Investigatory Powers Act: State Security and Privacy Rights

Critically consider whether the new Investigatory Powers Act strikes the right balance between state security and individual privacy rights.

Introduction

Prior to the revelations of Edward Snowden, one may have believed that high surveillance from states as a concept of ‘Orwellian dystopia[1]’ or was limited to those countries known their close surveillance of residents, such as China.[2] However, it did not occur to individuals that this intrusive surveillance was taking place closer to home in western countries such as the United Kingdom.

This theory proved to be erroneous when in 2013, the ‘Snowden Files’ were revealed. Unfortunately, as verified by Edward Snowden, western countries are now heavily involved in close state surveillance, with the United Kingdom being ‘one of the most heavily surveilled countries in the world’[3]. Thus, it appears that the public had been misled to the extent in which their private lives were being impeded. 

As a result of these disclosures, changes have been made to existing legislation in many countries, including the United Kingdom, whom have changed their legislation from the Regulation of Investigatory Powers Act 2000 (RIPA) and the Data Retention and Investigatory Powers Act 2014 (DRIPA) [4] to the new Investigatory Powers Act which was given royal assent on the 29^th of November 2016. However, whether this Act presently means that individual privacy rights are now balanced correctly against state security is a little more complex in nature.

Idealized Balance between State Surveillance and Rights to Individual Privacy

Under the European Convention of Human Rights ‘everyone has the right to respect for his private and family life, his home and his correspondence.’[5] Therefore, it is expected that an individual may maintain a private life and that public authorities may not impede on this right, unless it is necessary ‘in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime.’[6] Edwards notes ‘the demarcation line, which ‘ensures strong citadels of individual and group privacy’[7] and ‘limits both disclosure and surveillance,’ is seen as a prerequisite for liberal democratic societies.’[8] Therefore, it is important that this balance is adhered to, to ensure privacy rights are not intruded upon, beyond what is necessary for the state to carry out its surveillance. Thus, to ensure this fair balance Murray states the importance for ‘the law [to] indicate the scope of any discretion conferred on the competent authorities and the manner of its exercise with sufficient clarity, having regards to the legitimate aim of the measure in question, to give the individual adequate protection against arbitrary interference.’[9]

Prior to the revelations of Edward Snowden, several cases have clarified the scope and principles that must be considered by public authorities before they may legitimately partake in state surveillance and compromise the privacy rights of individuals. Klass & Ors v Germany[10]recognised that the state powers of surveillance under Art 8 should not be ‘unlimited’[11] as it is ‘aware of the danger such a law poses of undermining or even destroying democracy on the ground of defending it’[12] thus ‘the struggle against espionage and terrorism [cannot be used] to adopt whatever measures they deem appropriate.’[13] Thus, it was deemed that the Art 8(2) ‘tolerable under the Convention only in so far as strictly necessary for safeguarding the democratic institutions[14].’ In other words, where it was necessary for a democratic society[15]. Moreover, the case of Malone v United Kingdom [16] stated the need for surveillance to be in ‘accordance with the law’[17] which was described in that it ‘does not merely refer to domestic law but also relates to the quality of the law.’[18] For instance, it must be ‘adequately accessible [in that it shall] enable the citizen to regulate his conduct[19]’ regarding the activities which may lead to them being surveilled. To do this an individual; ‘must be able…to foresee, to a degree that is reasonable in the circumstances, the consequences which a given action may entail.’[20] Finally, ‘proportionality’ was another factor discussed in S and Marper v United Kingdom[21] which stated that the government must balance ‘the potential benefits of the extensive use of such techniques [in state surveillance] against important private-life interests.’[22]

Murray states: ‘any law which allows for the interception, storage, and examination of digital data must therefore comply with these principles.’[23] If the state ensured that they were fulfilling these requirements, then they would correctly be balancing the need for state surveillance against the rights of individual privacy.

Breaching Privacy Rights

Unfortunately, the idealized views of what would ensure that state surveillance would be balanced against the private lives of individuals was not met. The Don’t Spy on Us campaign argued ‘gaps and weaknesses in the framework have been exploited to enable the collection of our private communications on a previously unimaginable scale’[24]. Therefore, due to ‘the Snowden revelations, [which] were shocking to the public [there were] challenges to the legality of several programs underway.’ This included the Tempora program[YOU NEED TO TALK ABOUT THIS],  This included the case of Liberty v UK and Big Brother Watch[25].’

