The detention of two journalists by Polish military officers and the searches of their cellphones and cameras for information documenting events near Poland’s border with Belarus has reached the European Court of Human Rights. The case presents an opportunity to consider again the highly intrusive nature of digital searches and how they implicate privacy rights and freedom of expression. Two internationally renowned non-governmental organizations were granted leave to intervene and have now filed a joint intervention brief.

1. Introduction

On November 16, 2021, photojournalists Maciek Nabrdalik and Maciej Moskwa were documenting the presence of the Polish army in Wiejka, a town near Michalowo in the Podlaskie region, close to the Belarusian border. The area was outside a three kilometer-wide zone designated under a state of emergency. The emergency measure had been taken to limit entry into the restricted area and prohibited the taking of photographs or video footage of the border and its infrastructure. A lack of information about events occurring in the restricted area escalated when thousands of migrants and asylum seekers tried to cross the border from Belarus into Poland sparking accusations by Polish and European Union leaders that Alexander Lukashenko, the authoritarian president of Belarus, orchestrated the crisis in retaliation against Western sanctions. The restrictions limited the ability of journalists to cover the human rights concerns and whether adequate protection was available for those trapped in inhumane conditions.

2. Background

The incident was triggered when Mr. Nabrdalik and Mr. Moskwa approached a military camp and asserted they were allowed to take photographs from their location. They were outside the three kilometer zone. The officers told them to wait. Sensing an escalation of tension they asked if they were being detained. The answer was “No.” They returned to their car but were prevented from leaving when chaos erupted. “Get out of the fucking car, now!” an unidentified voice shouted. “You’re getting out now, for fuck’s sake, you have a minute!” They were forced from the vehicle and ordered to take off their jackets. Their cameras and cellphones were searched. The Polish Ministry of National Defence has claimed it didn’t know who the journalists were. But Mr. Moskwa had a press card hanging around his neck. “They didn’t ask us for press cards. They only said: ‘You will no longer want to take fucking pictures’.” They were detained for approximately eighty minutes.

On March 6, 2023, the European Court of Human Rights published a summary of the case providing a précis of the factual background. The incident was not previously considered by the domestic courts of Poland. The journalists had informed the Operations Centre of the Ministry of National Defence about the incident but the ministry denied that an “abuse of power” took place. The appeals against the arrest and search were transferred to the prosecutor’s office “because it was held that the arrest in question had not been based on the provisions of the Code of Criminal Proceedings or on the basis of the Police Act.” The Polish domestic authorities did not use the term “deprivation of liberty” in relation to the events and generally described the incident as the “way in which operational activities had been carried out.” Both Mr. Nabrdalik and Mr. Moska maintain they were deprived of their liberty. (here and here)

3. Who are the Intervenors?

The two intervenors are Privacy International and ARTICLE 19. Privacy International is a London-based non-governmental organization that defends the right to privacy worldwide. Funded by an international array of donors including the European Parliament, the European Commission, the American Civil Liberties Union and the University of Toronto’s Munk School of Global Affairs, Privacy International promotes the human right of privacy set out in the Universal Declaration of Human Rights. I have discussed the work of Privacy International in previous posts to On The Wire. (here and here) ARTICLE 19 is an international human rights organization that globally defends freedom of expression. It takes its name from Article 19 of the Universal Declaration of Human Rights. ARTICLE 19 is a founding member of the International Freedom of Expression Exchange (IFEX), a clearinghouse for non-governmental organizations that monitor freedom of expression violations. I have also commented on the work of ARTICLE 19 in a previous post. (here)

4. Mobile Phone Extraction

On August 30, 2023, the intervenors filed the joint intervention brief titled “Written Submissions of Privacy International and Article 19”. (here) The brief contains a section dealing with digital device extraction methods and their impact on fundamental rights. It is unknown whether the Polish military officers used forensic extraction tools to search the journalists’ devices or if they obtained access through “soft” methods (such as obtaining PIN codes) and copied the contents to another device. In either case, the searches of the devices violated the jorunalists’ right to “private life” under Article 8 of the European Convention on Human Rights. (here) I will give you the following extracts from the submissions that highlight the vast quantity of personal data stored on electronic devices and the highly intrusive nature of digital strip searches.

