Cracking intercepts: the war on terror and difficulties with Human Rights
11 December 2014
Liberty v Government Communications Headquarters ( IPT/13/77/H); Privacy International v FCO and others (IPT/13/92/CH); American Civil Liberties Union v Government Communications Headquarters (IPT/13/168-173/H); Amnesty International Ltd v The Security Service and others (IPT/13/194/CH); Bytes for All v FCO (IPT/13/204/CH), The Investigatory Powers Tribunal [2014] UKIPTrib 13_77-, 5 December 2014 – read judgment
Robert Seabrook QC is on the panel of the IPT and David Manknell of 1 Crown Office acted as Counsel to the Tribunal in this case. They have nothing to do with the writing of this post.
This is a fascinating case, not just on the facts or merits but because it is generated by two of the major catalysts of public law litigation: the government’s duty to look after the security of its citizens, and the rapid outpacing of surveillance law by communications technology. Anyone who has seen The Imitation Game, a film loosely based on the biography of Alan Turing, will appreciate the conflicting currents at the core of this case: the rights of an individual to know, and foresee, what the limits of his freedom are, and the necessity to conceal from the enemy how much we know about their methods. Except the Turing film takes place in official wartime, whereas now the state of being at “war” has taken on a wholly different character.
The judgment is long and necessarily detailed, so forgive the length of the summary and commentary to follow: but I highly recommend the final twenty pages to anyone interested in a real-life exploration of the difficulties created by the extra-jurisdictional (and ex-EU) character of modern communications when governments try to ensure that their intercept powers are compatible with the European Convention on Human Rights.
General Background
The Claimants, all representatives of human rights organisations here and abroad, alleged the unlawfulness pursuant to Article 8 (and collaterally Article 10) of certain assumed activities of the Security Service (also, and colloquially, known as MI5), the Secret Intelligence Service (and similarly also known as MI6) and the Government Communications Headquarters (“GCHQ”), which are collectively described in the following paragraphs as the Intelligence Services or Respondents.
The alleged activity, which was not admitted by the Respondents, all surfaced as a result of the documents leaked by Ed Snowden. These leaks resulted in the Claimants asserting their belief that investigation of the Respondents would show that the Claimants’ privacy had been unlawfully invaded. The actions of the Respondents, involving inter alia information to the Respondents from the US National Security Agency and the issue of warrants under the 2000 Regulation of Investigatory Powers Act (RIPA), were not suggested to be unlawful save in the respects alleged by reference to Article 8 of the Convention, were all taken in the interests of national security, and at a time when the threat to the United Kingdom from international terrorism was ‘Substantial’, indicating that an attack was a strong possibility. This has been recently upgraded to ‘Severe’, meaning that an attack is highly likely.
Burton J, giving judgment as President of the Tribunal, commented that the Tribunal had had the benefit of “very full legal arguments on assumed facts at the open hearing”,
we gained a full understanding of the case as fully canvassed between counsel by reference to more than 140 legal authorities, including a substantial number of decisions of the ECtHR. We were and remain satisfied that the Tribunal thus fully appreciated the nature of the Claimants’ case .
The policy of neither denying or confirming information regarding their activities as a result of leaks is an essential part of the security services’ function in order to protect their intelligence and agents. This policy was not under challenge.
The Prism Issue (Issue (i))
The alleged facts for the first issue were that US Government’s “Prism” system collects foreign intelligence information from electronic communication service providers under US court supervision. The US Government’s “upstream collection” programme obtains internet communications under US court supervision as they transit the internet.
The Claimants’ communications and/or communications data (i) might in principle have been obtained by the US Government via Prism (and/or, on the Claimants’ case, pursuant to the “upstream collection” programme) and (ii) might in principle have thereafter been obtained by the Intelligence Services from the US Government. (It should be borne in mind – and comes as some surprise to the writer of this post – that since the United States is the principal hub of the world’s telecommunications system, a very substantial quantity of the world’s communications passes through the United States: thus for example an email sent by a sender in the UK to another email address in the UK may be routed via the United States.)
