Seminar 5 Position Statement: Dr.Yvonne McDermott Rees

International legal standards on surveillance and the Investigatory Powers Bill

Yvonne McDermott Rees

Law, Bangor University

A number of recent judgments have set parameters on the interplay between the right to privacy and state surveillance. Last December, the European Court of Human Rights established that those authorising interception of communications must be able to verify the existence of ‘reasonable suspicion’ that the person concerned is planning, committing or has committed criminal acts or other acts endangering national security. It also established that such authorisations ‘must clearly identify a specific person to be placed under surveillance or a single set of premises as the premises in respect of which the authorisation is ordered.’

The Court of Justice of the European Union, in its Schrems decision, established that granting public authorities to have access to the content of electronic communications ‘on a generalised basis’ contravened the right to privacy.

These decisions set clear parameters for governments to follow in their surveillance activities. Yet, the Investigatory Powers Bill, which has just gone through its second reading in Parliament, falls short of those benchmarks, as recently noted by the United Nations Special Rapporteur on the Right to Privacy.

The Bill allows generalised surveillance through bulk interception warrants and bulk equipment interference. It allows interception warrants to apply to groups of persons or premises, and thus fails in the requirement of specificity. Most importantly, perhaps, under the Bill, there is no need for a person (or group of persons) to even be identified as a suspect or for there to be ‘reasonable suspicion’ that they have committed, are committing, or are about to commit a crime before their communications can be intercepted.

Seminar 5 Position Statement: Dr Gilad Rosner

Data Protection and International Policy-Making

Dr Gilad Rosner

Horizon Digital Economy Research Institute / Internet of Things Privacy Forum

International privacy and data protection has always been a rather difficult challenge. This is in part a reflection of the difficulties of international regulation generally. Even intra-national privacy regulation is contentious: consider the tension between differing US states’ privacy laws, between German states and the federal government, or the great variation among EU member states despite having a supranational model law. That law, the 1995 Data Protection Directive, specified that personal data cannot be transferred out of the EU to other countries unless their own national data protection laws were adequate in comparison with Europe’s. While many nations were deemed adequate, arguably the most important non-European data transfer target – the US – would never reach an adequacy determination. To repair this breach, the ‘Safe Harbour’ framework was created, stipulating that companies could self-attest that they meet similar levels of data protection as in Europe. Last year saw this problematic solution invalidated by the European Court of Justice, in part because the revelations of mass surveillance by the US by Edward Snowden cast deep suspicion over the possibility of adequacy envisioned under Safe Harbour. More over, the Court saw the absence of Europeans’ ability to seek redress in US law for violations of their privacy rights as further complicating the US/EU data transfer relationship. The Safe Harbour invalidation caused the EC to accelerate the genesis of its replacement, dubbed the ‘Privacy Shield.’ This framework, too, is a self-certification regime; indeed, it’s hard to imagine any other type of regime being created.

The issue at the heart of such transatlantic, international policy gyrations is power – specifically, the ability to regulate. That is, once data leaves Europe, it and its recipient custodians are beyond the reach of the originating country’s regulators, who are tasked with ensuring the data protection rights of their citizens. Regulation relies upon, among other things, the ability to inspect and sanction – these abilities stop at a country’s borders, whereas the transport systems for the data being regulated are designed to cross borders at extremely high speeds. So, there is a fundamental tension within the institution of data protection between the prerogatives and powers of nations and the architectural intentions of networked technologies. Nowhere is this more evident than in attempts at international policy-making.

Privacy Shield, whatever its future efficacy, cleverly relies upon co-regulation. In the US, the closest thing to a data protection authority is the Federal Trade Commission (FTC), whose remit includes ‘deceptive and unfair practices.’ Rather than dealing with privacy issues directly, the FTC can sanction companies when they promise to treat data a certain way (via, e.g., a privacy policy) and then fail to behave in line with those promises. To participate in Privacy Shield, companies must declare that they subscribe to several principles, including Notice, Choice, Accountability for Onward Transfers, subject Access, and Purpose Limitation. This public declaration serves as a promise in the FTC’s eyes, which then gives them purchase to sanction misbehaving companies.