• First, mobile phone extraction (MPE) involves the collection, review and analysis of much greater amounts of information than would the search of a home which has for decades been subject to stringent safeguards worldwide. In Riley v. California, one of the first cases to explore the seizure of digital evidence by law enforcement, the Supreme Court of the United States observed that “[a] phone not only contains in digital form many sensitive records previously found in the home; it also contains a broad array of private information never found in a home in any form – unless the phone is.” (here and here) While the intervenors do not know whether software was used to extract the data in this case, they are aware of recent reports that the Polish Police has purchased extraction software from the Israeli company, Cellebrite. (paras. 4-6)
• Second, in addition to content data, a mobile phone extraction includes communications data or metadata whose collection has been recognized by the Court of Justice of the European Union in Privacy International v. Secretary of State for Foreign and Commonwealth Affairs as a “particularly serious” interference with privacy. This includes the content of messages and emails, photographs, videos, documents, location data and social media data. Further, users of digital devices may not initiate or even know about all the data created and stored on their devices. Apps often record data without the user’s awareness. All this data can reveal intimate information about the user’s life including health conditions, sexual orientation, intimate thoughts, political affiliations, religious beliefs and financial data. (paras. 8-10)
• Third, much of the extracted data will be irrelevant to the purposes of the search. The mobile extraction software Privacy International researched had limited options for selective data extraction only allowing for the selection of broad categories of data. Further, smartphones and computers are likely to contain significant amounts of third party data which is particularly concerning for journalists who rely on the anonymity of sources. Mobile phone extraction therefore threatens freedom of expression and freedom of the media under Article 10 of the Convention. (paras. 13-15)

The intervenors draw on comparative case law that recognizes the serious privacy implications raised by searches of digital devices. In R. (on the application of HM and MA and KH) v. Secretary of State for the Home Department, it was conceded that a blanket policy of searching the phones of migrants who arrived in the United Kingdom by small boats was unlawful and not “in accordance with law” for the purposes of the Convention. (here) A similar action was brought in Germany to challenge the extraction of data from asylum seekers’ phones to verify their identity. The Berlin Administrative Court (affirmed on appeal) held that the blanket analysis of mobile phones at the start of an asylum procedure was illegal as neither necessary nor proportionate. And in R. v. Canfield, the Alberta Court of Appeal held that reliance on a customs statute authorizing border officials to search goods as a basis for a mobile phone search violated the Canadian Charter of Rights and Freedoms – a conclusion reached on the basis of “the massive amounts of highly personal information” stored on mobile phones and the consequential need to protect the “biographical core of personal information” they contain. (paras. 18, 21 and 24) (here and here)

5. Protecting Privacy Rights and Freedom of Expression

The intervenors urge the court to adopt stricter measures governing the search and seizure of journalists’ digital devices to protect against intimidation, unlawful detention and overly-broad searches.

• In Accordance With Law. The search and seizure of digital devices must be subject to strict safeguards to be considered “in accordance with law” under Article 8(2) of the Convention. In Malone v. The United Kingdom it was held that provisions had to be stated “with reasonable precision in accessible legal rules that sufficiently indicated the scope and manner of exercise of the discretion conferred on the relevant authorities.” (para. 28)
• Prior Authorization by an Independent Judicial Authority. The standard must be higher when journalistic material is concerned. In Sorokin v. Russia, it was concluded that, “the requisite review should be carried out by a body separate from the executive and other interested parties, invested with the power to determine whether a requirement in the public interest overriding the principle of protection of journalistic sources exists prior to the handing over of such material and to prevent unnecessary access to information capable of disclosing the sources’ identity if it does not.” (para. 36)
• The Reasonable Suspicion Test. Authorization of the search of electronic devices by an independent judicial authority must be based on a reasonable suspicion that an offence has been committed, not merely the fact that the person is crossing the border. Particularly strong justification for a search and seizure will be required where the persons affected are not themselves suspected of the offence in respect of which the investigation is being undertaken. (para. 38)

6. Conclusion

The intervenors assert that the private nature of data extracted from digital devices requires a “stringent necessity and proportionality assessment.” Extracting all the data on a device will rarely be justifiable as access to the volume and variety of stored information will rarely be necessary to investigate a specific offence. The submission is supported by the Investigation report: Mobile phone data extraction by police forces in England and Wales published by the U.K.’s Information Commissioner’s Office in 2020. The ICO concluded that the police were regularly extracting and retaining disproportionate amounts of data in criminal investigations. “Of particular concern is my finding that police data extraction practices vary across the country, with excessive amounts of personal data often being extracted, stored, and made available to others, without an appropriate basis in existing data protection law,” the Commissioner stated. (here)