ISPs take legal action against GCHQ over mass network infrastructure surveillance

Six internet service providers (ISPs) from around the world – including the UK’s GreenNet – have filed a legal complaint with the Investigatory Powers Tribunal, calling for an end to what they term GCHQ’s “attacking and exploitation” of network infrastructure for mass surveillance.

Besides GreenNet, which bills itself as an ethical ISP, the collective is composed of Chaos Computer Club, from Germany; GreenHost, from the Netherlands; Jimbonet, from Korea; Mango, from Zimbabwe; May First/People Link and Riseup, both from the US; as well as pressure group, Privacy International.

Privacy International has previously filed cases against the mass surveillance programmes Tempora, Prism and Upstream, and GCHQ's use of computer intrusion software. However, the ISPs' collective legal move marks the first time a group action has been taken against the British intelligence agency.

The group’s claim is based on a series of articles in German magazine Der Spiegel and the Intercept, which made a number of allegations. These include the claim that GCHQ used malware to gain access to network infrastructure, by targeting employees of Belgian comms firm Belgacom.

The reports claimed GCHQ and the US National Security Agency (NSA) have developed a range of network exploitation and intrusion capabilities. These include a "man on the side" technique, which injects data into existing data streams to create connections that target individual users for infection. The publications accused GCHQ and the NSA of using a system codenamed "Turbine" that uses automation techniques to substantially scale the implant network to target millions of users.

The reports identified a number of other companies – including three internet exchange points in Germany – that were targeted by GCHQ and the NSA, to spy on traffic passing through their nodes, to identify and target customers.

The complaint asserts that GCHQ’s attacks on their networks were not only illegal, but were destructive, undermined the goodwill the ISPs had built up with their customers, and damaged the trust in security and privacy the ISPs claim is vital to the existence of the internet. It calls for an immediate end to the exploitation of internet and communications services and the targeting of their administrative staff.

While none of the ISPs involved in the action were named in the original documents leaked by Edward Snowden, they claim the type of attacks carried out could have been made against any ISP or comms provider, so they and their users were at equal risk.