Groups Similar Search Look up By Text Browse About

“Bulk interception” by GCHQ (and NSA) violated human rights charter, European court rules


Privacy was violated at moment of collection, not when humans viewed data, ECHR rules. In a set of rulings today, the European Court of Human Rights found that the mass surveillance scheme used by the GCHQ—the United Kingdom's signals intelligence agency—violated the European Convention on Human Rights (ECHR), unlawfully intruding on the private and family life and freedom of expression of British and European citizens. And the case included consideration of intelligence collected by the US National Security Agency shared with GCHQ. The Court found that sharing intelligence information gathered from bulk surveillance—as GCHQ does with the NSA and other members of the " Five Eyes" intelligence and security alliance—does not violate the human rights charter. But the judges did warn that using such intelligence sharing to bypass restrictions on surveillance of a member state's own citizens would be a violation of the charter. In the ruling, the judges found that there was insufficient oversight through the UK's Investigatory Powers Tribunal (the UK equivalent of the US' Foreign Intelligence Surveillance Court) over the UK's bulk interception, filtering, and search of communications by the GCHQ. The judges also found that there were insufficient safeguards put in place to govern access to communications data. While the case has no direct impact on US intelligence gathering, the case could have a ripple effect because of the close connections between US and UK intelligence and law enforcement organizations. The suit was brought by Big Brother Watch, Amnesty International, the American Civil Liberties Union, and a number of other civil liberties organizations from Europe and North America, as well as the Bureau of Investigative Journalism and others. "The decision sends a clear message that similar surveillance programs, such as those conducted by the NSA, are also incompatible with human rights," claimed ACLU attorney Patrick Toomey. "Governments in Europe and the United States alike must take steps to rein in mass spying and adopt long-overdue reforms that truly safeguard our privacy." No damages were awarded, other than for the court costs of some of the applicants who brought the suit. And the court did not find that the surveillance itself was illegal. However, the ruling did find that individuals' privacy rights applied from the moment communications and data were captured by surveillance systems —not just when they were viewed or processed by human analysts. And the ruling also found that surveillance violated freedom of expression because of its potential chilling effects on journalists. The Court found that the way the UK government collected data from communications service providers was in violation of Article 8 of the ECHR (private and family life rights). It also found that both the method of bulk interception of communications and the process for obtaining communications metadata from service providers violated Article 10 (freedom of expression) because of "insufficient safeguards in respect of confidential journalistic material." And of particular concern to the court was the lack of any oversight into what Internet traffic was collected or what filters were used to determine which traffic was of interest. "While there is no evidence to suggest that the intelligence services are abusing their powers, the Court is not persuaded that the safeguards governing the selection of bearers for interception and the selection of intercepted material for examination are sufficiently robust to provide adequate guarantees against abuse," the Court's ruling stated. "Of greatest concern... is the absence of robust independent oversight of the selectors and search criteria used to filter intercepted communications." The parts of UK law that were found to be problematic by the Court are similar to aspects of the PATRIOT Act in the US that have enabled the most controversial parts of US mass surveillance. The Court rejected the UK government's claim that metadata collection was less intrusive than collecting contents of communications. " The Court recognizes how revealing metadata can be to people's lives," Toomey told Ars. "It can expose things the government wouldn't otherwise have access to." Mass surveillance in and of itself, however, was not found to be a violation of the charter. " In reaching this conclusion, the Court found that the operation of a bulk interception regime did not in and of itself violate the Convention," a spokesperson for the court said in a statement on the case, "but noted that such a regime had to respect criteria set down in its case-law." While the court's ruling applied to surveillance regimes set down by the UK's Regulation of Investigatory Powers Act of 2000—not the new Investigatory Powers Act passed in 2016, which has not yet come into full effect—some of the provisions ruled to be in violation of the charter remain in the new law. Other mass-surveillance cases, including one against the French government's Intelligence Act of July 24, 2015, are still pending. But the precedent set here will likely force other governments in Europe to re-examine their surveillance laws.

