Surveillance under RIPA: neither a strict legal framework nor rigorously overseen – Sam Lincoln

13 October 2015 by


Those charged with the task of protecting the public from harm resort to assertion similar to that here attributed to a GCHQ spokesperson:

Our work is carried out in accordance with a strict legal and policy framework, which ensures that our activities are authorised, necessary and proportionate, and that there is rigorous oversight.

I was the Chief Surveillance Inspector at the Office of Surveillance Commissioners for eight years until August 2013. My own view is that the legal and policy framework is not strict and that oversight is not rigorous. Until they are, we should not blame public authorities for exploiting opportunities that enable them to meet their operational and investigative objectives.

Regardless of one’s views on the actions of Mr. Snowden, public knowledge of covert capabilities has encouraged those who engage in covert conduct to explain what it is they require and why. The reports published by the Independent Reviewer of Terrorism Legislation, the Intelligence and Security Committee and RUSI make important contributions but tend, in my view, to focus on the effect of technology and the impact of so-called mass surveillance. All agree that the law and oversight should be improved. Here’s my take on those two fundamentals.

RIPA is permissive legislation

In my view, RIPA is flawed because it is permissive legislation. Apart from an interception no covert surveillance – the acquisition of communications data, intrusive or directed surveillance or the use of a covert human intelligence source (CHIS) (whether an undercover officer or an informer) – must be authorised before it can proceed (RIPA s.80). As Simon McKay (author of Covert Policing) correctly identifies, RIPA is essentially a “voluntary code”. It is inevitable that an investigator will be tempted to use every means at his disposal and to keep his options open when planning covert surveillance; to be, as often quoted in my presence at ACPO conferences, “lawfully audacious”.

Far from hindering an investigator’s or intelligence officer’s ability to do their job, the law must be clear what cannot be done; it must set clear boundaries. The challenge is to create law which focuses on the purpose rather than the method of collection or where the collection takes place. I am not so concerned that my vehicle movements are held on a database for a period of time. I am concerned about who has access to that data, how long it is retained and the use made of it. If my vehicle is to be identified for specific attention (in other words an alert is created) I would expect an auditable prior justification.

Constructing laws which are clear requires agreement on definitions; practitioners should not be left to interpret meaning and parameters. Revision of most current definitions is vital. Let me use a single example to present my case.

The current definition of surveillance includes:

monitoring, observing or listening to persons, their movements, their conversations or their other activities or communications; recording anything monitored, observed or listened to in the course of surveillance; and surveillance by or with the assistance of a surveillance device. (RIP s.48(2))

At face value ‘surveillance’ is activity we all conduct much of the time. So the law needs to clarify that it relates to those entities acting on behalf of the State and the public must be informed of who those entities are. But the greatest concern is surveillance that is covert. So let’s see how RIPA defines covert surveillance:

surveillance is covert if, and only if, it is carried out in a manner that is calculated to ensure that persons who are subject to the surveillance are unaware that it is or may be taking place. (RIPA s.26(9)(a))

Does this mean that the scale and methods exposed by Snowden are no longer covert surveillance because we are now aware that it is or may be taking place? I hope not. Data and information collected at scale, often automatically, is a reality; technology cannot easily be restrained and we should allow those charged with our protection to exploit it. As I said earlier, the fact that surveillance is or may be taking place is not the definitive aspect of ‘covertness’; the crucial aspect is the purpose which identifies individuals for specific attention. It makes no difference whether it is conducted in the virtual or ‘real’ world; the individual has been singled out from the masses and they don’t know it.

Permissive legislation, poorly defined, allows too much discretion to focus intrusively on too many people without a proper audited and contemporaneous justification. Covert surveillance legislation should set clear limits focused on purpose not method. And all covert surveillance must be subject to prior authorisation.

Judicial oversight alone is not rigorous

My second proposition is that confidence in judicial oversight alone is misplaced. Legislation has two fundamental purposes: to protect the public from unnecessary and disproportionate covert surveillance by those acting on behalf of the State (ECHR Article 8) – a prospective process; and to ensure that evidence acquired covertly is admissible in court so as to allow a fair trial (ECHR Article 6) – a retrospective process.

