GCHQ debuted a program called Karma Police seven years ago to track the browsing habits and communications of “every visible user on the Internet”
From Radio to Porn, British Spies Track Web Users' Online Identities — THERE WAS A SIMPLE AIM at the heart of the top-secret program …
Context & Ripple Effects
Karma Police lands in the middle of the Snowden-document run: a year after The Intercept's first GCHQ stories, Ars Technica detailed more of the agency's data-mining techniques from the leaked files, establishing that bulk profiling of ordinary web users was engineered capability, not aspiration. The program's ambition — an index of 'every visible user' spanning browsing and communications — was the logical endpoint of what those leaks had already shown in pieces.
What makes the seven-year gap notable is where the capability resurfaces: by 2021 the UK Home Office confirmed a trial of a web-surveillance tool tracking users' browsing history alongside two unnamed ISPs and the National Crime Agency (the Home Office ISP trial), moving techniques of this kind from classified intelligence collection toward overt domestic law-enforcement use.
First-order effects
- Every user whose traffic transits GCHQ's taps is profiled at scale — browsing categories as sensitive as porn viewing are explicitly among the tracked identities — with no individualized suspicion required.
- GCHQ faces renewed exposure of its bulk-collection architecture, adding to the operational and reputational cost already incurred by successive Snowden disclosures.
Second-order effects
- UK ISPs are pulled into the surveillance supply chain: once the state demonstrates it can partner with carriers for browsing-history trials, every operator becomes a potential collection point rather than a mere conduit.
- Domestic agencies like the NCA gain a path to intelligence-grade profiling tools, blurring the line between foreign signals intelligence and everyday policing.
Third-order effects
- If the pattern holds — covert spy-agency program first, commercial-partnership trial later — bulk behavioral profiling becomes standard infrastructure across Western governments, normalized through incremental legal pilots rather than public debate.
- The precedent pressures other intelligence services to treat whole-population web identity mapping as baseline capability, with oversight frameworks perpetually trailing the technology.
The trend: Bulk web-user surveillance is migrating from classified intelligence programs toward institutionalized government–ISP partnerships, each disclosure normalizing the next expansion.