Surveillance under RIPA: neither a strict legal framework nor rigorously overseen – Sam Lincoln

13 October 2015 by Guest Contributor

Those charged with the task of protecting the public from harm resort to assertion similar to that here attributed to a GCHQ spokesperson:

Our work is carried out in accordance with a strict legal and policy framework, which ensures that our activities are authorised, necessary and proportionate, and that there is rigorous oversight.

I was the Chief Surveillance Inspector at the Office of Surveillance Commissioners for eight years until August 2013. My own view is that the legal and policy framework is not strict and that oversight is not rigorous. Until they are, we should not blame public authorities for exploiting opportunities that enable them to meet their operational and investigative objectives.

Regardless of one’s views on the actions of Mr. Snowden, public knowledge of covert capabilities has encouraged those who engage in covert conduct to explain what it is they require and why. The reports published by the Independent Reviewer of Terrorism Legislation, the Intelligence and Security Committee and RUSI make important contributions but tend, in my view, to focus on the effect of technology and the impact of so-called mass surveillance. All agree that the law and oversight should be improved. Here’s my take on those two fundamentals.

RIPA is permissive legislation

In my view, RIPA is flawed because it is permissive legislation. Apart from an interception no covert surveillance – the acquisition of communications data, intrusive or directed surveillance or the use of a covert human intelligence source (CHIS) (whether an undercover officer or an informer) – must be authorised before it can proceed (RIPA s.80). As Simon McKay (author of Covert Policing) correctly identifies, RIPA is essentially a “voluntary code”. It is inevitable that an investigator will be tempted to use every means at his disposal and to keep his options open when planning covert surveillance; to be, as often quoted in my presence at ACPO conferences, “lawfully audacious”.

Far from hindering an investigator’s or intelligence officer’s ability to do their job, the law must be clear what cannot be done; it must set clear boundaries. The challenge is to create law which focuses on the purpose rather than the method of collection or where the collection takes place. I am not so concerned that my vehicle movements are held on a database for a period of time. I am concerned about who has access to that data, how long it is retained and the use made of it. If my vehicle is to be identified for specific attention (in other words an alert is created) I would expect an auditable prior justification.

Constructing laws which are clear requires agreement on definitions; practitioners should not be left to interpret meaning and parameters. Revision of most current definitions is vital. Let me use a single example to present my case.

The current definition of surveillance includes:

monitoring, observing or listening to persons, their movements, their conversations or their other activities or communications; recording anything monitored, observed or listened to in the course of surveillance; and surveillance by or with the assistance of a surveillance device. (RIP s.48(2))

At face value ‘surveillance’ is activity we all conduct much of the time. So the law needs to clarify that it relates to those entities acting on behalf of the State and the public must be informed of who those entities are. But the greatest concern is surveillance that is covert. So let’s see how RIPA defines covert surveillance:

surveillance is covert if, and only if, it is carried out in a manner that is calculated to ensure that persons who are subject to the surveillance are unaware that it is or may be taking place. (RIPA s.26(9)(a))

Does this mean that the scale and methods exposed by Snowden are no longer covert surveillance because we are now aware that it is or may be taking place? I hope not. Data and information collected at scale, often automatically, is a reality; technology cannot easily be restrained and we should allow those charged with our protection to exploit it. As I said earlier, the fact that surveillance is or may be taking place is not the definitive aspect of ‘covertness’; the crucial aspect is the purpose which identifies individuals for specific attention. It makes no difference whether it is conducted in the virtual or ‘real’ world; the individual has been singled out from the masses and they don’t know it.

Permissive legislation, poorly defined, allows too much discretion to focus intrusively on too many people without a proper audited and contemporaneous justification. Covert surveillance legislation should set clear limits focused on purpose not method. And all covert surveillance must be subject to prior authorisation.

Judicial oversight alone is not rigorous

My second proposition is that confidence in judicial oversight alone is misplaced. Legislation has two fundamental purposes: to protect the public from unnecessary and disproportionate covert surveillance by those acting on behalf of the State (ECHR Article 8) – a prospective process; and to ensure that evidence acquired covertly is admissible in court so as to allow a fair trial (ECHR Article 6) – a retrospective process.