In light of these disclosures, it is imperative to consider whether the privacy issues of the Regulation of Investigatory Powers Act 2000 (RIPA) and the Data Retention and Investigatory Powers Act 2014 (DRIPA) were addressed in the current Investigatory Powers Act 2016 (IPA).  In undertaking this assessment, this discussion will decipher whether the current law under the Investigatory Powers Act 2016 strikes the correct balance between state security and an individual’s privacy rights.

RIPA, Warrants and Privacy Issues

To ensure that RIPA is in accordance with the law, section one of the Act deems that it is unlawful for a person to intercept communications where they do not have authority[26]. Under RIPA, subject to limited exceptions,[27] there was typically a requirement for a warrant before communications could be intercepted.[28]

• Privacy issues with bulk warrants

The second warrant available under RIPA is what is commonly referred to as a bulk warrant.[29] This relates to external communications outside the British Isles and is not intended to intrude upon the communications of its own citizens[30]. However, section sixteen of the act makes exceptions to the person being surveilled being within the British Islands.  The first is where their external communications are being reviewed for the purposes of national security, the prevention or detection of serious crime or protecting the economic wellbeing of the UK.[31] The second is where someone enters the British Islands or were mistaken to be outside the British Islands[32] they can be surveilled for up to five days where it is necessary[33] of get an internal warrant under section eight, subsection one. Therefore, it does not appear as though residents or citizens are safeguarded in this way, as their external communications can be impeded upon where the public authorities can claim a reason for doing so.

Another issue related to the transparency of the law and public authorities in relation to bulk warrants. Many people were unaware of what was classed as an ‘external communication’ and it was not until May 2014 when Charles Farr announced that social media may be included in external communications. He stated: ‘A user located in the British Islands posting a message to Facebook will communicate with a Facebook web server, located in a Facebook Data Centre. If it is based outside the British Islands, then the message will be an “external communication.”’[34]  However, if the same technology was used for two individuals to send messages, it would be treated the same as an email in terms of being classed as an internal communication. Farr states that ‘ [it] would depend upon where that individual was located but not on how the email was routed’.[35] This definition did not exist prior to this statement and thus was not clear about when communications would be considered internal or external. Therefore, it would make it difficult for individuals to foresee the circumstances in which they would be surveilled and even in light of the definition. Moreover, it may still have been considered confusing for some individuals to understand why some communications would be internal through email but others would be external, such as searches to Google, which many individuals would not consider a communication in the first place.

• Privacy issues with internal warrants

One type of warrant is an internal warrant which is targeted at a certain person[36] or place[37] and must contain information of ‘addresses, numbers, apparatus or other factors, or combination of factors, that are to be used for identifying the communications that may be or are to be intercepted[38]’. Therefore, it could be argued that there were reasonable safeguards in which the public authority had to be transparent about who they were surveilling and the methods they were using to do so. Thus, this presents the illusion that their privacy rights are being respected in so far as they were restricted from ‘bulk interception of residents or citizens in the United Kingdom, as the warrant requires a specific location or person.’[39]  

Arguably, this safeguard was not as effective as once considered due to bulk warrants. It has been noted by Charles Farr as per Murray that external communications are intercepted at communication cables which contain both internal and external communications[40]. As information of both types are sent through a variety of servers, it is impossible to comprehend which information is internal or external. Therefore, there is no way to decide if communications are internal or external until they have been reviewed to make this determination.[41] This is clearly a significant intrusion into the privacy rights of individuals, as their communications are being considered at random. It would appear as though this would be a clear breach of RIPA as there was no warrant to intercept these internal communications. However, this is resolved by section five, subsection six of the act that recognised this information is unavoidably collected to ensure that the essential data for the warrant can be retrieved.[42] Therefore, arguably the safeguards provided by section one of the act, fall short in protecting all residents and citizens within the United Kingdom, as their data may be reviewed at random for the purposes of a bulk warrant.

