Another parliamentary committee that has been scrutinizing UK surveillance legislation currently before parliament says changes are needed to remove concerns the Investigatory Powers Bill would afford state security agencies powers that are too broad.
However the Human Rights Committee is generally less critical of the controversial bill than the security-cleared Intelligence and Security Committee, concluding that the controversial bulk powers the government is seeking to enshrine in law are not, in and of themselves, incompatible with European Human Rights law — at least not if certain legal bases are properly established, and checks and balances built in. It says it is basing this assessment on current case law.
“On the current state of the ECHR case-law, we do not consider the bulk powers in the Bill to be inherently incompatible with the right to respect for private life, but capable of being justified if they have a sufficiently clear legal basis, are shown to be necessary, and are proportionate in that they are accompanied by adequate safeguards against arbitrariness,” it writes.
It does also note that other legal challenges to bulk powers are pending. “Whether the powers have a sufficiently clear legal basis and the adequacy of the safeguards are closely intertwined questions on which the courts will rule in due course, and we do not express a view pending the determination of those legal challenges,” it adds.
Late last month the UK government agreed to an independent review of the IP Bill’s bulk powers — something the opposition Labour Party had been calling for — appointing QC David Anderson to the task: its previous reviewer of terrorism legislation, whose earlier report paved the way for the IP bill to be drafted.
The Human Rights Committee says it supports this planned review of bulk powers, and recommends Anderson should report before the bill completes its passage through parliament — as you’d hope, if the review is to have any impact on the proposed legislation.
Critics, including privacy and human rights groups, continue to describe bulk collection powers as ‘mass surveillance’ — arguing they are inherently disproportionate. While, at the European level, bulk collection legislation was overturned by the European Court of Justice, back in April 2014 which also judged bulk intercept powers as contravening fundamental privacy and human rights.
More recently the US-EU Safe Harbor agreement, which had governed transatlantic data flows for some fifteen years, was struck down by Europe’s supreme court on the grounds that US government surveillance programs were breaching Europeans’ privacy rights.
Yet despite the wider legal climate in European having turned against bulk collection programs, the Human Rights Committee appears convinced bulk powers can be proportionate/non-arbitrary given the right checks and balances.
The UK government’s independent reviewer of terrorism legislation also supported continued use by the security and intelligence agencies of bulk collection powers in his June 2015 report — but again with caveats that “strict additional safeguards” be provided for in the associated legislation, such as, for example, judicial authorization of intercept warrants.
It remains to be seen what Anderson’s view will be of bulk powers now that he will be assessing them in the specific legislative context of the IP bill’s proposed framework.
“Too broadly drafted”
Despite supporting bulk powers (with caveats), the Human Rights committee does make some specific criticisms of the bill, flagging up issues other critics have also identified as problematic.
One major concern for the committee is the bill’s provision for so-called thematic warrants, where an intercept warrant can be obtained to capture data associated with multiple targets.
“We recognise the value of thematic warrants but consider that the wording of the clauses concerning the subject matter of targeted interception and targeted equipment interference warrants is too broadly drafted,” it writes in a summary of its report.
“We recommend that the Bill be amended so as to ensure that the description in the warrant is sufficiently specific to enable any person unknown, but who is the subject of it, to be identified and to prevent the possibility of large numbers of people being potentially within the scope of a vaguely worded warrant.”
It is also worried about powers that would enable targeted warrants to be modified after the fact — which it says might offer a route to circumvent judicial approval (the latter being a key recommendation of Anderson’s prior report — and one which the government partially adopted, albeit retaining ministerial authorization in a so-called “double lock” mechanism).
“We consider that the power to make modifications to warrants for targeted interception, without judicial approval, is so wide as to give rise to real concern that the requirement of judicial authorisation can be circumvented, thereby undermining that important safeguard against arbitrariness. We recommend that major modifications to warrants require approval by a Judicial Commissioner,” the committee writes.
On the human rights law point, the committee suggests the new legal framework the government is seeking to establish with the IP bill could be made more compatible with the requirements of European Human Rights law if the oversight system provides for “a clear separation of function between the prior judicial authorisation of warrants and ex post inspection and review”.
“We recommend that the Investigatory Powers Commissioner be placed under a duty to ensure that the two distinct functions of authorisation and inspection are carried out by different Commissioners,” it adds.
Other concerns for the committee include ensuring robust protections for journalists’ sources; for the communications of members of parliament; and the privileged communications of the legal profession.
Update: Responding to the report in a statement provided to TechCrunch, digital rights group Privacy International welcomed the committee’s assessment of thematic warrants as too broad but added that the general view that bulk collection is “not inherently incompatible” with privacy rights is out of step with recent decisions from the ECHR .
“The Committee’s remarks that bulk collection is ‘not inherently incompatible’ with the right to privacy based on existing case law, is like a sand castle built at low tide. The landscape of the case law in this area is set to change and has been changing rapidly,” said PI’s advocacy officer Matthew Rice.
“Recent decisions from the European Court of Human Rights in Zakharov, and by the Court of Justice of the European Union have been clear in condemning the practice of collecting, in bulk, the communications of individuals without sufficient limitations. And the upcoming cases involving UK human rights organisations will change the nature of case law in Europe. While this scrutiny is welcomed, on this point, the committee may find itself reviewing its opinion again.”