*/
Enormous, complicated and (inevitably) misreported – the ECtHR judgment following the Snowden revelations warrants further scrutiny. By Oliver Sanders QC and Dominic Ruck Keene
It was therefore perhaps inevitable that the media headlines should focus on the findings of breach, suggesting a wholesale reverse for the UK government: ‘GCHQ data collection regime violated human rights, court rules’ (Guardian); and ‘British spies violated privacy and free speech laws with GCHQ programme revealed by Edward Snowden’ (Daily Mail). The true picture was, of course, much more complicated and much less sexy, as reflected in the headline of the court’s own Press Release: ‘Some aspects of UK surveillance regimes violate Convention’.
The judgment determined three applications lodged by 16 different applicants in 2013-2015 in the wake of the Edward Snowden revelations. No fewer than 15 interveners joined the fray later. The key concern was with the bulk interception of electronic communications by the UK intelligence services, but three different surveillance regimes were targeted:
On grounds which were more procedural than substantive, the court found regimes (i) and (iii) to breach Articles 8 and 10 of the ECHR (respectively the right to respect for private and family life and the right to freedom of expression). That said, it should be noted that both regimes were set out in provisions of RIPA which have been or are being reformed by the Investigatory Powers Act 2016.
Much less media coverage was given to the court’s finding that regime (ii), on intelligence sharing with foreign governments, did not breach Articles 8 or 10 or to its support for the Investigatory Powers Tribunal (IPT) and dismissal of complaints under Article 6 (right to a fair trial) and Article 14 (prohibition of discrimination).
Furthermore, the court certainly did not endorse the wide-ranging criticisms levelled at the intelligence services by the applicants and others following the Snowden revelations and many of its observations on necessity and proportionality, and on the adequacy of the UK’s oversight arrangements will have been welcomed by the government.
A number of the applicants had not pursued their complaints before the IPT in reliance on the court’s earlier ruling in Kennedy v United Kingdom (App no. 26839/05, 2010) where concerns were expressed about the IPT’s ability to handle general complaints about the UK’s secret surveillance regime as a whole. Although the court was persuaded that the judgments of the IPT have had a ‘very real impact… on domestic law and practice’, such that it does represent an effective complaints mechanism after all, the applicants in question were nevertheless excused from having to show exhaustion of their domestic remedies via the IPT given their reliance on Kennedy. Future applicants wishing to pursue such complaints before the court cannot expect the same latitude and will need to proceed first in the IPT in order to demonstrate exhaustion of their domestic remedies.
Snowden claimed that a GCHQ operation called ‘Tempora’ allowed it to tap into and store huge volumes of data drawn from approximately 100,000 ‘bearers’ making up the global internet. The court found:
The government accepted that the s 8(4) of RIPA regime permitted the bulk interception of bearers for communications going to and from recipients outside the UK, but denied that it permitted mass surveillance or generalised access to communications. The court reiterated that bulk interception schemes involve a prima facie interference with Article 8(1) privacy rights but are capable of being justified under Article 8(2).
The key question was whether the UK regime was ‘in accordance with the law’ for the purposes of Article 8(2). Section 8(4) of RIPA provided the requisite legal basis and the question of lawfulness therefore came down to the satisfaction of the six ‘minimum safeguards’ against abuse established in Weber and Saravia v Germany (App no. 54934/00, 2006) and the existence of adequate arrangements for supervising compliance with these safeguards.
In short, did UK law ‘clearly indicate’: the nature of the offences which could give rise to an interception order; the categories of people liable to have their communications intercepted; the duration of any interception; a procedure to be followed for examining, using and storing the data obtained; precautions to be taken when communicating the data to other parties; and the circumstances in which intercepted data were erased or destroyed?
Interestingly, the court rejected an attempt to expand the Weber safeguards to include additional requirements for objective evidence of a reasonable suspicion, prior independent judicial authorisation or the subsequent notification of the surveillance subject. Furthermore, it held that the grounds on which interception warrants could be authorised were sufficiently clear and that the intelligence services were neither intercepting everyone’s communications, nor exercising an unfettered discretion to intercept whatever communications they wished.
