ECtHR Judgment in Big Brother Watch v. UK

Written by

Last week the European Court of Human Rights issued a highly anticipated blockbuster Chamber judgment in Big Brother Watch v. UK, nos. 58170/13, 62322/14, 24960/15.

This is the first mass electronic surveillance case to be decided against the UK after the Edward Snowden revelations, and it touches upon numerous issues. The judgment is nuanced, complex, and long. It addresses key questions such as the proportionality of bulk interception programmes much more directly and with greater sophistication than the recent judgment in Centrum för Rättvisa v. Sweden no. 35252/08, which was decided by a different Chamber while this case was being deliberated, and which also upheld a bulk surveillance programme (see here for Asaf Lubin’s take on Just Security).

The judgment is too rich to summarize easily, so I will only set out some key takeaways (for an extensive discussion on surveillance and privacy in the digital age, see my 2015 Harvard ILJ piece).

First, and most importantly, the judgment is a mixed bag for privacy activists: while the Court finds that the UK’s surveillance programme under the now-defunct Regulation of Investigatory Powers Act (RIPA) was deficient in important respects and in violation of Article 8 and 10 of the Convention, it at the same time normalizes such mass surveillance programmes. In particular, the Court decided that bulk interception programmes are not categorically disproportionate, as privacy activists have argued. Second, in a similar vein, the Court finds that prior judicial authorization is not indispensable for the legality of bulk interception, again contrary to what privacy activists have argued, even if prior judicial authorization could be seen as best practice (note that under the new 2016 Investigatory Powers Act the UK has moved to a double-authorization system which involves both a minister and an independent quasi-judicial commissioner).

Here are the key paragraphs (warning – extracts from the judgment make this a lengthy post):

  1.  The Court has expressly recognised that the national authorities enjoy a wide margin of appreciation in choosing how best to achieve the legitimate aim of protecting national security (see Weber and Saravia, cited above, § 106). Furthermore, in Weber and Saravia and Liberty and Others the Court accepted that bulk interception regimes did not per se fall outside this margin. Although both of these cases are now more than ten years old, given the reasoning of the Court in those judgments and in view of the current threats facing many Contracting States (including the scourge of global terrorism and other serious crime, such as drug trafficking, human trafficking, the sexual exploitation of children and cybercrime), advancements in technology which have made it easier for terrorists and criminals to evade detection on the Internet, and the unpredictability of the routes via which electronic communications are transmitted, the Court considers that the decision to operate a bulk interception regime in order to identify hitherto unknown threats to national security is one which continues to fall within States’ margin of appreciation.

  2. Nevertheless, as indicated previously, it is evident from the Court’s case-law over several decades that all interception regimes (both bulk and targeted) have the potential to be abused, especially where the true breadth of the authorities’ discretion to intercept cannot be discerned from the relevant legislation (see, for example, Roman Zakharov, cited above, and Szabó and Vissy v. Hungary, no. 37138/14, 12 January 2016). Therefore, while States enjoy a wide margin of appreciation in deciding what type of interception regime is necessary to protect national security, the discretion afforded to them in operating an interception regime must necessarily be narrower. In this regard, the Court has identified six minimum requirements that both bulk interception and other interception regimes must satisfy in order to be sufficiently foreseeable to minimise the risk of abuses of power (see paragraph 307 above).

  3. The applicants argue that in the present case the Court should “update” those requirements by including requirements for objective evidence of reasonable suspicion in relation to the persons for whom data is being sought, prior independent judicial authorisation of interception warrants, and the subsequent notification of the surveillance subject (see paragraph 280 above). In their view, such changes would reflect the fact that due to recent technological developments the interception of communications now has greater potential than ever before to paint an intimate and detailed portrait of a person’s private life and behaviour. However, while the Court does not doubt the impact of modern technology on the intrusiveness of interception, and has indeed emphasised this point in its case-law, it would be wrong automatically to assume that bulk interception constitutes a greater intrusion into the private life of an individual than targeted interception, which by its very nature is more likely to result in the acquisition and examination of a large volume of his or her communications. In any event, although the Court would agree that the additional requirements proposed by the applicants might constitute important safeguards in some cases, for the reasons set out below it does not consider it appropriate to add them to the list of minimum requirements in the case at hand.

