Lorna Woods,
Professor of Internet Law, University of Essex
This
chamber judgment is the latest in a line of cases that deal with secret
surveillance, a topic which seems to be appearing increasingly frequently in a
post-Snowden world. This judgment is substantial (over 200 pages in length) and
deals with three cases challenging the UK’s now mainly repealed Regulation of
Investigatory Powers Act 2000 (RIPA) as regards to interception of
communications in bulk, the acquisition of communications data and the sharing
of intercepted communications and communications data between the UK and the
United States of America: Big Brother
Watch (app no. 58170/13), Bureau of
Investigative Journalism and Alice Ross (app no. 62322/14) and 10 Human Rights Organisations (app. no.
24960/15). It follows in the steps of
the Liberty case (app no. 58243/00)
against the previous regime and, given the similarity between some aspects of RIPA and the Investigatory
Powers Act 2016 (IPA), might have relevance for our understanding of that
act too. In addition to questions about Article 8, the judgment also deals with
the impact of surveillance on freedom of speech under Article 10 ECHR.
This
post is the first of two on the judgment. It outlines the issues and the
Court’s reasoning. The second comments on the judgment. Given the size of the judgment
that will be just an initial reaction to the judgment – there will, no doubt,
be much more to be said.
Factual Background
The
applicants in the three cases are organisations and individuals who are either
journalists or are active in campaigning on civil liberties issues. Their
challenges to RIPA were triggered by the information revealed by Edward Snowden
which made apparent the existence of surveillance and intelligence sharing
programmes operated by the intelligence services of the United States and the
United Kingdom. Specifically, they
believed that the nature of their activities meant that their electronic
communications and/or communications data were likely to have been intercepted
or obtained by the UK intelligence services relying on the regime found in
RIPA. Three areas of problems were
highlighted:
-
bulk interception of ‘external’ communications
under s. 8(4), as well as connected communications data;
-
the sharing process whereby the British agencies
received data collected by the US; and
-
access to communications data under Part II
RIPA.
In
all instances the applicants thought that the protection against abuse were
insufficient and that the regimes were neither lawful nor necessary in a
democratic society.
Only
the applicants in the third case brought an action before the Investigatory
Powers Tribunal (IPT), alleging violations of Articles 8, 10 and 14 of the
Convention. Although the IPT found two
‘technical violations’ of the Convention, in the main it regarded the
challenged regime to be in accordance with the requirements of Article 8,
notably the requirements set down in Weber and Saravia (app no.
54934/00).
Judgment
The
first issue concerned exhaustion of domestic remedies, in particular the
failure to bring a case before the IPT.
The applicants argued that in the light of the ECtHR’s own ruling in Kennedy
(app no. 26839/05), the IPT would not be an effective remedy and they were
therefore not obliged so to do. The
Court agreed with this assessment of its case law in general terms, but now
thought that recent practice showed that the IPT now constituted a viable route
for a remedy, especially given the response of the UK government to its
findings. Nonetheless, the Court accepted that, at the time the applicants in
the first and second of the joined cases introduced their applications, they
could not be faulted for having relied on Kennedy
as authority for the proposition that the IPT was not an effective remedy for a
complaint about the general Convention compliance of a surveillance regime. It
therefore found that there existed special circumstances absolving those
applicants from the requirement that they first bring their complaints to the
IPT.
The
Court first considered the position under s. 8(4) RIPA and whether it met the
tests of legitimate purpose, lawful and necessary in a democratic society. In
doing so, it noted that there was jurisprudence in this field but that in
previous jurisprudence the Court had distinguished between different types of
secret surveillance, finding that there different levels of intrusion depending
on the data collected, and also different rules depending on whether national
security was in issue. The Court sought
to synthesise the principles, suggesting that the 6 principles established in Weber
– to ensure the lawfulness of any such regime - were the starting point, though
they might need to be differently applied depending on the type of
surveillance. These need not be updated to take account of changes in
technology. These minima are:
-
the nature of offences which might give rise to
an interception order;
-
definition of the categories of people liable to
have their communications intercepted;
-
a limit on the duration of interception;
-
the procedure to be followed for examining,
using and storing the data obtained;
-
the precautions to be taken when communicating
the data to other parties; and
-
the circumstances in which intercepted data may
or must be erased or destroyed.
In
the context of national security it also recognised the gloss added by the
Grand Chamber in Zakharov (app no. 47143/06) the
review mechanisms and remedies should also be taken into account. The Court
noted that the nature of secret surveillance was such that until an individual
were to be notified about such surveillance, that individual would not be in a
position to exercise their rights. In this, the safeguards against abuse
assumed high importance; moreover, the role or rights to remedies was important
for protection after notification.
