Snowden Leak Exposes PSNI Link To GCHQ Spy Programme

The Police Service of Northern Ireland has had access to the internet activity and phone records of millions of UK citizens, according to a document leaked by NSA whistleblower Edward Snowden.

The classified document dated March 2011, and published by American site The Intercept in one of its recent Snowden disclosures, specifically identifies the PSNI as one of the UK’s five “intercepting law enforcement agencies” facilitated by a top secret government programme named the MILKWHITE Enrichment Service. Other organisations named include MI5, the National Crime Agency (then called the Serious Organised Crime Agency), the Scottish Recording Centre and HMRC.

While cooperation between law enforcement and intelligence services will hardly come as a surprise, the leaked documents implicate the PSNI in the Snowden leak for the first time and shine a light on how these agencies work together.

The Internet Data Unit (iDU), hosted by the NCA, appear to be the division through which the PSNI are granted warrantless access to the enormous treasure trove of aggregated internet records, phone logs and social media activity gathered by the Government Communications Headquarters (GCHQ).

The GCHQ are tasked with eavesdropping on foreign intelligence, but the U.S whistleblower’s revelations exposed that the organisation was gathering and storing domestic communications data too. It considered this to be part of its wider mass surveillance mission.

As a data enrichment or analytics service, it appears MILKWHITE was put in place to help law enforcement agencies “identify IP selectors for their targets” and to improve the general utilisation of the big dataset that is harvested communications data. By 2011, according to the document, this was leading to the request for £20.8 million in additional funding in order that “service capacity [continue to] grow to keep pace with customer demand”.

Evidently UK-wide law enforcement were using this facility more and more with MI5 describing bulk communications data as a “fundamental investigative tool”.

Communications data, or metadata, is the breadcrumb trail left by each device that will allow an investigator or intelligence analyst to piece together where an individual was and who they associated with. It includes call time logs, device location records, IP-address logging, handset IMEI or IMSI identifiers, browsing histories and social media activity. GCHQ had extended their definition to include login usernames and passwords. The intelligence organisation also targeted mobile apps as viable sources of communications data — specifically naming LinkedIn, MySpace, Facebook and Whatsapp.

Mass data collection and the intrusive surveillance of citizens, formerly dismissed as dystopian conspiracy theory or paranoia, is now a politically contentious civil liberties matter. Only really since Snowden blew the lid on global surveillance programmes have citizens become aware of the extent to which their daily communications, movements and internet activities are being monitored in the name of security.

Pre-Snowden these populations were, by and large, being secretly and extralegally surveilled. Now, however, the apparent structures and means by which access and data had been managed and distributed have been laid bare.

In Scotland, the media’s reportage on MILKWHITE resulted in the Cabinet Secretary for Justice being forced to respond to revelations about the activities of the Scottish Recording Centre. Outraged privacy activists and Scots demanded to know who was aware of the SRC’s activities and how the access to collected data was regulated to uphold the Human Rights Act. The lack of transparency about these programmes in the first place, coupled with an apparent absence of independent oversight, has fuelled concern about mass surveillance across the UK.

Law enforcement agencies are inclined to utilise all methods of investigative power at their disposal to combat criminality and terrorism, yet in an age of endless connectivity and vulnerability how can individual citizen’s rights be safeguarded? The privacy advocates and political establishment clash across this ethics fault line every time drafted legislation is discussed.

Since Snowden’s revelations the intelligence community has made some effort at hesitant translucency, even in Northern Ireland, guardedly ‘opening it’s doors’ to media organisations. Yet, it’s been impossible to avert the forensic glare of Snowden’s spotlight which continues to reveal more about the shadowy world of espionage than any officially sanctioned ‘Inside MI5’ exclusive.

Despite its significance and in contrast to Scotland, the recently published classified document on MILKWHITE went unreported locally in Northern Ireland.

A Freedom of Information request issued to find out more about the PSNI’s use of the MILKWHITE programme was flatly refused (‘Neither Confirm Nor Deny’). Whether MILKWHITE is still utilised by the PSNI or not, budget pressures on the police are forcing more “agile” working practices. The current Chief Constable just recently emphasised greater investment in the organisation’s technological capability, which has been particularly effective in tackling serious organised crime.

The PSNI, working with MI5, are benefiting operationally from the UK’s mass surveillance or bulk communications data collection. In the Bulk Powers Review published in August by Whitehall, case studies demonstrate a joint investigative strategy by the PSNI and MI5 that makes use of “bulk acquisition” to counter dissident republican terror activity.

Given this persisting threat of terrorism in Northern Ireland, the debate between privacy rights and national security protocol is heightened in immediacy and at the same time cautiously restrained.

Following decades of conflict the local population has understood both imposed surveillance and terror in a way that most of the western world has only known since 9/11. With historic first-hand experience, there are few illusions about the questionable application of surveillance and espionage during the country’s conflict. The Northern Irish public are far from jaded though, a real appetite to challenge intelligence services exists but is generally retrospective and grounded in a search for historical justice.

Post-Snowden, accountability of government surveillance agencies is not just of historical significance but, added to the privacy rights of citizens, it’s continuing importance is very much a present issue and perhaps increasingly so for everyone.