  4. First of all, requiring objective evidence of reasonable suspicion in relation to the persons for whom data is being sought and the subsequent notification of the surveillance subject would be inconsistent with the Court’s acknowledgment that the operation of a bulk interception regime in principle falls within a State’s margin of appreciation. Bulk interception is by definition untargeted, and to require “reasonable suspicion” would render the operation of such a scheme impossible. Similarly, the requirement of “subsequent notification” assumes the existence of clearly defined surveillance targets, which is simply not the case in a bulk interception regime.

  5. Judicial authorisation, by contrast, is not inherently incompatible with the effective functioning of bulk interception. Nevertheless, as the Venice Commission acknowledged in their report on the Democratic Oversight of Signals Intelligence Agencies (see paragraph 212 above), while the Court has recognised that judicial authorisation is an “important safeguard against arbitrariness” (see Roman Zakharov, cited above, § 249), to date it has not considered it to be a “necessary requirement” or the exclusion of judicial control to be outside “the limits of what may be deemed necessary in a democratic society” (see, for example, Roman Zakharov, cited above, § 258; see also Klass and Others, cited above, §§ 51 and 56; Weber and Saravia, cited above, § 115; Kennedy, cited above, § 167; and Szabó and Vissy, cited above, § 77). There would appear to be good reason for this. The Court has found it “desirable to entrust supervisory jurisdiction to a judge” because, as a result of the secret nature of the surveillance, the individual will usually be unable to seek a remedy of his or her own accord (see Roman Zakharov, cited above, § 233). However, that is not the case in every contracting State. In the United Kingdom, for example, any person who thinks that he or she has been subject to secret surveillance can lodge a complaint with the IPT (see paragraph 250 above). Consequently, in Kennedy the Court accepted that regardless of the absence of prior judicial authorisation, the existence of independent oversight by the IPT and the Interception of Communications Commissioner provided adequate safeguards against abuse (see Kennedy, cited above, §§ 167-169). In this regard, the Venice Commission also noted that independent oversight may be able to compensate for an absence of judicial authorisation (see paragraph 212 above).

  6. Secondly, the Court has acknowledged that “the possibility of improper action by a dishonest, negligent or over-zealous official can never be completely ruled out whatever the system” (see Klass and Others, cited above, § 59), and one need only look at its most recent jurisprudence to find examples of cases where prior judicial authorisation provided limited or no protection against abuse. For example, in Roman Zakharov, any interception of communications had to be authorised by a court and the judge had to give reasons for the decision to authorise interceptions. However, as judicial scrutiny was limited in scope and the police had the technical means to circumvent the authorisation procedure and to intercept any communications without obtaining prior judicial authorisation, the Court found that Russian law was incapable of keeping the “interference” to what was “necessary in a democratic society”. Similarly, in Association for European Integration and Human Rights and Ekimdzhiev the relevant law required judicial authorisation before interception could take place. Nevertheless, the Court found that numerous abuses had taken place (according to a recent report, more than 10,000 warrants were issued over a period of some twenty‑four months). More recently, in Mustafa Sezgin Tanrıkulu v. Turkey, no. 27473/06, § 64, 18 July 2017 the Court found a violation of Article 8 where an assize court had granted the National Intelligence Agency permission to intercept all domestic and international communications for a month and a half with a view to identifying terrorist suspects.

  7. Therefore, while the Court considers judicial authorisation to be an important safeguard, and perhaps even “best practice”, by itself it can neither be necessary nor sufficient to ensure compliance with Article 8 of the Convention (see Klass and Others, cited above, § 56). Rather, regard must be had to the actual operation of the system of interception, including the checks and balances on the exercise of power, and the existence or absence of any evidence of actual abuse (see Association for European Integration and Human Rights and Ekimdzhiev, cited above, § 92). Accordingly, the Court will examine the justification for any interference in the present case by reference to the six minimum requirements, adapting them where necessary to reflect the operation of a bulk interception regime. It will also have regard to the additional relevant factors which it identified in Roman Zakharov, but did not classify as “minimum requirements”; namely, the arrangements for supervising the implementation of secret surveillance measures, any notification mechanisms and the remedies provided for by national law (see paragraph 307 above).

