BULK POWERS IN THE INVESTIGATORY POWERS BILL:

Transcription

1 BULK POWERS IN THE INVESTIGATORY POWERS BILL: The Question Of Trust Remains Unanswered September /10

2 Introduction We are on the brink of introducing the most pervasive and intrusive surveillance legislation of any democratic country in the world. The Investigatory Powers Bill sought to answer important questions about the place that modern and highly intrusive surveillance capabilities have in a democratic society, questions that were raised by the Edward Snowden disclosures in 2013 and subsequent reports produced by David Anderson QC, the Royal United Services Institute (RUSI) and the Intelligence and Security Committee (ISC) in But just a matter of weeks before the new law is enacted, significant questions of trust remain unanswered. This paper highlights some of the key flaws Privacy International sees in the current incarnation of the Investigatory Powers Bill, and urges the House of Lords to put the brakes on the bulk powers, about which many important questions remain unanswered. In this paper we set out how: the Bill fails to provide sufficient clarity, which was promised at the outset of the legislative process, to alleviate confusion around the UK s surveillance laws; the Bill has not advanced transparency to the degree needed, still leaving most of the public in the dark about the extent of the surveillance powers; significant questions remain about the Bill s safeguards and oversight regime; and major questions also remain regarding the bulk powers, even in light of David Anderson QC s recent report. The points we raise lead to a single recommendation for consideration by the House of Lords. Because of the significant questions that remain unanswered, we urge the House of Lords to introduce a series of amendments that will remove the bulk powers contained in the Bill. 2/10

3 1. The proposed Bill adds to our already confusing and impenetrable surveillance laws In an oft-quoted section of his 2015 report on the investigatory powers regime, David Anderson QC declared: Obscure laws and there are few more impenetrable than RIPA and its satellites corrode democracy itself, because neither the public to whom they apply, nor even the legislators who debate and amend them, fully understand what they mean. 1 Anderson went on to say that many of the current surveillance laws are so baldly stated as to tell the citizen little about how they are liable to be used. 2 The Investigatory Powers Bill was thus introduced with a goal of improving transparency and enhancing the safeguards that apply to modern surveillance. 3 Unfortunately, it has fallen far short of those goals. The Bill is over two hundred pages long, and filled with vague language, confusing definitions and catch-all powers, like national security notices, that leave even experts confused as to what activities the Bill may permit in the future. 4 The Bill also leaves in place most of the obscure laws criticised by Anderson, including significant portions of the Regulation of Investigatory Powers Act 2000 (RIPA), and the Intelligence Services Act 1994 (ISA). Indeed, the Intelligence and Security Committee (ISC) has criticised the Bill for encompassing only certain types of equipment interference (EI), while allowing different forms of EI... [to] continue to sit under the broad authorisations provided to the Agencies under the [ISA]. 5 In the past, the intelligence services have demonstrated their predilection for using the law that is most convenient, not necessarily the one that is most transparent. 6 In this context, leaving RIPA, the ISA and other related acts in place while adding the Investigatory Powers Bill into the mix will only increase confusion. 2. The Government has failed to be transparent with the public about how it will intrude on their privacy The public does not understand or give consent to the Bill It is important to recognise that the Investigatory Powers Bill is a materially different piece of legislation to the one that the Conservative Party s 2015 election manifesto indicated would be put forward. 7 The manifesto states we continue to reject any suggestions of sweeping, authoritarian measures that would threaten our hard-won freedoms. 8 Despite this assertion, the bulk powers that are the foundation of this Bill amount to nothing short of a mass surveillance apparatus, and suspicionless collection and retention of the personal data of an entire population is a profound and dangerous antithesis to democratic principles and values A Question of Trust: Report of the Investigatory Powers Review, June A Question of Trust: Report of the Investigatory Powers Review, June (a) Draft Investigatory Powers Bill, November 2015, Forward from the Home Secretary See, for example, Graham Smith, The content v metadata contest at the heart of the Investigatory Powers Bill 26 May 2016, available at Intelligence and Services Committee, Report on the draft Investigatory Powers Bill, 9 February 2016, Privacy International, New documents reveals that GCHQ and MI5 stretched law to breaking point 6 June 2016, available at The Conservative Party Manifesto 2015, available at The Conservative Party Manifesto 2015, p. 61 3/10