Arguments before the Tribunal
In the light of factual premises (1) and (2) above, the Claimants asked whether the statutory regime governing the sharing of information between the UK and the US satisfied the Article 8(2) “in accordance with the law” requirement. They sought, in effect, declarations that the Respondents had unlawfully failed to ensure that there was in place a regime which complied with Article 8 and 10 governing the soliciting, receiving, storing and transmitting by UK authorities of private communications of individuals located in the UK which have been obtained by US authorities. They further asked for a declaration that the soliciting, receipt, storage and transmission of such information by the Security Service, the Secret Intelligence Service and/or GCHQ was unlawful, and an order that the Security Service, the Secret Intelligence Service and/GCHQ would not solicit, receive, store or transmit such information unless and until such activities are governed by a legal regime which satisfied Articles 8 and 10 and would destroy any material unlawfully obtained.
The Respondents relied on the statutory framework set out under Section 1 of the Security Service Act 1989 to permit them to receive and use such information. This provision imposes limits on the securing of information, which should be no more than is necessary for the purposes of protecting national security. As Burton J pointed out,
these statutory limits do not simply apply to the obtaining of information from other persons in the United Kingdom or to the disclosing of information to such persons: they apply equally to obtaining information from or disclosing information to persons abroad, including foreign intelligence agencies.
The Respondents are also bound by their obligations under s.6(1) of the Human Rights Act 1998, which, in relation to breach of Articles 8 and 10 of the Convention, is another positive obligation which can be enforced in a court, or in this case, in this Tribunal. There is also substantial and effective parliamentary oversight of the Intelligence Services as protection against arbitrary interference or unlawful use of powers by them. They are also supervised by the Interception of Communications Commissioner, appointed (for relevant purposes) under s.57(1) of RIPA, independent from Government and the Intelligence Services. He too has a staff to assist him with his functions, which include a constant review of the Intelligence Services.
Essentially, counsel for the claimants submitted that there were “different levels of “prescribed by law”, and that, as they put it, “we don’t necessarily say exactly the same [level], but one [has] to have something at least approaching the “prescribed by law” standards, set out in Weber etc, when it is communications intercepted by the US and then accessed here, received here, analysed here” (the Strasbourg case of Weber and Saravia v Germany [2008] 46 EHRR).
The Respondents contended that in practice it would be “inappropriate and unnecessary” to differentiate between the different kinds of information which might be supplied e.g. to foil a bomb plot in London, and impracticable to try to draw a distinction between information derived from intercept and not so derived or to seek explanations or make enquiries from NSA or any other agency as to whether information supplied did or did not derive from Prism or any other system of interception.
In the Tribunal’s view, information obtained in the field of national security is much less is required to be put in the public domain, and the degree of foreseeability must be reduced, because otherwise the whole purpose of the steps taken to protect national security would be at risk. The views of the Strasbourg Court endorse that position: see para 51 of Leander v Sweden [1987] 9 EHRR 433:
the requirement of foreseeability in the special context of secret controls of staff in sectors affecting national security cannot be the same as in many other fields. Thus, it cannot mean that an individual should be enabled to foresee precisely what checks will be made in his regard by the Swedish special police service in its efforts to protect national security.
The Tribunal was therefore satisfied that in the field of intelligence sharing it is not to be expected that rules need to be contained in statute or even in a code:
It is in our judgment sufficient that:
- Appropriate rules or arrangements exist and are publicly known and confirmed to exist, with their content sufficiently signposted, such as to give an adequate indication of it
- They are subject to proper oversight.
Some of these arrangements may be, of necessity, secret or “below the waterline”, but the Tribunal has the advantage of being able to hear the details in closed session and assess their adequacy. The Tribunal did do not accept the claimants’ contention that the holding of a closed hearing, as they had carried it out, was unfair.
It accords with the statutory procedure, and facilitates the process [of scrutinising the obtaining and use of information by the security services]. This enables a combination of open and closed hearings which both gives the fullest and most transparent opportunity for hearing full arguments inter partes on hypothetical or actual facts, with as much as possible heard in public, and preserves the public interest and national security.