UK’s mass surveillance regime violated human rights law, finds ECHR


In another blow to the UK governments record on bulk data handling for intelligence purposes the European Court of Human Rights (ECHR) has ruled that state surveillance practices violated human rights law. Arguments against the UK intelligence agencies bulk collection and data sharing practices were heard by the court in November last year. In todays ruling the ECHR has ruled that only some aspects of the UKs surveillance regime violate human rights law. So its not all bad news for the government — which has faced a barrage of legal actions (and quite a few black marks against its spying practices in recent years) ever since its love affair with mass surveillance was revealed and denounced by NSA whistleblower Edward Snowden, back in 2013. The judgement reinforces a sense that the government has been seeking to push as close to the legal line as possible on surveillance, and sometimes stepping over it — reinforcing earlier strikes against legislation for not setting tight enough boundaries to surveillance powers, and likely providing additional fuel for fresh challenges. The complaints before the ECHR focused on three different surveillance regimes: 1) The bulk interception of communications (aka mass surveillance); 2) Intelligence sharing with foreign governments; and 3) The obtaining of communications data from communications service providers. The challenge actually combines three cases, with the action brought by a coalition of civil and human rights campaigners, including the American Civil Liberties Union, Amnesty International, Big Brother Watch, Liberty, Privacy International and nine other human rights and journalism groups based in Europe, Africa, Asia and the Americas. The Chamber judgment from the ECHR found, by a majority of five votes to two, that the UKs bulk interception regime violates Article 8 of the European Convention on Human Rights (a right to respect for private and family life/communications) — on the grounds that there was insufficient oversight both of the selection of Internet bearers for interception and the filtering; search and selection of intercepted communications for examination; and the safeguards governing the selection of related communications data for examination were inadequate. The judges did not find bulk collection itself to be in violation of the convention but noted that such a regime must respect criteria set down in case law. In an even more pronounced majority vote, the Chamber found by six votes to one that the UK governments regime for obtaining data from communications service providers violated Article 8 as it was not in accordance with the law. While both the bulk interception regime and the regime for obtaining communications data from communications service providers were deemed to have violated Article 10 of the Convention (the right to freedom of expression and information,) as the judges found there were insufficient safeguards in respect of confidential journalistic material. However the Chamber did not rule against the government in two other components of the case — finding that the regime for sharing intelligence with foreign governments did not violate either Article 8 or Article 10. While the court unanimously rejected complaints made by the third set of applicants, under Article 6 (right to a fair trial), about the domestic procedure for challenging secret surveillance measures, and under Article 14 (prohibition of discrimination). The complaints in this case were lodged prior to the UK legislating for a new surveillance regime, the 2016 Investigatory Powers Act, so in coming to a judgement the Chamber was considering the oversight regime at the time (and in the case of points 1 and 3 above thats the Regulation of Investigatory Powers Act 2000). RIPA has since been superseded by IPA but, as noted above, todays ruling will likely fuel ongoing human rights challenges to the latter — which the government has already been ordered to amend by other courts on human rights grounds. Nor is it the only UK surveillance legislation judged to fall foul on that front. A few years ago UK judges agreed with a similar legal challenge to emergency surveillance legislation that predates IPA — ruling in 2015 that DRIPA was unlawful under human rights law. A verdict the UK Court of Appeal agreed with, earlier this year. Also in 2015 the intelligence agencies own oversight court, the IPT, also found multiple violations following challenges to aspects of its historical surveillance operations, after they have been made public by the Snowden revelations. Such judgements did not stop the government pushing on with the IPA, though — and it went on to cement bulk collection at the core of its surveillance modus operandi at the end of 2016. Among the most controversial elements of the IPA is a requirement that communications service providers collect and retain logs on the web activity of the digital services accessed by all users for 12 months; state power to require a company to remove encryption, or limit the rollout of end-to-end encryption on a future service; and state powers to hack devices, networks and services, including bulk hacking on foreign soil. It also allows the security agencies to maintain large databases of personal information on U.K. citizens, including individuals suspected of no crime. On the safeguards front the government legislated for what it claimed was a double lock authorization process for interception warrants — which loops in the judiciary to signing off intercept warrants for the first time in the U.K., along with senior ministers. However this does not regulate the collection or accessing of web activity data thats blanket-retained on all users. In April this shiny new surveillance regime was also dealt a blow in UK courts — with judges ordering the government to amend the legislation to narrow how and why retained metadata could be accessed, giving ministers a deadline of November 1 to make the necessary changes. In that case the judges also did not rule against bulk collection in general — declining to find that the states current data retention regime is unlawful on the grounds that it constituted general and indiscriminate retention of data. (For its part the government has always argued its bulk collection activities do not constitute blanket retention.) And todays ECHR ruling further focuses attention on the safeguards placed around bulk collection programs — having found the UK regime lacked sufficient monitoring to be lawful (but not that bulk collection itself is unlawful by default). Opponents