Blockbuster Strasbourg Judgment on Surveillance in Russia

Last Friday a unanimous Grand Chamber of the European Court delivered a hugely important judgment in Roman Zakharov v. Russia, no. 47143/06, in which it found serious and systematic faults with the Russian legislative framework regulating the surveillance of mobile communications. This is set to be a leading Strasbourg authority on assessing the compliance of surveillance measures with human rights law, a topic we’ve already extensively discussed on the blog. This judgment important for a number of reasons.

First, because a unanimous Grand Chamber reaffirmed much of relatively older or Chamber-based case law, and applied the principles it identified robustly. This provides an important indication that the Court remains acutely aware of the dangers surveillance programs possibly pose to democratic societies, and that it will also scrutinize such programs robustly in the cases shortly coming before it, e.g. against the United Kingdom. I must say that I was particularly struck by how the Russian judge in the Court, Judge Dedov, concluded his concurring opinion with a quote from Edward Snowden – with the added irony of Snowden still continuing his sojourn in Russia, the very country whose regulatory system of surveillance the Court exposed as so sorely inadequate.

Second, more specifically, the Court affirmed the relatively broad approach to standing that it had already taken in cases such as Klass and Kennedy. This approach has two strands: (1) if an individual claims that they have themselves been subjected to surveillance, they have to show only a ‘reasonable likelihood’ of being so subjected, rather than having to furnish conclusive proof, which would in most cases be impossible to obtain; (2) alternatively, and very much exceptionally in the Convention system, applicants can challenge the surveillance regulatory framework in abstracto, without alleging that they’ve been spied upon themselves. Roman Zakharov was precisely an example of the latter situation, and so will be the majority of future surveillance cases. This is how the Court now articulates the abstract review standard:

171. In the Court’s view the Kennedy approach is best tailored to the need to ensure that the secrecy of surveillance measures does not result in the measures being effectively unchallengeable and outside the supervision of the national judicial authorities and of the Court. Accordingly, the Court accepts that an applicant can claim to be the victim of a violation occasioned by the mere existence of secret surveillance measures, or legislation permitting secret surveillance measures, if the following conditions are satisfied. Firstly, the Court will take into account the scope of the legislation permitting secret surveillance measures by examining whether the applicant can possibly be affected by it, either because he or she belongs to a group of persons targeted by the contested legislation or because the legislation directly affects all users of communication services by instituting a system where any person can have his or her communications intercepted. Secondly, the Court will take into account the availability of remedies at the national level and will adjust the degree of scrutiny depending on the effectiveness of such remedies. As the Court underlined in Kennedy, where the domestic system does not afford an effective remedy to the person who suspects that he or she was subjected to secret surveillance, widespread suspicion and concern among the general public that secret surveillance powers are being abused cannot be said to be unjustified (see Kennedy, cited above, § 124). In such circumstances the menace of surveillance can be claimed in itself to restrict free communication through the postal and telecommunication services, thereby constituting for all users or potential users a direct interference with the right guaranteed by Article 8. There is therefore a greater need for scrutiny by the Court and an exception to the rule, which denies individuals the right to challenge a law in abstracto, is justified. In such cases the individual does not need to demonstrate the existence of any risk that secret surveillance measures were applied to him. By contrast, if the national system provides for effective remedies, a widespread suspicion of abuse is more difficult to justify. In such cases, the individual may claim to be a victim of a violation occasioned by the mere existence of secret measures or of legislation permitting secret measures only if he is able to show that, due to his personal situation, he is potentially at risk of being subjected to such measures.

172. The Kennedy approach therefore provides the Court with the requisite degree of flexibility to deal with a variety of situations which might arise in the context of secret surveillance, taking into account the particularities of the legal systems in the member States, namely the available remedies, as well as the different personal situations of applicants.

…

178. Having regard to the secret nature of the surveillance measures provided for by the contested legislation [in Russia], the broad scope of their application, affecting all users of mobile telephone communications, and the lack of effective means to challenge the alleged application of secret surveillance measures at domestic level, the Court considers an examination of the relevant legislation in abstracto to be justified.