In its ultimate assessment of proportionality the Court was also quite deferential to the views of the UK’s oversight institutions, which possessed both independence and an expertise which was hard to replicate in an international court:

  1. With regard to the proportionality of the bulk interception regime, the Court notes that the Independent Reviewer of Terrorism Legislation, examined a great deal of closed material and concluded that bulk interception was an essential capability: first, because terrorists, criminals and hostile foreign intelligence services had become increasingly sophisticated at evading detection by traditional means; and secondly, because the nature of the global Internet meant that the route a particular communication would travel had become hugely unpredictable. Although he and his team (including a person with the necessary technical background to understand the systems and techniques used by GCHQ, and the uses to which they could be put, an investigator with experience as a user of secret intelligence, including intelligence generated by GCHQ, and senior independent counsel with the skills and experience to challenge forensically the evidence and the case studies presented by the security and intelligence services) looked at alternatives to bulk interception (including targeted interception, the use of human sources and commercial cyber-defence products), they concluded that no alternative or combination of alternatives would be sufficient to substitute for the bulk interception power (see paragraph 176 above).

  2. Similarly, while acknowledging the risks that bulk interception can pose for individual rights, the Venice Commission nevertheless recognised its intrinsic value for security operations, since it enabled the security services to adopt a proactive approach, looking for hitherto unknown dangers rather than investigating known ones (see paragraph 211 above).

  3. The Court sees no reason to disagree with the thorough examinations carried out by these bodies and the conclusions subsequently reached. It is clear that bulk interception is a valuable means to achieve the legitimate aims pursued, particularly given the current threat level from both global terrorism and serious crime.

Third, the Court found a violation of Article 8 primarily because the search criteria and selectors used to filter intercepted communications  were not subject to independent oversight under the RIPA regime (paras. 340-347).

Fourth, in a clear win for privacy activists, the Court held that it was unsustainable to treat the content of communications and metadata/communications data differently in terms of their potential for privacy intrusion – in other words, the interception of metadata can be just as intrusive as the interception of content (see also in that regard p. 141 of my Harvard piece):

  1. In addition, the Court is not persuaded that the acquisition of related communications data is necessarily less intrusive than the acquisition of content. For example, the content of an electronic communication might be encrypted and, even if it were decrypted, might not reveal anything of note about the sender or recipient. The related communications data, on the other hand, could reveal the identities and geographic location of the sender and recipient and the equipment through which the communication was transmitted. In bulk, the degree of intrusion is magnified, since the patterns that will emerge could be capable of painting an intimate picture of a person through the mapping of social networks, location tracking, Internet browsing tracking, mapping of communication patterns, and insight into who a person interacted with (see paragraph 301 above).

  2. Consequently, while the Court does not doubt that related communications data is an essential tool for the intelligence services in the fight against terrorism and serious crime, it does not consider that the authorities have struck a fair balance between the competing public and private interests by exempting it in its entirety from the safeguards applicable to the searching and examining of content. While the Court does not suggest that related communications data should only be accessible for the purposes of determining whether or not an individual is in the British Islands, since to do so would be to require the application of stricter standards to related communications data than apply to content, there should nevertheless be sufficient safeguards in place to ensure that the exemption of related communications data from the requirements of section 16 of RIPA is limited to the extent necessary to determine whether an individual is, for the time being, in the British Islands.

Fifth, the Court also for the first time directly examines the lawfulness of intelligence sharing, which it again normalizes while being wary of the possibility of abuse:

  1. Faced with such a threat, the Court has considered it legitimate for Contracting States to take a firm stand against those who contribute to terrorist acts (see Othman, cited above, § 183). Due to the nature of global terrorism, and in particular the complexity of global terror networks, the Court accepts that taking such a stand – and thus preventing the perpetration of violent acts endangering the lives of innocent people – requires a flow of information between the security services of many countries in all parts of the world. As, in the present case, this “information flow” was embedded into a legislative context providing considerable safeguards against abuse, the Court would accept that the resulting interference was kept to that which was “necessary in a democratic society”.

