Last Thursday, the British government’s surveillance regime, the Investigatory Powers Act (IPA), was dealt yet another a blow—this time by the European Court of Human Rights (ECHR) which gave its landmark ruling against the UK government’s mass surveillance program. In its decision, the ECHR stated that the IPA violated human rights and offered “no real safeguards” to the public by enabling mass surveillance and undermining the rights to privacy and freedom of expression.
Last week’s judgment is a temporary victory, for various reasons. First, the European Court of Human Rights is a forum in which people can try to challenge decisions from their domestic courts (such as the High Court). It does not, however, have powers to enforce its decisions, and it deals with laws set out in the European Convention on Human Rights, not EU law. It is important to note that the ECHR predates the European Union. Because of this, the ECHR judgments are not legally binding. Second, the British government has persistently gone against the judgments of previous courts. For instance, there are three previous court rulings which the UK government has yet to definitively obey:
-the EU Court of Justice (CJEU) judgment in December 2016 which deemed that the indiscriminate collection of emails is illegal as are core parts of the Snoopers’ Charter;
-theJanuary 2018 ruling by the UK Court of Appeal ruled that the Data Retention and Investigatory Powers Act of 2014 (DRIPA), which made way for the Investigatory Powers Act of 2016 (IPA), did not restrict the access of confidential personal phone and web browsing records to investigations of serious crime; and
-the April 2018 High Court of England judgement which states that Part 4 of the IPA which relates to retention of communications data is incompatible with EU law for two principal reasons — that ministers could issue data retention orders without any independent review and that such orders could be undertaken for reasons other than serious crime. Additionally the judges ordered the government to narrow the reasons for retaining metadata and how it might be accessed.
While these three courts are legal bodies with authority over UK law, the April judgment has given the British government six months to rewrite the IPA in accordance with EU law. And given that the IPA replaces DIRPA which was ruled unlawful in 2015, it would seem that the British government is playing musical chairs with this issue. As it stands, the government has until 1November to address these issues for which human rights and free speech groups are eagerly awaiting massive reforms to the IPA.
In this recent legal challenge, the complaints brought before the ECHR focused on three different surveillance regimes: the bulk interception of communications, otherwise known as “mass surveillance”; intelligence sharing with foreign governments; and the obtaining communications data from communication and technology service providers. Aside from finding out in 2014 during the Investigatory Powers Tribunal that UK intelligence agencies had been unlawfully spying on the communications of Amnesty International and South Africa’s Legal Resources Centre, it was discovered that UK intelligence was illegally shared with the US government. The current form of the IPA means that any information that you have in the UK, on your laptop, can be shared with governments with whom the UK has similar agreements and the countries that these partnering nations also share information under similar secret legal accords. And this means anything from your private photos, medical records, to include the subversion of any data security or data dashboard systems you might have to safeguard your information. The IPA renders all this pretty much open terrain.
Another part of the legal challenge concerned complaints of the UK intelligence agencies’ oversight court, the IPT. Big Brother Watch et al claimed that these tribunals lacked independence and impartiality. The court disagreed stating that the tribunal had “extensive power to consider complaints concerning wrongful interference with communications, and those extensive powers had been employed in the applicants’ case to ensure the fairness of the proceedings.”
Another important aspect to consider here are the impediments to tech development that are under threat such as when then Prime Minister David Cameron threatened to ban Snapchat, WhatsApp, and any other encrypted messaging services unless these companies provided the government with backdoor access to user data. Such measures actually deter technology since most tech companies are conscious of the fact that if they undermine their users’ privacy, their business will soon be history. Hence Apple’s decision to go against the US Department of Justice in 2015 and again in 2016 which was eventually decided US District Judge, Mark Kearney, who stated that since passwords for smartphones are not recorded with the corporation“the act of producing their personal passcodes is testimonial in nature and Defendants properly invoke their Fifth Amendment privilege.” Essentially, the unlocking of mobile phones would be tantamount to self-incrimination. Another plus, the design of the iPhone meant that Apple can’t—even if it wanted to—unlock any of its iPhones, making backdoor architecture to grant governments access a non-issue.
Although the UK government replaced the contested DRIPA (Data Retention and Investigatory Powers Act, 2104) powers with the IPA in November 2016, human rights and free speech campaigners have maintained that the new legislation still leaves massive questions about the spying capabilities granted to the British government. For example, the 2015 intelligence agencies’ oversight court known as the IPT (Investigatory Powers Tribunal), also found various violations after challenges to its surveillance operations in the aftermath of Edward Snowden’s revelations in 2013. This tribunal made a similar judgment last year when it decided that the courts needed to decide the future of the IPT.
Since January 2017, the IPA has allowed the British state to monitor, intercept, record and hack Internet communications, granting it immense powers to carry out mass digital surveillance, including “bulk hacking,” which enables police and state agencies to access and even alter all types of electronic devices “on an industrial scale” even if the owners of these devices are not suspected of a crime. Because of the British government’s many attempts to rebrand its spying programs, many fighting the IPA are not so optimistic in the British government’s willingness to change this legislation. For instance, Liberty Lawyer Megan Goulding recently noted, in reaction to the ECHR judgment, the government’s intractable position: “The reality is that industrial-scale surveillance of citizens can never be lawful in a free, rights-respecting democracy. Instead of continuing to fight this, the Government can and must give us a targeted system that protects our safety, our data security and our fundamental rights.”
This case was brought by a number of human rights and journalism organizations which are one of a stream of legal challenges launched after former NSA sysadmin Edward Snowden’s 2013 revelations that GCHQ was secretly intercepting communications traffic via fibre-optic undersea cables. The organizations involved in this case were: the American Civil Liberties Union (ACLU), Amnesty International, Bytes for All, the Canadian Civil Liberties Association, the Egyptian Initiative for Personal Rights, the Hungarian Civil Liberties Union, the Irish Council for Civil Liberties, the Legal Resources Centre (South Africa), Liberty and Privacy International, Big Brother Watch, Open Rights Group, English PEN and Dr Constanze Kurz, and The Bureau of Investigative Journalism and Alice Ross.
This legal challenge presents a bright light for human rights and free speech advocates the world over. It is important to keep in mind that what happens in another country can affect what happens in neighboring nations. For instance, the ECHR has looked at bulk interception in other countries, most recently in June of this year where it viewed Swedish legislation and practices in its signals intelligence did not violate EU human rights law. The court found that the Swedish system had provided “adequate and sufficient guarantees against arbitrariness and the risk of abuse.” All this, in addition to the recent Sleepwet victory in the Netherlands, indicates that we must fight against draconian practices where the state oversees our every movement and private interaction.
Today the UK government claims its new regime, under the Investigatory Powers Act, complies with the law and this latest decision. Groups like Liberty and Big Brother Watch have challenged this claim in the High Court arguing that the IPA has effectively replicated and expanded the system that the ECHR found to infringe the rights of private citizens in their homes, offices, and pretty much anywhere they use technology. Many of us are waiting for 1 November to see what the British government rolls out in terms of court-mandated changes while others are ready to continue legal challenges either way.
It is crucial that we maintain our right to maintain social boundaries, our extension of trust, the way we effect control over our lives and freedom of thought and speech, all of which are very much wrapped up in the IPA and similar laws which have recently been enacted in other countries such as the Netherlands, Belgium and Switzerland. The right to privacy must be maintained.