The subject access provision is an example of a European data protection right that does not exist consistently in American law, but here is being extended from Europe into US information policy and then enforced by a US institution. Privacy rights and values, thereby, are evolving through non-legislative means via treaties and administrative policy. While US privacy advocates have criticized the Privacy Shield as being fatally porous[1], its future is still being written, and at least it has the benefit of being creative, forward-looking policy.

Privacy Shield is reliant on ‘institutional momentum’ – over 15 years of prior established policy. Institutional theory says that institutions – in this case, data protection – tend towards durability and stability. Privacy Shield is a recommitment to data protection principles, occurring in an international context. This is a positive evolutionary step; what neo-institutionalist scholar Ronald Jepperson[2] might call “institutional development.” Still, the criticisms of Privacy Shield and those yet to come are reflective of other scholars’ view of institutions as “contested terrains contoured by variation, struggles and relatively temporary truces[3].”

---

[1] O’Brien, D. and Reitman, R. (2016). The Privacy Shield is Riddled with Surveillance Holes. Electronic Frontier Foundation. https://www.eff.org/deeplinks/2016/03/privacy-shield-riddled-surveillance-holes

[2] Jepperson, R. (1991). Institutions, Institutional Effects, and Institutionalism. In W. Powell & P. DiMaggio (Eds.), The New Institutionalism in Organizational Analysis (pp. 143-163). Chicago: University of Chicago Press.

[3] Greenwood, R., Oliver, C., Sahlin, K. and Suddaby, R. (2008). Introduction. In R. Greenwood, C. Oliver, K. Sahlin & R. Suddaby (Eds.), The SAGE Handbook of Organizational Institutionalism (pp. 1-46). London: SAGE.

Seminar 5 Position Statement: Prof Vian Bakir

Resistance to State Mass Surveillance:  The Trumping of Civil Society by the Global Digital Tech Elite

Prof. Vian Bakir

Political Communication & Journalism, Bangor University

Civic and Technological Resistance to State Mass Surveillance

In the DATA-PSST! Seminar on Media Agenda-Building, National Security, Trust and Forced Transparency we examined whether civic practices needed strengthening to generate a more informed public debate on the pros and cons of Snowden-revealed state mass surveillance (most participants agreed that they did). The following DATA-PSST! Seminar on Visible Mediations of Transparency explored a range of cultural practices that could constitute civic resistance to state mass surveillance, as well as querying the adequacy and desirability of such resistance. In my recent article for Media and Communication, I concluded that civic practices to counter mass state surveillance are weak, including whistle-blower protection, encouraging debate in public fora, and participatory projects such as those involving Non-Governmental Organisations (NGOs). The only evidently strong resistive practice is technological, this led by the digital tele-communications industry in their innovations to the communication platforms and devices on which state surveillance piggy-backs. Since Snowden’s revelations in 2013, as well as lobbying for changes to surveillance and transparency laws and practices, major players in the digital tech industry (e.g. Apple) have developed their encryption technologies (using end-to-end encryption) so that the state cannot compel them to disclose people’s communications. This has caused intelligence agencies to publicly express much concern about the internet ‘going dark’.

The struggle between corporations seeking to retain consumer trust in the privacy of their digital communications, and the state’s secret demands for access continues to play out in the development of the UK’s Investigatory Powers (IP) bill, currently under scrutiny in Parliament.  A few months ago, I attended a round-table policy discussion on the IP bill. I learned that the IP bill is intended to set a global gold standard for issues of data surveillance. However, tech and security companies and academics at the table expressed a wide range of concerns with the bill as it currently stood. Some noted the lack of convincing or detailed evidence provided by government that such surveillance actually helps prevent terrorism. Technology companies charged with implementing and complying with the law worried that the IP Bill’s provisions and definitions were too vague to be readily useable by them. The IP Bill continues to attract public legal criticism, for instance, the recent letter from British lawyers and legal academics to The Guardian. Concomitantly, civil servants and regulators worry that large global digital technology corporations will simply not comply with UK law.