  2. In light of the foregoing considerations, the Court considers that the domestic law, together with the clarifications brought by the amendment of the IC Code, indicate with sufficient clarity the procedure for requesting either interception or the conveyance of intercept material from foreign intelligence agencies. In this regard, it observes that the high threshold recommended by the Venice Commission – namely, that the material transferred should only be able to be searched if all the material requirements of a national search were fulfilled and this was duly authorised in the same way as a search of bulk material obtained by the signals intelligence agency using its own techniques – is met by the respondent State’s regime. The Court further observes that there is no evidence of any significant shortcomings in the application and operation of the regime. On the contrary, following an investigation the ISC found no evidence whatsoever of abuse.

Sixth, the Court happily avoids the enormous difficulties posed with regard to the applicability of the Convention to extraterritorial surveillance, which are left for another day (and on which, again, see my Harvard piece). In other words, the Court does not pronounce on in what specific circumstances and on what basis the Convention would protect individuals located outside the UK but surveilled by the UK – recall that the UK’s Investigatory Powers Tribunal had ruled that such individuals would have no Convention rights, since they would be outside the UK’s jurisdiction in the sense of Article 1 of the Convention (see more here and here). The Court simply avoids this whole set of issues, assumes that the Convention does apply, and then proceeds to do an analysis on the merits, despite the fact that a number of the applicants were not based in the UK. The Court is able to do so because the UK government – probably wisely – did not raise an extraterritoriality objection. The Court could easily have examined the question proprio motu because it concerns the very applicability of the Convention, but (again, wisely) chose not to):

  1. The Government contested that argument. They did not, however, raise any objection under Article 1 of the Convention; nor did they suggest that the interception of communications under the section 8(4) regime was taking place outside the United Kingdom’s territorial jurisdiction. The Court will therefore proceed on the assumption that the matters complained of fall within the jurisdictional competence of the United Kingdom.

Note the Court’s reference to interception taking place within the UK, which is not the same thing as the individual whose communications are being intercepted being located in the UK – see in that regard my Harvard piece, pp. 124-127, where I argue that this type of scenario is more likely to be regarded as being covered by human rights treaties, if on an uncertain conceptual basis. The Court seems to be signalling (without so deciding) that surveillance that takes place in a state’s territory will be covered by the Convention, even if the individual is physically not in that territory (think the UK police searching my flat in Nottingham while I am in Geneva as an analog analogue).

With regard to intelligence sharing in particular, the Court deals with one scenario – the receipt by the respondent state of intelligence intercepted by some other state; it does not deal with the other scenario, of the respondent state sharing the intelligence it collected with a third state. This is how it defines the nature of the interference:

  1. The Court has already found that the applicants can claim to be victims of the alleged violation of Article 8 of the Convention occasioned by the existence of an intelligence sharing regime. However, it is important to clarify at the outset the nature of the interference under consideration.

  2. Although the impugned regime concerns intercepted communications, the interference under consideration in this case does not lie in the interception itself, which did not, in any event, occur within the United Kingdom’s jurisdiction, and was not attributable to that State under international law. As the communications are being intercepted by foreign intelligence agencies, their interception could only engage the responsibility of the respondent State if it was exercising authority or control over those agencies (see, for example, Jaloud v. the Netherlands [GC], no. 47708/08, §§ 139 and 151 ECHR 2014 and Al-Skeini and Others v. the United Kingdom [GC], no. 55721/07, §§ 130-139, ECHR 2011). Even when the United Kingdom authorities request the interception of communications (rather than simply the conveyance of the product of intercept), the interception would appear to take place under the full control of the foreign intelligence agencies. Some of the third parties have invoked the ILC Articles, but these would only be relevant if the foreign intelligence agencies were placed at the disposal of the respondent State and were acting in exercise of elements of the governmental authority of the respondent State (Article 6); if the respondent State aided or assisted the foreign intelligence agencies in intercepting the communications where that amounted to an internationally wrongful act for the State responsible for the agencies, the United Kingdom was aware of the circumstances of the internationally wrongful act, and the act would have been internationally wrongful if committed by the United Kingdom (Article 16); or if the respondent State exercised direction or control over the foreign Government (Article 17). There is no suggestion that this is the case.