The Tribunal’s conclusions on the Prism issue
As far as arrangements “below the waterline” were concerned, the Tribunal was satisfied that there were adequate arrangements in place for the purpose of ensuring compliance with the statutory framework and with Articles 8 and 10 of the Convention, so far as the receipt of intercept from Prism and/or Upstream is concerned. Insofar as this was not in itself – because the arrangements must be sufficiently accessible to the public – the Tribunal was satisfied that these arrangements were “sufficiently signposted” by virtue of the statutory framework under the 1989 Act. The scope of the discretion conferred on the Respondents to receive and handle intercepted material and communications data and the manner of its exercise, were accordingly accessible with sufficient clarity to give the individual adequate protection against arbitrary interference. There was therefore no breach of Article 8 in the Prism/Upstream system.
The Tribunal also made short work of Amnesty International’s somewhat curious argument that the United Kingdom owes a positive obligation under the Convention to prevent or forestall the United States from intercepting such communications; such a duty would extend to not acquiescing in such course by receiving the product. How such a duty would be enforceable by Amnesty International or anyone else is open to question, and even though the Convention’s extra-jurisdictional reach has been extended to near breaking point by various judgements from Chahal on, there is still no authority
which imposes any obligation on the part of contracting states to secure that non-contracting states, acting within their own jurisdiction, respect the rights and freedoms guaranteed by the Convention, even if the failure of such non-contracting states to do so may have adverse effects on persons within the jurisdiction of contracting states.
The Section 8(4) RIPA Issue (Issue no. (ii)
Warrants to intercept communications can be obtained under RIPA, mainly by the Director General of MI5, the Chief of MI5 and the Director of GCHQ. Only exceptionally will an interception warrant be issued without the say so of the Home Secretary or the FCO. Of the two types of warrants – the “targeted warrant” under Section 8(1) and the “untargeted warrant” under 8(4), it was the latter that was under challenge in this case because the Act contains authorisation to intercept communications “not identified by the warrant”. In effect that means an interception warrant can be used to obtain internal messages from communication between two foreign parties, even though on the face of it Section 8(4) “untargeted” warrants should only be aimed at external communications.
Arguments before the Tribunal
In its skeleton argument, Amnesty, in the judge’s words, “hyperbolically describes the Respondents’ purpose as “to obtain data wholesale from every living human being with a working internet connection”, although the claimants’ oral submissions were somewhat narrower than that. They alleged that the Intelligence Services operate a programme, described as Tempora, under which fibre optic cables are intercepted. This involves making available the contents of all the communications and communications data being transmitted through the fibre optic cables. The intercepted communications and communications data may be retained for an indefinite period and automatically searched through the use of a large number of search terms, including search terms supplied by the United States National Security Agency. The intercepted communications and communications data may then be further retained, analysed and shared with other public authorities.
Burton J summarised the Claimants’ case thus:
(1) Is the difficulty of determining the difference between external and internal communications, whether as a theoretical or practical matter, such as to cause the s.8(4) regime not to be in accordance with law contrary to Article 8(2)?
(2) Does the RIPA lay down sufficient safeguards in order to render the interference with Article 8 in accordance with law?
(3) Is the regime governing interception sufficiently compliant with the requirements laid down in Strasbourg (in particular, Weber and Saravia v Germany [2008] 46 EHRR), insofar as such is necessary in order to be in accordance with law?
The relief sought was effectively for a declaration that the Respondents had acted unlawfully in violation of the Claimants’ rights under Articles 8 and 14 ECtHR.
The crux of the Claimants’ case was that there been a “sea-change” in technology since 2000 which meant that, by virtue of the blurring of the distinction between external and internal communications, s.8(4) was no longer, ‘fit for purpose’. The response from the government was that the real world necessitated broad interception of communications, which included internal material, and unless the claimants were asking for an order that the Intelligence Services should not be able to obtain the external communications at all, that is what they would have to put up with. The Tribunal agreed, broadly, given the borderless nature of modern communications technology:
It is inevitable that, when a telephone call is made from a mobile phone or IPhone, or an email is sent to an email address, it will not necessarily be known whether it will be received in the United Kingdom or in the course of travel or at a foreign destination. It is accepted that once and if received abroad by the intended recipient it will be an external communication, even if the sender did not know, when he or she made the call or sent the email, that that was to be the case.