However, the court was troubled by the fact that the only independent oversight of the process of filtering and selecting intercept data for examination was after-the-event audit by the (then) Interception of Communications Commissioner and (in the event of a complaint) the IPT. It highlighted the absence of ‘robust independent oversight of the selectors and search criteria used to filter intercepted communications’.
Furthermore, the court found there were no safeguards governing the selection of related communications data for examination notwithstanding that their interception could involve a high level of intrusion: ‘the patterns that will emerge could be capable of painting an intimate picture of a person through the mapping of social networks, location tracking, internet browsing tracking, mapping of communication patterns, and insight into who a person interacted with.’
For these reasons, the court found that the bulk interception regime under s 8(4) of RIPA was not ‘in accordance with the law’ and so was in breach of Article 8.
Importantly, the defects found were capable of being addressed and the court’s substantive finding on proportionality was positive: ‘bulk interception is a valuable means to achieve the legitimate aims pursued, particularly given the current threat level from both global terrorism and serious crime.’
With regards to intelligence sharing, the court agreed with the applicants that there was a potential risk of their communications being obtained by the intelligence services under arrangements with other countries, in particular, but not exclusively, the USA. However, it emphasised that the UK’s interference with their Article 8 rights lay solely in receipt of the intercepted material and its subsequent storage, examination and use by our intelligence services, and not in its original interception by foreign authorities.
Applying the same test of lawfulness, the court found that the operation of the intelligence sharing regime was ‘sufficiently clear’ from national legislation and Codes of Practice. Furthermore, the ‘complexity of global terror networks’ required ‘a flow of information between the security services of many countries in all parts of the world.’ Accordingly, there was no violation of Article 8.
The court then looked at the regime under Chapter II of RIPA allowing the intelligence services to request specific communications data from CSPs. In previous litigation, the government had conceded, and the High Court had found, that a similar set of provisions in the Investigatory Powers Act 2016 was incompatible with EU law because requests thereunder were not subject to a ‘serious crime’ requirement or prior review by a court or independent administrative body.
Given that compliance with EU law was a requirement of domestic law and given that the same safeguards were absent from Chapter II of RIPA, the court found that the regime thereunder was not ‘in accordance with the law’ and therefore breached Article 8.
The court gave separate consideration to the discrete question whether both the bulk interception and communications data regimes under s 8(4) and Chapter II of RIPA breached Article 10, as well as Article 8, because neither contained specific safeguards surrounding the handling of ‘journalistic material’.
The court emphasised that there was a potential ‘chilling effect’ on the freedom of the press from any perceived interference with the confidentiality of journalistic communications and sources. In the absence of any avowed ‘above the waterline’ restrictions, ie public domain checks and balances limiting the search and examination of such material, the court held that there had also been a violation of Article 10.
Overall, the real issue for the government will be whether the ‘checks and balances’ introduced in the reformed Investigatory Powers Act 2016 (which is not yet fully in force) will be sufficient to defeat the court’s criticisms of the predecessor regimes in RIPA.
Big Brother Watch has made its position clear: ‘Under the guise of counter-terrorism, the UK has adopted the most authoritarian surveillance regime of any Western state, corroding democracy itself and the rights of the British public. This judgment is a vital step towards protecting millions of law-abiding citizens from unjustified intrusion. However, since the new Investigatory Powers Act arguably poses an ever greater threat to civil liberties, our work is far from over.’
In light of the court’s judgment, key issues will be the selection criteria governing the material examined by human analysts and the safeguards protecting journalistic materials and sources. The court’s recent judgment in Centrum för Rättvisa v Sweden (App no. 35252/08 2018) upholding the Swedish approach to bulk interception may prove illuminating.
Oliver Sanders QC and Dominic Ruck Keene are barristers at 1 Crown Office Row.
It was therefore perhaps inevitable that the media headlines should focus on the findings of breach, suggesting a wholesale reverse for the UK government: ‘GCHQ data collection regime violated human rights, court rules’ (Guardian); and ‘British spies violated privacy and free speech laws with GCHQ programme revealed by Edward Snowden’ (Daily Mail). The true picture was, of course, much more complicated and much less sexy, as reflected in the headline of the court’s own Press Release: ‘Some aspects of UK surveillance regimes violate Convention’.