4 Indeed, the manifesto recognises that the power that should be maintained is the ability of the authorities to intercept the content of suspects communications, while continuing to strengthen oversight of the use of these powers. 9 Yet, Part 6, Chapter 1 of the Bill is devoted to bulk interception, which inherently involves the interception of communications of people both abroad and in the UK who are not suspected of any crime. The far-reaching bulk powers contained within the Bill affect literally everyone in the UK but public knowledge of the Bill - and even a rudimentary understanding of its impact on the privacy of everyone s personal data - is extremely low. According to a ComRes poll commissioned by Liberty in June 2016, 72% of people polled have either never heard of the Investigatory Powers Bill or know nothing about it. 10 In the same poll, ninety percent of the public either said it is only acceptable for the Government to access and monitor records of their s, text messages, phone calls and online browsing history if they are suspected of or have committed a crime or say this practice is never acceptable. Most fundamentally, nine out of 10 British adults polled believe state surveillance powers proposed by the Investigatory Powers Bill are not acceptable. A manifesto commitment that has been greatly exceeded and a lack of public understanding and support for the Bill demonstrate the Government s failure to secure a proper democratic mandate for a law that rewrites the contract between the state and the citizen. Powers vs programmes The conversation around the Bill has also suffered from a failure to address some of the ways in which the bulk powers may operate in practice. While the police and intelligence agencies capabilities were revealed in broad strokes with the introduction of the Bill, many questions about how those powers actually operate remain unanswered. Despite the publication of hundreds of pages of draft legislation, explanatory notes and codes of practice, the Government has explained very little to Parliament or the public about the nature of the bulk operations. As such, the legislation remains abstract, and lacks clarity and transparency about the specific capabilities Parliament is on the verge of sanctioning. Indeed, it may only be through examining known operational capabilities that a full understanding of the bulk powers can be ascertained. For instance, the Snowden disclosures reveal that through a programme codenamed Optic Nerve, the Government Communications Headquarters (GCHQ) had collected screen captures of 1.8m Yahoo webcam users. 11 Such widespread collection was disturbing both because of its scale and the extremely private and intimate nature of some of the images obtained, which were described as containing substantial quantities of sexually explicit communications The Conservative Party Manifesto 2015, p. 65 Liberty, Ninety per cent of Brits believe Government surveillance powers contained in new Snoopers Charter are not acceptable, new poll finds 5 June 2016, available at Ackerman and Ball, Optic Nerve- millions of Yahoo webcam images intercepted by GCHQ, The Guardian 27 February 2014 Ackerman and Ball, Optic Nerve- millions of Yahoo webcam images intercepted by GCHQ, The Guardian 27 February /10

5 Under the Investigatory Powers Bill, it is very possible that a programme like Optic Nerve might continue pursuant to a bulk interception warrant. The debate around the Bill has provided no assurances this won t happen, in part because of the Government s continuing policy of neither confirming nor denying most of the Snowden disclosures. The Government has not declared to the public that it wants the ability to scoop up their webcam footage, even if they re not suspected of any crime. Does the public accept that the state should have such a deep reach into their personal lives? Is this the type of power that we are comfortable sanctioning in our democratic society? Similar questions should be asked with regard to many other revealed programmes, including two examples code-named Muscular and Karma Police. Under Muscular, GCHQ, in cooperation with the US National Security Agency (NSA) infiltrated the private fibre optic cables linking the data centers of Yahoo and Google in order to obtain their users private data and communications. 13 Such activity, directed at overseas companies, might now be authorised under a bulk equipment interference warrant. Under Karma Police, GCHQ sought to map the web-browsing habits, online interactions (including messenger service chats and s) and locations of almost anyone who uses the internet. 14 GCHQ did this by collecting and storing billions of communications data records. Bulk acquisition and bulk personal datasets warrants could allow GCHQ to continue this work. The question is, should they? Does the public understand this and accept this? These questions have not been answered. 3. Safeguards remain weak The kind of pervasive and deeply intrusive surveillance capabilities in the Investigatory Powers Bill must have the most rigorous and independent authorisation and oversight possible. But the standards that have been proposed fall far short of this. We provide two of the most pressing examples here. Judicial authorisation The proposed judicial authorisation scheme is far from world leading. While posited as a double lock authorisation, it is in truth a single broken lock. The Secretary of State retains the power to issue warrants. While Judicial Commissioners approve this decision, there remains a lack of clarity regarding the scope of their review. 15 The passage of the Investigatory Powers Bill would continue to make the UK an outlier among other democratic countries and the only state in the Five Eyes Alliance (which also includes the US, Australia, Canada, and New Zealand) that does not vest the full power to approve surveillance activities in the judiciary. It flies in the face of Gellman and Soltani, NSA infiltrates links to Yahoo, Google data centers worldwide, Snowden documents say, The Washington Post 30 October 2013 Ryan Gallagher, From Radio to Porn, British Spies Track Web Users Online Identities, The Intercept 25 September 2015 See Justice, Investigatory Powers Bill 2016 Briefing for House of Commons Second Reading, March 2016, p. 3, available at Bill-2R-Briefing-11-March-2016-FINAL.pdf 5/10

