Barristers tell Parliament that some GCHQ mass surveillance is illegal
29 January 2014
Two barristers have advised a Parliamentary committee that some mass surveillance allegedly undertaken by the UK’s security services is probably illegal. Jemima Stratford QC and Tim Johnston’s advice (PDF) was commissioned by the chair of the All Party Parliamentary Group on Drones.
You may ask why an Parliamentary group on drones is getting involved in the GCHQ surveillance debate, itself kickstarted by the revelations by Edward Snowden (pictured). The slightly tangential answer is that the committee is concerned about the legality of data being passed to the United States for use in drone strikes.
That is an important issue. But to my mind this advice raises another question, namely why it took a Parliamentary group on drones to commission a public legal advice on mass surveillance, when there is another a Parliamentary committee which should be considering the question in detail: the Intelligence and Security Committee. That committee is currently asking for submissions on data privacy , but things seem to be moving pretty slowly. I have written about serious criticisms of the ISC recently in the context of rendition and torture allegations against the Security Services.
It is to be hoped that the ISC independent enough to do a proper job, given the importance of the Snowden allegations. If it cannot, then it may be for other committees, including the Joint Committee on Human Rights, to pick up the slack. The JCHR does not appear at present to be looking into the issue.
Getting back to drones, the question of what kind of data the UK’s security services may be passing on to the USA to use in drone strikes is currently before the courts, with the Court of Appeal recently refusing permission for Mr Noor Khan to appeal against a determination of the High Court from early 2013 (our post on the High Court case here). Lord Dyson said “It is only in certain established circumstances that our courts will exceptionally sit in judgment of such acts. There are no such exceptional circumstances here”.
Meanwhile, the wider issues identified by Snowden’s revelations are being considered urgently by the European Court of Human Rights as a priority case (the case is called Big Brother Watch v United Kingdom).
Stratford and Johnston’s legal opinion is summarised in the Parliamentary Group’s blog and I will reproduce that summary below:
(i) GCHQ is not entitled to intercept ‘internal’ contents data between two British residents under the existing legislative framework of Regulation of Investigatory Powers Act (‘RIPA’);
(ii) GCHQ is entitled to intercept metadata and ‘external’ contents data under RIPA, although this is considered a disproportionate interference with Article 8 (privacy) rights of British citizens;
(iii) the executive has retained a largely unrestrained discretion to permit transfer of UK data to the NSA under RIPA;
(iv) RIPA does not place any restriction on the uses to which intercept material might be put, other than its admissibility in court;
(v) a new UK-US bilateral arrangement governing the transfer, storage and use of UK data is the minimum required to protect British citizens and ensure British data and facilities are not used to support activities which would be unlawful in the UK, including drone strikes against non combatants;
(vi) the government is obliged to investigate and prevent UK agents, visiting forces and visiting agents becoming ‘accidental’ accessories to murder under domestic law, where those responsible know that relevant data or facilities may be used to support US drone strikes, properly regarded as unlawful in the UK;
(vii) RIPA has been overtaken by developments in technology since 2000. The key distinction between ‘contents’ and ‘communications’ data is no longer meaningful, given modern internet usage.
Keen readers may also note there is may be a political dimension to the timing of this advice. As the Drones Group blog points out, the “Advice also lends real weight to amendments proposed to the Defence Reform Bill, Visiting Forces Act and RIPA tabled by four peers from the All Parliamentary Group on Drones which will be moved next week on 3rd February in the Grand Chamber”.
Interesting times…
Sign up to free human rights updates by email, Facebook, Twitter or RSS
Related posts:
- Read the full advice here
- New Year, new tort of misuse of private information
- David Miranda – Remember his name
- When you wish upon a rendition and torture inquiry
This blog is run by 
In my view, RIPA 2000 S8(4)-8(6), provides the legal authority for GCHQ to undertake mass surveillance and virtually mirrors the old authority under the IOCA 1985 s3(2). The basis in law is there, but the proportionality of what goes on is not.(See Liberty & others v UK). There remains an unfettered executive discretion whereby with a Ministerial certificate (s8(5)) and the limitation of conduct to that authorised in RIPA, s5(6), there is a basis in law for GCHQ to use “all such conduct as may be described in the interception warrant to [seek whatever intercept content and related communications data] as is described in the warrant.” The Cabinet Secretary is required by s5(2) and 5(3) to consider the necessity and proportionality of ALL warrants he issues (including certificated warrants). It is on proportionality that the current Privacy not PRISM complaint before the ECtHR is likely to succeed (as it did in Liberty). Thre has been no response to date by the UK to Liberty’s findings.
An interception is only an interception if it is effected by conduct in the UK (RIPA 2000, s2(2) and 2(4). RIPA 2000 requires a closed list (s6(2) of UK intelligence-gathering bodies to apply for an interception warrant for ANY interception. There are no exceptions. GCHQ’s mass-surveillance activities are all backed by Ministerially-certifiicated s8(4) warrants, giving them legal authority. As in Liberty, The ECTHR is unlikely to accept the Govt position on proportionality or on current jurisprudence as to whether it is conducted “in accordance with law.”
Any conduct by GCHQ will always have been effected in the UK, as their warrant application seeking authorisation for their proposed activity will be made in the UK. RIPA 2000, s5(1) also permits disclosure of intercepted material without limitation upon the jurisdiction of who may actually see it. The Ministerial certificate (S8(5) will limit the recipients and ss 15 and 16 can only cover intercepted material that has been obtained as a result of interceptions effected in the UK. Similarly, s3(1) of the Intelligence Services Act 1994, whilst not limiting GCHQ’s monitoring and interfering brief territorially, limits the obtaining and provision of reports based on their activities to obtianing and providing reports on monitoring and interference undertaken by them. (see the “such emissions” drafting in s3(1)(a).) To this end, the separate issue of acquiring intercepted material obtained extra-jurisdictionally (e.g. by the NSA) or indeed any foreign intelligence reports, seems to be precluded by the drafting of both the ISA 1994 and RIPA 2000, both of which as drafted seem only to envisage, authorise and regulate the dissemination of UK intercepted material (in order presumably to give effect to the UK’s perceived reciprocal obligations under the highly secret UKUSA Agreement).
The morality and ethics of mass surveillance are separate issues from legality. The drafting of ISA 1994 and RIPA 2000 mean that acquisition of extra-jurisdictionally obtained intercepted material is almost certainly not “in accordance with law ” Mass interception of UK residents’ external communications under certificated warrants may have an opaque basis in law, but as currently drafted, RIPA 2000 fails to encompass key ECtHR requirements as to proportionality, clarity and foreseeability. It is likely that the Privacy not PRISM complaint will succeed on at least one of the 2 counts. This may explain the historic decision by the ISC to consult publicly.
I think the barristers have put the cart before the horse. Does the government have lawful authority to undertake the surveillance? The advice did not explore this question and is potentially flawed as a result.
The advice only asks if the surveillance meets RIPA. RIPA only refers to lawful surveillance.
(1)It shall be an offence for a person intentionally and without lawful authority.
What has not been analyzed or suggested is that the surveillance is unlawful or lacking lawful authority. The barristers did not explore this question, which is different from and precedes RIPA. RIPA only comes into question if there is a belief that the lawful authority was either not lawful or its application was excessive. Consider the intelligence services act 1994 that provides lawful authority for such interceptions. http://www.legislation.gov.uk/ukpga/1994/13/crossheading/authorisation-of-certain-actions
RIPA does *not* give them lawful authority. Instead, RIPA makes sure they are complying with lawful authority. In this case, they appear to be complying with that lawful authority as suggested by intelligence and security committee of parliament, which is a parliamentary committee unlike the All Party Parliament Group. https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/225459/ISC-Statement-on-GCHQ.pdf
In this case, the question to ask is what is the lawful authority for the surveillance, but that is not asked or explored. It is assumed (always dangerous in a legal analysis) that the surveillance is unlawful. We may dislike it, but that does not make it unlawful. So, was there a lawful authority directing the surveillance? We do not know from this analysis but that is the key question. Is there a Warrant or other authorization from HMG? It would appear there is from Intelligence and Security Committee investigation. Did they do it to support a lawful activity? Yes, protect national security. Is defense of national security unlawful? No. Can the manner in which national security be defended be unlawful? Yes. Has that been proven. No.
The barrister’s advice shows they do not like surveillance but it has not shown it is unlawful. Therefore, they cannot say that it is not compliant with RIPA because they have not answered the first or fundamental question: is it lawful? If it is lawful, RIPA cannot prove it unlawful.
You’d like to think they’d taken legal advice beforehand: was any opinion sought? If so, who from?
They were relying on a literal reading of RIPA – which is not how it works when interpreting EU directives.
Jemima Stratford crucially also suggests that GCHQ is wrong to assert it has a getout – that material for mass surveillance was collected offshore from transatlantic cables and hence not covered by RIPA. She says: ‘In that case, the security services might contend that the interception is “effected by conduct” outside the UK (the words used at the start of section 8(4) of RIPA) and thereby seek to evade the limitations of RIPA. We seriously doubt whether a court would accept that argument, not least because there would still be conduct connected with the interception in the UK.’
I have noted that the Court of Appeal has clarified this issue recently, re phone hacking but the same principle applies: “no matter where in the process a phone message is captured, it will have been intercepted somewhere in the transmission system and hence potentially unlawfully”. ie contrary to RIPA.
http://thinkinglegally.wordpress.com/2013/07/02/edmondson-et-al-news-international-hacking-judgment-gchq-scandal/
The putative GCHQ argument is that RIPA is said to cover such surveillance only when “the interception is effected by conduct within the United Kingdom” ie claiming the cables are beyond UK borders or its surveillance is done on US servers. The hacking judgment is evidence for Stratford’s point: that a court would not see it this way. I suggested that “effected” would have to be interpreted in the light of the purpose of RIPA – to implement Art 5 of Directive 2002/58/EC which said member states must: “prohibit listening, tapping, storage or other kinds of interception or surveillance of communications etc”.
RIPA must be interpreted on that basis ie it can’t fail to prohibit those things if it can be construed by any means as probibiting them. The words “effected by conduct” will be interpreted as “bring about” or “make something occur”, so, as I put it: “Even if the British authorities brought it about by asking the US authorities to do it for them, or even if they did it by attaching their bugging devices to cables offshore, it can be argued that GCHQ “effected” the interception from the UK.” That is the interpretation that should prevail to implement the directive. Hence the mass storage is illegal.
All-Party Parliamentary Groups are not parliamentary committees. APPGs are informal cross-party groups with no official status within Parliament (http://www.parliament.uk/about/mps-and-lords/members/apg/). The Guide to the Rules on APPGs explains that: “They should not be confused with select committees, which are formal institutions of the House”. APPGs do not have the same powers as formal parliamentary committees to summon witnesses or to expect a government response to any recommendations they make.
Thanks for clarifying this – I have amended the post