On 1 December 2016, I had the honour of being invited to give evidence to Germany’s Bundestag Committee of Inquiry on the subject of international mass surveillance, as revealed by NSA whistleblower Edward Snowden.
This is the only major over-arching inquiry into Snowden’s revelations of NSA/international mass surveillance. Sorrily for the Committee, it became interested in evidence on what the UK’s agencies have been up to and what the recent legislative process (the Investigatory Powers Act) had been like.
It was a good opportunity to reaffirm that the UK’s new surveillance legislation must not be seen as world-leading because it is not compliant with human rights law and only entrenches and extends, rather than remedies, mass surveillance.
The video of my oral evidence is here, and a transcript is posted below:
WRITTEN NOTE TO BUNDESTAG COMMITTEE OF INQUIRY
- Liberty welcomes the opportunity to engage with the Bundestag Committee of Inquiry on the subject of international mass surveillance, as revealed by NSA whistleblower Edward Snowden.
- Liberty, also known as the National Council for Civil Liberties, is a membership organisation founded in 1934 that campaigns for civil liberties and human rights in the UK. Liberty has, and continues to, campaign against suspicionless and mass surveillance through the courts, in Parliament and in the wider community. I am a Policy Officer at Liberty, specialising in Technology and Surveillance.
- The British government enacted new, over-arching legislation on surveillance – the Investigatory Powers Act – on 29 November 2016. Liberty closely followed the progress of the Bill through parliament, lobbying against the raft of powers viewed to contravene human rights law and democratic principles, and now plans to mount a legal challenge.
- This legislation is widely understood to be a response to the public controversy and litigation arising from the Snowden revelations of GCHQ and Five Eyes mass surveillance, bringing British security and intelligence agencies’ (SIAs) secret practices within the rule of law. Thus, the Government has described the legislation as ‘world-leading’ and exemplary for other democracies. However, Liberty strongly urges against such perception of the legislation as, in our view, it is plainly in breach of fundamental human rights and obligations under the European Convention on Human Rights and Charter of Fundamental Rights of the European Union respectively.
- Major powers and processes legislated in the Investigatory Powers Act are currently being challenged in the Courts as provided for in previous legislation. Notably, in the 10 NGOs case currently being considered at the European Court of Human Rights (ECtHR), Liberty is challenging bulk interception as practiced under the Regulation of Investigatory Powers Act 2000 (RIPA). In addition, Liberty is acting on behalf of Tom Watson MP in the Watson case challenging the compatibility of communications data (aka ‘metadata’) surveillance practices under the Data Retention and Investigatory Powers Act 2014 (DRIPA) with the European Charter. A judgement from the Court of Justice of the European Union (CJEU) is due on 21 December 2016. The Advocate General’s opinion on the Watson case indicated that institutionally independent authorisation for access to communications data, and only in relation to the prevention or detection of serious crime, are necessary safeguards. Neither safeguards are currently within pre-existing legislation (DRIPA) or the recently passed Investigatory Powers Act.
Powers in the Investigatory Powers Act
- The Investigatory Powers Act provides for:
- Targeted and ‘thematic’ interception (Part 2)
- Targeted access to communications data (Part 3)
- Notices requiring the bulk retention of communications data (Part 4)
- Targeted and ‘thematic’ equipment interference/’hacking’ (Part 5)
- Bulk interception (Part 6, Chapter 1)
- Bulk acquisition of communications data (Part 6, Chapter 2)
- Bulk equipment interference/hacking (Part 6, Chapter 3)
- The acquisition and retention of bulk personal datasets (Part 7)
- Widely enabling ‘national security’ and ‘technical capability’ notices, forcing telecommunications operators to comply with Government orders including the removal of encryption on services (within Part 9).
- The Investigatory Powers Act also provides for new oversight mechanisms, via the creation of an Investigatory Powers Commissioner and fellow ‘Judicial Commissioners’ who will authorise surveillance warrants where they are provided for in the Act, on the basis of their adherence to correct procedure as their authorisation is constrained to judicial review principles.