The judgment determined three applications lodged by 16 different applicants in 2013-2015 in the wake of the Edward Snowden revelations. No fewer than 15 interveners joined the fray later. The key concern was with the bulk interception of electronic communications by the UK intelligence services, but three different surveillance regimes were targeted:
On grounds which were more procedural than substantive, the court found regimes (i) and (iii) to breach Articles 8 and 10 of the ECHR (respectively the right to respect for private and family life and the right to freedom of expression). That said, it should be noted that both regimes were set out in provisions of RIPA which have been or are being reformed by the Investigatory Powers Act 2016.
Much less media coverage was given to the court’s finding that regime (ii), on intelligence sharing with foreign governments, did not breach Articles 8 or 10 or to its support for the Investigatory Powers Tribunal (IPT) and dismissal of complaints under Article 6 (right to a fair trial) and Article 14 (prohibition of discrimination).
Furthermore, the court certainly did not endorse the wide-ranging criticisms levelled at the intelligence services by the applicants and others following the Snowden revelations and many of its observations on necessity and proportionality, and on the adequacy of the UK’s oversight arrangements will have been welcomed by the government.
A number of the applicants had not pursued their complaints before the IPT in reliance on the court’s earlier ruling in Kennedy v United Kingdom (App no. 26839/05, 2010) where concerns were expressed about the IPT’s ability to handle general complaints about the UK’s secret surveillance regime as a whole. Although the court was persuaded that the judgments of the IPT have had a ‘very real impact… on domestic law and practice’, such that it does represent an effective complaints mechanism after all, the applicants in question were nevertheless excused from having to show exhaustion of their domestic remedies via the IPT given their reliance on Kennedy. Future applicants wishing to pursue such complaints before the court cannot expect the same latitude and will need to proceed first in the IPT in order to demonstrate exhaustion of their domestic remedies.
Snowden claimed that a GCHQ operation called ‘Tempora’ allowed it to tap into and store huge volumes of data drawn from approximately 100,000 ‘bearers’ making up the global internet. The court found:
The government accepted that the s 8(4) of RIPA regime permitted the bulk interception of bearers for communications going to and from recipients outside the UK, but denied that it permitted mass surveillance or generalised access to communications. The court reiterated that bulk interception schemes involve a prima facie interference with Article 8(1) privacy rights but are capable of being justified under Article 8(2).
The key question was whether the UK regime was ‘in accordance with the law’ for the purposes of Article 8(2). Section 8(4) of RIPA provided the requisite legal basis and the question of lawfulness therefore came down to the satisfaction of the six ‘minimum safeguards’ against abuse established in Weber and Saravia v Germany (App no. 54934/00, 2006) and the existence of adequate arrangements for supervising compliance with these safeguards.
In short, did UK law ‘clearly indicate’: the nature of the offences which could give rise to an interception order; the categories of people liable to have their communications intercepted; the duration of any interception; a procedure to be followed for examining, using and storing the data obtained; precautions to be taken when communicating the data to other parties; and the circumstances in which intercepted data were erased or destroyed?
Interestingly, the court rejected an attempt to expand the Weber safeguards to include additional requirements for objective evidence of a reasonable suspicion, prior independent judicial authorisation or the subsequent notification of the surveillance subject. Furthermore, it held that the grounds on which interception warrants could be authorised were sufficiently clear and that the intelligence services were neither intercepting everyone’s communications, nor exercising an unfettered discretion to intercept whatever communications they wished.
However, the court was troubled by the fact that the only independent oversight of the process of filtering and selecting intercept data for examination was after-the-event audit by the (then) Interception of Communications Commissioner and (in the event of a complaint) the IPT. It highlighted the absence of ‘robust independent oversight of the selectors and search criteria used to filter intercepted communications’.
Furthermore, the court found there were no safeguards governing the selection of related communications data for examination notwithstanding that their interception could involve a high level of intrusion: ‘the patterns that will emerge could be capable of painting an intimate picture of a person through the mapping of social networks, location tracking, internet browsing tracking, mapping of communication patterns, and insight into who a person interacted with.’
For these reasons, the court found that the bulk interception regime under s 8(4) of RIPA was not ‘in accordance with the law’ and so was in breach of Article 8.
