Access Now et al. (IPB0109)

●       Thank you for this opportunity to provide comments. This written evidence is submitted on behalf of Access Now, Advocacy for Principled Action in Government, the Center for Financial Privacy and Human Rights, the Electronic Frontier Foundation, New America’s Open Technology Institute, Restore the Fourth, and TechFreedom. We are human rights, technology policy, and civil society organisations based out of or doing work in the United States and internationally.

●       Communications surveillance interferes with individuals’ human right to privacy, as well as other human rights recognised in international law and policies. Accordingly, laws that permit communications surveillance must be necessary and proportionate.

●       In particular, we note the close partnership between the surveillance agencies operating within the United Kingdom and the United States, as demonstrated by the string of investigative reports starting on June 6, 2013 and known colloquially as the “Snowden Revelations.” While it is unclear the exact terms by which surveillance information is disseminated between the United Kingdom and the United States, it is clear that agencies in both nations work in close concert to conduct surveillance around the world. We know that information collected by UK intelligence agencies, including information about U.S. citizens and foreign nationals, is shared in secret with the U.S. National Security Agency to be held and analysed.[1] Additionally, the extraterritorial effect of the Draft Investigatory Powers Bill means that its provisions are also likely to have direct impact on the signers of this Comment.

●       Accordingly, we recommend that the consideration of the Draft IP Bill be given adequate time, and not be rushed. Each provision should be provided with adequate attention and care. The surveillance authorities granted in the Draft IP Bill will subject millions, if not billions, of internet users around the world to surveillance by the UK intelligence and law enforcement agencies. In her introduction to the Draft Bill, the Home Secretary notes:

The draft Investigatory Powers Bill that has been published for pre-legislative scrutiny and public consultation builds on their recommendations to bring together all of the powers available to law enforcement and the security and intelligence agencies to acquire communications and communications data and make them subject to enhanced, consistent safeguards.

However, the period for public consultation for the Draft, which numbers close to 300 pages including explanatory text and notes, has not given sufficient time to independently consider each provision as well as the interplay between separate authorities.

●       A new investigatory powers law must include suitably specific and clear authority as to give notice to the public of the circumstances when they may be subject to surveillance and provide for independent judicial review and robust human rights protections and safeguards, as well as transparency and accountability.

●       The Joint Committee on the Draft Investigatory Powers Bill (the “Draft IP Bill”) has requested answers to several questions to inform its analysis of the draft bill. We provide answers in brief here. If you would like additional information, we encourage you to reach out to the signatories of this comment.

1. Overarching / Thematic Questions

1. Are the powers sought necessary? Has the case been made, both for the new powers and for the restated and clarified existing powers?

2. The International Principles on the Application of Human Rights to Communications Surveillance defines the standard of necessity:

Surveillance laws, regulations, activities, powers, or authorities must be limited to those which are strictly and demonstrably necessary to achieve a legitimate aim. Communications Surveillance must only be conducted when it is the only means of achieving a legitimate aim, or, when there are multiple means, it is the means least likely to infringe upon human rights. The onus of establishing this justification is always on the State.[2]

The European Court of Human Rights has explained that the secret surveillance authorities are amongst those that receive a greater level of scrutiny.[3] The Home Office has not explained the necessity of the exceedingly broad surveillance authorities that it seeks to renew or instate in the Draft IP Bill. Rather, the Draft IP Bill appears to seek all foreseeable surveillance authorities, and grants their use with little public oversight as to how the Secretary of State interprets their standards for use by the intelligence agencies, public agencies, or law enforcement agencies.

3. Are the powers sought legal?

4. “The State must not adopt or implement a measure that interferes with these rights in the absence of an existing publicly available legislative act, which meets a standard of clarity and precision that is sufficient to ensure that individuals have advance notice of and can foresee its application.”[4]

5. The Draft IP Bill fails to provide this requisite level of clarity.[5] Additionally, it fails to include a “sunset” provision that would require Parliament review the authorities granted periodically to ensure their continued need or the ability to incorporate additional safeguards.

6. Are the powers compatible with the Human Rights Act and the ECHR?

7. No -- nor are they consistent with the right to privacy even more deeply rooted in British traditions[6] The Draft IP Bill violates several provisions of the European Convention on Human Rights (“ECHR”), including the Right to respect for private and family life (Article 8), Freedom of thought, conscience, and religion (Article 9), Freedom of expression (Article 10), and Freedom of assembly and association (Article 11), among others.

