Investigatory Powers Act: State Security and Privacy Rights

Critically consider whether the new Investigatory Powers Act strikes the right balance between state security and individual privacy rights.

Introduction

Prior
to the revelations of Edward Snowden, one may have believed that high
surveillance from states as a concept of ‘Orwellian dystopia[1]’
or was limited to those countries known their close surveillance of residents,
such as China.[2]
However, it did not occur to individuals that this intrusive surveillance was
taking place closer to home in western countries such as the United Kingdom.

This
theory proved to be erroneous when in 2013, the ‘Snowden Files’ were revealed.
Unfortunately, as verified by Edward Snowden, western countries are now heavily
involved in close state surveillance, with the United Kingdom being ‘one of the
most heavily surveilled countries in the world’[3].
Thus, it appears that the public had been misled to the extent in which their
private lives were being impeded. 

As
a result of these disclosures, changes have been made to existing legislation
in many countries, including the
United Kingdom, whom have changed their legislation from the Regulation
of Investigatory Powers Act 2000 (RIPA) and the Data Retention and Investigatory Powers Act
2014 (DRIPA) [4]
to the new Investigatory Powers Act which was given royal assent on the 29^th of November 2016.
However, whether this Act presently means that individual privacy rights are
now balanced correctly against state security is a little more complex in
nature.

Idealized Balance between State Surveillance and Rights to Individual Privacy

Under the European Convention of Human Rights ‘everyone has the right to respect for his private and family life, his home and his correspondence.’[5] Therefore, it is expected that an individual may maintain a private life and that public authorities may not impede on this right, unless it is necessary ‘in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime.’[6] Edwards notes ‘the demarcation line, which ‘ensures strong citadels of individual and group privacy’[7] and ‘limits both disclosure and surveillance,’ is seen as a prerequisite for liberal democratic societies.’[8] Therefore, it is important that this balance is adhered to, to ensure privacy rights are not intruded upon, beyond what is necessary for the state to carry out its surveillance. Thus, to ensure this fair balance Murray states the importance for ‘the law [to] indicate the scope of any discretion conferred on the competent authorities and the manner of its exercise with sufficient clarity, having regards to the legitimate aim of the measure in question, to give the individual adequate protection against arbitrary interference.’[9]

Prior to the revelations of Edward Snowden, several cases have clarified the scope and principles that must be considered by public authorities before they may legitimately partake in state surveillance and compromise the privacy rights of individuals. Klass & Ors v Germany[10]recognised that the state powers of surveillance under Art 8 should not be ‘unlimited’[11] as it is ‘aware of the danger such a law poses of undermining or even destroying democracy on the ground of defending it’[12] thus ‘the struggle against espionage and terrorism [cannot be used] to adopt whatever measures they deem appropriate.’[13] Thus, it was deemed that the Art 8(2) ‘tolerable under the Convention only in so far as strictly necessary for safeguarding the democratic institutions[14].’ In other words, where it was necessary for a democratic society[15]. Moreover, the case of Malone v United Kingdom [16] stated the need for surveillance to be in ‘accordance with the law’[17] which was described in that it ‘does not merely refer to domestic law but also relates to the quality of the law.’[18] For instance, it must be ‘adequately accessible [in that it shall] enable the citizen to regulate his conduct[19]’ regarding the activities which may lead to them being surveilled. To do this an individual; ‘must be able…to foresee, to a degree that is reasonable in the circumstances, the consequences which a given action may entail.’[20] Finally, ‘proportionality’ was another factor discussed in S and Marper v United Kingdom[21] which stated that the government must balance ‘the potential benefits of the extensive use of such techniques [in state surveillance] against important private-life interests.’[22]

Murray states: ‘any law which allows for the
interception, storage, and examination of digital data must therefore comply
with these principles.’[23] If the state ensured that
they were fulfilling these requirements, then they would correctly be balancing
the need for state surveillance against the rights of individual privacy.

Breaching Privacy Rights

Unfortunately, the idealized
views of what would ensure that state surveillance would be balanced against
the private lives of individuals was not met. The
Don’t Spy on Us campaign argued ‘gaps and weaknesses in the framework have been
exploited to enable the collection of our private communications on a
previously unimaginable scale’[24]. Therefore, due to
‘the Snowden revelations, [which] were shocking to
the public [there were] challenges to the legality of several programs underway.’
This included the Tempora program[YOU NEED TO TALK ABOUT THIS],  This included the case of Liberty v UK and Big Brother
Watch[25].’

