INSUBCONTINENT EXCLUSIVE:
In another blow to the UK government record on bulk data handling for intelligence purposes the European Court of Human Rights (ECHR) has
ruled that state surveillance practices violated human rights law.
Arguments against the UK intelligence agencies& bulk collection and data
sharing practices were heard by the court in November last year.
In today ruling the ECHR has ruled that only some aspects of the UK
surveillance regime violate human rights law
So it not all bad news for the government — which has faced a barrage of legal actions (and quite a few black marks against its spying
practices in recent years) ever since its love affair with mass surveillance was revealed and denounced by NSA whistleblower Edward Snowden,
back in 2013.
The judgement reinforces a sense that the government has been seeking to push as close to the legal line as possible on
surveillance, and sometimes stepping over it — reinforcing earlier strikes against legislation for not setting tight enough boundaries to
surveillance powers, and likely providing additional fuel for fresh challenges.
The complaints before the ECHRfocused on three different
surveillance regimes: 1) The bulk interception of communications (aka ‘mass surveillance&); 2) Intelligence sharing with foreign
governments; and 3) The obtaining of communications data from communications service providers.
The challenge actually combines three cases,
with the action brought by a coalition of civil and human rights campaigners, including the American Civil Liberties Union, Amnesty
International, Big Brother Watch, Liberty, Privacy International and nine other human rights and journalism groups based in Europe, Africa,
Asia and the Americas.
The Chamber judgment from the ECHR found, by a majority of five votes to two, that the UK bulk interception regime
violates Article 8 of the European Convention on Human Rights (a right to respect for private and family life/communications) — on the
grounds that ''there was insufficient oversight both of the selection of Internet bearers for interception and the filtering; search and
selection of intercepted communications for examination; and the safeguards governing the selection of ‘related communications data& for
examination were inadequate&.
The judges did not find bulk collection itself to be in violation of the convention but noted that such a
regime must respect criteria set down in case law.
In an even more pronounced majority vote, the Chamber found by six votes to one that the
UK government regime for obtaining data from communications service providers violated Article 8 as it was ¬ in accordance with the
law&.
While both the bulk interception regime and the regime for obtaining communications data from communications service providers
were deemed to have violated Article 10 of the Convention (the right to freedom of expression and information,) as the judges found there
were insufficient safeguards in respect of confidential journalistic material.
However the Chamber did not rule against the government
in two other components of the case — finding thatthe regime for sharing intelligence with foreign governments did not violate either
Article 8 or Article 10.
While the court unanimously rejected complaints made by the third set of applicants, under Article 6 (right to
a fair trial), about the domestic procedure for challenging secret surveillance measures, and under Article 14 (prohibition of
discrimination).
The complaints in this case were lodged prior to the UK legislating for a new surveillance regime, the 2016
Investigatory Powers Act, so in coming to a judgement the Chamber was considering the oversight regime at the time (and in the case of
points 1 and 3 above that the Regulation of Investigatory Powers Act 2000).
RIPA has since been superseded by IPA but, as noted above, today
ruling will likely fuel ongoing human rights challenges to the latter — which the government has already been ordered to amend by other
courts on human rights grounds.
Nor is it the only UK surveillance legislation judged to fall foul on that front
A few years ago UK judges agreed with a similar legal challenge to emergency surveillance legislation that predates IPA — ruling in 2015
that DRIPA was unlawful under human rights law
A verdict the UK Court of Appeal agreed with, earlier this year.
Also in 2015 the intelligence agencies& own oversight court, the IPT, also
found multiple violations following challenges to aspects of its historical surveillance operations, after they have been made public by the
Snowden revelations.
Suchjudgements did not stop the government pushing on with the IPA, though — and it went on to cement bulk collection
at the core of its surveillance modus operandi at the end of 2016.
Among the most controversial elements of the IPAis a requirement that
communications service providers collect and retain logs on the web activity of the digital services accessed by all users for 12 months;
statepowerto require a company to remove encryption, or limit the rollout of end-to-end encryption on a future service; andstate powers to
hack devices, networks and services, includingbulk hackingon foreign soil
It also allows the security agencies to maintainlarge databases of personal information on U.K
citizens,including individualssuspected of no crime.
On the safeguards front the government legislated for what it claimed was a&double
lock& authorization process for interception warrants — which loops in the judiciary to signing off intercept warrants for the first time
in the U.K., along with senior ministers
However this does not regulate the collection or accessing of web activity data that blanket-retained on all users.
InApril this shiny new
surveillance regime was also dealt a blow in UK courts — with judges ordering the government to amend the legislation to narrow how and
why retained metadata could be accessed, giving ministers a deadline of November 1 to make the necessary changes.
In that case the judges
also did not rule against bulk collection in general — declining to find that the state current data retention regime is unlawful on the
grounds that it constituted &general and indiscriminate& retention of data
(For its part the government has always argued its bulk collection activities do not constituteblanket retention.)
And today ECHR ruling
further focuses attention on the safeguards placed around bulk collection programs — having found the UK regime lacked sufficient
monitoring to be lawful (but not that bulk collection itself is unlawful by default).
Opponents of the current surveillance regime will be
busily parsing the ruling to find fresh fronts to attack.
The battle moves on now to @libertyhq litigation challenging the current
Snoopers Charter & the Investigatory Powers Act
Many of the legal flaws slammed in today decision are baked into that law
The wind is in our sails today.
mdash; Corey Stoughton (@CoreyStoughton) September 13, 2018
It not the first time the ECHR has looked at
Most recently, in June 2018, it deemed Swedish legislation and practice in the field of signals intelligence did not violate EU human rights
Among its reasoning was that it found the Swedish system to have provided &adequate and sufficient guarantees against arbitrariness and the
risk of abuse&.