RIPA requires an authorising officer to explain in writing why he has granted covert surveillance. Permissive legislation implies discretion and subjective judgement. It was common for a Surveillance Commissioner to explain that to me, despite insufficient detail on the written authorisation, that he was persuaded to approve covert activity because there was clear necessity on one of the applicable grounds (usually the prevention and detection of a crime). In other words, there was no inclination to inhibit covert surveillance merely because detail was lacking as to method or adequate consideration of social and ethical impact. My experience is that retired judges, when in doubt, are comfortable relying on retrospective assessment by trial judges. It is worth noting here that oversight bodies are only required to approve a small number of authorisations and only examine about ten percent of authorisations often after they have been conducted and cancelled. Bearing in mind that RIPA s.80 does not oblige authorisation, and that a Commissioner is not engaged in the process of reviewing authorisations after covert surveillance has commenced, the Commissioners’ stance is not unreasonable. But it is insufficient for the following reasons.

Firstly, a trial judge is unlikely to exclude compelling evidence merely because an authorisation was inadequate or did not exist. Additionally, a trial judge benefits from information not available to a Commissioner. This additional information may reduce concerns about human rights or amend perceptions of necessity and proportionality. Furthermore, a trial judge is wrong to rely on the capability of the oversight bodies especially if assuming that every authorisation is examined by a Commissioner prior to covert conduct. Retrospective judgment appears to trump prospective decisions and might appear as the ends justifying the means.

Secondly, a trial judge is only concerned with the facts of a specific case and the effect of covert conduct on the accused and the fairness of the trial. He is not concerned with the impact of covert surveillance on anyone not accused even if their Article 8 rights were invaded in the process. The innocent may not be protected despite being subjected to covert surveillance. Whether or not they should be notified is not currently a consideration.

Thirdly, those conducting covert surveillance are constrained by the terms of an authorisation (RIPA s.27(b)) which should “describe” and “specify” the conduct (RIPA ss.28(4) and 29(4)). If the terms are unclear or, more likely, too general the authorisation may be deemed invalid. It is my view that a retired judge, or Secretary of State, has insufficient knowledge of investigative techniques, technological capability or covert modus operandi to properly assess an authorisation. With limited capability to examine a sufficient number of authorisations, oversight bodies can only make retrospective assessment of compliance. My personal view is that too many authorisations could be deemed invalid because they do not properly justify necessity, inadequately consider proportionality, and too frequently dismiss collateral intrusion on persons innocent of misdemeanour.

Finally, multiple oversight bodies for a single Act invite unhelpful difference in interpretation. It is my firm belief that the Chief Surveillance Commissioner and the Interception of Communications Commissioner benefit from the support of inspectors with covert surveillance experience. This benefit is not available to the Intelligence Services Commissioner or the Investigatory Powers Tribunal. I can only provide personal experience, but I know that the ISC and, more importantly, the IPT have interpreted RIPA in a way not supported by the Surveillance Commissioners during my tenure.

So oversight by those who have held high judicial office alone, in my judgment, is insufficient if the law is to remain permissive and essentially voluntary. If preventing unnecessary and disproportionate intrusion of privacy is the aim, the process is necessarily prospective. Deciding whether or not covert conduct should proceed is more than mere legal consideration and meeting operational imperatives. An unbiased assessment of ethics and social impact are vital when capability is so intrusive. Those with the responsibility to authorise covert surveillance must have clear limits of exploitation. If those limits are exceeded there should be adequate sanction for the transgressor. If there is any lesson from Snowden’s revelations, disclosure to those affected may be a better curb on excess than any formal report from an oversight body!

No, based on my experience, the current oversight mechanism is not rigorous. That said, I am equally sure that all oversight bodies have a more positive impact on public authorities than the public probably believes (see this article for example). The reason why the public are not convinced is probably that they are only exposed to sensational reporting from an inadequately informed media; a media that often relies on the very covert techniques it criticises! It would help if oversight bodies are required to engage in public debate; a task best suited to a person unencumbered by judicial reticence.

Sam Lincoln was the Chief Surveillance Inspector with the Office of Surveillance Commissioners from April 2006 – August 2013, responsible for the oversight of the Regulation of Investigatory Powers Act.

Sign up to free human rights updates by email, Facebook, Twitter or RSS

Related posts:

• Divisional Court strikes down DRIPA data communications law
• Britain can lead the world in online privacy
• Google’s misuse of private browsing data entitles individuals to damages