BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM
In an exhaustive and detailed judgment coming to over 200 pages, the ECtHR held that both the bulk electronic communications interception regime operated by the UK’s intelligence agencies under the Regulation of Investigatory Powers Act 2000 and its provisions for acquiring communications data from telecommunications operators violated Articles 8 and 10 of ECHR.
However, the ECtHR held that there was no violation of Article 8 through the UK’s receipt and use of similar information obtained from other countries.
The ECtHR’s judgment is as noteworthy for what it deemed to be incompatible with the ECHR as what it deemed to be incompatible. In contrast to the tenor of many of the headlines in the media about the judgment, it was not an unreserved endorsement of the criticisms that have been levelled at the intelligence services in light of the Snowden revelations. The ECtHR’s comments as to the proportionality and necessity of the bulk collection of electronic communications, as well as about the adequacy of the safeguards and oversight structures will be of some consolation to the government.
The real issue for the Government is whether the ‘checks and balances’ in the Investigatory Powers Act (which is not yet fully in force) will be sufficient to defeat the criticisms made by the ECtHR of the previous regime under RIPA; in particular over the selection criteria for material that would be seen by human eyes and whether there are sufficient ‘journalistic’ safeguards.
Background
The case involved three conjoined applications brought by individuals who believed (courtesy of the Edward Snowden revelations) that their electronic communications were likely to have either been intercepted by the UK’s intelligence services, obtained by those intelligence services after being intercepted by foreign governments, and/or obtained by the UK authorities from Communications Service Providers (“CSPs”).
The Snowden revelations indicated that GCHQ was running an operation known as ‘Tempora’ which allowed it to tap into and store huge volumes of data drawn from the approximately 100,000 ‘bearers’ which make up the global internet.
The court summarised the subsequent analysis of the data by the intelligence services as:
- The interception of a small percentage of Internet bearers, selected as being those most likely to carry external communications of intelligence value.
- The filtering and automatic discarding (in near real-time) of a significant percentage of intercepted communications.
- The application of simple and complex search criteria (by computer) to the remaining communications to see what else can be discarded.
- The examination of some of the remaining material by an analyst.
The ECtHR went on to untangle the complex legislative provisions under RIPA:
- “Bulk interception” of communications was carried out pursuant to a section 8(4) warrant.
- At the time of issuing a warrant, the Secretary of State must also issue a certificate setting out a description of the intercepted material which he considers it necessary to examine in the interests of national security, for the purpose of preventing or detecting serious crime, or for safeguarding the economic well-being of the United Kingdom.
- Section 16 sets out additional safeguards in relation to the interception of “external” communications with a recipient or sender outside the British Isles: intercepted material cannot be read, looked at or listened to solely according to a factor which is “referable to an individual who is known to be for the time being in the British Islands; and that “has as its purpose, or one of its purposes, the identification of material contained in communications sent by him, or intended for him.”
The ECtHR then examined the web of regulation and oversight provided by the Interception of Communication Code of Practice, the Investigatory Powers Tribunal (IPT), the Interception of Communications Commissioner, the Independent Reviewer of Terrorism Legislation, and the Parliamentary Intelligence and Security Committee (ISC).
It noted that the ISC’s report following Snowden had found that the
intelligence services did not have the legal authority, the resources, the technical capability, or the desire to intercept every communication of British citizens, or of the Internet as a whole: GCHQ were not reading the emails of everyone in the United Kingdom.
The bulk interception regime and Article 8
The first issue before the ECtHR was regarding the sufficiency of the IPT as a mechanism for investigating potential complaints about secret surveillance regime.
The ECtHR concluded that in light of the manner in which the IPT had exercised its powers, and the “very real impact its judgments have had on domestic law and practice”, that the IPT
has shown itself to be a remedy, available in theory and practice, which is capable of offering redress to applicants complaining of both specific incidences of surveillance and the general Convention compliance of surveillance regimes.
