Liberty, PI, Amnesty v Foreign Secretary at IPT

I had a quick go yesterday at explaining the Investigatory Powers Tribunal (IPT) ruling, in Liberty & Ors v The Secretary of State for Foreign and Commonwealth Affairs & Others (Case No: IPT/13/77/H).

When government, for an indeterminate number of years prior to 5th December 2014 has said,

“All of the work of the intelligence and security services is carried out in accordance within a strict legal and policy framework, which ensures that our activities are authorised, necessary and proportionate ...”

they were being economical with the truth. They were, during that period, in fact flagrantly undermining the rights to privacy and freedom of expression under articles 8 and 10 respectively of the European Convention on Human Rights (ECHR).

The government can, according to the IPT however, make that claim now because we are told there is a legal and policy framework. We are not just entrusted with the privilege of knowing what those legal and policy framework rules are.

Secret laws and policies.

For secret government mass surveillance activities.

Approved by a secretive tribunal historically predisposed towards approving of government secrecy, with the sole limited exception being this Liberty & Ors case.

The most recent IPT ruling takes great pains, from the start, to emphasise that they ruled, in December 2014, that the UK security services intelligence sharing with the NSA, in connection with the Prism and Upstream, is lawful.

"Save in one possible (and to date hypothetical) respect"

The limited and hypothetical exception is laid out in paragraph 53 of their 5 December judgement.

"53. The one matter of concern is this. Although it is the case that any request for, or receipt of, intercept or communications data pursuant to Prism and/or Upstream is ordinarily subject to the same safeguards as in a case where intercept or communication data are obtained directly by the Respondents, if there were a 1(b) request, albeit that such request must go to the Secretary of State, and that any material so obtained must be dealt with pursuant to RIPA, there is the possibility that the s.16 protection might not apply. As already indicated, no 1(b) request has in fact ever occurred, and there has thus been no problem hitherto. We are however satisfied that there ought to be introduced a procedure whereby any such request, if it be made, when referred to the Secretary of State, must address the issue of s.16(3)"

But the exception was hypothetical, had not happened and they were therefore "satisfied as to the lawfulness" of the intelligence services' activities relating to Prism and Upstream. From the 6 February decision:

"10. By our Order of 5 December 2014 we made declarations that the Prism and/or Upstream arrangements (subject to the exception referred to in paragraphs 7 and 8 above) did not contravene Articles 8 or 10 ECHR, and further that the RIPA regime in respect of ss. 8(4), 15 and 16 of RIPA similarly did not contravene Articles 8 or 10 ECHR.

By paragraph 4 of the Order, we directed that the parties serve written submissions according to an agreed timetable, and with a view to the two outstanding issues being resolved by the Tribunal, by agreement of the parties, without a further hearing:

“4. i) Whether by virtue of the fact that any of the matters now disclosed in the judgment of 5 December 2014 were not previously disclosed, there had prior thereto been a contravention of Articles 8 or 10 ECHR. (“The First Issue”).

ii) Whether by virtue of the facts and matters set out in paragraph 53 of the judgment of 5 December 2014, there is a contravention of Articles 8 or 10 ECHR.” (“The Second Issue”). "

We'll get to the IPT's specific answers to these questions presently but (spoiler alert) they basically conclude i) keeping the existence of the rules secret was illegal but isn't anymore since we now know the rules exist (it's slightly more subtle than that, in that there is a the question of "adequate signposting" to the rules) and ii) don't worry about it, the government promise to behave.

Perhaps surprisingly, (though I expect the legal representatives advised of the serious possibility of a limited win on the secret rules grounds and decided to focus exclusively on that), Liberty and co chose not to challenge the RIPA regime at this particular stage. So the IPT take the open goal opportunity to pat GCHQ and co on the back,

"12. ... As requested by the Respondents, therefore, the Tribunal can make it clear, for the avoidance of doubt, that the declaration it made on 5 December 2014 in relation to the RIPA regime was that it is in accordance with the law/prescribed by law and was so prior to the Tribunal’s Judgment of 5 December 2014."

They next tackle the question of whether the absence of government acknowledgment of secret rules governing mass surveillance was illegal.

"15. We set out the requirements of Article 8 in paragraph 37 of the December Judgment:

“37. The relevant principles appear to us to be that in order for interference with Article 8 to be in accordance with the law:
(i) there must not be an unfettered discretion for executive action. There must be controls on the arbitrariness of that action.
(ii) the nature of the rules must be clear and the ambit of them must be in the public domain so far as possible, an “adequate indication” given (Malone v UK [1985] 7 EHRR 14 at paragraph 67), so that the existence of interference with privacy may in general terms be foreseeable."