In light of these
disclosures, it is imperative to consider
whether the privacy issues of the Regulation of Investigatory Powers Act 2000
(RIPA) and the Data Retention and Investigatory Powers Act
2014 (DRIPA) were addressed in the current
Investigatory Powers Act 2016 (IPA).  In
undertaking this assessment, this discussion will decipher whether the current
law under the Investigatory Powers Act 2016 strikes the correct balance between
state security and an individual’s privacy rights.

RIPA, Warrants and Privacy Issues

To ensure that RIPA is in accordance with the law,
section one of the Act deems that it is unlawful for a person to intercept
communications where they do not have authority[26].
Under RIPA, subject to limited exceptions,[27]
there was typically a requirement for a warrant before communications could be
intercepted.[28]

• Privacy issues with bulk warrants

The second warrant available
under RIPA is what is commonly referred to as a bulk warrant.[29] This relates to external
communications outside the British Isles and is not intended to intrude upon
the communications of its own citizens[30]. However, section sixteen of the act makes exceptions to the
person being surveilled being within the British Islands.  The first is where their external
communications are being reviewed for the purposes of national security, the
prevention or detection of serious crime or protecting the economic wellbeing
of the UK.[31]
The second is where someone enters the British Islands or were mistaken to be
outside the British Islands[32] they can be surveilled
for up to five days where it is necessary[33] of get an internal
warrant under section eight, subsection one. Therefore, it does not appear as
though residents or citizens are safeguarded in this way, as their external
communications can be impeded upon where the public authorities can claim a
reason for doing so.

Another issue related to the transparency of the law and public authorities
in relation to bulk warrants. Many people were unaware of what was classed as
an ‘external communication’ and it was not until May 2014 when Charles Farr
announced that social media may be included in external communications. He
stated: ‘A user located in the British Islands posting a message to Facebook
will communicate with a Facebook web server, located in a Facebook Data Centre.
If it is based outside the British Islands, then the message will be an
“external communication.”’[34]  However, if the same technology was used for
two individuals to send messages, it would be treated the same as an email in
terms of being classed as an internal communication. Farr states that ‘ [it] would
depend upon where that individual was located but not on how the email was
routed’.[35]
This definition did not exist prior to this statement and thus was not clear
about when communications would be considered internal or external. Therefore,
it would make it difficult for individuals to foresee the circumstances in
which they would be surveilled and even in light of the definition. Moreover,
it may still have been considered confusing for some individuals to understand
why some communications would be internal through email but others would be
external, such as searches to Google, which many individuals would not consider
a communication in the first place.

• Privacy
  issues with internal warrants

One type of warrant is an
internal warrant which is targeted at a certain person[36] or place[37] and must contain information of
‘addresses, numbers, apparatus or other factors, or combination of factors,
that are to be used for identifying the communications that may be or are to be
intercepted[38]’. Therefore, it could be argued
that there were reasonable safeguards in which the public authority had to be
transparent about who they were surveilling and the methods they were using to
do so. Thus, this presents the illusion that their privacy rights are being
respected in so far as they were restricted from ‘bulk interception of
residents or citizens in the United Kingdom, as the warrant requires a specific
location or person.’[39]  

Arguably,
this safeguard was not as effective as once considered due to bulk warrants. It has been noted by Charles Farr as per Murray
that external communications are intercepted at communication cables which
contain both internal and external communications[40]. As information of both
types are sent through a variety of servers, it is impossible to comprehend
which information is internal or external. Therefore, there is no way to decide
if communications are internal or external until they have been reviewed to
make this determination.[41] This is clearly a
significant intrusion into the privacy rights of individuals, as their
communications are being considered at random. It would appear as though this
would be a clear breach of RIPA as there was no warrant to intercept these
internal communications. However, this is resolved by section five, subsection
six of the act that recognised this information is unavoidably collected to
ensure that the essential data for the warrant can be retrieved.[42] Therefore, arguably the
safeguards provided by section one of the act, fall short in protecting all
residents and citizens within the United Kingdom, as their data may be reviewed
at random for the purposes of a bulk warrant.