With regards to the substantive issue of the breach of Article 8, the ECtHR noted the acceptance by the UK that while it denied that the section 8(4) regime permitted mass surveillance or generalised access to communications, it did permit the bulk interception of bearers for external communications.
The ECtHR whilst the regime was in principle part of the UK’s ‘margin of appreciation’, nevertheless,
where a power vested in the executive is exercised in secret, the risks of arbitrariness are evident. It is therefore essential to have clear, detailed rules on secret surveillance measures … The domestic law must be sufficiently clear to give citizens an adequate indication as to the circumstances in which and the conditions on which public authorities are empowered to resort to any such measures.
Accordingly, the relevant tests were:
- the nature of offences which may give rise to an interception order
- whether there was a definition of the categories of people liable to have their communications intercepted
- whether there was a limit on the duration of interception
- the procedure to be followed for examining, using and storing the data obtained
- the precautions to be taken when communicating the data to other parties
- the circumstances in which intercepted data may or must be erased or destroyed
- the arrangements for supervising the implementation of secret surveillance measures, any notification mechanisms and the remedies provided for by national law.
The ECtHR however rejected the applicants’ arguments that there should be additional requirements for objective evidence of reasonable suspicion in relation to the persons for whom data is being sought, prior independent judicial authorisation of interception warrants, and the subsequent notification of the surveillance subject.
The ECtHR held that the grounds on which interception warrants could be authorised (e.g. national security) were sufficiently clear. It further held that while anyone could potentially have their communications intercepted under the section 8(4) regime, it was clear that the intelligence services were neither intercepting everyone’s communications, nor exercising an unfettered discretion to intercept whatever communications they wished. The section 16(2) exclusion of communications of individuals known currently to be in the British Islands was also stated to be an important safeguard, since persons of interest to the intelligence services who are known to be in the British Islands could be subject to a targeted warrant under section 8(1) of RIPA. As such, the intelligence services should not be permitted to obtain via a bulk warrant what they could obtain via a targeted warrant.
However, the ECtHR was troubled by the fact that in practice the only independent oversight of the process of filtering and selecting intercept data for examination was the post factum audit by the Interception of Communications Commissioner and (should an application be made to it) the IPT.
It concluded that
while there is no evidence to suggest that the intelligence services are abusing their power … the Court is not persuaded that the safeguards governing the selection of bearers for interception and the selection of intercepted material for examination are sufficiently robust to provide adequate guarantees against abuse. Of greatest concern, however, is the absence of robust independent oversight of the selectors and search criteria used to filter intercepted communications.
Regarding the interception of communications data (i.e. the metadata of communications rather than their contents), the ECtHR held that whilst communications data is a valuable resource for the intelligence services, for example in fast-moving terror operations, the level of intrusion potentially resulting from the interception of data was high. The court stated that
the patterns that will emerge could be capable of painting an intimate picture of a person through the mapping of social networks, location tracking, Internet browsing tracking, mapping of communication patterns, and insight into who a person interacted with.
The Court concluded there had been a failure to strike a fair balance between the competing public and private interests by exempting the interception of communications data from the safeguards applicable to the searching and examining of content.
The ECtHR, however, was unpersuaded by other criticism of the bulk interception regime. It held that it was satisfied with the provisions governing the duration of storage of intercepted data; those concerning storing, accessing, examining and using intercepted data; and also those for the erasure and destruction of material.
It also rejected the contention that the authorisation of section 8(4) warrants by the Secretary of State gave rise to a breach of Article 8. It considered that the supervision and oversight of the bulk interceptions under the regime was capable of providing adequate and effective guarantees against abuse.
Perhaps most significantly, the ECtHR held with regards to proportionality that
bulk interception is a valuable means to achieve the legitimate aims pursued, particularly given the current threat level from both global terrorism and serious crime
So the bulk interception regime was a proportionate interference with Article 8.