8. In a recent ruling of the European Court of Human Rights in the case Roman Zakharov v. Russia, the Court found Russia’s system of secret interception of mobile telephone communications to interfere with Article 8 of the ECHR.[7] The Court explained that, in order to be compatible with the ECHR, secret surveillance had to be clear on its face, supervised by a truly independent authority that is open to public scrutiny, and provide for notice and an opportunity to challenge the surveillance as soon as practicable.[8] The Draft IP Bill is inconsistent with this standard.

9. Is the requirement that they be exercised only when necessary and proportionate fully addressed? Are they sufficiently clear and accessible on the face of the draft Bill?

10. We appreciate the Draft IP Bill’s application of the “necessary and proportionate” standard, but the bill should specifically define these terms in accordance with international human rights law and policy.[9] Bulk collection is fundamentally inconsistent with the “necessary and proportionate” standard. Further, the Draft IP Bill fails to provide for transparency into, or independent judicial approval of, the Secretary’s interpretation and application of those standards. Finally, the purposes for which surveillance can be “necessary and proportionate” are also overbroad, for example, “to assist investigations into alleged miscarriages of justice,” which is also facially unclear as to what activities would be covered.

11. Is the legal framework such that CSPs (especially those based abroad) will be persuaded to comply?

12. No. Communications Service Providers (CSPs) must be given the ability to respect the rights of their users and to object to government orders that interfere with those rights. The Draft IP Bill fails to provide for sufficient mechanisms for CSPs to appeal overbroad or objectionable orders and fails to give CSPs sufficient rights to inform users of orders that implicate their personal information. CSPs risk being sued in their own states for complying with these orders if they are not consistent with local law. Additionally, provisions requiring extra-territorial application of broad authorities -- including those that may require the removal of electronic protections of user data, such as encryption -- are particularly troubling and may make it harder for both large and small companies to protect their users.

13. Are the powers sought workable and carefully defined? Are the technological definitions accurate and meaningful (e.g. content vs communications data, internet connection records etc.)?

14. As explained above, the Draft IP Bill fails to provide adequate clarity as to the authorities that it authorises, and for many provisions the authorities described are over-broad and lack adequate transparency or oversight. In addition, the definitions are inadequately precise.

15. For example, the broad definition of what constitutes “communications data,” and, in particular, an “internet connection record,” fails to consider either the level to which collection of internet records is invasive or the substantially different process that must be taken for collecting that information versus obtaining telephone communications data. The line between communications content and communications data on the internet is not clear, and authorities to collect internet connection records must take this into account.

16. The powers of bulk and targeted equipment interference, specifically described in statute for the first time in this Bill, is granted with a broad set of permitted targets, and with no limits on technical scope or consideration for the effect on the services of CSPs required to comply with the warrants, nor the effect on their customers’ security and privacy.[10]

17. Does the draft Bill adequately explain the types of activity that could be undertaken under these powers?

18. No. Several provisions of the Draft IP Bill fail to adequately define the different activities that the Secretary could authorise public agencies, law enforcement agencies, or intelligence agencies to pursue under their authority. Additionally, several provisions of the bill contain a broad and undefined “catch-all” which authorises or requires from third-parties, “any conduct which it is necessary to undertake in order to do what is expressly authorised or required” by the warrant—including, for example, “the interception of communications not described in the warrant.”[11]

19. Is the wording of the powers sustainable in the light of rapidly evolving technologies and user behaviours? Overall is the Bill future-proofed as it stands?

20. While the language of a law should indeed be “technology neutral” in order to protect against developments that render its provisions inadequate or irrelevant, the Draft IP Bill goes too far by providing inadequate definitions of key terms, including internet connection records, and overbroad and unspecific authorisations, including the provisions on filtering. In addition, provisions that compel CSPs to tamper with their own infrastructure in order to provide “technical capabilities” place no external limits on what new capabilities might be might be imposed on service providers[12]. The bill’s targeted equipment interference provisions places an ad hoc obligation on providers to comply with individual demands from the intelligence services, military intelligence or law enforcement to transform or even undermine the functionality of their service,[13] with no oversight by the IP Bill’s own Technical Advisory Board, or possibility for CSPs or their customers to challenge these secret changes.

21. Are the powers sufficiently supervised? Is the authorisation process appropriate? Will the oversight bodies be able adequately to scrutinise their operation? What ability will Parliament and the public have to check and raise concerns about the use of these powers?

