How to challenge state surveillance powers in the UK
An overview of the Investigatory Powers Tribunal
The BBC reported that a hearing will be held by the Investigatory Powers Tribunal (IPT) today (Friday 14 March 2025) concerning a technical capability notice (TCN) imposed on Apple by the UK government. The scheduling of this hearing can be seen on the Tribunal's website. Apple is challenging the TCN which requires the company to provide access to encrypted iCloud backup data of its users to the government. You can read more about the TCN imposed on Apple below:
This post provides an overview of the IPT, including its jurisdiction, its procedures and its powers.
What is the Investigatory Powers Tribunal?
Under the Human Rights Act 1998 (HRA 1998), a person who claims that a public authority has infringed their rights may bring proceedings against that authority in the appropriate court or tribunal.1
To this effect, the IPT has jurisdiction to hear cases against the security and intelligence agencies (SIAs), and certain other public authorities, to determine whether such authorities have acted lawfully using their surveillance powers.2
What is the jurisdiction of the IPT?
There are two ways in which UK state surveillance can be challenged before the IPT:
Challenging surveillance legislation itself
The actual conduct of the SIAs under that legislation
The latter type of challenge is one that is exclusively reserved for the Tribunal to decide on as it has the appropriate jurisdiction and powers to investigate such claims. With this special status, the Tribunal van validate the claims brought to it in terms of the validity of the specific use of surveillance powers by UK public authorities.
The European Court of Human Rights (ECtHR) has commended the Tribunal for the "elucidatory role" that it plays in litigation against the SIAs. It acts as a fact-finder and information filter to formulate an accurate starting point for the ECtHR to base its decisions.3 This prevents the Court from having to assess the legalities of surveillance powers in a "factual vacuum" when cases eventually come it.4 The IPT can confirm the activities and operations of the SIAs with the ECtHR then deciding definitively on whether those activities or operations comply with the requirements of the European Convention on Human Rights.
Certain decisions of the IPT are capable of being reviewed by the UK senior courts. In R (Privacy International) v IPT & Others, the Supreme Court held that the High Court has jurisdiction to hear appeals against the rulings of the IPT where the appeal is based on an error of law made by the Tribunal in its decision.5
Who can lodge complaints with the IPT and how?
Human rights complaints can be submitted directly to the IPT by completing the requisite form,6 of which is available on its website. In that form, the complainant must state, among other things, the SIAs that the complaint relates to and a description of the nature of the claim, including the details of the right that is alleged to have been infringed, and the complainant's interest.7 Other complaints can be lodged with the Tribunal too,8 including, among other things, the conduct required under a national security or technical capability notice.9
While the nature of surveillance powers are covert, and therefore it may not always be possible for a complainant to know when they have been subject to such powers, this will not necessarily frustrate the complainant's ability to lodge their claim. As held by the ECtHR, "an individual might, under certain conditions, claim to be the victim of a violation occasioned by the mere existence of secret measures or of legislation permitting secret measures, without having to allege that such measures had been in fact applied to him."10
Accordingly, the IPT has held that an individual "may claim to be a victim of a violation occassione by the mere existence of secret measures or of legislation permitting secret measures only if he is able to show that, due to this personal situation, he is potentially at risk of being subjected to such measures."11 This may be the case even if the basis of a claim is hypothetical (see further below for more on this).
What are the information powers of the IPT?
The IPT is subject to a duty to investigate claims that are submitted to it,12 though it is required to dismiss claims that it considers frivolous or vexatious.13
Such investigations can be made with the assistance of a Judicial Commissioner or the Investigatory Powers Commissioner and require public authorities to disclose all such documents and information as may be required to vet a claim lodged with the IPT.14
Additionally, there is a duty on public authorities and all government personnel to disclose or provide to the IPT all documents and information that the Tribunal may require to exercise its jurisdiction.15 This means that no information can be withheld from the IPT on national security grounds or for other public interest reasons.16 However, this must be balanced with the Tribunal's duty to secure that information is not disclosed in a way that is contrary to the public interest or prejudicial to national security.17
How are hearings held by the IPT?
The IPT is equipped with special powers that allow it to conduct in-depth examinations of the work of the SIAs. With these powers, the IPT has developed two practices regarding how it hears cases brought to it:
Holding hearings on the basis of assumed or hypothetical facts
Holding hearings wholly or partly in private
Hearings on the basis of assumed or hypothetical facts
The IPT is permitted to presume that a set of facts presented by a claimant are true to decide whether those facts constitute lawful conduct. An example of this took place in Privacy International v Secretary of State for Foreign and Commonwealth Affairs & Others (2016). This case concerned the lawfulness of GCHQ's use of computer network exploitation (essentially computer hacking) as a means to obtain intelligence. You can read my previous commentary of such surveillance operations by GCHQ here
But regarding the procedural aspects of the case, given that GCHQ did not admit to the use of computer hacking, the IPT proceeded on the presumption that GCHQ did carry out such activity. In doing so, the Tribunal was able to reach conclusions on the basis that computer hacking did take place against the claimants and determine whether such conduct was lawful.18
This practice allows the IPT to balance national security with the rights of the claimants and principles of open justice. This is particularly the case where SIAs invoke the 'Neither Confirm Nor Deny' (NCND) policy whereby the SIAs provide no comment on their surveillance capabilities or operations. In Liberty v GCHQ, the UK SIAs, while admitting to their involvement in the PRISM surveillance programme revealed by Edward Snowden in 2013, relied on NCND in relation to the other information on the surveillance activities of the UK and US that formed part of the Snowden documents.19 Nevertheless, the IPT took the approach of presuming the activities alleged by the claimants in that case to be true and provided their conclusions on that basis.20
Hearings wholly or partly in private
The IPT is under not duty to hold an oral hearing.21 But its powers do enable it to hold 'closed' hearings.
It is through these closed hearings that the SIAs can submit evidence regarding their operations that would be too sensitive or confidential to discuss in open court.22 Whilst this departs from the principle of open justice,23 such arrangements form part of the Tribunal's duty to secure that information is not disclosed in a way that is contrary to the public interest or prejudicial to national security, the prevention or detection of serious crime, the economic well-being of the UK or the continued discharge of the functions of the SIAs.24
The IPT also has the ability to hold hearings where the complainant is absent.25 However, the SIAs can be requested to give reasons for the withholding of any information from the complainant.26 After considering such representations, the IPT can direct the SIAs to disclose documents or information to the complainant or provide a gist or summary of the documents or information.27
What are the remedial powers of the IPT?
The IPT is empowered to make orders quashing or cancelling a warrant or authorisation if it finds against public authorities.28 Before making any such orders, the Tribunal must allow the parties to the case to make representations.29
The IPT has emphasised how its remedial powers are discretionary, just as relief in public law is discretionary. Accordingly, the IPT will not grant a quashing order if it deems it not necessary in the circumstances and other effective remedies will suffice.30
This discretion is also used when determining the specifics of any orders granted. In Liberty v GCHQ, the IPT found that Amnesty International's emails had been retained for longer than was permitted under GCHQ's internal policies. The agency was therefore ordered to to destroy these communications but also deliver a copy to the then Interception of Communications Commissioner31 to be retained for five years in case it was needed for any legal proceedings or inquiry.32
Regulation of Investigatory Powers Act 2000, s.65(2)(a). See also R(A) v B [2009] UKSC 12.
Big Brother Watch and Others v UK, App nos. 58170/13, 62322/14 and 24960/15 (ECHR, 13 September 2018), para. 256.
Big Brother Watch and Others v UK, App nos. 58170/13, 62322/14 and 24960/15 (ECHR, 13 September 2018), para. 256.
R (Privacy International) v Investigatory Powers Tribunal & Others [2019] UKSC 22.
Regulation of Investigatory Powers Act 2000, s.65(2)(a) and Investigatory Powers Tribunal Rules 2018, SI 2018/1334, Rule 8(1).
Regulation of Investigatory Powers Act 2000, s.65(5)(czi).
Roman Zakharov v Russia, App no. 47143/06 (ECHR, 4 December 2015), para. 169.
Human Rights Watch Inc & Others v Secretary of State for the Foreign & Commonwealth Affairs Office & Others [2016] UKIPTrib 15_165-CH, para. 19. See also R (Liberty) v Secretary of State for the Home Department & Others [2019] EWHC 2057 (Admin), paras. 99–112.
Regulation of Investigatory Powers Act 2000, s.67(3)(a). See also S v Marper, App nos. 30562/04 and 30566/04 (ECHR, 4 December 2008), para. 183.
Regulation of Investigatory Powers 2000, s.67(4). See also R (Privacy International) v Investigatory Powers Tribunal [2017] EWCA Civ 1868, para. 10.
Regulation of Investigatory Powers Act 2000, ss.68(2) and (6).
Robert Ward et al (eds), National Security: Law, Procedure and Practice (OUP 2021), p.159.
Privacy International vs Secretary of State for Foreign and Commonwealth Affairs Office [2016] UKIPTrib 14_85-CH, para. 2.
Liberty & Others v GCHQ & Others [2014] UKIPTrib 13_77-h, para. 4(i).
Liberty & Others v GCHQ & Others [2014] UKIPTrib 13_77-h, para. 4.
Investigatory Powers Tribunal Rules 2018, SI 2018/1334, Rule 10(1).
Liberty & Others v GCHQ & Others [2014] UKIPTrib 13_77-h, para. 7.
Robert Ward et al (eds), National Security: Law, Procedure and Practice (OUP 2021), p.161.
Investigatory Powers Tribunal Rules 2018, SI 2018/1334, Rule 10(1)(c).
Regulation of Investigatory Powers Act 2000, s.67(7)(a).
Investigatory Powers Tribunal Rules 2018, SI 2018/1334, Rule 14(1).
Liberty v Security Service [2023] UKIPTrib 1, paras. 190-192.
This has now been superseded by the Investigatory Powers Commissioner and their office.
Liberty & Others v GCHQ & Others [2014] UKIPTrib 13_77-h.