Analysis of the ECtHR judgment in Big Brother Watch: part 1

Lorna Woods, Professor of Internet Law, University of Essex

This chamber judgment is the latest in a line of cases that deal with secret surveillance, a topic which seems to be appearing increasingly frequently in a post-Snowden world. This judgment is substantial (over 200 pages in length) and deals with three cases challenging the UK’s now mainly repealed Regulation of Investigatory Powers Act 2000 (RIPA) as regards to interception of communications in bulk, the acquisition of communications data and the sharing of intercepted communications and communications data between the UK and the United States of America: Big Brother Watch (app no. 58170/13), Bureau of Investigative Journalism and Alice Ross (app no. 62322/14) and 10 Human Rights Organisations (app. no. 24960/15).  It follows in the steps of the Liberty case (app no. 58243/00) against the previous regime and, given the similarity between some aspects of RIPA and the Investigatory Powers Act 2016 (IPA), might have relevance for our understanding of that act too. In addition to questions about Article 8, the judgment also deals with the impact of surveillance on freedom of speech under Article 10 ECHR. 

This post is the first of two on the judgment. It outlines the issues and the Court’s reasoning. The second comments on the judgment. Given the size of the judgment that will be just an initial reaction to the judgment – there will, no doubt, be much more to be said.

Factual Background

The applicants in the three cases are organisations and individuals who are either journalists or are active in campaigning on civil liberties issues. Their challenges to RIPA were triggered by the information revealed by Edward Snowden which made apparent the existence of surveillance and intelligence sharing programmes operated by the intelligence services of the United States and the United Kingdom.  Specifically, they believed that the nature of their activities meant that their electronic communications and/or communications data were likely to have been intercepted or obtained by the UK intelligence services relying on the regime found in RIPA.  Three areas of problems were highlighted:

-          bulk interception of ‘external’ communications under s. 8(4), as well as connected communications data;

-          the sharing process whereby the British agencies received data collected by the US; and

-          access to communications data under Part II RIPA.

In all instances the applicants thought that the protection against abuse were insufficient and that the regimes were neither lawful nor necessary in a democratic society.

Only the applicants in the third case brought an action before the Investigatory Powers Tribunal (IPT), alleging violations of Articles 8, 10 and 14 of the Convention.  Although the IPT found two ‘technical violations’ of the Convention, in the main it regarded the challenged regime to be in accordance with the requirements of Article 8, notably the requirements set down in Weber and Saravia (app no. 54934/00).

Judgment

The first issue concerned exhaustion of domestic remedies, in particular the failure to bring a case before the IPT.  The applicants argued that in the light of the ECtHR’s own ruling in Kennedy (app no. 26839/05), the IPT would not be an effective remedy and they were therefore not obliged so to do.  The Court agreed with this assessment of its case law in general terms, but now thought that recent practice showed that the IPT now constituted a viable route for a remedy, especially given the response of the UK government to its findings. Nonetheless, the Court accepted that, at the time the applicants in the first and second of the joined cases introduced their applications, they could not be faulted for having relied on Kennedy as authority for the proposition that the IPT was not an effective remedy for a complaint about the general Convention compliance of a surveillance regime. It therefore found that there existed special circumstances absolving those applicants from the requirement that they first bring their complaints to the IPT.

The Court first considered the position under s. 8(4) RIPA and whether it met the tests of legitimate purpose, lawful and necessary in a democratic society. In doing so, it noted that there was jurisprudence in this field but that in previous jurisprudence the Court had distinguished between different types of secret surveillance, finding that there different levels of intrusion depending on the data collected, and also different rules depending on whether national security was in issue.  The Court sought to synthesise the principles, suggesting that the 6 principles established in Weber – to ensure the lawfulness of any such regime - were the starting point, though they might need to be differently applied depending on the type of surveillance. These need not be updated to take account of changes in technology.  These minima are:

-          the nature of offences which might give rise to an interception order;

-          definition of the categories of people liable to have their communications intercepted;

-          a limit on the duration of interception;

-          the procedure to be followed for examining, using and storing the data obtained;

-          the precautions to be taken when communicating the data to other parties; and

-          the circumstances in which intercepted data may or must be erased or destroyed.

In the context of national security it also recognised the gloss added by the Grand Chamber in Zakharov (app no. 47143/06) the review mechanisms and remedies should also be taken into account. The Court noted that the nature of secret surveillance was such that until an individual were to be notified about such surveillance, that individual would not be in a position to exercise their rights. In this, the safeguards against abuse assumed high importance; moreover, the role or rights to remedies was important for protection after notification.