The Anti-regulation Global Tech Elite

Field trips across 2016 to SxSW interactive in Austin, Texas, and to California’s digital tech centres, lays bare the anti-regulation stance of the US-based global technology industries. For instance, Jacquelline Fuller, director of Google’s philanthropy arm, Google.org, and Nicole Wong, Google’s Vice President and Deputy General Counsel from 2004-11, see regulation as too slow given technological progress that is so rapid that we don't know what we should be regulating. They questioned whether we should regulate how we collect data when we don't even know what the algorithms are, or what the social consensus is. The slowness of government jars with the tech companies’ mentality that when the tech breaks it needs to be fixed, and quickly. Furthermore, they see government as highly inefficient with respect to its procurement rules. Repeatedly across SXSW as I attended panels presented by industry movers and shakers and start-ups in big data, marketing, virtual reality, Internet of Things, and wearables, I heard their preferred alternative to regulation: self-regulation. However, recognising that regulation is not going to go away, they favour maximising corporate input. Their solutions proffered comprised letting big players work it out through lobbying Congress at federal and state levels, and putting a tech corps in government to improve understanding between Washington D.C. and Silicon Valley.

The Influence of the Global Tech Elite

The influence of the big tech corps cannot be underestimated. Certainly for the UK’s IP Bill, the big tech players were consulted. Formative consultation documents - the Anderson Report and the RUSI Report - consulted with The Internet Services Providers’ Association, BT, Vodafone, Facebook, Google, Microsoft, Twitter, Yahoo, Apple, BT, TalkTalk, EE, Three, Telefonica, Virgin Media, and Reform Government Surveillance (an alliance of some of the world’s most influential Internet companies).

With political-intelligence elites’ concern to dissuade telecommunications companies from making the internet ‘go dark’, it would seem that the digital tech corps’ desire to retain their customer’s loyalty remains the strongest bastion of resistance to state mass surveillance. Google, for instance, does not want its users to reduce their use of Google services, as heavier usage provides a richer digital footprint that can be sold to online advertisers. Meanwhile, companies like Apple, whose business model is based more on brand superiority than online advertising, can see that there is money to be made from privacy and data protection, hence its touting of end-to-end encryption. Technological innovations driven by the global digital tech elite, then, appear to be a stronger resistive force to state mass surveillance than civil society practices (involving whistle-blowers, the press and NGOs).

This state of affairs has profound implications for democratic health. If business models were to change, or if the founders and CEOs of the pro-privacy, global tech corps so decided, this strong technological resistance to state mass surveillance could cease. Given the weakness of civil society, this would be highly detrimental to the public accountability of political-intelligence elites.

Seminar 5 Position Statement: Prof. Mark Phythian

Surveillance and Oversight – The Intelligence and Security Committee and the Post-Snowden Debate

Prof. Mark Phythian

Politics & International Relations, Univ. of Leicester

The parliamentary Intelligence and Security Committee (ISC) has had a chequered history. However, it is too useful to government and the intelligence agencies to be replaced, and this is the secret of its resilience. At the same time, though, the ISC can be under no illusions following the mini ‘season of inquiry’ that occurred in the UK during 2015 as a consequence of the Snowden leaks. It has few friends outside of government and limited legitimacy – no surprise if legitimacy is understood as arising out of the historical effectiveness of a system in dealing with a circumscribed set of national problems.[1] It needs to up its game.

