They mention mass tracking of cookies from sources like google, yahoo, reddit, youtube, etc. - those might technically count as "metadata", but they are used to track individuals.
I'd be fascinated as to how that's justified legally. Mass tracking has been accepted by the high courts, but the moment you start tracking individual users, you need some sort of warrant or RIPA authority.
>I'd be fascinated as to how that's justified legally.
They don't feel the need to justify it legally, especially when oversight is sitting down with the head of GCHQ over dinner and asking if there's anything dodgy going on.
>Mass tracking has been accepted by the high courts
By the Investigatory Powers Tribunal, maybe - but that's not a real court and it's barely part of the court system at all.
Not to mention that it can either be 'mass' or 'tracking' not both, at least not with the implied meaning that 'no individual is tracked'.
Tracking is by definition of an identifiable group or individual. If you can't be sure that the track you are looking at refers to the same individual throughout its length then you are not tracking, at least not successfully. Conversely if you are tracking you cannot reasonably also claim that you don't know who you are tracking except in the trivial sense that you, perhaps, don't know their name or some other attribute; although you could look it up.