6 Anderson s explicit recommendation in A Question of Trust that the warrant-issuing powers currently vested in the Secretary of State... be exercised only by Judicial Commissioners [emphasis added]. 16 Thematic warrants are problematic - and Anderson agrees Anderson s review repeatedly raises concerns about the use of thematic warrants for the supposed targeted interception and equipment interference powers, which respectively authorise interception or hacking within the United Kingdom. Under a thematic warrant, the Secretary of State and Judicial Commissioner will not approve each individual target of surveillance. Instead law enforcement and the security and intelligence agencies may choose their targets without additional sign-off. Anderson therefore notes that thematic warrants have some of the potential range of bulk warrants but without the same safeguards. 17 Anderson similarly criticises thematic EI warrants, which he notes effectively import[ ] an alternative means of performing bulk EI, with fewer safeguards. 18 To be clear, thematic warrants, like bulk warrants, can never have effective safeguards. They lack any element of individualised suspicion, preventing effective judicial authorisation and increasing the risk of arbitrary action The case for the Bulk Powers still has not been made Are the bulk powers necessary and proportionate? Much stock has been placed in David Anderson s review of the bulk powers, which was released in August Anderson s review sought to address whether there is an operational case for the bulk powers in the Investigatory Powers Bill. However, his analysis does not answer the critical question of whether an operational case justifies the significant privacy intrusions that the powers entail. As the European Court of Human Rights has eloquently stated, there exists the risk that a system of secret surveillance set up to protect national security may undermine or even destroy democracy under the cloak of defending it. Accordingly, the state must always balance its interest in protecting its national security through secret surveillance measures against the seriousness of the interference with [the] right to respect for... private life. 20 International legal authorities are clear on why bulk powers fail the tests of necessity and proportionality. By their very nature, the bulk powers place very large groups of innocent people under surveillance without any suspicion whatsoever. Under the proposed Bill, the UK Government will not be required to specify or target their surveillance toward the communications, data or equipment of a particular person, premises or even an organisation David Anderson Q.C. Report of the Bulk Powers Review, 14.95(b); see also id. at Recommendation 22 ( Specific interception warrants, combined warrants, bulk interception warrants and bulk communications data warrants should be issued and renewed only on the authority of a Judicial Commissioner. ); Liberty s briefing on the Investigatory Powers Bill for Report Stage in the House of Commons 2016, Liberty, available at s%20briefing%20on%20the%20 Investigatory%20Powers%20Bill%20for%20Report%20Stage%20in%20the%20House%20of%20Commons.pdf David Anderson Q.C. Report of the Bulk Powers Review, August 2016, 2.10, 2.12, available at David Anderson Q.C. Report of the Bulk Powers Review, August 2016, para. 2.56, available at, See Statement of Facts and Grounds, The Queen on the application of Privacy International v. Investigatory Powers Tribunal, 9 May 2016, available at Szabo and Vissy v. Hungary 12 January , available at AND-VISSY-v-%20HUNGARY.pdf 6/10