• Addressing
  Privacy issues

It is clear an
individual cannot protect their right to privacy if they do not understand the
circumstances in which it will be impeded, their rights and how they may avoid
this happening. Therefore, as Dr Paul Bernal for authorities to simply say
‘trust us’ is not satisfactory in assisting individuals to protect their rights
to a private life.[43] Thus, both the first
review, ‘Privacy and Security: A Modern and Transparent Legal Framework’[44] and the second review, ‘A
question of Trust: Report of the Investigatory Powers Review’[45] by David Anderson QC
noted the need for transparency under a new law.

Regarding transparency,
the review communicated its concern that it was ‘unsatisfactory’ that the
extent of investigatory powers used by the public authorities and other
‘disclosures’ were only made clear after the Snowden files were released.[46] Overall, the review takes
the stance that a ‘fundamental imbalance[47]’ existed due to this lack
of transparency. The review drew attention to the Liberty case[48] which stated, ‘A clear
understanding of the absolute limits of what is permitted by legislation is
essential when the exercise of powers will be done largely in secret.’[49] It was noted that the new
act would be in ‘non-technical language’[50] which would be understood
by the ‘intelligent readers across the world’[51] and ensure it is
transparent unless prohibited by national security.[52]

The Investigatory
Powers Act 2016 attempts to address these issues by setting out the strict
powers regarding warrants. Part 2, Chapter 1 of the act deals with three types
of targeted warrants.[53] The first is a targeted
interception warrant.[54] Murray describes this as
‘a warrant that allows the interception of a communication or the obtaining of
communication data, or the disclosure of such data.’[55] The second is targeted
examination warrant[56] described by Murray as a
warrant which ‘authorises the examination of intercepted material obtained
under a bulk interception warrant’[57] Thirdly, is a mutual
assistance warrant which Murray defines as allowing ‘communications to be
intercepted or communications data to be examined as part of a mutual
assistance request under EU or other Treaty like requirements.’[58]

It may be argued
that these definitions are clearer and more transparent in nature, describing
the purpose of each warrant in more depth within the act. This allows for
individuals to understand when and for what purposes these warrants will be
sought by public authorities. [will it help them protect their privacy rights??]

Authorisation of Warrants and Privacy Issues

• Separation of powers?

The issue with RIPA was that ‘there was no
separation in terms of the executive and judiciary in the warrant process’.[59] Both internal and external
warrants were approved by the Secretary of State.[60] Murray has quoted that there was ‘around fifty
billion intercepts daily’.[61]  This meant that there was no checks or
balances regarding this procedure and it was possible for the state to impede
into the private lives of individuals unnecessarily if they chose to do so.
Many individuals were concerned by this and after the Snowden revelations this
was potentially an avenue for a real abuse of power by public authorities into
the private lives of individuals. This was in disparity to the US court where
the ‘US provided these through a secret court 99.97% of the time’ thus allowing
for a separation of powers and protection of privacy rights.[62]

• Addressing Privacy issues

The first review
identifying this problem was the ‘Privacy and Security: A Modern and
Transparent Legal Framework’.[63] The review maintained the
necessity for the authorisation of warrants to remain this way. Sir David Omund
stated ‘I think it is entirely right that a Minister takes the responsibility
on herself or himself to sign the warrant and then answers for the consequences
if something terrible happens[64].’

While this review
remained in favor of this approach, it was noted ‘other witnesses to the inquiry
from outside Government disagreed, arguing that the public has lost trust and
confidence in elected politicians to make these decisions. Contributors felt
that judges would be better placed to balance individual and collective
‘rights’ objectively.’[65] It was deemed that judges
would conduct better ‘checks on state power[66]’ and ensure ‘surveillance
was necessary and proportionate.’[67] The second review ‘A
question of Trust: Report of the Investigatory Powers Review’ by David Anderson
QC[68] and the third review ‘A
Democratic License to Operate’[69] by Prime Minister Nick
Clegg, agreed that there had to be a change in this system to introduce the powers
of a Judicial Commissioner through different perceptions of what is now known
as a ‘double lock’ procedure.