RIPA requires an authorising officer to explain in writing why he has granted covert surveillance. Permissive legislation implies discretion and subjective judgement. It was common for a Surveillance Commissioner to explain that to me, despite insufficient detail on the written authorisation, that he was persuaded to approve covert activity because there was clear necessity on one of the applicable grounds (usually the prevention and detection of a crime). In other words, there was no inclination to inhibit covert surveillance merely because detail was lacking as to method or adequate consideration of social and ethical impact. My experience is that retired judges, when in doubt, are comfortable relying on retrospective assessment by trial judges. It is worth noting here that oversight bodies are only required to approve a small number of authorisations and only examine about ten percent of authorisations often after they have been conducted and cancelled. Bearing in mind that RIPA s.80 does not oblige authorisation, and that a Commissioner is not engaged in the process of reviewing authorisations after covert surveillance has commenced, the Commissioners’ stance is not unreasonable. But it is insufficient for the following reasons.

Firstly, a trial judge is unlikely to exclude compelling evidence merely because an authorisation was inadequate or did not exist. Additionally, a trial judge benefits from information not available to a Commissioner. This additional information may reduce concerns about human rights or amend perceptions of necessity and proportionality. Furthermore, a trial judge is wrong to rely on the capability of the oversight bodies especially if assuming that every authorisation is examined by a Commissioner prior to covert conduct. Retrospective judgment appears to trump prospective decisions and might appear as the ends justifying the means.

Secondly, a trial judge is only concerned with the facts of a specific case and the effect of covert conduct on the accused and the fairness of the trial. He is not concerned with the impact of covert surveillance on anyone not accused even if their Article 8 rights were invaded in the process. The innocent may not be protected despite being subjected to covert surveillance. Whether or not they should be notified is not currently a consideration.

Thirdly, those conducting covert surveillance are constrained by the terms of an authorisation (RIPA s.27(b)) which should “describe” and “specify” the conduct (RIPA ss.28(4) and 29(4)). If the terms are unclear or, more likely, too general the authorisation may be deemed invalid. It is my view that a retired judge, or Secretary of State, has insufficient knowledge of investigative techniques, technological capability or covert modus operandi to properly assess an authorisation. With limited capability to examine a sufficient number of authorisations, oversight bodies can only make retrospective assessment of compliance. My personal view is that too many authorisations could be deemed invalid because they do not properly justify necessity, inadequately consider proportionality, and too frequently dismiss collateral intrusion on persons innocent of misdemeanour.

Finally, multiple oversight bodies for a single Act invite unhelpful difference in interpretation. It is my firm belief that the Chief Surveillance Commissioner and the Interception of Communications Commissioner benefit from the support of inspectors with covert surveillance experience. This benefit is not available to the Intelligence Services Commissioner or the Investigatory Powers Tribunal. I can only provide personal experience, but I know that the ISC and, more importantly, the IPT have interpreted RIPA in a way not supported by the Surveillance Commissioners during my tenure.

So oversight by those who have held high judicial office alone, in my judgment, is insufficient if the law is to remain permissive and essentially voluntary. If preventing unnecessary and disproportionate intrusion of privacy is the aim, the process is necessarily prospective. Deciding whether or not covert conduct should proceed is more than mere legal consideration and meeting operational imperatives. An unbiased assessment of ethics and social impact are vital when capability is so intrusive. Those with the responsibility to authorise covert surveillance must have clear limits of exploitation. If those limits are exceeded there should be adequate sanction for the transgressor. If there is any lesson from Snowden’s revelations, disclosure to those affected may be a better curb on excess than any formal report from an oversight body!

No, based on my experience, the current oversight mechanism is not rigorous. That said, I am equally sure that all oversight bodies have a more positive impact on public authorities than the public probably believes (see this article for example). The reason why the public are not convinced is probably that they are only exposed to sensational reporting from an inadequately informed media; a media that often relies on the very covert techniques it criticises! It would help if oversight bodies are required to engage in public debate; a task best suited to a person unencumbered by judicial reticence.

Sam Lincoln was the Chief Surveillance Inspector with the Office of Surveillance Commissioners from April 2006 – August 2013, responsible for the oversight of the Regulation of Investigatory Powers Act.

Sign up to free human rights updates by email, Facebook, Twitter or RSS

Related posts:

Welcome to the UKHRB

This blog is run by 1 Crown Office Row barristers' chambers. Subscribe for free updates here. The blog's editorial team is:
Commissioning Editor: Jonathan Metzer
Editorial Team: Rosalind English
Angus McCullough QC David Hart QC
Martin Downs
Jim Duffy

Free email updates

Enter your email address to subscribe to this blog for free and receive weekly notifications of new posts by email.