7 In 2014, the UN High Commissioner on Human Rights stated that [m]ass or bulk surveillance programmes may... be deemed to be arbitrary, even if they serve a legitimate aim and have been adopted on the basis of an accessible legal regime and that it will not be enough that the measures are targeted to find certain needles in a haystack. 21 That same year, the UN Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism, Ben Emmerson QC, stated it is incompatible with existing concepts of privacy for States to collect all communications or metadata all the time indiscriminately and that [t] he very essence of the right to the privacy of communication is that infringements must be exceptional, and justified on a case-by-case basis. 22 Recently, in 2016, the UN High Commissioner on Human Rights reiterated that [m]ass secret surveillance is not permissible under international human rights law, as an individualised necessity and proportionality analysis would not be possible in the context of such measures. 23 The European Court of Human Rights has similarly found that a government, in authorising surveillance, must be capable of verifying the existence of a reasonable suspicion against the person concerned, in particular, whether there are factual indications for suspecting that person of planning, committing or having committed criminal acts or other acts that may give rise to secret surveillance measures, such as, for example, acts endangering national security. 24 It must also ascertain whether the requested interception meets the requirement of necessity in a democratic society, as provided by Article 8 and 2 of the [ECHR], including whether it is proportionate to the legitimate aims pursued, by verifying, for example whether it is possible to achieve the aims by less restrictive means. 25 The European Court concluded that an authorisation for surveillance must identify a specific person or a single set of premises in order to facilitate the necessity and proportionality analysis. 26 No case for bulk hacking The Government s operational case for bulk equipment interference, more commonly known as bulk hacking, is a purely hypothetical one. As Anderson himself notes in his review [t]he entire debate about [bulk hacking s] utility is... focused on the [security and intelligence agencies ] assessments of future developments in technology, on extrapolation from the use made of other powers, and on hypothetical case studies. 27 What is not hypothetical is the serious security implications of bulk hacking. Hacking, by its very nature, exploits weaknesses in software and hardware used by millions of people. It therefore incentivises the state to maintain security vulnerabilities that allow any attacker - whether GCHQ, another country s intelligence agency or a cyber criminal - potential access to the devices of large swathes of people as well as access to network infrastructure upon which we depend for financial and other everyday transactions UN High Commissioner for Human Rights, The right to privacy in the digital age, A/HRC/27/37, 30 June , available at Report of the UN Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism, A/69/397, 23 September 2014, available at N14/545/19/PDF/N pdf?OpenElement UN High Commissioner for Human Rights, Report on best practices and lessons learned on how protecting and promoting human rights contribute to preventing and countering violent extremism, A/HRC/33/29, 21 July 2016, available at Zakharov v Russian Federation, [GC], No /06, 4 December 2015, 260 Zakharov v Russian Federation, [GC], No /06, 4 December 2015, 261 Zakharov v Russia 47143/06 (4 December 2015) at David Anderson Q.C. Report of the Bulk Powers Review, August 2016, at 7.1, available at 7/10

8 While Anderson was perfectly willing to accept hypothetical cases about the utility of bulk hacking, he refused to engage in what he described as allegations... about the potential of [hacking] to create security vulnerabilities or leave users vulnerable to damage. 28 These security implications are well-documented by the technology and security community, 29 and are fundamental to an assessment of the utility of bulk hacking. If bulk hacking produces weaknesses in devices, systems, and networks, which the intelligence and security agencies are also tasked with protecting, are these powers really operationally effective? Questioning the case for domestic bulk acquisition As Anderson himself points out, in the US, the Privacy and Civil Liberties Oversight Board (PCLOB), an independent bipartisan agency, concluded that there is no operational case for the bulk telephone records program operated by the National Security Agency (NSA) under Section 215 of the USA PATRIOT Act. Anderson admits that this program has obvious similarities with the bulk acquisition power in the IP Bill. 30 In particular, both programmes authorise the bulk collection of domestic communications data. And in PCLOB s own words: [W]e have not identified a single instance involving a threat to the United States in which the program made a concrete difference in the outcome of a counterterrorism investigation. Moreover, we are aware of no instance in which the program directly contributed to the discovery of a previously unknown terrorist plot or the disruption of a terrorist attack. 31 Astonishingly however, Anderson dismisses PCLOB s findings on the basis that [t]he nature of the communications..., the types of provider from whom it is collected and the categories of records collected are more limited in the US context. 32 According to PCLOB, the NSA was acquiring a massive number of calling records from telephone companies each day, potentially including the records of every call made across the nation. 33 And PCLOB s findings point to no fundamental limitations to bulk acquisition powers; at no point does it suggest that the bulk telephone records program would be effective if only it were expanded further. We believe that the same conclusion is warranted for the domestic bulk acquisition powers in the Investigatory Powers Bill. Other flaws in Anderson s review Anderson s review had other methodological weaknesses that have led us to question his conclusions. Whereas Anderson relied on three team members David Anderson Q.C. Report of the Bulk Powers Review, August 2016, at 7.26, available at For example, see Expert report of Professor Ross Anderson, Privacy International et al. v. Secretary of State for Foreign and Commonwealth Affairs et al, IPT/14/85/CH, 14/ /CH, available at org/sites/default/files/anderson_ipt_expert_report_2015_final.pdf David Anderson Q.C. Report of the Bulk Powers Review, August 2016, 3.50, available at Privacy and Civil Liberties Oversight Board, Report on the Telephone Records Program Conducted under Section 215 of the USA PATRIOT Act and on the Operations of the Foreign Intelligence Surveillance Court, 23 January 2014, p. 11, available at David Anderson Q.C. Report of the Bulk Powers Review, August 2016, at , available at Privacy and Civil Liberties Oversight Board, Report on the Telephone Records Program Conducted under Section 215 of the USA PATRIOT Act and on the Operations of the Foreign Intelligence Surveillance Court, 23 January 2014, p. 87, available at Committee on Responding to Section 5(d) of Presidential Policy Directive 28: The Feasibility of Software to Provide Alternatives to Bulk Signals Intelligence Collection, p. vii, 2015, available at bulk-collection-of-signals-intelligence-technical-options 8/10