of the current surveillance regime will be busily parsing the ruling to find fresh fronts to attack. The battle moves on now to @libertyhqs litigation challenging the current Snoopers Charter – the Investigatory Powers Act. Many of the legal flaws slammed in todays decision are baked into that law. The wind is in our sails today. Its not the first time the ECHR has looked at bulk interception. Most recently, in June 2018, it deemed Swedish legislation and practice in the field of signals intelligence did not violate EU human rights law. Among its reasoning was that it found the Swedish system to have provided adequate and sufficient guarantees against arbitrariness and the risk of abuse. However it said the Big Brother Watch and Others vs United Kingdom case being ruled upon today is the first case in which it specifically considered the extent of the interference with a persons private life that could result from the interception and examination of communications data (as opposed to content). In a Q&A about todays judgement, the court notes that it expressly recognised the severity of threats facing states, and also how advancements in technology have made it easier for terrorists and criminals to evade detection on the Internet. It therefore held that States should enjoy a broad discretion in choosing how best to protect national security. Consequently, a State may operate a bulk interception regime if it considers that it is necessary in the interests of national security. That being said, the Court could not ignore the fact that surveillance regimes have the potential to be abused, with serious consequences for individual privacy. In order to minimise this risk, the Court has previously identified six minimum safeguards which all interception regimes must have, it writes. The safeguards are that the national law must clearly indicate: the nature of offences which may give rise to an interception order; a definition of the categories of people liable to have their communications intercepted; a limit on the duration of interception; the procedure to be followed for examining, using and storing the data obtained; the precautions to be taken when communicating the data to other parties; and the circumstances in which intercepted data may or must be erased or destroyed.(Additional elements the court says it considered in an earlier surveillance case, Roman Zakharov v. Russia, also to determine whether legislation breached Article 8, included arrangements for supervising the implementation of secret surveillance measures, any notification mechanisms and the remedies provided for by national law.) Commenting on todays ruling in a statement, Megan Goulding, a lawyer for Liberty, said: This is a major victory for the rights and freedom of people in the UK. It shows that there is — and should be — a limit to the extent that states can spy on their citizens. Police and intelligence agencies need covert surveillance powers to tackle the threats we face today — but the court has ruled that those threats do not justify spying on every citizen without adequate protections.  Our government has built a surveillance regime more extreme than that of any other democratic nation, abandoning the very rights and freedoms terrorists want to attack.  It can and must give us an effective, targeted system that protects our safety, data security and fundamental rights. A Liberty spokeswoman also told us it will continue its challenge to IPA in the UK High Court, adding: We continue to believe that mass surveillance can never be compliant in a free, rights-respecting democracy. Also commenting in a statement, Silkie Carlo, director of Big Brother Watch, said: This landmark judgment confirming that the UKs mass spying breached fundamental rights vindicates Mr Snowdens courageous whistleblowing and the tireless work of Big Brother Watch and others in our pursuit for justice. Under the guise of counter-terrorism, the UK has adopted the most authoritarian surveillance regime of any Western state, corroding democracy itself and the rights of the British public. This judgment is a vital step towards protecting millions of law-abiding citizens from unjustified intrusion. However, since the new Investigatory Powers Act arguably poses an ever greater threat to civil liberties, our work is far from over. A spokesperson for Privacy International told us its considering taking the case to the ECHRs Grand Chamber. Also commenting in a supporting statement, Antonia Byatt, director of English PEN, added: This judgment confirms that the British governments surveillance practices have violated not only our right to privacy, but our right to freedom of expression too. Excessive surveillance discourages whistle-blowing and discourages investigative journalism. The government must now take action to guarantee our freedom to write and to read freely online. Weve reached out to the Home Office for comment from the UK government. On intelligence sharing between governments, which the court had not previously considered, the judges found that the procedure for requesting either the interception or the conveyance of intercept material from foreign intelligence agencies to have been set out with sufficient clarity in the domestic law and relevant code of practice, noting: In particular, material from foreign agencies could only be searched if all the requirements for searching material obtained by the UK security services were fulfilled. It also found no evidence of any significant shortcomings in the application and operation of the regime, or indeed evidence of any abuse — hence finding the intelligence sharing regime did not violate Article 8. On the portion of the challenge concerning complaints that UK intelligence agencies oversight court, the IPT, lacked independence and impartiality, the court disagreed — finding that the tribunal had extensive power to consider complaints concerning wrongful interference with communications, and those extensive powers had been employed in the applicants case to ensure the fairness of the proceedings. Most notably, the IPT had access to open and closed material and it had appointed Counsel to the Tribunal to make submissions on behalf of the applicants in the closed proceedings, it also writes. In addition, it said it accepted the governments argument that in order to ensure the efficacy of the secret surveillance regime restrictions on the applicants procedural rights had been both necessary and proportionate and had not impaired the essence of their Article 6 rights. On the complaints under Article 14, in conjunction with Articles 8 and 10