Snowden was right, rules human rights court as it declares UK spy laws broke ECHR
- Reference: 1621962486
- News link: https://www.theregister.co.uk/2021/05/25/echr_ruling_uk_ripa_surveillance_laws/
- Source link:
The judgment, handed down this morning in Strasbourg, vindicates the Edward Snowden revelations of 2013. The former [1]NSA contractor revealed that Western spy agencies had been largely ignoring legal controls on their operations because, at the time, indiscriminate dragnet surveillance was more convenient than obeying the law.
Today’s ruling confirms that dragnet surveillance is not against the European Convention on Human Rights per se, provided that properly enforced safeguards to minimise indiscriminate spying are in force – and this is where UK.gov’s arguments fell apart.
[2]
[3]
[4]
“The Court considers that, when viewed as a whole, the section 8(4) regime, despite its safeguards... did not contain sufficient ‘end-to-end’ safeguards to provide adequate and effective guarantees against arbitrariness and the risk of abuse,” ruled the European Court of Human Rights (ECtHR)’s Grand Chamber.
Section 8(4) is a reference to the Regulation of Investigatory Powers Act 2000. That section has since been replaced by the Investigatory Powers Act 2016, but the court was looking at allegedly unlawful acts by UK.gov in the past.
The ECtHR’s ruling added: “In particular, it has identified the following fundamental deficiencies in the regime: the absence of independent authorisation, the failure to include the categories of selectors in the application for a warrant, and the failure to subject selectors linked to an individual to prior internal authorisation.”
[5]
In wording unlikely to win the ECHR many friends in Whitehall or Cheltenham, the court said “it is of fundamental importance for at least the categories of selectors to be identified in the authorisation and for those strong selectors linked to identifiable individuals to be subject to prior internal authorisation providing for separate and objective verification of whether the justification conforms to the aforementioned principles.”
In other words, warrants authorising surveillance of named targets should be pondered in advance of each operation, not signed off in bulk (as the UK used to do) at the start of the year, and legal justification should be held on file – something the British spy agencies, MI5, MI6 and GCHQ, have been shoddy about in the past.
The Liberty human rights pressure group celebrated today’s judgment, with lawyer Megan Goulding saying in a statement: “We all want to have control over our personal information, and to have a government that respects our right to privacy and our freedom of expression. That’s what makes today’s victory, and the court’s recognition of the dangers posed by these mass surveillance powers, so important.”
[6]Furious Google techie on NSA snooping: 'F*CK THESE GUYS'
[7]When it comes to privacy, everyone says America needs a new federal law ASAP. As for mass spying, well, um… huh what’s that over there?
[8]NSA: We've learned our lesson after foreign spies used one of our crypto backdoors – but we can't say how exactly
[9]Ed Snowden doesn’t need to worry about being turfed out of Russia any more
[10]Chinese database details 2.4 million influential people, their kids, addresses, and how to press their buttons
She added: “Bulk surveillance powers allow the State to collect data that can reveal a huge amount about any one of us – from our political views to our sexual orientation. These mass surveillance powers do not make us safer.”
The Grand Chamber also ruled that sending intercepted data to non-ECHR signatory countries such as America would be unlawful unless it was stored securely to prevent “abuse and disproportionate interference” with ECHR rights, though it added that diplomatic assurances would be enough to meet that condition.
[11]
The Court of Appeal is expected to hear an ongoing, related UK case later this year.
What the ECtHR said about the ECHR
Today’s judgment ruled on three separate cases that had been linked together by the court because they all raised similar issues about the lawfulness of British dragnet surveillance laws. Everyone involved, including Liberty, Privacy International, EU campaign group EDRi and others, argued that “the [UK] regime for the bulk interception of communications was incompatible with Article 8 of the Convention.”
Article 8 of the European Convention on Human Rights (ECHR) is where the “right to respect for private and family life” comes from, as [12]set out in the UK legal version of it contained in the Human Rights Act 1998.
Summarising their arguments, the court said: “The applicants contended that bulk interception was in principle neither necessary nor proportionate within the meaning of Article 8 of the Convention and, as such, did not fall within a State’s margin of appreciation.”
That “margin of appreciation” is the discretion which governments have to interfere with privacy rights “as far as is necessary in a democratic society”. The Foreign, Commonwealth and Development Office (FCDO), on behalf of the British government, argued that legal changes since the original Snowden revelations of 2013 meant the UK’s laws now complied in full with the ECHR.
“The Government contended that the interception of communications under the bulk interception regime would only have resulted in a meaningful interference with a person’s Article 8 rights if his or her communications were either selected for examination (that is, included on an index of communications from which an analyst could potentially choose items to inspect) or actually examined by an analyst,” said the court.
UK.gov “reiterated that any analysts who examined selected material had to be specially authorised to do so, and received mandatory regular training, including training on the requirements of necessity and proportionality. They were also vetted. Before they examined the material, they had to create a record setting out why access to the material was required, why it was consistent with the Secretary of State’s certificate and the requirements of [the Regulation of Investigatory Powers Act]; and why it was proportionate,” continued the court.
A spokesperson for Home Office said:
“The UK has one of the most robust and transparent oversight regimes for the protection of personal data and privacy anywhere in the world. This unprecedented transparency sets a new international benchmark for how the law can protect both privacy and security whilst continuing to respond dynamically to an evolving threat picture.
“The 2016 Investigatory Powers Act has already replaced large parts of the 2000 Regulation of Investigatory Powers Act (RIPA) that was the subject of this challenge. We note today’s judgment.”