The Court’s liberal approach to standing contrasts markedly to the very narrow one taken in the United States, as e.g. in Clapper v. Amnesty International. Because the merits then depend on abstract review, a lot of substantive work in the Court’s jurisprudence is done by the formal ‘in accordance with the law’ criterion under Article 8 ECHR, which incorporates elements of the necessity in a democratic society test.

Third, in performing this abstract review the Court took a variety of elements into account (para. 238): ‘the accessibility of the domestic law, the scope and duration of the secret surveillance measures, the procedures to be followed for storing, accessing, examining, using, communicating and destroying the intercepted data, the authorisation procedures, the arrangements for supervising the implementation of secret surveillance measures, any notification mechanisms and the remedies provided for by national law.’ And these were the principal faults that the Court identified in the Russian regulatory framework:

• The breadth of discretion granted to the executive in cases dealing with national, military, economic and ecological security (para. 248);
• Lack of sufficient safeguards against abuse with regard to the discontinuation of surveillance measures (para. 251);
• The continued storage of data which proves to be irrelevant (para. 255), as well as the unlimited storage of interception evidence after the conclusion of a criminal trial (para. 256);
• The fact that while Russian law requires prior judicial authorization for interception measures, Russian judges in practice only apply purely formal criteria in deciding whether to grant an authorization, rather than verifying the necessity and proportionality of imposing such measures (para. 263);
• The fact that Russian ‘courts sometimes grant interception authorisations which do not mention a specific person or telephone number to be tapped, but authorise interception of all telephone communications in the area where a criminal offence has been committed’ (para. 265);
• That the emergency procedure provided for in Russian law, which enables interception without judicial authorization, does not provide sufficient safeguards against abuse (para. 266);
• That the secret services had direct remote access to the databases and networks of communications service providers, thus enabling them to easily circumvent even the existing legal safeguards, in particular because they were not required to serve a judicial order to service providers before collecting data (paras. 268-271);
• That the equipment installed by the secret services keeps no logs or records of intercepted communication, which coupled with the direct access rendered any supervisory arrangements incapable of detecting unlawful interceptions (para. 272);
• That judicial involvement was limited solely to the authorization stage, with the courts having no continuous supervisory function (para. 274);
• That supervisory functions within the executive branch were entirely unregulated, while other mechanisms (such as prosecutorial oversight) were lacking in independence and not open to any significant public scrutiny (paras. 277-283);
• That the government was unable to provide the Court with any examples of effective prosecutorial oversight (para. 284);
• That judicial remedies in Russia were generally ineffective, particularly in light of the total absence of any notification requirement with regard to the interception subject, without any meaningful ability of retrospective challenges to surveillance measures (para. 300).

The Court thus concluded that:

303. It is significant that the shortcomings in the legal framework as identified above appear to have an impact on the actual operation of the system of secret surveillance which exists in Russia. The Court is not convinced by the Government’s assertion that all interceptions in Russia are performed lawfully on the basis of a proper judicial authorisation. The examples submitted by the applicant in the domestic proceedings (see paragraph 12 above) and in the proceedings before the Court (see paragraph 197 above) indicate the existence of arbitrary and abusive surveillance practices, which appear to be due to the inadequate safeguards provided by law (see, for similar reasoning, Association for European Integration and Human Rights and Ekimdzhiev, cited above, § 92; and, by contrast, Klass and Others, cited above, § 59, and Kennedy, cited above, §§ 168 and 169).

304. In view of the shortcomings identified above, the Court finds that Russian law does not meet the “quality of law” requirement and is incapable of keeping the “interference” to what is “necessary in a democratic society”.

305. There has accordingly been a violation of Article 8 of the Convention.

It is particularly noteworthy that in its review the Court did not simply look at the provisions of Russian law on their face, but also at how they were applied in practice. Indeed, looking at the many defects identified by the Court, by comparison US and UK laws on surveillance positively look like masterpieces of effective regulation and oversight.

In sum, the detail and rigour of the Court’s analysis, as well as the Grand Chamber’s unanimity in reaching its decision, both indicate that the Court will seriously scrutinize the surveillance practices and legislation of European states, as cases against them come before it. What remains to be seen is how the Court will evaluate systems of bulk collection, how it will address problems raised by extraterritorial surveillance, and those posed by the involvement of third states. If this judgment is to serve as any guide, however, the Court does not seem likely to approach such questions timidly.