But in view of the other shortcomings, the Court found that the section 8(4) regime does not meet the “quality of law” requirement and is incapable of keeping the “interference” to what is “necessary in a democratic society”. There had accordingly been a violation of Article 8 of the Convention.
The intelligence sharing regime and Article 8
The ECtHR agreed with the applicants that there was a potential risk of having their communications obtained by the intelligence services of the UK under the intelligence sharing regime with other countries (in particular, but not exclusively the USA).
However, it emphasised that the interference with their Article 8 rights solely lay in receipt of the intercepted material and its subsequent storage, examination and use by the UK intelligence services, and not its interception.
The ECrHR considered that the regime clearly pursued several legitimate aims, including the interests of national security, public safety and the economic well-being of the country, the prevention of disorder or crime, and the protection of the rights and freedoms of others.
It then went to apply the same considerations as it did when analysing the bulk interception regime.
The ECtHR then held that in light of the commonality of the safeguards between the bulk interception regime and the intelligence sharing regime, the provisions relating to the storing, accessing, examining and using such material were sufficiently clear. The provisions relating to the procedure to be followed for communicating the material obtained to other parties were also sufficiently clear.
Again, the ECtHR’s view on proportionality was that
Due to the nature of global terrorism, and in particular the complexity of global terror networks, the Court accepts that taking such a stand – and thus preventing the perpetration of violent acts endangering the lives of innocent people – requires a flow of information between the security services of many countries in all parts of the world. As, in the present case, this “information flow” was embedded into a legislative context providing considerable safeguards against abuse, the Court would accept that the resulting interference was kept to that which was “necessary in a democratic society”.
Accordingly, the ECtHR held that there had been no Article 8 violation as a result of the intelligence sharing regime.
The Chapter II regime and Article 8
The ECtHR then looked at the ‘Chapter II RIPA regime’, under which the intelligence agencies could request specific communications data from Communication Service Providers (CSPs).
The applicants in the second of the joined cases are investigative journalists who had reported on issues such as CIA torture, and the Court accepted that they were potentially at risk of having their communications obtained by the United Kingdom authorities.
The ECtHR noted that the High Court had ruled that the relevant part of the Investigative Powers Act was incompatible with EU law. The court therefore held that as UK domestic law, as interpreted by the domestic authorities in light of the recent judgments of the CJEU, required that any regime permitting the authorities to access data retained by CSPs limits access to the purpose of combating “serious crime”, and that access be subject to prior review by a court or independent administrative body.
As the Chapter II regime permits access to retained data for the purpose of combating crime (rather than “serious crime”) and was not usually subject to prior review by a court or independent administrative body, it was not “in accordance with the law”. There was therefore a breach of Article 8.
Article 10
The ECtHR then considered the separate issue as to whether the bulk interception regime was a violation of Article 10, and looked at whether there specific safeguards surrounding the search for ‘journalistic material.’
It held that
in view of the potential chilling effect that any perceived interference with the confidentiality of their communications and, in particular, their sources might have on the freedom of the press and, in the absence of any “above the waterline” arrangements limiting the intelligence services’ ability to search and examine such material other than where “it is justified by an overriding requirement in the public interest”, the Court finds that there has also been a violation of Article 10 of the Convention.
Similarly, the ECtHR was concerned by the lack of specific safeguards for the requesting of journalistic material from CSPs.
It acknowledged that the Chapter II regime afforded enhanced protection where data is sought for the purpose of identifying a journalist’s source. However,
these provisions only apply where the purpose of the application is to determine a source; they do not, therefore, apply in every case where there is a request for the communications data of a journalist, or where such collateral intrusion is likely. Furthermore, in cases concerning access to a journalist’s communications data there are no special provisions restricting access to the purpose of combating “serious crime”.
Consequently, the Court considered that the regime was not “in accordance with the law”. Therefore, there was a further breach of Article 10.
Dominic Ruck Keene is a barrister at One Crown Office Row.
The post Who is reading your email…? appeared first on UK Human Rights Blog.