A version of the
double lock procedure was introduced through the Investigatory Powers Act 2016.
Under this approach, the power to issue targeted warrants remain with the Secretary
of State[70]
or Scottish minister.[71] However, the Judicial
Commissioner must approve this process[72] the same as it would in a
judicial review.[73]
This would include whether ‘the warrant is necessary on relevant grounds[74]’ and ‘whether the conduct
that would be authorised by the warrant is proportionate to what is sought to
be achieved by the conduct.’[75]  Murray argues that this means that ‘This section has no associated Explanatory
Notesthis is a substantial change in power as the judicial commissioner
has the authority to overrule the secretary of state on substantive grounds.’[76]

This shows that
there is a significantly higher consideration on the privacy of individuals in
this respect, as the Secretary of State is now accountable to the Judicial
Commissioner for its actions.  The
principles in ensuring that these acts are only done when it is necessary, in
accordance with the law and proportionate is now arguably being upheld to a
much higher standard than before. However, there is an exception where there
are urgent cases[77]
and there is up to three working days[78] for the Judicial Commissioner
to decide whether to approve the warrant and notify the person of that
decision.[79]
If rejected it cannot be renewed and no longer in effect.[80] This system would be the
same for bulk warrants, however, there would be no devolved powers to the
Scottish Minister. This allows the appropriate time for checks and balances,
but also adequately ensures that public authorities can act in the interests of
state security where it is necessary.

Overall, it could be deemed that there is an
appropriate balance between state security and
individual privacy rights. It is certainly a more effective system than
anything that has been in place before.

[1]
THE DANGERS OF SURVEILLANCE Neil M. Richards∗ 1937

[2] THE DANGERS OF SURVEILLANCE Neil M. Richards∗ 1937

[3]
THE DANGERS OF SURVEILLANCE Neil M. Richards∗ 1938

[4]
Murray 591

[5]
Art 8 ECHR

[6]
Art 8(2) ECHR

[7]
Edwards 548

[8]
Edwards 548

[9] Murray 593

[10]
(1978) 2 EHRR 214

[11]
Klass & Ors v Germany
(1978) 2 EHRR 214 Para 47

[12]
Klass & Ors v Germany
(1978) 2 EHRR 214 Para 47

[13]
Klass & Ors v Germany
(1978) 2 EHRR 214 Para 47

[14] 
Klass & Ors v Germany (1978) 2 EHRR 214 Para 42

[15]
Malone v United Kingdom
(1984) 7 EHRR 14, para 81

[16]Malone v United Kingdom
(1984) 7 EHRR 14

[17] Malone v United Kingdom
(1984) 7 EHRR 14, para 66

[18] Malone v United Kingdom
(1984) 7 EHRR 14, para 67

[19]
Malone v United Kingdom
(1984) 7 EHRR 14, para 67

[20]
Sunday Times v United Kingdom [1983] , 2 EHRR 245 at para.49;  [check if it is the para]

[21]
[2008]
ECHR 1581

[22] S and Marper v United Kingdom[2008] ECHR 1581, para 112

[23]
Murray 594

[24]
Don’t Spy on Us, ‘Don’t Spy on Us: Reforming Surveillance in the UK’, 2014. 10

[25]
Page …

[26]
S(1) RIPA

[27]
S(3) & S(4) RIPA

[28]
S(5)(1) RIPA

[29]
S8(4) RIPA

[30]
Cite this

[31]
S16(3)

[32]
S6 RIPA

[33]
S5 RIPA

[34]
Statement of Charles Farr, the Director General of the Office for Security and
Counter Terrorism, dated 16 May 2014, para 137

[35]
Statement of Charles Farr, the Director General of the Office for Security and
Counter Terrorism, dated 16 May 2014, para 137

[36]
S8(1)(a) RIPA

[37]
S8(1)(b) RIPA

[38]
S8(2) RIPA

[39]
595 Murray

[40]
Need referenced

[41]
603 Murray

[42]
603 Murray

[43]
214 David Anderspn review 2 para 12.6

[44]
Recommendation YY

[45]
citation

[46]
12.5 David Anderson Review

[47]
214 David Anderspn review 2 para 12.6

[48]
Find this

[49]
Find page

[50]
285 David Anderspn review 2

[51]
285 David Anderspn review 2

[52]
285 David Anderspn review 2

[53]
Part 2 Chapter 1 of Investigatory Powers Act 2016

[54]
S15(1)(a)