• Addressing Privacy issues

It is clear an individual cannot protect their right to privacy if they do not understand the circumstances in which it will be impeded, their rights and how they may avoid this happening. Therefore, as Dr Paul Bernal for authorities to simply say ‘trust us’ is not satisfactory in assisting individuals to protect their rights to a private life.[43] Thus, both the first review, ‘Privacy and Security: A Modern and Transparent Legal Framework’[44] and the second review, ‘A question of Trust: Report of the Investigatory Powers Review’[45] by David Anderson QC noted the need for transparency under a new law.

Regarding transparency, the review communicated its concern that it was ‘unsatisfactory’ that the extent of investigatory powers used by the public authorities and other ‘disclosures’ were only made clear after the Snowden files were released.[46] Overall, the review takes the stance that a ‘fundamental imbalance[47]’ existed due to this lack of transparency. The review drew attention to the Liberty case[48] which stated, ‘A clear understanding of the absolute limits of what is permitted by legislation is essential when the exercise of powers will be done largely in secret.’[49] It was noted that the new act would be in ‘non-technical language’[50] which would be understood by the ‘intelligent readers across the world’[51] and ensure it is transparent unless prohibited by national security.[52]

The Investigatory Powers Act 2016 attempts to address these issues by setting out the strict powers regarding warrants. Part 2, Chapter 1 of the act deals with three types of targeted warrants.[53] The first is a targeted interception warrant.[54] Murray describes this as ‘a warrant that allows the interception of a communication or the obtaining of communication data, or the disclosure of such data.’[55] The second is targeted examination warrant[56] described by Murray as a warrant which ‘authorises the examination of intercepted material obtained under a bulk interception warrant’[57] Thirdly, is a mutual assistance warrant which Murray defines as allowing ‘communications to be intercepted or communications data to be examined as part of a mutual assistance request under EU or other Treaty like requirements.’[58]

It may be argued that these definitions are clearer and more transparent in nature, describing the purpose of each warrant in more depth within the act. This allows for individuals to understand when and for what purposes these warrants will be sought by public authorities. [will it help them protect their privacy rights??]

Authorisation of Warrants and Privacy Issues

• Separation of powers?

The issue with RIPA was that ‘there was no separation in terms of the executive and judiciary in the warrant process’.[59] Both internal and external warrants were approved by the Secretary of State.[60] Murray has quoted that there was ‘around fifty billion intercepts daily’.[61]  This meant that there was no checks or balances regarding this procedure and it was possible for the state to impede into the private lives of individuals unnecessarily if they chose to do so. Many individuals were concerned by this and after the Snowden revelations this was potentially an avenue for a real abuse of power by public authorities into the private lives of individuals. This was in disparity to the US court where the ‘US provided these through a secret court 99.97% of the time’ thus allowing for a separation of powers and protection of privacy rights.[62]

• Addressing Privacy issues

The first review identifying this problem was the ‘Privacy and Security: A Modern and Transparent Legal Framework’.[63] The review maintained the necessity for the authorisation of warrants to remain this way. Sir David Omund stated ‘I think it is entirely right that a Minister takes the responsibility on herself or himself to sign the warrant and then answers for the consequences if something terrible happens[64].’

While this review remained in favor of this approach, it was noted ‘other witnesses to the inquiry from outside Government disagreed, arguing that the public has lost trust and confidence in elected politicians to make these decisions. Contributors felt that judges would be better placed to balance individual and collective ‘rights’ objectively.’[65] It was deemed that judges would conduct better ‘checks on state power[66]’ and ensure ‘surveillance was necessary and proportionate.’[67] The second review ‘A question of Trust: Report of the Investigatory Powers Review’ by David Anderson QC[68] and the third review ‘A Democratic License to Operate’[69] by Prime Minister Nick Clegg, agreed that there had to be a change in this system to introduce the powers of a Judicial Commissioner through different perceptions of what is now known as a ‘double lock’ procedure.