The post-Snowden mini ‘season of inquiry’ of 2015 comprised three separate inquiries that reported within a short space of time between March and July: the March 2015 report into Privacy and Security from the ISC;[2] the June 2015 report, A Question of Trust, from David Anderson QC, the Independent Reviewer of Terrorism Legislation;[3] closely followed by the July 2015 report of the Independent Surveillance Review (ISR), A Democratic Licence to Operate, set up at the instigation of then-Deputy Prime Minister Nick Clegg.[4] The Anderson report hadn’t been sought and wasn’t particularly wanted by government, but had been granted as a concession accompanying the rapid parliamentary passage of the Data Retention and Investigatory Powers Act 2014 (DRIPA) - in just four days - in July 2014. It was also the most radical of the three. It recommended that all warrants for interception should be judicially rather than ministerially authorised (although with regard to warrants relating to national security, the relevant secretary of state would have a significant role in certifying that the warrant was required for the purposes stated, in which case the Judicial Commissioner could only depart on the basis of the principles of judicial review).[5] It also recommended that these be authorised by a Judicial Commissioner of an Independent Surveillance and Intelligence Commission (ISIC), which would replace the existing system of three separate commissioners (the Interception of Communications Commissioner, the Intelligence Services Commissioner, and the Chief Surveillance Commissioner). Like the ISC earlier in the year, Anderson recommended overhauling the existing legislative framework, with the withering observation that: “RIPA, obscure since its inception, has been patched up so many times as to make it incomprehensible to all but a tiny band of initiates. A multitude of alternative powers, some of them without statutory safeguards, confuse the picture further. This state of affairs is undemocratic, unnecessary and – in the long run – intolerable.”[6]

Anderson saw ISIC as a body that would be “public-facing, transparent and open to diverse ideas (including from all sectors of the community in all parts of the UK, from other countries, from international institutions and from young people who have grown up online)”, and would draw on a wide range of expertise “from the worlds of intelligence, computer science, technology, academia, law and the NGO sector” and participate in conferences, “invite dialogue”, be accessible to traditional media and have an active social media presence.[7]

This was a long way from the culture of oversight adopted over a long period by the ISC, notwithstanding reforms and incremental improvements in its approach to openness and engagement since 2013. Anderson was aware of the limitations of the ISC, pointing out that the ISC “as an institution did not receive significant support from those making submissions to us”, with some advocating its abolition.[8] As a result, the Anderson report did not support the continuation of the ISC in its current form. While making clear the importance of some form of parliamentary oversight of intelligence, Anderson proposed that ISIC and ISC functions should not overlap – which would represent a contraction of the ISC’s remit (for example, its Privacy and Security report would have been infeasible under such an arrangement). Anderson’s report also suggested that Parliament should consider whether to maintain the ISC but strengthen it by appointing a Chair from outside the governing party or parties, whether to transfer its investigative resource to ISIC in due course, or whether to recast it as a Select Committee, possibly merged with the Defence Select Committee.[9]

The Independent Surveillance Review (ISR) panel was established by Deputy Prime Minister Nick Clegg in response to the Snowden leaks. It was chaired by Michael Clarke, Director General of the Royal United Services Institute, and contained a cross-section of leading figures from the worlds of technology, policing, intelligence and academia, including Sir David Omand, former head of MI6 and Chair of the Joint Intelligence Committee Sir John Scarlett and investigative journalist and privacy campaigner Heather Brooke. As with the Anderson report, the ISR recommended that the existing three commissioners be replaced by a single organisation, the National Intelligence and Surveillance Office (NISO), with its independence guaranteed by statute, but that the judicial commissioners who would authorise warrants should not be part of it. As with Anderson’s vision for the ISIC, public education would be a key plank of the proposed NISO’s role. The ISR report, like Anderson’s, also noted the lack of public confidence in the ISC and the problem this created in terms of intelligence and security legitimacy.

