mass surveillance must have meaningful safeguards, says echr
European Court Ruling on Bulk Surveillance
The European Court of Human Rights (ECHR)’s highest chamber has issued a significant ruling concerning mass surveillance practices. The court did not determine that the broad interception of digital communications is inherently a violation of human rights, despite these rights enshrining privacy and freedom of expression.
Need for Robust Safeguards
The judgement, however, strongly emphasizes the necessity of “end-to-end safeguards” when employing such extensive intelligence-gathering capabilities. Governments across Europe risk further legal challenges if they fail to implement these protections, according to the judges’ assessment.
The ruling also validates previous findings that the United Kingdom’s historical surveillance framework – established under the Regulation of Investigatory Powers Act 2000 (RIPA) – was unlawful due to a lack of adequate safeguards.
Defining ‘End-to-End’ Safeguards
According to the court, ‘end-to-end’ safeguards necessitate evaluations at every stage of the process to confirm the necessity and proportionality of the measures taken.
- Bulk interception must be subject to independent authorization initially.
- The scope and objectives of the operation should be clearly defined during authorization.
- Ongoing supervision and independent review after the fact are also crucial.
Deficiencies in the UK’s RIPA Regime
The Grand Chamber identified several shortcomings within the UK’s bulk interception regime as it functioned under RIPA.
These included the Secretary of State authorizing bulk interception, rather than an independent body. Furthermore, applications for warrants did not always include categories of search terms defining the communications subject to examination.
The court also noted that search terms linked to specific individuals, such as email addresses, were not subject to prior internal approval.
Impact on Freedom of Expression
The UK’s bulk intercept regime was also found to have infringed upon Article 10 (freedom of expression) due to insufficient protection for confidential journalistic materials.
The Court stated that operating a bulk interception regime does not, in itself, violate the Convention, given the numerous threats faced by modern states.
From RIPA to IPA
The RIPA regime has since been superseded by the UK’s Investigatory Powers Act (IPA), which codified bulk intercept powers into law, accompanied by purported oversight mechanisms.
The IPA has also faced human rights challenges, leading the UK High Court to order revisions to parts of the law deemed incompatible with human rights in 2018.
Snowden Revelations and Legal Challenges
Today’s Grand Chamber judgement specifically addresses RIPA and a series of legal challenges brought against the UK’s mass surveillance practices. These challenges were initiated by journalists, privacy advocates, and digital rights campaigners following the 2013 disclosures by Edward Snowden, a former NSA whistleblower, and were heard simultaneously by the ECHR.
Previous Chamber Ruling
A lower Chamber ruling in 2018 identified violations of human rights law in certain aspects of the UK’s regime. The majority found insufficient oversight regarding selectors, filtering, and the examination of intercepted communications, as well as inadequate safeguards for related communications data.
Campaigners subsequently requested and secured a referral to the Grand Chamber, which has now delivered its verdict.
Grand Chamber Findings
The Grand Chamber unanimously found a violation of Article 8 concerning the regime for obtaining communications data from communication service providers.
However, by a vote of 12 to 5, the court ruled there was no violation of Article 8 regarding the UK’s practice of requesting intercepted material from foreign governments and intelligence agencies.
In another unanimous decision, the Grand Chamber found a violation of Article 10, encompassing both the bulk interception regime and the acquisition of communications data from service providers.
Again, with a 12 to 5 vote, the court determined there was no violation of Article 10 concerning requests for intercepted material from foreign entities.
Reactions to the Judgement
Big Brother Watch, a privacy rights group involved in the challenges, stated that the judgement “confirms definitively that the UK’s bulk interception practices were unlawful for decades,” thus validating Snowden’s actions.
The organization also highlighted a dissenting opinion from Judge Pinto de Alburquerque, who cautioned about the risk of an electronic “Big Brother” emerging in Europe.
Silkie Carlo, director of Big Brother Watch, added: “Mass surveillance damages democracies under the cloak of defending them, and we welcome the Court’s acknowledgement of this. We will continue our work to protect privacy, from parliament to the courts, until intrusive mass surveillance practices are ended.”
Further Safeguards Needed
Privacy International emphasized a more optimistic interpretation, stating that the Grand Chamber’s ruling goes beyond the 2018 decision by “providing for new and stronger safeguards, adding a new requirement of prior independent or judicial authorisation for bulk interception”.
They added that authorization must be meaningful, rigorous, and incorporate proper ‘end-to-end safeguards’.
Jim Killock, executive director of the Open Rights Group, commented: “The court has shown that the UK Government’s legal framework was weak and inadequate when we took them to court with Big Brother Watch and Constanze Kurz in 2013. The court has set out clear criteria for assessing future bulk interception regimes, but we believe these will need to be developed into harder red lines in future judgments, if bulk interception is not to be abused.”
Killock also cautioned that GCHQ continues to share technology and data with the US, and expressed skepticism that current bulk interception practices are sufficiently safeguarded, stating this judgement is “an important step on a long journey”.