So there must be rules reigning in "unfettered... executive action" i.e. theoretically the government is subject to some controls. The rules don't have to be public but the public must know enough to be able to deduce that our privacy may be undermined.

"16. We continued:

“41. We consider that what is required is a sufficient signposting of the rules or arrangements insofar as they are not disclosed. . . It is in our judgment sufficient that:
(i) Appropriate rules or arrangements exist and are publicly known and confirmed to exist, with their content sufficiently signposted, such as to give an adequate indication of it (as per Malone: see paragraph 37(ii) above).
(ii) They are subject to proper oversight.”

I'll leave you to decide on the difference, if any, between "the nature of the rules must be clear..." etc and " what is required is a sufficient signposting of the rules or arrangements insofar as they are not disclosed" etc.

Bottom line?

Secret rules governing mass surveillance are ok as long as the public know there are rules, even if they are not allowed to know what the rules are and as long as the rules "are subject to proper oversight".

The IPT did get a confidential look at the "arrangement below the waterline" i.e. secret rules, in secret and:

"17. We set out our conclusions, so far as relevant to this question, in paragraph 55:

“55. After careful consideration, the Tribunal reaches the following conclusions:
(i) Having considered the arrangements below the waterline, as described in this judgment, we are satisfied that there are adequate arrangements in place for the purpose of ensuring compliance with the statutory framework and with Articles 8 and 10 of the Convention, so far as the receipt of intercept from Prism and/or Upstream is concerned.
(ii)This is of course of itself not sufficient, because the arrangements must be sufficiently accessible to the public. We are satisfied that they are sufficiently signposted by virtue of the statutory framework to which we have referred and the Statements of the ISC and the [Interception of Communications] Commissioner quoted above, and as now, after the two closed hearings that we have held, publicly disclosed by the Respondents and recorded in this judgment.”

In other words - trust us, there is "adequate" secret oversight of mass surveillance ensuring it complies with human rights.

But don't worry, we've got your back. Not only can we confirm the the existence of adequate secret controls but we realise the fact of the existence of these secret rules must be in the public domain. And hey presto! By way of our wondrous work in getting this information disclosed to the public - i.e. that secret rules exist - the public know that secret rules exist. High fives and self congratulatory kudos all round.

But wait.

Liberty's QC, Matthew Ryder, pointed out that it was only because this case was pursued that the government were forced into releasing the information that secret rules existed that, in turn, satisfied the IPT that the public now know that secret rules exist.

The IPT response?

"19. ... We agree."

Not much to add to that.

Paragraph 20. of the judgement is fun but really for the lawyers. Rough translation:

The government say: leave us alone, there was enough information to deduce that rules existed.

Privacy International barristers, Dan Squires and Ben Jaffey say: maybe but there was not enough information about the nature and ambit of the rules (in the language of the Padfield decision noted in para 15) or sufficient signposting to the content of the rules to give an adequate indication (Padfield & IPT from para 15 & 16) of the ballpark they might reside in.

I won't quote the IPT in paragraph 20 agreeing with Privacy International but the IPT agreed with Privacy International.

We finally reach the heart of the decision so loudly proclaimed as historic by Liberty, Privacy International, Amnesty and The Guardian.

"21. ... We are however satisfied ... that, without the disclosures made, there would not have been adequate signposting, as we have found was required and has now, as a result of our Judgment, been given.

22. Although the first requirement of Article 8, set out in paragraph 37(i) of the December Judgment and in paragraph 15 above, is satisfied, the second requirement, as set out in paragraph 37(ii) of the December Judgment, was only satisfied by the Disclosures being made public in our Judgment.

23. We would accordingly make a declaration that prior to the disclosures made and referred to in the Tribunal’s Judgment of 5 December 2014, the regime governing the soliciting, receiving, storing and transmitting by UK authorities of private communications of individuals located in the UK, which have been obtained by US authorities pursuant to Prism and/or (on the Claimants’ case) Upstream, contravened Articles 8 or 10 ECHR, but now complies."

So,

There are secret rules controlling government action in this area.

There would not have been "adequate signposting" to the secret rules governing Prism & Upsteam intelligence sharing, without the disclosures the government made in this case.

Prior to these disclosures the government were in breach of  Articles 8 or 10 of the European Convention on Human Rights (ECHR), protecting privacy and freedom of expression; as there was inadequate signposting to the secret rules.

The Prism & Upstream intelligence sharing regime, by virtue of government disclosures, as a result of this case, of adequate signposting to the secret rules, now comply with Articles 8 or 10 of the ECHR.

Having shot the government metaphorically in the foot then bandaged the wound so it was no longer noticeable, the IPT move thence to the" hypothetical" Regulation of Investigatory Powers (RIPA) loophole. "Hypothetical" because they are assured by the government that the issue has never arisen.

