Source: https://www.justsecurity.org/59923/legitimizing-foreign-mass-surveillance-european-court-human-rights/
Timestamp: 2019-04-23 09:02:13+00:00

Document:
The European Court of Human Rights (ECtHR) is beginning to weigh in on a sweep of legislation passed, in recent years, that authorizes bulk interception of foreign communications in countries including France and the U.K. A recent ruling pertaining to Swedish bulk interception programs expands permission for mass surveillance, exploratory or general monitoring, and broader storage of raw data, thereby easing safeguards against the abuse of power, further demonstrating a surprising willingness by the court to re-tailor its human rights standards to meet the “collect it all” and “master the internet” agendas of western SIGINT agencies.
Avid Just Security readers would recall that in a January 2017 I wrote a post about this “new era of mass surveillance legislation” that was emerging across Europe. I suggested that this emerging trend would widen the chasm between the expressed policies and aspirational agenda of the European Union and the Council of Europe and the laws and regulations of their member states. It was, therefore, inevitable that these laws would be subjected to the scrutiny of the ECtHR for their presumed violation of the right to privacy enshrined under Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR).
Two such cases are pending before the court. One challenges the French Intelligence Act of 2015 (Association confraternelle de la presse judiciaire v. France et 11 autres requêtes) and another, triggered by the revelations of U.S. National Security Agency contractor Edward Snowden, challenges the programs of mass surveillance conducted by the U.K.’s signals intelligence agency, the Government Communications Headquarters (GCHQ), in collaboration with its U.S. counterpart, the National Security Agency (NSA) (10 Human Rights Organisations and Others v. the United Kingdom).
Last month, the ECtHR gave judgment in Centrum För Rättvisa v. Sweden that upheld Swedish legislation authorizing the gathering of covert bulk signals intelligence (SIGINT). The judgment is one of only a few cases in the history of the court to directly address foreign mass surveillance, and is certainly the only ruling in the post-Snowden era to be favorable to government. As such, it makes an important contribution to the court’s surveillance case law and sets a crucial precedent by drawing the lines of legality and illegality for intelligence agencies operating in the digital age.
The bottom line of the judgment is this: not only has mass surveillance by governments become the new normal even in Europe, as I indicated in my 2017 post, but this new normal has now received the Strasbourg Court’s official stamp of approval.
The case was initially brought in 2008 after the Swedish parliament extended the powers of the Defense Radio Establishment (Försvarets radioanstalt, or FRA), Sweden’s primary SIGINT agency, to allow the bulk interception of communications and communications data running through cables. The Signals Intelligence Act (Lagen om signalspaning i försvarsunderrättelseverksamhet), which entered into force on Jan. 1, 2009, established that “all cable-based cross-border communications” will now be transferred to “points of collection” so that the FRA may conduct foreign signals intelligence based on (a) “detailed tasking directive(s)” which were to be routinely issued by governmental offices, the armed forces, the security police, and the national operative department of the police authority (para. 9).
The law has since been amended three times (in 2013, 2015, and 2016, respectively), and the ECtHR determined that it would examine its compatibility with the ECHR based on the most recent version of the law (para. 98).
Prior to launching any new SIGINT operation or accessing and querying information at the various collection points, the FRA must secure a permit from the Foreign Intelligence Court (Försvarsunderrättelsedomstolen), except in the case of exigent circumstances where delay might make the operation futile. The Foreign Intelligence Court applies a proportionality test (whether less intrusive aims were considered, whether the benefits from surveillance outweigh the potential harms) in considering the reasoning for the request, the search terms or categories of search terms to be used, and the proposed duration of surveillance (up to six months, with possible routine extensions) (paras. 18-22).
In all the proceedings before the Foreign Intelligence Court, a privacy protection representative (Integritesskyddsombud) must be present, unless this would delay – and compromise — the operation. The representative as well as all other members of the court are appointed by the government. While the law requires the Foreign Intelligence Court to hold hearings in public whenever possible, in practice, its hearings have never been open to the public and all of its decisions are confidential (para. 135).
Finally, under the Swedish law, the Foreign Intelligence Inspectorate (Statens inspektion för försvarsunderrättelseverksamheten, or SSIUN), which is led by a government-appointed board, is tasked with overseeing all of the country’s foreign intelligence activities. The inspectorate monitors the implementation of existing laws and compliance with applicable directives and ordinances, and may submit opinions and suggestions to the FRA and the government. The inspectorate’s decisions are subject to a review by the Parliamentary National Audit Office (Riksrevisionen), and its analysis is further enhanced by the work of the FRA’s internal Privacy Protection Council (paras. 36-43).
The applicant, the Centrum för Rättvisa, is a Stockholm-based nonprofit public-interest firm representing clients in litigation against the state on issues concerning individual rights and freedoms. While the organization was unable to show that it was specifically targeted for communications interception, it asserted that it was at risk of potential abuses of its right to privacy due to the particular functions it serves and the sensitive nature of its communications.
The court explicitly finds that “bulk interception regimes did not per se fall outside” the state’s margin of appreciation, the phrase used by the ECtHR to refer to states’ discretion. The court explains that, in light of technological advancements and the current transnational threats that plague many countries, “the decision to operate a bulk interception regime in order to identify hitherto unknown threats to national security is one which continues to fall within states’ margin of appreciation” (para. 112). The Court seems to base this finding on Weber v. Germany and Liberty v. The United Kingdom. It is true that in both those cases the Court found that the two countries’ specific bulk interception regimes did not fall outside the scope of those their margin of appreciation. Nonetheless, in neither of those cases has the ECtHR made such an explicit and controversial general statement, suggesting that mass surveillance is a legitimate mean in the protection of national security. Moreover, both those cases were determined before the Snowden revelations, and the public outcry that it triggered.