[55]
Murray 610

[56]
S15(1)(b)

[57]
Murray 610

[58]
Murray 610

[59]
599 Murray

[60]  or Scottish Minister for internal warrants s7 RIPA CHECK

[61]
Murray 596

[62]
599 Murray

[63]
Cite this

[64]  Review 1 https://b1cba9b3-a-5e6631fd-s-sites.googlegroups.com/a/independent.gov.uk/isc/files/20150312_ISC_P%2BS%2BRpt%28web%29.pdf?attachauth=ANoY7cqzVJ8waEyy-qH3I5HS0jIgGrusQo4IqLA_DdlM_5qrLkKOpXKbkYQEhGhSl6v2wIPmBI_-7mpu41N_y1u11bi85pB3Tii2n8J-5dUrjKNWFQZ7LJEuzCpwYE_aZDHZ3wzvLOLW657rEk2UbgwI5GfNyZthBs1-dBANgvQnmFo0ejznynmRPC0j5rQukAYv_6EpSNa_vhSS51h-JlRNMGzpd_6FAiVfkgkGixfc3rc8HRgJ0z8sdGE407favz94zqLIeeIz&attredirects=0
 73

[65]
Review 1 https://b1cba9b3-a-5e6631fd-s-sites.googlegroups.com/a/independent.gov.uk/isc/files/20150312_ISC_P%2BS%2BRpt%28web%29.pdf?attachauth=ANoY7cqzVJ8waEyy-qH3I5HS0jIgGrusQo4IqLA_DdlM_5qrLkKOpXKbkYQEhGhSl6v2wIPmBI_-7mpu41N_y1u11bi85pB3Tii2n8J-5dUrjKNWFQZ7LJEuzCpwYE_aZDHZ3wzvLOLW657rEk2UbgwI5GfNyZthBs1-dBANgvQnmFo0ejznynmRPC0j5rQukAYv_6EpSNa_vhSS51h-JlRNMGzpd_6FAiVfkgkGixfc3rc8HRgJ0z8sdGE407favz94zqLIeeIz&attredirects=0
  P74

[66]
Review 1 https://b1cba9b3-a-5e6631fd-s-sites.googlegroups.com/a/independent.gov.uk/isc/files/20150312_ISC_P%2BS%2BRpt%28web%29.pdf?attachauth=ANoY7cqzVJ8waEyy-qH3I5HS0jIgGrusQo4IqLA_DdlM_5qrLkKOpXKbkYQEhGhSl6v2wIPmBI_-7mpu41N_y1u11bi85pB3Tii2n8J-5dUrjKNWFQZ7LJEuzCpwYE_aZDHZ3wzvLOLW657rEk2UbgwI5GfNyZthBs1-dBANgvQnmFo0ejznynmRPC0j5rQukAYv_6EpSNa_vhSS51h-JlRNMGzpd_6FAiVfkgkGixfc3rc8HRgJ0z8sdGE407favz94zqLIeeIz&attredirects=0
  P74

[67]
Review 1 https://b1cba9b3-a-5e6631fd-s-sites.googlegroups.com/a/independent.gov.uk/isc/files/20150312_ISC_P%2BS%2BRpt%28web%29.pdf?attachauth=ANoY7cqzVJ8waEyy-qH3I5HS0jIgGrusQo4IqLA_DdlM_5qrLkKOpXKbkYQEhGhSl6v2wIPmBI_-7mpu41N_y1u11bi85pB3Tii2n8J-5dUrjKNWFQZ7LJEuzCpwYE_aZDHZ3wzvLOLW657rEk2UbgwI5GfNyZthBs1-dBANgvQnmFo0ejznynmRPC0j5rQukAYv_6EpSNa_vhSS51h-JlRNMGzpd_6FAiVfkgkGixfc3rc8HRgJ0z8sdGE407favz94zqLIeeIz&attredirects=0
  P74

[68]
6 David Anderspn review 2

[69]
Cite this

[70]
Cl.19

[71]
Cl. 21

[72]
Cl. 23

[73]
Cl 23(2)

[74]
Cl 23(1)(a)

[75]
Cl 23(1)(b)

[76]
Murray 610

[77]
Cl 24

[78]
Cl 24(3)(b)

[79]
Cl 24(3)

[80]
Cl 24(4)