The RIPA issue in the case is more complicated than the question of the existence of secret rules, so  in deference to the patience and stamina of readers who have got this far, I'm going to take a relatively short run at it. It is addressed in paragraphs 24 to 31 of the decision. Let's skip the hypotheticals on the 1(b) request and the dancing in and out of sections 5, 8, 15 and 16 of RIPA and get to the government promise outlined in paragraph 30.

"30. The Respondents have now given the further Disclosure, as contained in paragraphs 19 and 20 of their submissions:

“19. For the avoidance of doubt, the concern identified by the Tribunal would not arise in the first place if a request were made pursuant to paragraph 1(b) of the Disclosure for material to, from or about specific selectors (relating therefore to a specific individual or individuals). In such a situation, the request would be a “targeted” one and the Secretary of State would therefore have approved it for the specific individual(s) in question. In that case, the proper parallel would be with a warrant under s.8(1) of RIPA, not s.8(4). Thus, the safeguards under s.16 of RIPA would not be at issue even by analogy because s.16 of RIPA only applies to the examination stage following interception under s.8(4) warrants (i.e. “untargeted” interception).
20. In those circumstances, the remaining concern is in relation to such untargeted interception. The Respondents can confirm that, in the event that a request falling within paragraph 1(b) of the Disclosure were to be made and approved by the Secretary of State other than in relation to specific selectors (i.e. “untargeted”), the Intelligence Services would not examine any communications so obtained according to any factors as are mentioned in section 16(2)(a) and (b) of RIPA unless the Secretary of State personally considered and approved the examination of those communications by reference to such factors.” "

This requires careful and repeated reading but purports to be an assurance from the government to close this one lacuna, in a veritable colander of RIPA loopholes. The assurance attempts to give the impression that the Secretary of State must sign off on surveillance targeted at specific individuals.

In other words the government promise to behave... honestly... on this specific RIPA pathway.

Secretary of State approval is now supposed to apply both:

to targeted interception of communications

and to targeted data mining of the giant data silos collected through untargeted interception.

I'm not sure I derive a great deal of comfort from that.

On the latter, just to repeat;

"The Respondents can confirm that, in the event that a request falling within paragraph 1(b) of the Disclosure were to be made and approved by the Secretary of State other than in relation to specific selectors (i.e. “untargeted”), the Intelligence Services would not examine any communications so obtained according to any factors as are mentioned in section 16(2)(a) and (b) of RIPA unless the Secretary of State personally considered and approved the examination of those communications by reference to such factors.”

Privacy International and Amnesty accepted the government assurances explicitly. Liberty were silent on the matter. The IPT takes the declaration as a resolution.

"31. Privacy in their reply submissions, with which Amnesty agrees, accept that “that safeguard is now in place, but was not in place before December 2014”. Liberty does not expressly so accept, but made no submissions to the contrary in their reply. In any event we agree, and the disclosure which resolves the lacuna is now made public in this judgment."

Given the importance the government RIPA promise and the IPT's acceptance that it closes a loophole, they conclude the case at paragraph 32:

"32. In our judgment the appropriate course is to alter the declaration we were otherwise minded to make as set out in paragraph 23 above in respect of the First Issue, so that the declaration we propose to make would recite that “prior to the disclosures made and referred to in the Tribunal’s Judgment of 5 December 2014 and this judgment” the Prism and/or Upstream arrangements contravened Articles 8 or 10 ECHR, but now comply."

So, prior to -

the disclosure of adequate signposting to secret rules governing Prism and Upstream intelligence sharing

And

the government's promise not to exploit one of many RIPA loopholes  

- the UK government, for many years, contravened articles 8 and 10 of the European Convention on Human Rights. Now, thanks to the disclosures and promises extracted as a result of this case, they are no longer undermining the right to privacy and freedom of expression. At least as far as the IPT is concerned, within the narrow confines of the issues it examined in this case.

Update: I meant but neglected to include Caspar Bowden's wonderful description of the decision -

"IPT "illegality" finding a Pyrrhic victory, harpoon hurled at heart of "margin of appreciation". ECtHR reviews "safeguards" not spy methods"

Also Privacy International's note about the secret rules: 

"What was publicly disclosed, therefore, is little more than a Tribunal’s summary of secret policies disclosed in a secret hearing, which policies describe only the broadest of restrictions on the receipt of intelligence material by the UK, and remain buried in a 77-page long decision from the IPT, not enshrined in any accessible law or statute. 

We think that falls far short of what is called for by the “in accordance with law” requirement, and in the coming weeks will be appealing to the European Court of Human Rights to argue our case there, demanding an end to unlawful mass intelligence sharing, and ensuring privacy protections for all. "