A version of the double lock procedure was introduced through the Investigatory Powers Act 2016. Under this approach, the power to issue targeted warrants remain with the Secretary of State[70] or Scottish minister.[71] However, the Judicial Commissioner must approve this process[72] the same as it would in a judicial review.[73] This would include whether ‘the warrant is necessary on relevant grounds[74]’ and ‘whether the conduct that would be authorised by the warrant is proportionate to what is sought to be achieved by the conduct.’[75]  Murray argues that this means that ‘This section has no associated Explanatory Notesthis is a substantial change in power as the judicial commissioner has the authority to overrule the secretary of state on substantive grounds.’[76]

This shows that there is a significantly higher consideration on the privacy of individuals in this respect, as the Secretary of State is now accountable to the Judicial Commissioner for its actions.  The principles in ensuring that these acts are only done when it is necessary, in accordance with the law and proportionate is now arguably being upheld to a much higher standard than before. However, there is an exception where there are urgent cases[77] and there is up to three working days[78] for the Judicial Commissioner to decide whether to approve the warrant and notify the person of that decision.[79] If rejected it cannot be renewed and no longer in effect.[80] This system would be the same for bulk warrants, however, there would be no devolved powers to the Scottish Minister. This allows the appropriate time for checks and balances, but also adequately ensures that public authorities can act in the interests of state security where it is necessary.

Overall, it could be deemed that there is an appropriate balance between state security and individual privacy rights. It is certainly a more effective system than anything that has been in place before.

---

[1] THE DANGERS OF SURVEILLANCE Neil M. Richards∗ 1937

[2] THE DANGERS OF SURVEILLANCE Neil M. Richards∗ 1937

[3] THE DANGERS OF SURVEILLANCE Neil M. Richards∗ 1938

[4] Murray 591

[5] Art 8 ECHR

[6] Art 8(2) ECHR

[7] Edwards 548

[8] Edwards 548

[9] Murray 593

[10] (1978) 2 EHRR 214

[11] Klass & Ors v Germany (1978) 2 EHRR 214 Para 47

[12] Klass & Ors v Germany (1978) 2 EHRR 214 Para 47

[13] Klass & Ors v Germany (1978) 2 EHRR 214 Para 47

[14]  Klass & Ors v Germany (1978) 2 EHRR 214 Para 42

[15] Malone v United Kingdom (1984) 7 EHRR 14, para 81

[16]Malone v United Kingdom (1984) 7 EHRR 14

[17] Malone v United Kingdom (1984) 7 EHRR 14, para 66

[18] Malone v United Kingdom (1984) 7 EHRR 14, para 67

[19] Malone v United Kingdom (1984) 7 EHRR 14, para 67

[20] Sunday Times v United Kingdom [1983] , 2 EHRR 245 at para.49;  [check if it is the para]

[21] [2008] ECHR 1581

[22] S and Marper v United Kingdom[2008] ECHR 1581, para 112

[23] Murray 594

[24] Don’t Spy on Us, ‘Don’t Spy on Us: Reforming Surveillance in the UK’, 2014. 10

[25] Page …

[26] S(1) RIPA

[27] S(3) & S(4) RIPA

[28] S(5)(1) RIPA

[29] S8(4) RIPA

[30] Cite this

[31] S16(3)

[32] S6 RIPA

[33] S5 RIPA

[34] Statement of Charles Farr, the Director General of the Office for Security and Counter Terrorism, dated 16 May 2014, para 137

[35] Statement of Charles Farr, the Director General of the Office for Security and Counter Terrorism, dated 16 May 2014, para 137

[36] S8(1)(a) RIPA

[37] S8(1)(b) RIPA

[38] S8(2) RIPA

[39] 595 Murray

[40] Need referenced

[41] 603 Murray

[42] 603 Murray

[43] 214 David Anderspn review 2 para 12.6

[44] Recommendation YY

[45] citation

[46] 12.5 David Anderson Review

[47] 214 David Anderspn review 2 para 12.6

[48] Find this

[49] Find page

[50] 285 David Anderspn review 2

[51] 285 David Anderspn review 2

[52] 285 David Anderspn review 2

[53] Part 2 Chapter 1 of Investigatory Powers Act 2016

[54] S15(1)(a)

[55] Murray 610

[56] S15(1)(b)