Looking at the situation in issue, the Court started by making the general point that operating a bulk interception scheme was not in itself in violation of the Convention. Governments would have “a wide margin of appreciation” in deciding what kind of surveillance scheme was necessary to protect national security.  The operation of the system would still however need to be checked to ensure that there were sufficient safeguards against abuse.  The applicants argued that the fact that there was no requirement for prior judicial authorization was a fatal flaw in the scheme. 

The Court agreed judicial authorisation was an important safeguard, perhaps even “best practice”, but by itself it was neither necessary nor sufficient to ensure compliance with Article 8. It was unnecessary because of the ex post controls available in the British system. Looking to Zakharov, the Court recognised that a formal requirement was insufficient – the requirement there had not prevented bad practice. The Court then held that regard had to be had to the actual operation of the system of interception, including the checks and balances on the exercise of power, and the existence or absence of any evidence of actual abuse.

In assessing the scheme the Court took the law at the time of its consideration of the claims; this meant that the Court considered the matter after the impact of the Snowden leak and some of the consequent changes to practice, including revisions to relevant codes accompanying RIPA, as well as statements in Parliament (such as the clarification as to what an external communication was – it includes Google searches, tweets and Facebook posts from by users in the UK). 

The Court took the view that, as regards the first Weber requirement, the law was clear as to the circumstances in which and the conditions on which a section 8(4) warrant might be issued. There was no evidence to suggest that the Secretary of State was authorising warrants without due and proper consideration. The authorisation procedure was subject to independent oversight and the IPT had extensive jurisdiction to examine any complaint of unlawful interception. Following its analysis in Kennedy, the Court accepted that the provisions on the duration and renewal of interception warrants, the provisions relating to the storing, accessing, examining and using intercepted data, the provisions on the procedure to be followed for communicating the intercepted data to other parties and the provisions on the erasure and destruction of intercept material provided adequate safeguards against abuse.

There were some weaknesses in the system.  While in the opinion of the Court the selectors (e.g. email address) and search criteria used to narrow down the mass of information collected to that which would be read by analysts did not need to be made public or be listed in the warrant ordering interception, the choice of search criteria and selectors should be subject to independent oversight (para 387); indeed the Court expressed some concerned about the cables (‘bearers’) selected for tapping. Here the ex post review by the Interception of Communications Commissioner (now replaced under the IPA by the Investigatory Powers Commissioner) and, should an application be made to it, the IPT were held not to be ‘sufficiently robust to provide adequate guarantees against abuse’ (para 347).

The Court also expressed concern about communications data.  This is often summarised as who, where, when but this underplays the significance of the data collected.  Indeed, here the Court rejected the Government’s argument that communications data was necessarily less sensitive than the content of the communications (para 357). The Court explained the position thus:

... the content of an electronic communication might be encrypted and, even if it were decrypted, might not reveal anything of note about the sender or recipient. The related communications data, on the other hand, could reveal the identities and geographic location of the sender and recipient and the equipment through which the communication was transmitted. In bulk, the degree of intrusion is magnified, since the patterns that will emerge could be capable of painting an intimate picture of a person through the mapping of social networks, location tracking, Internet browsing tracking, mapping of communication patterns, and insight into who a person interacted with. (para 356)

In the context of s 8(4), communications data associated with the communications intercepted is also covered by the warrant but crucially some of the limitations (e.g. that the communication must be external) do not apply to this data.  The Court concluded that the unjustified lower level of protection meant that there was a violation in this regard.

The Court then considered the data sharing arrangements, the first time that the Court had been asked to consider the matter. It noted to start with the many ways in which this issue might arise.  The interference in the case had not been occasioned by the interception of communications itself but lay in the receipt of the intercepted material and subsequent storage, examination and use by the intelligence services.  It confined its judgment to the specific argument brought before it: the breach occasioned by the British services receiving American intelligence.  The applicants argued that this indirect access should be treated the same way as direct surveillance by the British services.  The Court commented that:

"[a]s with any regime which provides for the acquisition of surveillance material, the regime for the obtaining of such material from foreign Governments must be 'in accordance with the law'..., it must be proportionate to the legitimate aim pursued, and there must exist adequate and effective safeguards against abuse .… In particular, the procedures for supervising the ordering and implementation of the measures in question must be such as to keep the 'interference' to what is 'necessary in a democratic society'" (para 422).