France, the Netherlands and Norway all formally supported the UK’s unsuccessful defence of dragnet surveillance powers. As the judgement points out, those countries, together with Finland, Germany, Sweden, Switzerland and the United Kingdom, all "officially operate bulk interception regimes over cables and/or the airways."
The full, and dense, judgment can be [13]read on the court's website .
®
Get our [14]Tech Resources
[1] https://www.theregister.com/2013/06/10/prism_source_named_as_techie_edward_snowden/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YK1zg0@DsOZt60UB36QLlAAAAEI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YK1zg0@DsOZt60UB36QLlAAAAEI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YK1zg0@DsOZt60UB36QLlAAAAEI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YK1zg0@DsOZt60UB36QLlAAAAEI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2013/11/07/google_engineers_slam_nsa/
[7] https://www.theregister.com/2020/12/09/congress_privacy_shield/
[8] https://www.theregister.com/2020/10/28/nsa_backdoor_wyden/
[9] https://www.theregister.com/2020/10/23/edward_snowden_russian_permanent_residency/
[10] https://www.theregister.com/2020/09/15/china_shenzhen_zhenhua_database/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YK1zg0@DsOZt60UB36QLlAAAAEI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://www.legislation.gov.uk/ukpga/1998/42/schedule/1/part/I/chapter/7
[13] https://hudoc.echr.coe.int/eng#{%22documentcollectionid2%22:[%22GRANDCHAMBER%22,%22CHAMBER%22],%22itemid%22:[%22001-210077%22]}
[14] https://whitepapers.theregister.com/
Always listening to our customers
I can understand the motives - wanting to get all the information possible and then trawl through it to find information useful for 'protecting the public', but the issue is that if you do that there is temptation to find something, anything, to justify the mass data grab in the first place (otherwise you might not be allowed to do it again).
The problem is that 'the State' often considers itself, and its survival to be 'the public interest' and that any activities considered to be even potentially attacking 'the state' or current members of the hierarchy constitute 'subversives' who 'need' to be watched and targeted. They need to remember who coined the phrase 'you have nothing to fear if you have nothing to hide'*.
(Big Brother icon for the obvious reason.)
*It was the NAZIs.
Re: Always listening to our customers
In reality, except, for example, in militaristic dictatorships, the "State" doesn't have a concrete reality at all. Unless implemented by coercion, it's no more than a convention grounded in the common consent of the populace.
There is however a danger that those entrusted by that common consent with managing the national interest come to confuse that with their own personal interests. The ultimate result is dictatorship of the worst kind - bureaucratic dictatorship, which is faceless and thus impossible to negotiate with. The saddest aspects of this are that those responsible commonly believe that they're acting for the common good and they close their eyes to unintended consequences.
So basically
TL:DR
A moral victory but essentially pyrrhic?
They'll carry on what they are doing and they are very sorry, but business as usual Guvnor?
All seems to be making a point but without any actual useful outcome.
Re: So basically
"All seems to be making a point but without any actual useful outcome."
Correct you are! But this whole exercise surely paid lots of people lots of money, and looks good on their CV. If you call that useful outcome...
Remember Gordon 10 in your report!
Big Brother icon because he's probably here in the dungeons of El Reg Forums and Comments taking notes.
Can we do it? Hell yes!
May we do it? Er, apparently not. But let's just do it anyway.
"Big Brother icon because he's probably here in the dungeons of El Reg Forums and Comments taking notes."
I suspect the clerks in MI5 have been replaced by an AI that looks for key words and phrases now but I would expect most comments sections and forums to be viewed regularly in some way.
As the Register is a public web site, and access to the fora* is open to all, I do not doubt that a lot of 'security services' read it daily, indeed someone probably has it on their job description to monitor what we (the commentarderie) are posting.
So, umm, 'hello' and 'good evening' to all the spooks. :o)
*fora is the latin plural of "forum', I'm trying to be erudite for once, as I understand the British spooks are mostly recruited from Oxford and Cambridge university classics and history toffs.
To quote the late David Frost,
"Hello, good evening and welcome"
So, umm, 'hello' and 'good evening' to all the spooks. :o)
I'm afraid it's just spooky bots, rather than spooks themselves...
Curse your sudden but inevitable betrayal
Interesting to see that "France, the Netherlands and Norway all formally supported the UK". Norway, note, shares with the UK its non-membership of the EU but founder membership of the even longer-standing and wider-ranging Council of Europe - and hence subject to the European Court of Human Rights. So we see a genuinely pan-European debate unfolding.
When we read the details, it is really just fine-print dickering about what constitutes adequate precautions against abuse; all are agreed that bulk slurping is fine in principle.
Suppose hypothetically that some analyst in GCHQ is caught spying on their ex and new partner. They get summarily sacked, literally frogmarched to the door - end of career, period. Has the regime failed because they were able to somehow evade the system safeguards and do that, or has it worked because the system laid an audit trail which led to them being caught and made an example of?
Fun and games for all the family.
"dragnet surveillance laws"
The problem lies right in the title : dragnet.
No fine-tuning, no discrimination, just violate everyone's privacy and hope you find something. After all, you're The Law. The good guy. Except when you abuse your powers to check on your wife, which is sooo easy to do. Just rewatch True Lies.
I would like, nay, I demand, a report on how many times this global violation of privacy has resulted in stopping crime, let alone terrorism.
If you could prove, without doubt, that raping my privacy has stopped significantly more criminals than you could have without it, then I might rethink my attitude on that.
But you won't, because you cannot actually justify any concrete benefit.
The UK has one of the most robust and transparent oversight regimes
where the oversighters oversee the oversighted
Wankers.