Aarhus Abortion Abu Qatada Abuse Access to justice adoption AI air pollution air travel ALBA Allergy Al Qaeda Amnesty International animal rights Animals Anne Sacoolas anonymity Article 1 Protocol 1 Article 2 article 3 Article 4 article 5 Article 6 Article 8 Article 9 article 10 Article 11 article 13 Article 14 article 263 TFEU Artificial Intelligence Asbestos Assange assisted suicide asylum asylum seekers Australia autism badgers benefits Bill of Rights biotechnology blogging Bloody Sunday brexit Bribery British Waterways Board care homes Catholic Church Catholicism Chagos Islanders Charter of Fundamental Rights child protection Children children's rights China christianity citizenship civil liberties campaigners civil partnerships climate change clinical negligence closed material procedure Coercion Commission on a Bill of Rights common law communications competition confidentiality consent conservation constitution contact order contact tracing contempt of court Control orders Copyright coronavirus coronavirus act 2020 costs costs budgets Court of Protection covid crime criminal law Cybersecurity Damages data protection death penalty defamation DEFRA deportation deprivation of liberty derogations Detention Dignitas diplomacy diplomatic relations disability disclosure Discrimination disease divorce DNA domestic violence duty of care ECHR ECtHR Education election Employment Environment Equality Act Equality Act 2010 Ethiopia EU EU Charter of Fundamental Rights EU costs EU law European Convention on Human Rights European Court of Human Rights European Court of Justice evidence extradition extraordinary rendition Facebook Facial Recognition Family Fatal Accidents Fertility FGM Finance foreign criminals foreign office foreign policy France freedom of assembly Freedom of Expression freedom of information freedom of speech Gay marriage gay rights Gaza Gender genetics Germany Google Grenfell Gun Control hague convention Harry Dunn Health HIV home office Housing HRLA human rights Human Rights Act human rights news Human Rights Watch Huntington's Disease immigration India Indonesia injunction Inquests insurance international law internet inuit Iran Iraq Ireland islam Israel Italy IVF ivory ban Japan joint enterprise judaism judicial review Judicial Review reform Julian Assange jury trial JUSTICE Justice and Security Bill Law Pod UK legal aid legal aid cuts Leveson Inquiry lgbtq liability Libel Liberty Libya lisbon treaty Lithuania local authorities marriage Media and Censorship mental capacity Mental Capacity Act Mental Health military Ministry of Justice modern slavery morocco murder music Muslim nationality national security naturism neuroscience NHS Northern Ireland nuclear challenges nuisance Obituary ouster clauses parental rights parliamentary expenses scandal patents Pensions Personal Injury physician assisted death Piracy Plagiarism planning planning system Poland Police Politics Pope press prison Prisoners prisoner votes Prisons privacy procurement Professional Discipline Property proportionality prosecutions prostituton Protection of Freedoms Bill Protest Public/Private public access public authorities public inquiries quarantine Radicalisation refugee rehabilitation Reith Lectures Religion RightsInfo right to die right to family life Right to Privacy right to swim riots Roma Romania round-up Round Up Royals Russia saudi arabia Scotland secrecy secret justice Secret trials sexual offence shamima begum Sikhism Smoking social media social workers South Africa Spain special advocates Sports Standing starvation statelessness stem cells stop and search Strasbourg super injunctions Supreme Court Supreme Court of Canada surrogacy surveillance sweatshops Syria Tax technology Terrorism The Round Up tort Torture travel treason treaty accession trial by jury TTIP Turkey Twitter UK Ukraine universal credit universal jurisdiction unlawful detention USA US Supreme Court vicarious liability Wales War Crimes Wars Weekly Round-up Welfare Western Sahara Whistleblowing Wikileaks wildlife wind farms WomenInLaw Worboys wrongful birth YearInReview Zimbabwe


This blog is maintained for information purposes only. It is not intended to be a source of legal advice and must not be relied upon as such. Blog posts reflect the views and opinions of their individual authors, not of chambers as a whole.

Our privacy policy can be found on our ‘subscribe’ page or by clicking here.

%d bloggers like this: