Find out if the NSA spied on you and shared it with GCHQ

An online tool helps you find out if the NSA spied on you and then shared that data with the GCHQ.

NSA spying

Curious if the NSA has ever spied on you? Privacy International launched a site so you can find out if Britain's GCHQ spied on you; put another way, GCHQ can access NSA data so if the NSA gobbled up your communications, then this is how you can find out and get that digital dirt destroyed.

Privacy International wrote:

Have you ever made a phone call, sent an email, or, you know, used the internet? Of course you have!

Chances are, at some point over the past decade, your communications were swept up by the U.S. National Security Agency's mass surveillance program and passed onto Britain's intelligence agency GCHQ. A recent court ruling found that this sharing was unlawful but no one could find out if their records were collected and then illegally shared between these two agencies… until now!

If you are an American and you are still wondering if this applies to you, it does; it applies to "everyone" in the world. After Privacy International's legal victory in February, the watchdog organization explained:

Through their secret intelligence sharing relationship with the NSA, GCHQ has had intermittently unrestricted access to PRISM - NSA's means of directly accessing data and content handled by some of the world's largest Internet companies, including Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube and Apple.

GCHQ could also access the NSA's Upstream surveillance program. In fact, GCHQ's access to NSA material "makes up the large bulk of all surveillance material handled by the security services; some ex-GCHQ staffers estimated that '95% of all SIGINT [signals intelligence material] handled at GCHQ is American'."

So the next step in Privacy International's "Did GCHQ Illegally Spy On You" campaign allows you to find out if you were spied upon. People need to make their own personal claims to be submitted to the Investigatory Powers Tribunal (IPT). The online tool offers options for individuals representing themselves, for individuals with representation such as attorneys or advocates, for organizations representing themselves, and for organizations with representation.

The FAQ states, "This campaign will only tell you if the NSA shared your communications with GCHQ before December 2014, not if GCHQ shared communications with the NSA."

If you have been unlawfully spied on before December 2014, then the IPT has to tell you. "You will receive a declaration that your privacy rights have been violated and you can request that any information unlawfully obtained is deleted."

"The public have a right to know if they were illegally spied on, and GCHQ must come clean on whose records they hold, some of which they should never have had in the first place," said Eric King, Deputy Director of Privacy International.

If you are looking for the catch to all this, then to take advantage of this rare opportunity and file a claim, you must supply information about yourself. However, GCHQ can only keep the personal information you submit to the IPT for the duration of the investigation.

As an example, if you were filing a claim on behalf of yourself, you need to input your title, last name at birth, last name during 2014, your first name, any aliases you commonly went by in 2014, your birth date, your current address and your email address. You also need to provide other personally identifiable information.

The form for an individual states:

Please provide a list of relevant telephone numbers, e-mail addresses, IP addresses, vehicle registration numbers or other information that may be used to help locate any information or communications GCHQ has that relate to you. We do not know how GCHQ chooses to organize its massive databases of information, so unfortunately we cannot provide you with more concrete guidance on the types of identifiers that are likely to yield results.

While you do not need to provide any identifiers, the Tribunal is unlikely to be able to order an effective search for your information without them. You may include more than one identifier in each of the below lines, but if you do so please separate each identifier with a semi-colon (;). If it is not readily apparent what the identifier is, please try to indicate the nature of the information you are providing, e.g. Twitter: @privacyint; IP address: 123.456.789.101.

Don't procrastinate too long as it's in your "best interest," and you only have until December 5, 2015 to submit a claim.

Copyright © 2015 IDG Communications, Inc.

22 cybersecurity myths organizations need to stop believing in 2022