- The new Investigatory Powers Commissioner is to review both the issue of warrants and the subsequent use of surveillance powers. Liberty’s analysis is that this dual responsibility is constitutionally inappropriate as it conflates the roles of authorisation and oversight and risks leading to a conflict of interests. A number of civil society groups, parliamentary committees, and current oversight bodies also raised this and other concerns about the insufficient oversight mechanisms.
- Liberty called for an independent commission to oversee the use of surveillance powers, separate to the body that also authorises surveillance warrants.
- We posit that such an oversight body should be under a mandatory statutory duty to notify those subject to surveillance once a particular operation or investigation has ended or once reasonable suspicion of the subject/s has subsided, as this is necessary to ensure accountability, public trust, and access to remedy (as stated by the ECtHR in Klass v Germany, later Weber v Germany, and Zakharov v Russia). At present, unlawful surveillance is discovered only as a result of a chance leak, whistleblowing, or through public interest litigation.
- Liberty also called for an independent Privacy and Civil Liberties Board to promote human rights compliant practice. Expert scrutiny and reporting focused on safeguarding civil liberties would be a welcome addition to the oversight framework. Such a board was provided for in the Counter Terrorism and Security Act 2015, but Government has resisted its establishment.
- Liberty is disappointed that the Investigatory Powers Act does not address the intelligence sharing relationship between British and foreign intelligence agencies, in particular the Five Eyes. The Intelligence and Security Committee (ISC) noted that the legislation “does not, therefore, meet the recommendations made in the Committee’s Privacy and Security Report that future legislation must set out these arrangements more explicitly, defining the powers and constraints governing such exchanges”. The ISC had strongly recommended that international data sharing be included in the Act, remarking that “the proportion of intercept material obtained from international partners is such that it is not appropriate to exclude it from legislation which purports to cover interception”. However, international raw intelligence sharing remains absent from the Act.
- The Government’s Terrorism Legislation Reviewer, David Anderson QC, described an “international trade in intelligence” between the Five Eyes partners – the UK, USA, Canada, Australia and New Zealand. Insofar as material gathered by the British services is shared with other countries, the report explained that the security services take the view that under their founding statutes, information can be shared if it is “necessary for the purpose of the proper discharge of the security and intelligence agencies’ functions” and that when it is considered that this test is met certain (RIPA) safeguards apply. However, the report concluded that “in practical terms, the safeguards applying to the use of such data are entirely subject to the discretion of the Secretary of State.” This would seem to remain the case under the new Investigatory Powers Act.
- Surveillance legislation and Codes of Practice are silent on British services receiving or accessing information from foreign services, with the security services only limited by the “general constraints” on their actions in various statutes. It was only during the course of Liberty’s legal action against the security services in the Investigatory Powers Tribunal (IPT) that limited information about the way in which the security services approach such situations was revealed. In its first finding against the Agencies, the IPT held that prior to these disclosures, the framework for information sharing was not sufficiently foreseeable and was not therefore “in accordance with law”. The Tribunal held that as a result of the fact that the litigation had resulted in disclosures of information, the security services were no longer acting unlawfully when accessing information from the U.S..
- David Anderson’s report recommended that information sharing with foreign countries be subject to strict, clearly defined and published safeguards. The report added that the “the new law should make it clear that neither receipt nor transfer [of data] should ever be permitted or practised for the purpose of circumventing safeguards on the use of such material in the UK”. Such safeguards and guarantees are notably absent from the Investigatory Powers Act. Liberty concurs that intelligence sharing with foreign countries should be subject to strict, clearly defined and published statutory safeguards. This would be a vital safeguard against abuses of international data sharing to evade safeguards in domestic law. In our view, an essential safeguard to international intelligence sharing must be a prohibition on sharing intelligence where there is a risk that it could facilitate actions that would be unlawful domestically. This would help us to protect against the risk that UK intelligence may lead to human rights abuses overseas such as torture or execution.
 Report of the draft Investigatory Powers Bill – The Intelligence and Security Committee, 9 February 2016; Recommendation J (xii)
 Paragraph 6.87.
 Paragraph 6.89.
 Recommendations 76 and 77.
 Recommendation 78.