their friends at GCHQ.””