Looking
at the situation in issue, the Court started by making the general point that
operating a bulk interception scheme was not in itself in violation of the
Convention. Governments would have “a wide margin of appreciation” in deciding
what kind of surveillance scheme was necessary to protect national
security. The operation of the system
would still however need to be checked to ensure that there were sufficient
safeguards against abuse. The applicants
argued that the fact that there was no requirement for prior judicial
authorization was a fatal flaw in the scheme.
The
Court agreed judicial authorisation was an important safeguard, perhaps even
“best practice”, but by itself it was neither necessary nor sufficient to
ensure compliance with Article 8. It was unnecessary because of the ex post controls available in the
British system. Looking to Zakharov,
the Court recognised that a formal requirement was insufficient – the
requirement there had not prevented bad practice. The Court then held that regard
had to be had to the actual operation of the system of interception, including
the checks and balances on the exercise of power, and the existence or absence
of any evidence of actual abuse.
In
assessing the scheme the Court took the law at the time of its consideration of
the claims; this meant that the Court considered the matter after the impact of
the Snowden leak and some of the consequent changes to practice, including
revisions to relevant codes accompanying RIPA, as well as statements in
Parliament (such as the clarification as to what an external communication was
– it includes Google searches, tweets and Facebook posts from by users in the
UK).
The
Court took the view that, as regards the first Weber requirement, the law was clear as to the circumstances in
which and the conditions on which a section 8(4) warrant might be issued. There
was no evidence to suggest that the Secretary of State was authorising warrants
without due and proper consideration. The authorisation procedure was subject
to independent oversight and the IPT had extensive jurisdiction to examine any
complaint of unlawful interception. Following its analysis in Kennedy, the
Court accepted that the provisions on the duration and renewal of interception
warrants, the provisions relating to the storing, accessing, examining and
using intercepted data, the provisions on the procedure to be followed for
communicating the intercepted data to other parties and the provisions on the
erasure and destruction of intercept material provided adequate safeguards
against abuse.
There
were some weaknesses in the system.
While in the opinion of the Court the selectors (e.g. email address) and
search criteria used to narrow down the mass of information collected to that
which would be read by analysts did not need to be made public or be listed in
the warrant ordering interception, the choice of search criteria and selectors
should be subject to independent oversight (para 387); indeed the Court
expressed some concerned about the cables (‘bearers’) selected for tapping.
Here the ex post review by the Interception of Communications Commissioner (now
replaced under the IPA by the Investigatory Powers Commissioner) and, should an
application be made to it, the IPT were held not to be ‘sufficiently robust to
provide adequate guarantees against abuse’ (para 347).
The
Court also expressed concern about communications data. This is often summarised as who, where, when
but this underplays the significance of the data collected. Indeed, here the Court rejected the
Government’s argument that communications data was necessarily less sensitive
than the content of the communications (para 357). The Court explained the
position thus:
... the content of an electronic communication might be
encrypted and, even if it were decrypted, might not reveal anything of note
about the sender or recipient. The related communications data, on the other
hand, could reveal the identities and geographic location of the sender and
recipient and the equipment through which the communication was transmitted. In
bulk, the degree of intrusion is magnified, since the patterns that will emerge
could be capable of painting an intimate picture of a person through the mapping
of social networks, location tracking, Internet browsing tracking, mapping of
communication patterns, and insight into who a person interacted with. (para
356)
In
the context of s 8(4), communications data associated with the communications
intercepted is also covered by the warrant but crucially some of the
limitations (e.g. that the communication must be external) do not apply to this
data. The Court concluded that the
unjustified lower level of protection meant that there was a violation in this
regard.
The
Court then considered the data sharing arrangements, the first time that the
Court had been asked to consider the matter. It noted to start with the many
ways in which this issue might arise.
The interference in the case had not been occasioned by the interception
of communications itself but lay in the receipt of the intercepted material and
subsequent storage, examination and use by the intelligence services. It confined its judgment to the specific
argument brought before it: the breach occasioned by the British services
receiving American intelligence. The
applicants argued that this indirect access should be treated the same way as
direct surveillance by the British services.
The Court commented that:
"[a]s with any regime which provides for the acquisition
of surveillance material, the regime for the obtaining of such material from
foreign Governments must be 'in accordance with the law'..., it must be
proportionate to the legitimate aim pursued, and there must exist adequate and
effective safeguards against abuse .… In particular, the procedures for
supervising the ordering and implementation of the measures in question must be
such as to keep the 'interference' to what is 'necessary in a democratic
society'" (para 422).
The
Court also recognised the danger of States using intelligence sharing as a
means to circumvent controls (para 423).
It nonetheless accepted that the safeguards need not look identical in
this context as in that of direct surveillance. Applying the principles to the
facts, the Court found unanimously that there had been no violation. In
particular, it accepted that the lawful requirement had been satisfied although
the basis for the data sharing was an internal agreement which were disclosed
only during proceedings before the IPT and subsequently incorporated into the
Interception of Communications Code (para 426). The Code links the
circumstances in which intelligence may be requested to the issuing of s. 8(1)
or s. 8(4) warrants, thus circumscribing the circumstances in which such
requests may arise and indirectly imposes supervision via sign-off by the
Secretary of State and review by the ISC and the Interception of Communications
Commissioner.
The
Court applied its assessment of the Code’s safeguards in relation to s. 8(4)
warrants (in paras 361-363) here. Its assessment of the proportionality of
information sharing was influenced by the threat of international terrorism and
the global nature of terror networks necessitating information flow. In the
Court’s view, ‘this “information flow” was embedded into a legislative context
providing considerable safeguards against abuse’ so that ‘the resulting
interference was to that which was “necessary in a democratic society”’ (para
446) and it considered that the threshold set by the Venice Commission – that
the material transferred should only be able to be searched if all material
requirements of a national search were fulfilled – were met (para 447).
The
next issue was the final question relating to Article 8. It concerned Chapter II of RIPA which allows
specified authorities to access communications data held by communications
service providers (CSPs). As noted,
communications data is not necessarily less intrusive than content. The Court did not however go into detail on
this here, although it noted that real time surveillance is more intrusive that
the transfer of records of existing data (citing Ben Faiza (app no. 31446/12)). It re-iterated
that the same three criteria apply: lawfulness, legitimate aim and necessary in
a democratic society. The Court focussed
on the lawfulness of the rules, referring to the position under EU law –
notably Digital
Rights Ireland (Case C-293/12 and C-594/12) and Watson
(Case C-698/15) - which requires that any regime permitting access to data
retained by CSPs was only to be for the purpose of combating “serious crime”,
and that such access be subject to prior review by a court or independent
administrative body. RIPA -although it provided a clear basis for action on the
face of it - did not comply with this requirement and was therefore was not
compliant with domestic law requirements (para 467).
A
further issue arose in the Bureau of Investigative Journalism (BIJ) complaint.
There, BIJ (a newsgathering organisation) and a journalist (Ross) raised the
issue of interference with confidential journalistic material occasioned by the
operation of both the section 8(4) and the Chapter II regimes. While the Court has emphasised the importance
of protection of journalists’ sources, its case law has distinguished between
court orders for disclosure and searches carried out by the authorities to
obtain this information – that latter is more intrusive. Further, the Court
also distinguished between attempts to reveal sources and investigations into
the commission of crimes. So the importance of source confidentiality is not an
automatic trump card. The Court noted that the s. 8(4) regime was not aimed at
monitoring journalists or uncovering journalistic sources. The authorities would often only know that a
journalist’s communications had been intercepted when examining the intercepted
communications. Following Weber, this
in itself could not be characterised as a particularly serious interference
with freedom of expression. Nonetheless, where those communications were
selected, the concerns would increase and safeguards would be required,
especially as regards the need to protect confidentiality. In this context,
concerns expressed in relation to the s. 8(4) regime ran through to Article 10
concerns. The Court emphasised that:
... there are no [public] requirements...either circumscribing
the intelligence services' power to search for confidential journalistic or
other material (for example, by using a journalist's email address as a
selector), or requiring analysts, in selecting material for examination, to
give any particular consideration to whether such material is or may be
involved. (para 493)
This
blanket power without any “above the water” arrangements limiting the
intelligence services’ ability to search and examine such material constituted
a violation of Article 10.
As
regards the Chapter II regime, while there were some protections in place for
journalistic sources, the Court determined that this was limited. They applied
only where the purpose of the application was to determine a source. They would
not apply in every case where there was a request for the communications data
of a journalist, or where such collateral intrusion was likely. Given this and the fact that access was not
limited to ‘serious crime’, the Court found a violation of Article 10.
The
Court rejected complaints under Article 6 as well as Article 14 combined with
Articles 8 and 10 of the Convention as manifestly ill-founded.
The
judgment was not unanimous. Judge Koskelo, joined by Judge Turkovic, disagreed
with some points of the reasoning of the majority and particularly the
appropriateness of relying on old case law in a context following a technological
‘sea change’ in which people’s lives are more thoroughly exposed to view. Judges Pardalos and Eicke did not agree that
the applicants in the first and second case should have been absolved from the
requirement to exhaust domestic remedies, nor – in the light of the recent
chamber judgment in Centrum For Rattvisa (app no.
35252/08) – that there had been a violation of Article 8 in relation to s. 8(4)
warrants.
Barnard
& Peers: chapter 9
Photo
credit: Journalism, Media and Culture