One consequence of this mini ‘season of inquiry’ is that oversight that commands public trust is now clearly accepted as being essential to the legitimacy of intelligence and security practice. As the ISR report observed:

There is certainly a problem of trust in the system of oversight, and particularly the lack of popular visibility of the oversight arrangements that currently exist. A clear and transparent new legal framework and a more coherent, visible and effective oversight regime should be the basis for a public discussion about the appropriate and constrained power the British state should have to intrude into the lives of its citizens.[10]

But does all of this suggest that the idea of parliamentary oversight is a busted flush given issues of time, complexity and lack of expertise? Do a combination of structural realities and the ISC’s past performance mean that there is a growing acceptance that parliamentary oversight is not the answer, and that primary responsibility should be transferred to lawyers whose job is, in essence, to check for compliance with legislation? For a number of years now I have been critical of the performance of the ISC, but this criticism was not an argument for downgrading legislative oversight in favour of judicial oversight. This would create clear problems – not least the risk that this becomes little more than a tick-box exercise establishing compliance with legislation when the lesson of the past (and not just in the UK) is that the law is often the problem. Moreover, oversight should be concerned with normative and policy issues (for example, look at the range of work undertaken by the Defence Committee or Foreign Affairs Committee) rather than simply ruling on legal compliance. However, posing this question does beg another one; what would adequate legislative oversight require in terms of staffing and support?

The current ISC, which came together in September 2015, post-dates the regime criticised by Anderson and the ISR. It may be that these processes and reports, together with the recasting of the ISC - with new chairman Dominic Grieve (interestingly, a critic of the ISC prior to the election of the coalition government in 2010) replacing the disgraced Sir Malcolm Rifkind, and with just three surviving members of the previous ISC (one of whom, Fiona Mactaggart, only joined in May 2014) – constitute a Damascene moment for its members. Confronted with intimations of its mortality, its members may seek to up their game and be more assertive. There is some evidence of this in the ISC’s response to the government’s initial investigatory powers bill, published in draft form in late 2015 to enable pre-legislative scrutiny. The ISC was critical:

Taken as a whole, the draft Bill fails to deliver the clarity that is so badly needed in this area. The issues under consideration are undoubtedly complex, however it has been evident that even those working on the legislation have not always been clear as to what the provisions are intended to achieve. The draft Bill appears to have suffered from a lack of sufficient time and preparation.[11]

Then again, there are structural reasons for believing that the ISC remains hobbled by design, as Anderson seemed to recognise. It is still chaired by a member of the governing political party and has lost key expertise with the departure of members such as Lord Butler, which it is not immediately clear it has replaced. However, it is worth making a final point; the development of intelligence oversight is not a linear process leading, inevitably, to some Francis Fukuyama-style ‘end of history’ moment at which point the ideal form will have been arrived at. It is, rather, a contested process with ebbs and flows – reflecting the fact that executive, agencies, legislators and public have different understandings of the purpose of oversight and, consequently, different expectations of it. It is more useful to consider the emerging legislative framework as representing another episode in this history of contestation rather than arrival at a mythical end-state for oversight and accountability of intelligence.

---

[1] As per the definition in E. C. Hargrove, The Power of the Modern Presidency (New York: Knopf, 1974), p.20.

[2] Intelligence and Security Committee, Privacy and Security: A Modern and Transparent Legal Framework (HC 1075 - London: HMSO, March 2015).

[3] David Anderson, QC, A Question of Trust: Report of the Investigatory Powers Review (London, HMSO, June 2015) [henceforward ‘Anderson report’], https://terrorismlegislationreviewer.independent.gov.uk/a-question-of-trust-report-of-the-investigatory-powers-review/

[4] Independent Surveillance Review, A Democratic Licence to Operate (London, Royal United Services Institute, July 2015) [henceforward ‘ISR report’].

[5] Anderson report, paras. 15.30, 15.47.

[6] Ibid, para.35.

[7] Ibid, para.111.

[8] Ibid, para.12.93.

[9] Ibid, paras. 118-120. The director of Liberty, Shami Chakrabarti illustrated the lack of support for the ISC in welcoming the publication of the Anderson report: “This thoughtful report is in sharp contrast with the defensive whitewash from the discredited intelligence and security committee of the last parliament...While we don’t agree with all his conclusions, Mr Anderson’s intervention could be the beginning of re-building public trust in surveillance conducted with respect for privacy, democracy and the law.” Richard Ford, ‘Cameron in Showdown over Spying’, The Times, 12^th June 2015.

