On Thursday, 13 September 2018, the European Court of Human Rights (ECtHR) handed down their decision in . This decision addressed the legality of the United Kingdom鈥檚 (UK) bulk interception programme, intelligence sharing, and the obtaining of communications data from communications service providers and was prompted by the 2013 Snowden revelations.
This is a complex decision which is likely to have significant ramifications for mass surveillance programmes. As such, it is too early to offer detailed analysis, and this post intends to highlight some of the interesting elements that we will be thinking over in the coming weeks and months. Our focus here is on the bulk interception programme.
For an excellent initial post on the implications for the UK鈥檚 Investigatory Power鈥檚 Act, please see 鈥樷�� at Cyberleagle.
An effective remedy in law, or practice?
The ECtHR found the UK鈥檚 Investigatory Powers Tribunal (IPT) to be an effective remedy, in light of the UK Government鈥檚 鈥榩ractice of giving effect to its findings on the incompatibility of domestic law with the Convention鈥� despite the fact that a binding obligation, requiring the Government to remedy any incompatibility identified by the Investigatory Powers Tribunal, did not exist. See, 搂262.
The Court found that the effectiveness of the IPT was underlined by the fact that it could make an order for reference to the Court of Justice of the European Union (CJEU) (in 搂263).
Extraterritorial human rights obligations?
The UK Government did not raise a jurisdictional-based objection to the Court鈥檚 consideration of section 8(4) of the Regulation of Investigatory Powers Act (RIPA), which authorises the interception of external communications, or suggest that interception under section 8(4) took place outside the UK鈥檚 territorial jurisdiction.
Some of the communications classified as external may actually involve communication with in the UK, for instance when an email is sent from an external location to an address in the UK, or vice versa. As such, they all concerned communications are not necessarily entirely extraterritorial. Nonetheless, it is somewhat surprising that jurisdiction was not contested, and this has potential relevance as regards the extraterritorial effect of the right to privacy.
The general principles applicable to secret surveillance
The Court, for the first time, list the general principles which apply in all cases concerning measures of secret surveillance.
This is an explicit enumeration of the principles that are extrapolated from the Court鈥檚 case law. See 搂304-310. Of particular relevance are the six minimum safeguards that should be set out in law to avoid abuses of power, namely: 鈥渢he nature of offences which may give rise to an interception order; a definition of the categories of people liable to have their communications intercepted; a limit on the duration of interception; the procedure to be followed for examining, using and storing the data obtained; the precautions to be taken when communicating the data to other parties; and the circumstances in which intercepted data may or must be erased or destroyed鈥�. The Court affirmed that these safeguards also apply in cases where interception is ordered in relation to national security objectives. See, 搂308.
In 搂330, the Court clarified that when addressing the first two minimum requirements (nature of the offences, categories of persons liable to interception) the Court stated that it will examine 鈥榝irst, whether the grounds upon which a warrant can be issued are sufficiently clear; secondly, whether domestic law gives citizens an adequate indication of the circumstances in which their communications might be intercepted; and thirdly, whether domestic law gives citizens an adequate indication of the circumstances in which their communications might be selected for examination鈥�.
Significantly, the Court declined to decide whether these safeguards applied to the interception of communications data (as distinct from interception of content and communications data). See, 搂352. This is particularly interesting in light of the Court鈥檚 later statement, in 搂356, that it was 鈥榥ot persuaded that the acquisition of related communications data is necessarily less intrusive than the acquisition of content.鈥�
Recognising the legitimacy 鈥� in principle 鈥� of bulk interception
The Court explicitly recognised the legitimacy, in principle, of bulk interception regimes, noting that these fall within the State鈥檚 margin of appreciation 鈥榠n choosing how best to achieve the legitimate aim of protecting national security鈥�. See, 搂314.
Rejecting a 鈥榬easonable suspicion鈥� requirement (with uncertain implications)
In 搂317, the Court rejected the claim that 鈥榬easonable suspicion鈥� be a requirement for bulk interference, noting that 鈥榌b]ulk interception is by definition untargeted, and to require 鈥渞easonable suspicion鈥� would render the operation of such a scheme impossible.鈥� There is a lot to digest in terms of the reasoning associated with this statement, and there is a lack of clarity as to the implications.
An initial question is whether the Court would make the same statement if the bulk interception also included internal communications. If so, this raises questions as to what it means for the use of information gleaned from bulk intercept to initiate a criminal prosecution. It is the potential link between intelligence operations and domestic law enforcement activity that raises numerous issues in relation to these powers. These include very broad human rights concerns bringing in to play the rights to freedom of expression, and association as well as the effective functioning of democracy.