[57] Murray 610

[58] Murray 610

[59] 599 Murray

[60]  or Scottish Minister for internal warrants s7 RIPA CHECK

[61] Murray 596

[62] 599 Murray

[63] Cite this

[64]  Review 1 https://b1cba9b3-a-5e6631fd-s-sites.googlegroups.com/a/independent.gov.uk/isc/files/20150312_ISC_P%2BS%2BRpt%28web%29.pdf?attachauth=ANoY7cqzVJ8waEyy-qH3I5HS0jIgGrusQo4IqLA_DdlM_5qrLkKOpXKbkYQEhGhSl6v2wIPmBI_-7mpu41N_y1u11bi85pB3Tii2n8J-5dUrjKNWFQZ7LJEuzCpwYE_aZDHZ3wzvLOLW657rEk2UbgwI5GfNyZthBs1-dBANgvQnmFo0ejznynmRPC0j5rQukAYv_6EpSNa_vhSS51h-JlRNMGzpd_6FAiVfkgkGixfc3rc8HRgJ0z8sdGE407favz94zqLIeeIz&attredirects=0  73

[65] Review 1 https://b1cba9b3-a-5e6631fd-s-sites.googlegroups.com/a/independent.gov.uk/isc/files/20150312_ISC_P%2BS%2BRpt%28web%29.pdf?attachauth=ANoY7cqzVJ8waEyy-qH3I5HS0jIgGrusQo4IqLA_DdlM_5qrLkKOpXKbkYQEhGhSl6v2wIPmBI_-7mpu41N_y1u11bi85pB3Tii2n8J-5dUrjKNWFQZ7LJEuzCpwYE_aZDHZ3wzvLOLW657rEk2UbgwI5GfNyZthBs1-dBANgvQnmFo0ejznynmRPC0j5rQukAYv_6EpSNa_vhSS51h-JlRNMGzpd_6FAiVfkgkGixfc3rc8HRgJ0z8sdGE407favz94zqLIeeIz&attredirects=0   P74

[66] Review 1 https://b1cba9b3-a-5e6631fd-s-sites.googlegroups.com/a/independent.gov.uk/isc/files/20150312_ISC_P%2BS%2BRpt%28web%29.pdf?attachauth=ANoY7cqzVJ8waEyy-qH3I5HS0jIgGrusQo4IqLA_DdlM_5qrLkKOpXKbkYQEhGhSl6v2wIPmBI_-7mpu41N_y1u11bi85pB3Tii2n8J-5dUrjKNWFQZ7LJEuzCpwYE_aZDHZ3wzvLOLW657rEk2UbgwI5GfNyZthBs1-dBANgvQnmFo0ejznynmRPC0j5rQukAYv_6EpSNa_vhSS51h-JlRNMGzpd_6FAiVfkgkGixfc3rc8HRgJ0z8sdGE407favz94zqLIeeIz&attredirects=0   P74

[67] Review 1 https://b1cba9b3-a-5e6631fd-s-sites.googlegroups.com/a/independent.gov.uk/isc/files/20150312_ISC_P%2BS%2BRpt%28web%29.pdf?attachauth=ANoY7cqzVJ8waEyy-qH3I5HS0jIgGrusQo4IqLA_DdlM_5qrLkKOpXKbkYQEhGhSl6v2wIPmBI_-7mpu41N_y1u11bi85pB3Tii2n8J-5dUrjKNWFQZ7LJEuzCpwYE_aZDHZ3wzvLOLW657rEk2UbgwI5GfNyZthBs1-dBANgvQnmFo0ejznynmRPC0j5rQukAYv_6EpSNa_vhSS51h-JlRNMGzpd_6FAiVfkgkGixfc3rc8HRgJ0z8sdGE407favz94zqLIeeIz&attredirects=0   P74

[68] 6 David Anderspn review 2

[69] Cite this

[70] Cl.19

[71] Cl. 21

[72] Cl. 23

[73] Cl 23(2)

[74] Cl 23(1)(a)

[75] Cl 23(1)(b)

[76] Murray 610

[77] Cl 24

[78] Cl 24(3)(b)

[79] Cl 24(3)

[80] Cl 24(4)