  3. Consequently, the interference lies in the receipt of the intercepted material and its subsequent storage, examination and use by the intelligence services of the respondent State.

The Court’s reference to ‘authority and control over those agencies’ is an error – this is the language of a jurisdiction test in the sense of Article 1 (and so are the cases which the Court cites), while what it is really doing is an attribution test, i.e. it is saying (in essence correctly) that state A cannot be responsible for the conduct of state B unless it exercised control over B’s agents. The Court’s analysis of Article 16 of the ILC ASR is, on these facts at least, also correct – but consider a scenario in which state A received intelligence from state B while knowing that B obtained that intelligence unlawfully (e.g. through torture). Note also that, with regard to extraterritoriality, the Court again assumes that an applicant located outside the UK, whose communications were intercepted outside the UK, has Convention rights vis-à-vis the UK when the intelligence is shared and processed within the UK.

Seventh, the Court rather summarily dismissed the applicants’ non-discrimination argument:

  1. Insofar as section 16 prevents intercepted material from being selected for examination according to a factor “referable to an individual who is known to be for the time being in the British Islands”, any resulting difference in treatment would not be based directly on nationality or national origin, but rather on geographical location. In Magee v. the United Kingdom, no. 28135/95, § 50, ECHR 2000‑VI the Court held that as such a difference in treatment could not be explained in terms of personal characteristics, it was not a relevant difference in treatment for the purposes of Article 14 of the Convention and did not amount to discriminatory treatment within the meaning of Article 14 of the Convention (see Magee, cited above, § 50).

  2. In any event, the Court is of the view that any difference in treatment based on geographic location was justified. The Government have considerable powers and resources to investigate persons within the British Islands and do not have to resort to interception of their communications under a section 8(4) warrant. They do not, however, have the same powers to investigate persons outside of the British Islands.

Note what the Court here does and does not say. On the one hand, distinctions based on an individual’s location are justified – because the UK has many more options to tackle terrorism, crime etc within its territory, which it lacks outside its territory, when acting externally the UK can have a broader surveillance regime (cf. my Harvard paper, pp. 138-139). On the other hand, the Court obliquely mentions that these distinctions are not based on nationality – signaling that if they were, the discrimination analysis could turn out differently. And in fact numerous states (and all of the Five Eyes other than the UK) make distinctions in privacy protections with regard to surveillance which are based on nationality.

I will end here, even if post has only scratched the surface. As we could see, this is a hugely important judgment, notwithstanding that it concerns a surveillance regime which was replaced in the UK in the meantime. It sets a benchmark against which other surveillance regimes will be scrutinized. It is possible that either the applicants or the government or both refer the case to the Grand Chamber. We shall see whether that happens or whether the Chamber judgment stands as it is – it will any case not be the last word on any of these issues. Nonetheless it is an impressive effort which (whether one agrees with the Court’s conclusions or not) does credit to the judges who decided it.

Print Friendly, PDF & Email

Categories

  • EJIL Analysis
  • European Convention on Human Rights
  • European Court of Human Rights
  • Extraterritorial Application
  • Freedom of Expression
  • Right To Privacy/Family Life

    • Tags

  • Privacy
  • Surveillance

    • Leave a Comment

    Comments for this post are closed

    Comments

    Russell Buchan says

    September 18, 2018

    Dear Marko,

    Thank you for this interesting analysis. I have a question for you. The Court explains in paragraph 317 (quoted above) that bulk interception can be lawful even though it does not target specific individuals that are reasonably suspected of being involved in illicit activities. In other words, and as the Court says at paragraph 314 (also quoted above), it can be necessary for a state to operate a 'bulk interception regime in order to identify hitherto unknown threats to national security'.