The Tribunal made detailed reference to a similar action brought by Liberty where the IPT almost exactly ten years ago made a ruling in relation to the “untargeted warrant” regime (the British Irish Rights Watch case). Here, the IPT gave considerable weight to the Strasbourg authorities’ observations about the foreseeability requirement in a 1993 case. The Commission’s musings are worth setting out because they do set a slightly different test for this requirement when national security is at stake:
It is clear from the Sunday Times case at para 49 that foreseeability is only expected to a degree that is reasonable in the circumstances, and the circumstances here are those of national security, as discussed in Klass v Germany and Leander v Switzerland. … In this case the legislation is adequate and the guidelines are clear. Foreseeability does not require that a person who telephones abroad knows that his conversation is going to be intercepted because of the existence of a valid s8(4) warrant.
The Tribunal in the instant case saw no reason to doubt its conclusions in British Irish Rights Watch, notwithstanding the more recent Strasbourg decision in Weber. Whilst the Claimants argued that the Strasbourg’s approach may have evolved since the Commission considered the UK’s surveillance system in Christie, the Tribunal saw no reason to depart from its earlier interpretation of Strasbourg’s position in 2004. The RIPA Code that has since been put in place, governing the authorising and processing of interception warrants, is quite sufficient to satisfy the ECHR requirements of foreseeability, and thus justifies the interference under Article 8(2).
The Tribunal’s conclusions on the RIPA issue
Although Article 8 was engaged by “untargeted warrants”, the safeguards provided by RIPA meant that interference with private communications under Article 8 was justified and proportionate. One prong of the Claimants’ challenge was that the term “national security” was too vague to justify intrusion with individuals’ private communications. But even in Strasbourg, this argument is a non-starter:
the term “national security” is frequently employed in both national and international legislation and constitutes one of the legitimate aims to which Article 8(2) itself refers. The Court has previously emphasised that the requirement of “foreseeability” of the law does not go so far as to compel States to enact legal provisions listing in detail all conduct that may prompt a decision to deport an individual on “national security” grounds. By the nature of things, threats to national security may vary in character and may be unanticipated or difficult to define in advance.” (Kennedy v United Kingdom [2011] 52 EHRR 4, para 159)
Quite.
Final decision
The Tribunal ruled that the current regime, both in relation to Prism and Upstream and to s.8(4), when conducted in accordance with the requirements both written into the legislation, the code and Parliamentary supervision, was both lawful and human rights compliant.
Technology in the surveillance field appears to be advancing at break-neck speed. This has given rise to submissions that the UK legislation has failed to keep abreast of the consequences of these advances, and is ill fitted to do so; and that in any event Parliament has failed to provide safeguards adequate to meet these developments. All this inevitably creates considerable tension between the competing interests, and the ‘Snowden revelations’ in particular have led to the impression voiced in some quarters that the law in some way permits the Intelligence Services carte blanche to do what they will. We are satisfied that this is not the case.
We can be satisfied that, as addressed and disclosed in this judgment, in this sensitive field of national security, in relation to the areas addressed in this case, the law gives individuals an adequate indication as to the circumstances in which and the conditions upon which the Intelligence Services are entitled to resort to interception, or to make use of intercept. [paras 158 – 159]
Guided by these conclusions, the Tribunal will now proceed to consider in closed session whether there has been in fact any unlawful interception or treatment of the Claimants’ communications.
Sign up to free human rights updates by email, Facebook, Twitter or RSS
Related posts:
- Sexual liaisons by undercover police officers could be authorised by RIPA
- Barristers tell Parliament that some GCHQ mass surveillance is illegal
- The dangers of data snooping – Angela Patrick
This blog is run by 