However it said the Big Brother Watch and Others vs United Kingdom case being ruled upon today is the first case in which it
specifically considered the extent of the interference with a person private life that could result from the interception and examination of
communications data (as opposed to content).
In a QA about today judgement, the court notes that it &expressly recognised& the severity of
threats facing states,and also how advancements in technology have &made it easier for terrorists and criminals to evade detection on the
Internet&.
It therefore held that States should enjoy a broad discretion in choosing how best to protect national security
Consequently, a State may operate a bulk interception regime if it considers that it is necessary in the interests of national security
That being said, the Court could not ignore the fact that surveillance regimes have the potential to be abused, with serious consequences
In order to minimise this risk, the Court has previously identified six minimum safeguards which all interception regimes must have,& it
writes.
The safeguards are that the national law must clearly indicate: the nature of offences which may give rise to an interception order;
a definition of the categories of people liable to have their communications intercepted; a limit on the duration of interception; the
procedure to be followed for examining, using and storing the data obtained; the precautions to be taken when communicating the data to
other parties; and the circumstances in which intercepted data may or must be erased or destroyed.
(Additional elements the court says it
considered in an earlier surveillance case, Roman Zakharov v
Russia, also to determine whether legislation breached Article 8, included &arrangements for supervising the implementation of secret
surveillance measures, any notification mechanisms and the remedies provided for by national law&.)
Commenting on today ruling in a
statement,Megan Goulding, a lawyer for Liberty, said: &This is a major victory for the rights and freedom of people in the UK
It shows that there is — and should be — a limit to the extent that states can spy on their citizens.
Police and intelligence agencies
need covert surveillance powers to tackle the threats we face today — but the court has ruled that those threats do not justify spying on
every citizen without adequate protections.Our government has built a surveillance regime more extreme than that of any other democratic
nation, abandoning the very rights and freedoms terrorists want to attack.It can and must give us an effective, targeted system that
protects our safety, data security and fundamental rights.
A Liberty spokeswoman also told us it will continue its challenge to IPA in the
UK High Court, adding: &We continue to believe that mass surveillance can never be compliant in a free, rights-respecting democracy.
Also
commenting in a statement,Silkie Carlo, director of Big Brother Watch, said:&This landmark judgment confirming that the UK mass spying
breached fundamental rights vindicates Mr Snowden courageous whistleblowing and the tireless work of Big Brother Watch and others in our
pursuit for justice.
Under the guise of counter-terrorism, the UK has adopted the most authoritarian surveillance regime of any Western
state, corroding democracy itself and the rights of the British public
This judgment is a vital step towards protecting millions of law-abiding citizens from unjustified intrusion
However, since the new Investigatory Powers Act arguably poses an ever greater threat to civil liberties, our work is far from over.
A
spokesperson for Privacy International told us it considering taking the case to the ECHR Grand Chamber.
Also commenting in a supporting
statement, Antonia Byatt, director of English PEN, added: &This judgment confirms that the British government surveillance practices have
violated not only our right to privacy, but our right to freedom of expression too
Excessive surveillance discourages whistle-blowing and discourages investigative journalism
The government must now take action to guarantee our freedom to write and to read freely online.
We&ve reached out to the Home Office for
comment from the UK government.
On intelligence sharing between governments, which the court had not previously considered, the judges found
thatthe procedure for requesting either the interception or the conveyance of intercept material from foreign intelligence agencies to have
been set out with &sufficient clarity in the domestic law and relevant code of practice&, noting:In particular, material from foreign
agencies could only be searched if all the requirements for searching material obtained by the UK security services were fulfilled.
It also
found &no evidence of any significant shortcomings in the application and operation of the regime, or indeed evidence of any abuse& —
hence finding theintelligence sharing regime did not violate Article 8.
On the portion of the challenge concerning complaints that UK
intelligence agencies& oversight court, the IPT,lacked independence and impartiality, the court disagreed — finding that the tribunal had
&extensive power to consider complaints concerning wrongful interference with communications, and those extensive powers had been employed
in the applicants& case to ensure the fairness of the proceedings&
Most notably, the IPT had access to open and closed material and it had appointed Counsel to the Tribunal to make submissions on behalf of
the applicants in the closed proceedings,& it also writes.
In addition, it said it accepted the government argument that in order toensure
the efficacy of the secret surveillance regime restrictions on the applicants& procedural rights had been &both necessary and proportionate
and had not impaired the essence of their Article 6 rights&.
On the complaints under Article 14, in conjunction with Articles 8 and 10
— that those outside the UK were disproportionately likely to have their communications intercepted as the law only provided additional
safeguards to people known to be in Britain — the court also disgareed,rejecting this complaint as manifestly ill-founded
The applicants had not substantiated their argument that people outside the UK were more likely to have their communications intercepted
In addition, any possible difference in treatment was not due to nationality but to geographic location, and was justified,& it
writes.
Update:Snowden has broken several weeks of Twitter silence to tweet a response to the ECHR judgement…
For five long years,
governments have denied that global mass surveillance violates of your rights
And for five long years, we have chased them through the doors of every court
Don't thank me: thank all of those who never stopped fighting
https://t.co/ARgbI5PKaa
mdash; Edward Snowden (@Snowden) September 13, 2018
