Lorna Woods, Professor of Internet Law, University of Essex

A recent court decision tackles the increasingly relevant issue of secret surveillance, a topic that has gained more attention since Edward Snowden’s revelations. This extensive ruling examines three cases against the UK’s Regulation of Investigatory Powers Act 2000 (RIPA), now largely revoked. These cases, brought by Big Brother Watch, the Bureau of Investigative Journalism and Alice Ross, and 10 Human Rights Organisations, challenged RIPA’s provisions on bulk interception of communications, acquisition of communications data, and data sharing between the UK and the US. This judgment builds on the precedent set by the Liberty case against a previous surveillance regime and may also shed light on the current Investigatory Powers Act 2016 (IPA) due to similarities with RIPA. Beyond Article 8 privacy concerns, the judgment also examines the impact of surveillance on freedom of speech under Article 10 of the European Convention on Human Rights (ECHR).

This post is the first of two parts analyzing the judgment. It summarizes the key issues and the court’s reasoning, while the second post provides commentary on the judgment’s implications. Given the judgment’s complexity, this initial reaction will undoubtedly be followed by further analysis.

Factual Background

The applicants, comprised of journalists and civil liberties organizations, challenged RIPA based on information exposed by Edward Snowden, which revealed surveillance and intelligence-sharing programs operated by US and UK intelligence agencies. Believing their activities made them likely targets of electronic surveillance under RIPA, they highlighted three areas of concern:

- Bulk interception of external communications under Section 8(4) of RIPA, including related communication data.

- Data sharing, specifically how UK agencies received data collected by the US.

- Access to communication data under Part II of RIPA.

The applicants argued that safeguards against abuse were insufficient, rendering these programs unlawful and unnecessary in a democratic society.

Only the third case brought a claim before the Investigatory Powers Tribunal (IPT), alleging violations of Articles 8, 10, and 14 of the ECHR. While the IPT found two minor violations, it largely upheld the challenged regime as compatible with Article 8, particularly the requirements outlined in the Weber and Saravia case.

Judgment

The court first addressed whether domestic remedies, specifically bringing a case before the IPT, had been exhausted. The applicants argued that based on the ECtHR’s ruling in Kennedy, the IPT wouldn’t provide an effective remedy, absolving them of this requirement. While the court acknowledged its previous stance, it now viewed the IPT as a viable avenue for redress, especially given the UK government’s response to its findings. However, it accepted that the first two cases couldn’t be faulted for relying on Kennedy when filing their applications and found special circumstances absolving them from first approaching the IPT.

Regarding Section 8(4) of RIPA, the court examined whether it met the standards of legitimate purpose, lawfulness, and necessity in a democratic society. Recognizing existing jurisprudence, the court noted previous distinctions drawn between types of secret surveillance, with varying intrusion levels depending on data collected and different rules for national security cases. Seeking to harmonize these principles, the court proposed that the six principles from Weber, designed to ensure the lawfulness of such regimes, should serve as a starting point, adaptable based on the type of surveillance. These minima, not requiring updates for technological advancements, are:

- The nature of offenses justifying an interception order.

- Definition of individuals subject to interception.

- Duration limits on interception.

- Procedures for handling intercepted data.

- Precautions for sharing intercepted data.

- Circumstances for erasing or destroying intercepted data.

In national security contexts, the court acknowledged additional considerations outlined in the Zakharov case, such as review mechanisms and remedies. It emphasized that secret surveillance’s nature prevents individuals from exercising their rights until notified about the surveillance, making safeguards paramount. Access to remedies after notification also plays a crucial role in protection.

Examining the case’s specifics, the court first established that bulk interception programs aren’t inherently incompatible with the Convention. Governments have “a wide margin of appreciation” in determining surveillance methods necessary for national security. However, these programs must still undergo scrutiny to ensure sufficient safeguards against abuse. The applicants argued that the absence of mandatory prior judicial authorization constituted a fatal flaw in the system.

While acknowledging judicial authorization as an important safeguard and possibly “best practice,” the court deemed it neither strictly necessary nor sufficient for ensuring compliance with Article 8. This was deemed unnecessary due to available ex-post controls within the British system. Referring to Zakharov, the court noted that formal requirements hadn’t prevented past abuses. Therefore, the court held that the interception system’s actual operation, including checks and balances, and evidence of abuse, must be considered.

The court considered the law as it stood at the time of its assessment, taking into account post-Snowden developments, including revised codes accompanying RIPA and parliamentary statements clarifying “external communication” to encompass UK users’ Google searches, tweets, and Facebook posts.

The court found that regarding the first Weber requirement, the law clearly defined the circumstances and conditions for issuing Section 8(4) warrants. No evidence suggested the Secretary of State authorized warrants without due consideration. Independent oversight applied to the authorization process, and the IPT held extensive jurisdiction to examine complaints about unlawful interception. Building upon its analysis in Kennedy, the court found provisions on duration and renewal of interception warrants, data handling procedures, communication of intercepted data, and erasure and destruction of such material to provide adequate safeguards.

However, the court identified weaknesses in the system. While selectors (e.g., email addresses) and search criteria used to filter intercepted information didn’t need public disclosure or inclusion in the interception warrant, the court stressed that independent oversight should govern the selection process. Concerns were raised about the cables (“bearers”) selected for tapping. The court deemed the ex-post review by the Interception of Communications Commissioner (now replaced by the Investigatory Powers Commissioner under the IPA) and the IPT, upon application, insufficiently robust to guarantee against abuse.