Updating the six minimum requirements applicable to bulk interception and other interception regimes
The applicants in the present case argued for the Court to 鈥榰pdate鈥� its six minimum requirements, to include the following: requirements for objective evidence of reasonable suspicion in relation to the persons for whom data is being sought, prior independent judicial authorisation of interception warrants, and the subsequent notification of the surveillance subject. See, 搂316. The Court noted that, although the proposed additional requirements, 鈥榤ight constitute important safeguards in some cases鈥�, it did not consider it appropriate to add them to the list of minimum safeguards in this instance.
A motivation for this reason is the Court鈥檚 conclusion that, 鈥榠t would be wrong automatically to assume that bulk interception constitutes a greater intrusion into the private life of an individual than targeted interception, which by its very nature is more likely to result in the acquisition and examination of a large volume of his or her communications.鈥� This issue is not addressed in greater detail, and is likely to surface in the future, particularly if consideration of the broader societal impact is included.
Downplaying the role of prior judicial or independent authorisation?
The Court makes a number of statements that appear to downplay the role of prior authorisation by a judicial or independent authority, particularly in 搂318 and 搂377. For instance, in 搂318 the Court approving notes the Venice Commission鈥檚 conclusion that although the Court has recognised judicial authorisation as an important safeguard against arbitrariness, it has not, to date, considered it to be a 鈥榥ecessary requirement鈥�. Later, in 搂377, the Court states that although it 鈥榟as generally required a non-judicial authority to be sufficiently independent of the executive [鈥 it must principally have regard to the actual operation of a system of interception as a whole, including the checks and balances on the exercise of power, and the existence (or absence) of any evidence of actual abuse [鈥 such as the authorising of secret surveillance measures haphazardly, irregularly or without due and proper consideration鈥�.
While it is, of course, appropriate to note that judicial or independent authorisation, of itself, is insufficient, and to highlight the importance of other safeguards as applied in practice, the apparent downplaying of the role of judicial/independent authorisation is surprising. To say the least. This appears to raise a potential conflict with the CJEU鈥檚 decision in Watson and is also an unexpected shift from the Court鈥檚 own case law; e.g. 鈥榠t is in principle desirable to entrust supervisory control to a judge, judicial control offering the best guarantees of independence, impartiality and a proper procedure 鈥� (搂309).
Why the Court would do this, having noted in 搂318 that judicial authorisation 鈥榠s not inherently incompatible with the effective functioning of bulk interception鈥� is unclear, and this will inevitably give rise to further debate.
Ensuring that the 鈥榥ecessity鈥� of surveillance measures is built into the underlying legal framework
In 搂322 the Court stated that 鈥榌i]n cases where the legislation permitting secret surveillance is contested before the Court, the lawfulness of the interception is closely related to the question whether the 鈥渘ecessity鈥� test has been complied with and it is therefore appropriate for the Court to address jointly the 鈥渋n accordance with the law鈥� and 鈥渘ecessity鈥� requirements.鈥� This relates to the requirement that any interference with rights have an established legal basis, pursue a legitimate aim, and be necessary in a democratic society.
It does appear appropriate that the law itself limit measures to those that can be considered 鈥榥ecessary鈥�. This may point at a requirement that there be greater nuance or specificity with respect to the grounds on which an interference may take place.
Unfortunately, however, the Court did not seem to engage further with the necessity of the measures at hand, beyond noting Contracting State鈥檚 margin of appreciation. In particular, and in light of the statement in 搂322, it is unfortunate that no consideration was given as to the types of activity that could constitute a threat to national security, or be classified as 鈥榮erious crime鈥� warranting extensive 鈥榩ro-active鈥� surveillance measures.
Intelligence sharing by the UK
In 搂368 and 搂369, the Court addressed the requirement that intercept material could be communicated 鈥榝or an authorised purpose鈥�, if it was 鈥榣ikely to become necessary鈥�. Ultimately, the Court found that although further definitional precision would be desirable, adequate safeguards existed for the protection of the relevant data.
This finding will require further thought, noting in particular that the specific value of bulk interception is that it allows for the development of an intelligence picture. That is, it allows for the analysis of bulk information in order to see whether this reveals patterns from which intelligence can be drawn. This is why the practice is sometimes referred to as a 鈥榝ishing operation鈥� and it is presumably on this basis that the Court rejected that application of a 鈥榬easonable suspicion鈥� requirement.
In this light, a significant amount of material is potentially relevant, and therefore 鈥榣ikely to become necessary鈥�. In this regard, statements from intelligence agencies regarding the necessity of bulk collection, whereby it is argued that in order to find the needle you must first have the haystack should be recalled. As such, the Court appears to allow significant room for discretion.