22. The Draft IP Bill fails to provide for adequate supervision or oversight of the provided-for authorities. In fact, the provided-for level of review is far below even the perfunctory review provided by the Foreign Intelligence Surveillance Court (“FISC”) in the United States, a body that has received international criticism for its secret deliberations and decisions despite its independence. Responding in part to this criticism, the U.S. Congress recently increased the transparency and accountability of the FISC, providing for unclassified publication of substantial Court decisions and the appointment of amicus curiae to provide additional independent legal or technical expertise. No equivalent resources or requirements are provided for the judicial commissioners or the Investigatory Powers Commissioner.

2. Selected Specific Questions

Interception

23. Are there sufficient operational justifications for undertaking (a) targeted and (b) bulk interception?

24. The targeted interception envisioned by the Draft IP Bill is already far from the layman’s definition of “targeted,” and may include not only a person, organisation, or single set of premises,[14] but may also include “a group of persons who share a common purpose or who carry on, or may carry on, particular activity,” as well as “more than one person or organisation, or more than one set of premises, where the conduct authorised or required by the warrant is for the purposes of the same investigation or operation.”[15] With this, already very broad, authority to conduct interception, it is not clear why additional “bulk” authority is necessary, or why the additional safeguards for bulk cannot or should not be applied to the “targeted” interception. Bulk interception violates core privacy rights guaranteed in international law.[16] Bulk interception is inherently disproportionate and its authorisation and, as implemented in the Draft IP Bill, would have excessive impact on people outside of the UK.[17]

25. Is the proposed process for authorising urgent warrants workable?

26. The Draft IP Bill allows the unilateral approval of a warrant, without the approval of a judicial commissioner so long as the person who issues the warrant considers that an urgent need exists in order to do so. This is an inadequate and inadequately specific standard, and the decision as to whether or not a situation is “urgent” is not subject to any judicial review.[18] This process fails to provide sufficient human rights protections or adequate oversight.

Data Retention

27. Do the proposed authorisation regime and safeguards for bulk data retention meet the requirements set out in the CJEU Digital Rights Ireland and the Court of Appeal Davis judgments?

28. The Draft IP Bill authorises mandates for providers to retain personal data up to twelve months.[19] The Investigatory Powers Commission can also deem information or documents appropriate for retention.[20] Data retention mandates infringe upon individual privacy and chill the exercise of human rights including freedom of expression and freedom of association.[21] This infringement is particularly pronounced in situations without meaningful limits to the scope of the data that provider can be compelled to retain. The current Draft IP Bill does not contain any finding or evidence as to whether a legal review was conducted on whether – and how – these proposed measures were in conformity with rules articulated by the Court of Justice of the European Union (hereinafter, “CJEU”).[22]

Equipment Interference

29. Should the security and intelligence services have access to powers to undertake (a) targeted and (b) bulk equipment interference?

30. “Equipment interference” carries with it the implication that the power is restricted to impeding normal equipment operations, but may also include adding unexpected new functionality to a device. Under targeted and bulk equipment warrants, telecommunication providers must obey any instructions given by or on behalf of the person to whom the warrant is addressed, and are bound by a gag order, which prevents them from conferring with others before executing the orders given by the warrant holder.[23] The broad scope of machine interference warrants, the range of affected providers who may be compelled to assist, and the large set of potential targets, make this power one of most potentially intrusive in the new bill. Yet it lacks many of the review and oversight mechanisms attached to other, narrower powers.

31. Are the safeguards for such activities sufficient?

32. Not even remotely. Given the Draft IP Bill’s weak oversight provisions, these powers would undermine trust in a broad range of online services, technology companies, academic research, and government services.

Oversight

33. Would the proposed Judicial Commission have sufficient powers, resources and independence to perform its role satisfactorily?

34. Under the Draft IP Bill, the judicial commissioners would not be fully independent of the Executive—the same entity whose authorities will be responsible for conducting much of the surveillance authorised by the Draft IP Bill. The commissioners would be appointed by and serve at the pleasure of the Prime Minister. Additionally, the head judicial commissioner, known as the Investigatory Powers Commissioner (“IPC”), would be given the power to remove other judicial commissioners unilaterally (in consultation only with the Prime Minister) on grounds that are not set out in the legislation.[24]

35. Are the new arrangements for the Investigatory Powers Tribunal including the possibility of appeal adequate or are further changes necessary?

36. Even the limited oversight provided for by the judicial commissioners is undermined by the grant of authority for the IPC to review final decisions of a judicial commissioner that fail to approve a sought-after warrant.

3. Conclusion

37. This comment is signed by Access Now, Advocacy for Principled Action in Government, the Center for Financial Privacy and Human Rights, the Electronic Frontier Foundation, New America’s Open Technology Institute, Restore the Fourth, and TechFreedom.[25]

21 December 2015