These activities are, by their very definition, less specific. They fail to meet the ECtHR’s traditional requirements of particular suspicion and are aimed at broadening the net through the deployment of fuzzier search terms. While it is true that most of these operations will result in the gathering of metadata, some development activities may also involve the examination of intercepted content.
The court finds that, given that these activities are authorized through the same permit process and subjected to the same oversight, they are “sufficiently demarcated” and do not violate Article 8 of the ECHR. This is a massive shift from the court’s original position on surveillance going back to the late 1970s. Indeed in Klass v. Germany, the Court explicitly prohibited “exploratory or general surveillance” that did not cover specific suspects (para. 51).
The ECtHR for the first time adopts the view that automated haystacks — databases of stored “unprocessed information,” raw materials not yet “subjected to manual treatment” — do not trigger an Article 8 infringement. Rather the court “accepts that it is necessary for the FRA to store raw material before it can be manually processed,” merely nodding to the obligation to delete such data “as soon as it is evident that it lacks pertinence for a signals intelligence mission” (para. 146). This is yet another radical claim that brings the Council of Europe’s human rights law far closer to the NSA’s playbook.
In Weber v. Germany (para. 95) the Court developed six safeguards that must be introduced into statutory authorizations to prevent any absuses of surveillance powers. The court in this case stretches the “Weber Criteria” to have them cover the FRA’s foreign surveillance operations.
The court, for example, acknowledged the fact that the Signals Intelligence Act included no provision obliging Swedish agencies to discontinue a signals intelligence mission when it is found that “the conditions for it have ceased to exist or the measures themselves are no longer necessary.” The inclusion of such a provision has been traditionally regarded by the court to be a prerequisite for the determination that a domestic law met the Weber Criteria. Nonetheless, the court was willing to avoid this omission, suggesting that unlike criminal investigations that target individual suspects, the need for such a cancellation provision is less “prominent” in the case of foreign intelligence against national security threats (para. 130).
The FRA’s current legal framework lacks sufficient clarity regarding if, when, or how intelligence is to be shared across agencies domestically or with foreign partners. Moreover, equally lacking are the frameworks that govern oversight over such intelligence cooperation. This is particularly concerning given the historical involvement of the FRA with the NSA and GCHQ in quite a number of controversial mass surveillance and hacking programs, such as Quantum and XKeyscore, as were revealed by the Snowden leaks.
This concern, however, is not enough for the court to find a violation of the ECHR. The court cites to the existing oversight structures, claiming that they are enough to ease the concern, failing to explain precisely how the existing oversight bodies may be effective in supervising the unique privacy infringements that intelligence sharing triggers. This is unfortunate given that, as Privacy International noted, “Intelligence sharing is one of the most pervasive, and least regulated, surveillance practices in our modern world,” with significant impacts on privacy (p.3). Privacy International has further highlighted that in Sweden, although intelligence agencies “must inform the oversight bodies of the principles underpinning forms of cooperation with foreign agencies” the law does not explicitly require them to “disclose the written arrangements of such cooperation” or any specific details around particular intelligence sharing programs (p.34).
Yuval Shany, the incoming president of the United Nations Human Rights Committee, suggested in July 2017 that there might be emerging “a duty for ex post facto notification of persons who were under surveillance.” This duty has been part and parcel of the surveillance jurisprudence of the ECtHR from its early days. In the context of foreign surveillance, however, the court seems to be willing to completely abandon the duty.
As a result, the court seems open to replacing notification requirements in foreign surveillance cases with other remedies, namely domestic standing in courts to bring in abstracto litigation, so that both nationals and foreigners could be able to determine whether they have been spied upon.
Earlier this year I published an article with the Chicago Journal of International Law titled: “The Myth of a Universal Right to Privacy and the Practice of Foreign Mass Surveillance.” I argued that those human rights defenders who seek to apply the same standards for domestic and foreign surveillance in the name of universalism are setting themselves up for heartbreak, disappointment, and disenchantment. Foreign surveillance is a unique creature, and its features demand specific tailoring. As such, I called on those who care for privacy to step outside the bounded thinking of “one-size-fits-all” human rights standards for all surveillance practices.
The ECtHR in Centrum För Rättvisa v. Sweden has clearly adopted this model. In doing so, it set itself on a new path and signaled what its eventual rulings are likely to be on similar practices by the U.K. and France. In fact, in the case of 10 Human Rights Organizations v. the U.K., one of the plaintiffs’ arguments is that the U.K. has violated Article 14 of the ECHR on the principle of non-discrimination by setting different statutory protections for domestic and foreign surveillance (paras. 262-271). In the Swedish case, the court clearly takes the opposite view, endorsing such distinctions and differentiations rather than branding them with illegality.
But the ECtHR may have taken this approach over the line. In the name of doing whatever it can to legitimize the Swedish foreign surveillance machine, it might have skewed the balance too far and inadvertently legitimized more dangerous mechanisms. Recognizing the need to tailor the right to privacy to account for the unique features of foreign surveillance should not result in de facto abandoning all of the court’s important safeguards, nor should it lead us to cover our eyes to the practice’s negative effects. Instead what is required is a careful and nuanced act of rebalancing. This requires high degrees of precision. In ruling on the Swedish case, the court unfortunately wielded its analysis less like a surgeon in an operating room and more like an elephant in a china shop.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.