    This is a drastic departure from the Court's existing case law and also represents a rather dangerous development. In its previous decisions, the Court has determined that surveillance can only be undertaken where 'strictly necessary', that is, where there is a 'reasonable suspicion' that persons to be targeted are involved in activities that the state has a legitimate need to suppress (Klass etc). Even more clearly, in Szabò the Court held that Hungary’s surveillance law was unlawful because it allowed warrants to be issued without the relevant authorities having to ‘produce supportive materials or, in particular, a sufficient factual basis’ to demonstrate that the persons to be targeted were engaged in illicit activities and, as a result, this precluded an ‘evaluation of [the] necessity of the proposed measure’. Indeed, when turning its attention to bulk surveillance, the Szabò Court expressed 'serious concern' over the necessity of such operations precisely because they are of a general and exploratory nature rather than being specific and targeted against suspects.

    So, the Court's determination that bulk surveillance can be regarded as necessary to 'identify hitherto unknown threats to national security' cannot be regarded as consistent with its previous jurisprudence and, more importantly, such forms of bulk surveillance cannot be regarded as truly 'necessary' in a democratic society (how can they be: when the surveillance is undertaken there is no known threat). Yet the Court never explains these issues. Given the importance of this aspect of the Court's decision, this is very unfortunate.

    Marko Milanovic says

    September 18, 2018

    Hi Russell,

    Thanks a lot for this. I would dispute the premise of your question. I think that one can say quite fairly that the whole issue of a bulk interception programme for national security purposes was not addressed directly in the line of cases which dealt with ordinary and targeted interception programmes for the purpose of crime prevention and prosecution. Cases like Weber and Liberty which did deal with the former type of programme also did not set out a categorical rule against bulk interception/strategic monitoring. So I'm simply not sure that the matter had already been decided, with the Court here departing from a settled position - the issue presenting in this case is sufficiently distinguishable from prior case law, whatever one thinks of the Court's bottom line.

    Re an unknown threat, I think the security services can definitely suspect that (say) terrorist attacks are being planned or considered without knowing the details or anything about the suspects.

    Russell Buchan says

    September 19, 2018

    Thanks Marko. Just a quick follow up, if I may. I agree with you that states can establish a legitimate aim for bulk surveillance where they are able to point to sound evidence indicating that, for example, a severe terrorist attack is likely, even if they cannot identify the person or persons that are behind that attack (in this sense, while the surveillance is not individualised (against a person), it is nevertheless targeted (against the specific threat)).

    But in this case the Court says that it is acceptable for a state to operate a ‘bulk interception regime in order to identify hitherto unknown threats to national security’. So, my reading of this is that states can undertake general and exploratory mass surveillance in order to uncover threats even before they are known/objectively established (the Court refers to threats that are 'unknown'). Put differently, the surveillance does not need to be individualised nor targeted. In which case, at the time the surveillance is undertaken, how can it be said that the measure is necessary?
    Russell

    THEODORE CHRISTAKIS says

    September 19, 2018

    Dear Marco

    Many thanks to you for posting so quickly this interesting analysis – and also thanks to Russell for his comment.
    Shortly after the Judgement I have given a long interview focusing on the strategic place of this judgement on the European Legal landscape. You can read it here:

    https://www.nextinpact.com/news/107035-surveillance-masse-et-cedh-interview-theodore-christakis.htm

    You can also check this article by another journalist who quotes me in relation with the possible impact that Big Brother could have re/ the ongoing ECHR cases against French surveillance laws. You can read it here:

    https://www.liberation.fr/amphtml/planete/2018/09/14/la-cedh-condamne-la-grande-bretagne-mais-pas-la-surveillance-de-masse_1678564?__twitter_impression=true

    I know that Marco is a perfect connoisseur de la langue de Molière, but for other readers, less familiar with French, I will publish here shortly (hopefully tomorrow morning) the link to a more substantial piece in English where I focus on the fragmentation between ECHR and EU law on surveillance matters

    Theodore

    THEODORE CHRISTAKIS says

    September 20, 2018

    Dear Marko, Russell,

    Following my post yesterday please find here the link to my article in English discussing the Big Brother Watch judgment and what I consider to be a fragmentation between EU/ECHR law on surveillance matters.

    http://europeanlawblog.eu/2018/09/20/a-fragmentation-of-eu-echr-law-on-mass-surveillance-initial-thoughts-on-the-big-brother-watch-judgment/

    In this article I discuss several issues and raise some questions about the implications and ramifications of the judgment and, more generally, about the constitutional significance of this fragmentation for the European Legal Order.

    Theodore