Importantly, the defects found were capable of being addressed and the court’s substantive finding on proportionality was positive: ‘bulk interception is a valuable means to achieve the legitimate aims pursued, particularly given the current threat level from both global terrorism and serious crime.’
With regards to intelligence sharing, the court agreed with the applicants that there was a potential risk of their communications being obtained by the intelligence services under arrangements with other countries, in particular, but not exclusively, the USA. However, it emphasised that the UK’s interference with their Article 8 rights lay solely in receipt of the intercepted material and its subsequent storage, examination and use by our intelligence services, and not in its original interception by foreign authorities.
Applying the same test of lawfulness, the court found that the operation of the intelligence sharing regime was ‘sufficiently clear’ from national legislation and Codes of Practice. Furthermore, the ‘complexity of global terror networks’ required ‘a flow of information between the security services of many countries in all parts of the world.’ Accordingly, there was no violation of Article 8.
The court then looked at the regime under Chapter II of RIPA allowing the intelligence services to request specific communications data from CSPs. In previous litigation, the government had conceded, and the High Court had found, that a similar set of provisions in the Investigatory Powers Act 2016 was incompatible with EU law because requests thereunder were not subject to a ‘serious crime’ requirement or prior review by a court or independent administrative body.
Given that compliance with EU law was a requirement of domestic law and given that the same safeguards were absent from Chapter II of RIPA, the court found that the regime thereunder was not ‘in accordance with the law’ and therefore breached Article 8.
The court gave separate consideration to the discrete question whether both the bulk interception and communications data regimes under s 8(4) and Chapter II of RIPA breached Article 10, as well as Article 8, because neither contained specific safeguards surrounding the handling of ‘journalistic material’.
The court emphasised that there was a potential ‘chilling effect’ on the freedom of the press from any perceived interference with the confidentiality of journalistic communications and sources. In the absence of any avowed ‘above the waterline’ restrictions, ie public domain checks and balances limiting the search and examination of such material, the court held that there had also been a violation of Article 10.
Overall, the real issue for the government will be whether the ‘checks and balances’ introduced in the reformed Investigatory Powers Act 2016 (which is not yet fully in force) will be sufficient to defeat the court’s criticisms of the predecessor regimes in RIPA.
Big Brother Watch has made its position clear: ‘Under the guise of counter-terrorism, the UK has adopted the most authoritarian surveillance regime of any Western state, corroding democracy itself and the rights of the British public. This judgment is a vital step towards protecting millions of law-abiding citizens from unjustified intrusion. However, since the new Investigatory Powers Act arguably poses an ever greater threat to civil liberties, our work is far from over.’
In light of the court’s judgment, key issues will be the selection criteria governing the material examined by human analysts and the safeguards protecting journalistic materials and sources. The court’s recent judgment in Centrum för Rättvisa v Sweden (App no. 35252/08 2018) upholding the Swedish approach to bulk interception may prove illuminating.
Oliver Sanders QC and Dominic Ruck Keene are barristers at 1 Crown Office Row.
Enormous, complicated and (inevitably) misreported – the ECtHR judgment following the Snowden revelations warrants further scrutiny. By Oliver Sanders QC and Dominic Ruck Keene
Chair of the Bar Sam Townend KC highlights some of the key achievements at the Bar Council this year
Louise Crush of Westgate Wealth Management highlights some of the ways you can cut your IHT bill
Rachel Davenport breaks down everything you need to know about AlphaBiolabs’ industry-leading laboratory testing services for legal matters
By Louise Crush of Westgate Wealth Management sets out the key steps to your dream property
A centre of excellence for youth justice, the Youth Justice Legal Centre provides specialist training, an advice line and a membership programme
By Kem Kemal of Henry Dannell
Mark Neale, Director General of the Bar Standards Board, offers an update on the Equality Rules consultation
Joanna Hardy-Susskind speaks to those walking away from the criminal Bar
Imposing a professional obligation to act in a way that advances equality, diversity and inclusion is the wrong way to achieve this ambition, says Nick Vineall KC
Tom Cosgrove KC looks at the government’s radical planning reform and the opportunities and challenges ahead for practitioners
By Ashley Friday of AlphaBiolabs