The Court also recognised the danger of States using intelligence sharing as a means to circumvent controls (para 423).  It nonetheless accepted that the safeguards need not look identical in this context as in that of direct surveillance. Applying the principles to the facts, the Court found unanimously that there had been no violation. In particular, it accepted that the lawful requirement had been satisfied although the basis for the data sharing was an internal agreement which were disclosed only during proceedings before the IPT and subsequently incorporated into the Interception of Communications Code (para 426). The Code links the circumstances in which intelligence may be requested to the issuing of s. 8(1) or s. 8(4) warrants, thus circumscribing the circumstances in which such requests may arise and indirectly imposes supervision via sign-off by the Secretary of State and review by the ISC and the Interception of Communications Commissioner. 

The Court applied its assessment of the Code’s safeguards in relation to s. 8(4) warrants (in paras 361-363) here. Its assessment of the proportionality of information sharing was influenced by the threat of international terrorism and the global nature of terror networks necessitating information flow. In the Court’s view, ‘this “information flow” was embedded into a legislative context providing considerable safeguards against abuse’ so that ‘the resulting interference was to that which was “necessary in a democratic society”’ (para 446) and it considered that the threshold set by the Venice Commission – that the material transferred should only be able to be searched if all material requirements of a national search were fulfilled – were met (para 447). 

The next issue was the final question relating to Article 8.  It concerned Chapter II of RIPA which allows specified authorities to access communications data held by communications service providers (CSPs).  As noted, communications data is not necessarily less intrusive than content.  The Court did not however go into detail on this here, although it noted that real time surveillance is more intrusive that the transfer of records of existing data (citing Ben Faiza (app no. 31446/12)). It re-iterated that the same three criteria apply: lawfulness, legitimate aim and necessary in a democratic society.  The Court focussed on the lawfulness of the rules, referring to the position under EU law – notably Digital Rights Ireland (Case C-293/12 and C-594/12) and Watson (Case C-698/15) - which requires that any regime permitting access to data retained by CSPs was only to be for the purpose of combating “serious crime”, and that such access be subject to prior review by a court or independent administrative body. RIPA -although it provided a clear basis for action on the face of it - did not comply with this requirement and was therefore was not compliant with domestic law requirements (para 467).

A further issue arose in the Bureau of Investigative Journalism (BIJ) complaint. There, BIJ (a newsgathering organisation) and a journalist (Ross) raised the issue of interference with confidential journalistic material occasioned by the operation of both the section 8(4) and the Chapter II regimes.  While the Court has emphasised the importance of protection of journalists’ sources, its case law has distinguished between court orders for disclosure and searches carried out by the authorities to obtain this information – that latter is more intrusive. Further, the Court also distinguished between attempts to reveal sources and investigations into the commission of crimes. So the importance of source confidentiality is not an automatic trump card. The Court noted that the s. 8(4) regime was not aimed at monitoring journalists or uncovering journalistic sources.  The authorities would often only know that a journalist’s communications had been intercepted when examining the intercepted communications. Following Weber, this in itself could not be characterised as a particularly serious interference with freedom of expression. Nonetheless, where those communications were selected, the concerns would increase and safeguards would be required, especially as regards the need to protect confidentiality. In this context, concerns expressed in relation to the s. 8(4) regime ran through to Article 10 concerns. The Court emphasised that:

... there are no [public] requirements...either circumscribing the intelligence services' power to search for confidential journalistic or other material (for example, by using a journalist's email address as a selector), or requiring analysts, in selecting material for examination, to give any particular consideration to whether such material is or may be involved. (para 493)

This blanket power without any “above the water” arrangements limiting the intelligence services’ ability to search and examine such material constituted a violation of Article 10.

As regards the Chapter II regime, while there were some protections in place for journalistic sources, the Court determined that this was limited. They applied only where the purpose of the application was to determine a source. They would not apply in every case where there was a request for the communications data of a journalist, or where such collateral intrusion was likely.  Given this and the fact that access was not limited to ‘serious crime’, the Court found a violation of Article 10.

The Court rejected complaints under Article 6 as well as Article 14 combined with Articles 8 and 10 of the Convention as manifestly ill-founded.

The judgment was not unanimous. Judge Koskelo, joined by Judge Turkovic, disagreed with some points of the reasoning of the majority and particularly the appropriateness of relying on old case law in a context following a technological ‘sea change’ in which people’s lives are more thoroughly exposed to view.  Judges Pardalos and Eicke did not agree that the applicants in the first and second case should have been absolved from the requirement to exhaust domestic remedies, nor – in the light of the recent chamber judgment in Centrum For Rattvisa (app no. 35252/08) – that there had been a violation of Article 8 in relation to s. 8(4) warrants.

Barnard & Peers: chapter 9

Photo credit: Journalism, Media and Culture