On September 13, 2018, the European Court of Human Rights (ECHR) released the judgment in Big Brother Watch and Others v The United Kingdom (Applications nos. 58170/13, 62322/14 and 24960/15). The case concerned the bulk interception of electronic communications by Britain’s Government Communications Headquarters (GCHQ). The court held by a 5-2 majority that the bulk interception regime violated Article 8 of the European Convention on Human Rights – the right to respect for private and family life, and correspondence.

Three joint applications were brought by sixteen organizations and individuals including Privacy International and The National Council for Civil Liberties (Liberty) after Edward Snowden, the former US National Security Agency (NSA) contractor, revealed the secret surveillance programs operated by the United States and the United Kingdom intelligence agencies in 2013. The majority opinion is 185 pages consisting of 525 paragraphs and considers three different surveillance regimes: (1) the bulk interception of communications; (2) intelligence sharing with foreign governments; and, (3) the obtaining of communications data from service providers. I will comment on the bulk interception issue.

GCHQ is Britain’s signals intelligence (SIGINT) agency that has conducted bulk interception of electronic communications by tapping undersea fibre optic cables landing in the UK. The court found that the legal regime under s 8(4) of the Regulation of Investigatory Powers Act 2000 (RIPA) governing mass interception violated the right to privacy. The statute was the precursor to the current Investigatory Powers Act 2016. Here are paras 387-8 of the judgment, at p 150:

• [T]he Court considers that the decision to operate a bulk interception regime was one which fell within the wide margin of appreciation afforded to the Contracting State. Furthermore, in view of the independent oversight provided by the Interception of Communications Commissioner and the [Investigatory Powers Tribunal], and the extensive independent investigations which followed the Edward Snowden revelations, it is satisfied that the intelligence services of the United Kingdom take their Convention obligations seriously and are not abusing their powers under section 8(4) of RIPA. Nevertheless, an examination of those powers has identified two principal areas of concern; first, the lack of oversight of the entire selection process, including the selection of bearers for interception, the selectors and search criteria for filtering intercepted communications, and the selection of material for examination by an analyst; and secondly, the absence of any real safeguards applicable to the selection of related communications data for examination.
• In view of these shortcomings and to the extent just outlined, the Court finds that the section 8(4) regime does not meet the “quality of law” requirement and is incapable of keeping the “interference” to what is “necessary in a democratic society”.

The court was specifically concerned with the manner in which the government selects “bearers” (undersea cables) and the search criteria used to obtain communications from them. “[T]he Court is not persuaded”, the majority wrote at para 347, p 140, “that the safeguards governing the selection of bearers for interception and the selection of intercepted material for examination are sufficiently robust to provide adequate guarantees against abuse. Of greatest concern, however, is the absence of robust independent oversight of the selectors and search criteria used to filter intercepted communications.”

In a post to its web site titled UK mass interception law violates human rights – but the fight against mass surveillance continues dated September 13, 2018, Privacy International said:

“The UK’s geographic location makes it a natural landing hub for many of the cables that carry the world’s communications. The Snowden disclosures revealed that the UK government – often with the cooperation of telecommunications companies – has attached probes to these cables to intercept their traffic. Once intercepted, the UK government uses ‘selectors’ and ‘search criteria’ to filter the content and metadata it collects. Those selectors could be as broad as: (1) all traffic to and from France (2) all search queries on Google (3) all purchases on Amazon (4) all location data, or (5) a wide range of IP addresses.

Intercepted information is stored in databases, which government analysts can query, data-mine or use to call up information to examine further. This process provides the UK intelligence agencies with a vast trove of content and metadata (referred to as ‘communications data’ in the judgment) that is capable of revealing the most intimate details of anyone who uses online communications.”

The court was also not persuaded that the acquisition of related communications data is necessarily less intrusive than the acquisition of content. The majority put it this way at para 356, p 142:

• For example, the content of an electronic communication might be encrypted and, even if it were decrypted, might not reveal anything of note about the sender or recipient. The related communications data, on the other hand, could reveal the identities and geographic location of the sender and recipient and the equipment through which the communication was transmitted. In bulk, the degree of intrusion is magnified, since the patterns that will emerge could be capable of painting an intimate picture of a person through the mapping of social networks, location tracking, Internet browsing tracking, mapping of social communication patterns, and insight into who a person interacted with […].

The court therefore concluded at para 357, p 142, that “a fair balance had not been struck between the competing public and private interests” by exempting communications data from the safeguards applicable to the search and examination of content.

The judgment was widely praised by privacy hawks. In an article titled GCHQ data collection regime violated human rights, court rules published in The Guardian edition of September 13, 2018, Owen Bowcott reported Megan Goulding, a lawyer for Liberty, as saying: “This is a major victory for the rights and freedom of people in the UK. It shows that there is – and should be – a limit to the extent that states can spy on their citizens.” And Lucy Claridge of Amnesty International said: “Today’s ruling represents a significant step forward in the protection of privacy and freedom of expression worldwide. It sends a strong message to the UK government that its use of extensive surveillance powers is abusive and runs against the very principles that it claims to be defending.”

What does the ruling mean for Canada and Canadians? In a post to the web site of the Canadian Civil Liberties Association (one of the applicants) titled CCLA, INCLO And Others Welcome Historic Win Against Mass Surveillance In U.K. dated September 14, 2018, Michael Bryant, Executive Director, described bulk surveillance as “a global issue that affects every nation and every person who communicates online.” The post continued: “Many of the undersea cables carrying the world’s internet traffic route through the U.K, which makes it inevitable that communications originating in Canada are frequently caught up in U.K. mass surveillance activities. Further, Canada is a participant in intelligence sharing activities with the U.K., the U.S. and others as a member of the Five Eyes intelligence alliance. Not only are Canadians affected by the problem of mass surveillance, but we need to pay attention to this ruling at home.”

It is important, then, to emphasize not only what the judgment does, but also what it does not do – or may not do. In a post to Cybereagle titled Big Brother Watch v UK – implications for the Investigatory Powers Act dated September 13, 2018, London privacy lawyer Graham Smith made two good points. First, the question for the future is whether the specific aspects of RIPA that resulted in the violation “have implications for the current Investigatory Powers Act 2016″. Second, the court did not hold that bulk interception itself was impermissible but that broad discretionary interception must be subject to “rigorous safeguards around selection and examination of intercepted material”.

And that really begs the question, doesn’t it? Is mass surveillance inherently disproportionate and thus in violation of Article 8?