Privacy International – May 15, 2015: The Government has quietly ushered through legislation amending the anti-hacking laws to exempt GCHQ from prosecution. Privacy International and other parties were notified of this just hours prior to a hearing of their claim against GCHQ’s illegal hacking operations in the Investigatory Powers Tribunal. In its legal filings, sent to Privacy International only the day before the hearing began, the Government notified claimants that the Computer Misuse Act was rewritten on 3 March 2015 to exempt the intelligence services from provisions making hacking illegal. Beginning in May 2014, Privacy International, along with seven internet and communications service providers, filed complaints with the IPT challenging GCHQ’s hacking activities. The claimants asserted that GCHQ’s actions were both unlawful under the Computer Misuse Act (CMA), which criminalises hacking, and that there was not sufficiently detailed legal authority to make GCHQ’s hacking “in accordance with law”, as any violation of privacy is required to be by Article 8 of the European Convention on Human Rights. Yesterday, the parties were notified that, only a few weeks after the claim was filed, the Government quietly introduced legislation on 6 June 2014 that would amend the CMA to provide a new exception for law enforcement and GCHQ to hack without criminal liability. The change not only affects Privacy International’s claim, but also grants UK law enforcement new leeway to potentially conduct cyber attacks within the UK. The explaintory notes that accompanied the act make no reference to the true impact of the change. It appears no regulators, commissioners responsible for overseeing the intelligence agencies, the Information Commissioner’s Office, industry, NGOs or the public were notified or consulted about the proposed legislative changes. There was no published Privacy Impact Assessment. Only the Ministry of Justice, Crown Prosecution Service, Scotland Office, Northern Ireland Office, GCHQ, Police and National Crime Agency were consulted as stakeholders. There was no public debate. That legislation, deemed the Serious Crime Bill 2015, passed into law on 3 March 2015 and become effective on 3 May 2015. The Government provided an open response to the claimants’ IPT complaint on 6 February 2015, but was silent on forthcoming passage of the Serious Crime Bill.  Indeed, it was not until yesterday, a day before the parties were due in court to determine the legal issues that will be addressed in the case, that the government indicated that amendments to the CMA had been made. This is not the Government’s first attempt to make “under the radar” changes to UK law in connection with this claim.  On 6 February 2015, the Government released a draft Equipment Interference Code of Practice, which it claimed mirrors internal GCHQ guidance. Despite this, the Government is refusing to disclose GCHQ’s earlier versions of the Code, or reveal when it was first drafted, claiming to do so would damage national security. The draft Code purports to grant the UK spy agencies sweeping powers to hack targets, including those who are not a threat to national security nor suspected of any crime. Yet it is not primary legislation, and will not be subject to the normal parliamentary process, including democratic debate, that such a sensitive subject should receive. The case will be heard on hypothetical facts, as the Government maintains a “neither confirm nor deny” stance in relation to the details of the hacking charges, despite GCHQ openly recruiting for hacking specialists on its website earlier this week.”