Concerns were also raised regarding communication data, often summarized as “who, where, when,” which downplays the data’s significance. Rejecting the government’s argument that communication data is inherently less sensitive than content, the court highlighted that:

“… the content of an electronic communication might be encrypted and, even if it were decrypted, might not reveal anything of note about the sender or recipient. The related communications data, on the other hand, could reveal the identities and geographic location of the sender and recipient and the equipment through which the communication was transmitted. In bulk, the degree of intrusion is magnified, since the patterns that will emerge could be capable of painting an intimate picture of a person through the mapping of social networks, location tracking, Internet browsing tracking, mapping of communication patterns, and insight into who a person interacted with.”

Under Section 8(4), while communication data associated with intercepted communications is covered by the warrant, it isn’t subject to the same limitations (e.g., the “external communication” requirement). The court concluded that this unjustified lower level of protection constituted a violation.

Next, the court addressed data-sharing arrangements, marking the first time this issue was raised before it. Recognizing the multifaceted nature of this issue, the court clarified that interference in this case stemmed not from interception itself, but from the UK services’ receipt, storage, examination, and use of intercepted material. Focusing on the specific argument presented - the breach arising from British services receiving US intelligence - the court acknowledged the applicants’ argument that this indirect access should be treated on par with direct surveillance by British services. The court stated that:

“[a]s with any regime which provides for the acquisition of surveillance material, the regime for the obtaining of such material from foreign Governments must be ‘in accordance with the law’…, it must be proportionate to the legitimate aim pursued, and there must exist adequate and effective safeguards against abuse .… In particular, the procedures for supervising the ordering and implementation of the measures in question must be such as to keep the ‘interference’ to what is ’necessary in a democratic society’.”

The court also acknowledged the risk of states circumventing controls through intelligence sharing. However, it accepted that safeguards in this context need not mirror those for direct surveillance. Applying these principles to the case, the court unanimously found no violation. Notably, it accepted the lawfulness of data sharing based on an internal agreement disclosed during IPT proceedings and subsequently incorporated into the Interception of Communications Code. By linking intelligence requests to the issuance of Section 8(1) or 8(4) warrants, the Code limits the circumstances for such requests, indirectly imposing supervision through Secretary of State approval and review by the Intelligence and Security Committee (ISC) and the Interception of Communications Commissioner.

The court applied its assessment of the Code’s safeguards for Section 8(4) warrants to this context. Its proportionality assessment considered the threat of international terrorism and the global nature of terror networks necessitating information sharing. The court found that “information flow” was embedded within a legislative framework with considerable safeguards, making the “interference” necessary in a democratic society. It also considered the Venice Commission’s threshold met, requiring transferred material to be searchable only if meeting all national search requirements.

The final Article 8 issue concerned Chapter II of RIPA, allowing designated authorities to access communication data held by communication service providers (CSPs). As previously noted, communication data isn’t inherently less intrusive than content. While not delving into detail, the court acknowledged that real-time surveillance is more intrusive than accessing existing data records, citing Ben Faiza. It reiterated the three criteria of lawfulness, legitimate aim, and necessity in a democratic society. Focusing on the lawfulness of these rules, the court referred to EU law, particularly Digital Rights Ireland and Watson, requiring that access to data retained by CSPs be limited to combating “serious crime” and subject to prior review by a court or independent body. RIPA, despite seemingly providing a clear basis for action, didn’t meet this requirement, rendering it incompatible with domestic law.

The Bureau of Investigative Journalism (BIJ) raised a further issue. The BIJ, a newsgathering organization, and a journalist, Alice Ross, claimed interference with confidential journalistic material due to Section 8(4) and Chapter II regimes. While the court emphasized protecting journalistic sources, its case law distinguishes between court-ordered disclosures and authorities searching for such information, deeming the latter more intrusive. Further distinctions were made between attempts to uncover sources and criminal investigations. Therefore, source confidentiality isn’t automatically paramount. The court noted that Section 8(4) didn’t target journalists or their sources. Authorities often discover intercepted communications involve journalists only during examination. Citing Weber, this wasn’t considered a serious interference with freedom of expression. However, concerns and safeguard requirements arise when selecting such communications for examination, particularly regarding confidentiality. Concerns about the Section 8(4) regime extended to Article 10. The court highlighted that:

“… there are no [public] requirements…either circumscribing the intelligence services’ power to search for confidential journalistic or other material (for example, by using a journalist’s email address as a selector), or requiring analysts, in selecting material for examination, to give any particular consideration to whether such material is or may be involved.”

This unrestricted power, lacking transparent limitations on searching and examining such material, constituted an Article 10 violation.

Regarding Chapter II, while offering some journalistic source protections, the court found them limited, applying only when seeking to identify a source, not in all cases involving journalists’ communication data or potential collateral intrusion. Combined with access not being restricted to “serious crime,” the court found an Article 10 violation.

The court rejected complaints under Article 6 and Article 14 in conjunction with Articles 8 and 10 as manifestly ill-founded.

The judgment wasn’t unanimous. Judge Koskelo, joined by Judge Turkovic, disagreed with aspects of the majority’s reasoning, particularly relying on outdated case law in a technologically transformed landscape with increased personal data exposure. Judges Pardalos and Eicke disagreed that the first two cases should’ve been exempt from exhausting domestic remedies, and, citing Centrum For Rattvisa, that Section 8(4) warrants violated Article 8.

Barnard & Peers: chapter 9

Photo credit: Journalism, Media and Culture