[10] ISR Report, para. 5.30.

[11] ISC, Press Release, 9^th February 2016.

Seminar 5: Tackling Transparency Beyond the Nation-State

Tackling Transparency Beyond the Nation-State

 31 March 2016

 Cardiff University
Law Building, Rm 1.29
Museum Avenue, CF10 3AX,

10am to 5pm

Your seminar leaders, Madeline Carr and Claudia Hillebrand, welcome you to the fifth of six seminars in the ESRC-funded DATA-PSST! seminar series.

Advanced technologies and the increased interconnectedness of state and private actors across borders allow for a constant flow of data around the globe. This provides opportunities for law enforcement and intelligence authorities to monitor terrorist suspects and criminals – but also the ordinary citizen. In the context of counter-terrorism, this kind of surveillance often also involves cooperation between states but also with private enterprises, such as banks and other financial authorities, as well as companies like Google and Facebook. Given the cross-border and cross-sector nature of these practices, questions arise about the utility of trying to regulate and control data-sharing at the national level only. In addition, tensions emerge between expectations of sovereign rights and responsibilities on the one hand and regional and global cooperation on the other hand. Increasingly, regional actors, such as the EU and the Council of Europe, and also the UN are involved in regulating data-sharing, protecting privacy and challenging excessive surveillance by security authorities.

This seminar will focus on the ongoing attempts at the European and international level to regulate, confine and oversee the global flow of information. To do so, it brings together scholars and practitioners of international relations, political science, media, international law and human rights to examine key debates, analyse strengths and weaknesses of existing mechanisms of regulation and oversight and explore the question of which political level is most suitable to fulfill such a demanding mandate.

Some of the subsidiary questions that will frame this seminar include:

-       How are concepts of borders, states and territory relevant in the practice of safeguarding human rights online?

-       What are the key regional and global mechanisms in place for regulating data-sharing, protecting privacy and challenging excessive surveillance by security authorities? How are these being adhered to, negotiated and/or contested?

-       What tensions have emerged in the UK and the EU in the context of attempts to impose international controls on data-sharing and privacy safeguards?

The seminar will be organized around these key questions and all participants will be able to actively contribute to the debate. In addition to short keynote talks, the seminar will function by means of position statements (which you can find on this blog) and roundtable discussions (a summary of which will be posted on the DATA-PSST website).

Two Roundtables / open discussions

1.     Surveillance and transparency in the international sphere 

2.     Strengths and weaknesses of existing oversight regimes and regulatory mechanisms

Schedule 

10 - 10.15:       Registration

10.15 - 10.30: Summary of previous seminars (Vian Bakir) followed by introduction to today’s seminar (Madeline Carr/Claudia Hillebrand) 

10.30 - 11.00: Peter Mantello and Joseph Connor (10 mins each) 

11.00 - 11.30: Eneken Tikk-Ringas and Rocco Bellanova (10 mins each) 

11.30 - 12.00: Coffee 

12.00 - 1.15:    Roundtable 1: Surveillance and transparency in the international sphere 

1.15 - 2.15:      Lunch 

2.15 - 2.45:      Gilad Rosner (15-20 mins) 

2.45 - 3.15:      Peter Gill and Mark Phythian (10 mins each) 

3.00 - 3.30:      Coffee 

3.30 - 4.30:      Roundtable 2: Strengths and weaknesses of existing oversight regimes and regulatory mechanisms

4.30 - 5:00       Plenary

5.30 - 8:00       DRINKS AND NO HOST DINNER - 29 Park Place.

Location

The seminar will be held at:

Cardiff University
Law Building, Rm 1.29
Museum Avenue, CF10 3AX

You can enter the Law Building either from Park Place or Museum Avenue. It’s a short(ish) walk from Central Station but you can get a train to Cathays Station if you prefer (see map). There is some on street parking available but it’s metered.