9 with no additional staff, PCLOB - which consists of five members - depends on a permanent staff of approximately 20 employees, including staff attorneys and security and technology specialists. Anderson also speaks highly of the US National Academy of Sciences (NAS) committee, which was tasked with considering alternatives to bulk collection by President Barack Obama in January The NAS Committee consisted of individuals with expertise in national security law; counterterrorism operations; privacy and civil liberties as they relate to electronic communications; data mining; large-scale systems development; software development; Intelligence Community (IC) needs as they relate to research and development; and networking and social media. 34 They were assisted by a staff drawn primarily from the Computer Science and Telecommunications Board, which provides independent advice to the federal government on technical and public policy issues related to computing and communications. By contrast, Anderson s team was small and under resourced. Serious questions have also been raised about their independence, as the team consisted of a former Director of Technology and Engineering at GCHQ, a former Director of intelligence at the NCA, and a barrister regularly instructed by the Treasury. Anderson and his small team relied heavily on secret briefings by the government, particularly the security and intelligence agencies, with only limited input from other stakeholders, and held no public hearings. His review considered a number of case studies selected by MI5, MI6 and GCHQ and as Anderson himself states he has seen only a small sample of the SIAs work. 35 In comparison, PCLOB received extensive briefings from experts across diverse fields, including government officials, academics, civil liberties advocates, technology and communications companies, and trade associations. In addition, PCLOB held multiple public hearings, at which such experts testified. Like PCLOB, the NAS Committee held extensive briefings and public hearings, consulting with a diverse range of experts. And their report underwent a rigorous review process from a similarly diverse panel of experts. Finally, it is worth noting the short space of time allocated to Anderson s review. PCLOB began its review of the bulk telephone records program in June 2013 and published its report seven months later. The NAS Committee was mandated to complete its study in five months but noted that it was not blessed with a luxury of time. Anderson, on the other hand, began his review in June 2016 and submitted his report just over two months later, relying on a bare bones team. 35 David Anderson Q.C. Report of the Bulk Powers Review, August 2016, 5.41, available at 9/10

10 5. Conclusion The investigatory powers that Parliament is on the brink of authorising represent a fundamental shift in power from the individual to the state. We seriously question whether the Bill as a whole is sufficiently clear and its consideration has been fully transparent. At the least, it still falls considerably short of providing sufficient safeguards for the intrusive powers it will authorise. With regard to bulk powers, David Anderson s recent report does not make a robust case. Instead, it asks the security and intelligence agencies to explain how these powers are effective, and accepts their justifications, even where they are merely hypothetical. Even more fundamentally, at no point during the debate of the Bill has the question of proportionality been answered - that is, even if we assume bulk powers are uniquely useful (which we do not accept), does that usefulness justify the intrusion into all of our privacy? We assert that bulk, indiscriminate collection of personal data can never be necessary or proportionate. We therefore put forward a single, overarching recommendation, which we urge the House of Lords to consider seriously: Remove all bulk powers from the Investigatory Powers Bill. The case for their effectiveness remains questionable, and whether such powers are proportionate has not been answered. Privacy International believes that bulk powers, by definition, can never be proportionate, and would create an apparatus for perpetual mass surveillance. 10/10