the bureau's application to the european court of human rights
DESCRIPTION
The Bureau of Investigative Journalism and one of its journalists are asking the European Court of Human Rights to rule on whether UK legislation properly protects journalists’ sources and communications from government scrutiny and mass surveillance.The action follows concerns about the implications to journalists of some of the revelations that have come out of material leaked by Edward Snowden.The Bureau is being represented by Gavin Millar QC of Doughty Street Chambers, Conor McCarthy of Monckton Chambers and Rosa Curling of solicitors Leigh Day.TRANSCRIPT
![Page 1: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/1.jpg)
IN THE EUROPEAN COURT OF HUMAN RIGHTS
BETWEEN:
(1) BUREAU OF INVESTIGATIVE JOURNALISM (“BIJ”);
(2) ALICE ROSS
APPLICANTS
V
THE UNITED KINGDOM
RESPONDENT
__________________________________
APPLICATION___________________________________
1
![Page 2: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/2.jpg)
A. INTRODUCTION
1. The Applicants are a respected public interest media / newsgathering organisation and one
of its journalists. Both undertake journalistic investigations into, and publish content about,
controversial global issues concerning the military, the intelligence services/the secret
state, national security issues, corruption and bribery as well as sensitive aspects of the
United Kingdom’s foreign policy. The Applicants challenge: first, the inadequacies of the
United Kingdom’s domestic legal framework for the protection of journalistic sources and
material amidst the interception, storage, dissemination and exploitation by the state of a
vast range of material treated as “external communications” under the United Kingdom’s
Regulation of Investigatory Powers Act PA; and secondly the inadequate protection afforded
to the same in relation to the interception, storage, dissemination and exploitation of
“communications data” or metadata under the 2000 Act. Their challenge is brought under
Article 8 and Article 10 of the European Convention on Human Rights (“the Convention” or
“ECHR”).
B. SUMMARY
2. The present application by the Bureau of Investigative Journalism (“BIJ” or “the Bureau”)
and Alice Ross, an investigative reporter with the Bureau, raises important issues regarding
journalistic free expression, the protection of confidential journalistic communications and
the mass scale interception of communications in the United Kingdom under the Regulation
of Investigatory Powers Act 2000.
3. The present application arises from the substantial body of information which has now
come to light indicating that communications deemed “external communications”1 for
purposes of the Regulation of Investigatory Powers Act 2000, are subject to mass scale
interception, collation, storage and analysis by government agencies in the United Kingdom,
notably Government Communications Headquarters (“GCHQ”). Furthermore, it is now
apparently that the interception, storage and analysis of data concerns not only
communications content but also includes “meta data” (e.g. data about communications).
Importantly, technological advances in recent years mean that such metadata can be used
and exploited in a way that is every bit, if not more, intrusive of confidentiality or
journalistic free expression as the interception of, for example, the content of journalistic
1 Section 20 Regulation of Investigatory Powers Act 2000
2
![Page 3: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/3.jpg)
communications. This is because metadata can be subject to hugely powerful computer
programmes which collate, link analyse and synthesise masses of data, enabling a
sophisticated picture to be developed of an individual or organization’s network of contacts,
sources, lines of enquiry as well as materials, subjects and persons of interest to them.
Without rigorous and effective legal safeguards, it is plain that the use of these powerful
technologies may now fundamentally undermine journalistic free expression in a way that
could not previously have been envisaged.
4. The interception and exploitation of journalistic communications in this manner, in the
absence of proper safeguards, may undermine the confidentiality of journalistic sources,
materials and information, a necessary and basic precondition for press freedom in a
democratic society.2 The threat to journalistic freedom of expression from mass interception
of external communications is all the greater where journalists, such as the present
applicants, are covering sensitive matters touching on issues of national security, counter
terrorism or sensitive aspects of foreign policy. Here investigative journalism often relies
heavily on human sources or data and material located outside a single jurisdiction. The
Court has held on many occasions that it is “incumbent on the press to convey information
and ideas on political issues, even divisive ones” (Ozgur Gundem v. Turkey, Merits,
Application No. 23144/93 [§ 58]; and Lingens v. Austria, (1986) 8 EHRR 407 [§ 41]). By
much the same token, it is also incumbent on journalists and the free press to report on
matters which may be very sensitive, including matters touching on national security or the
conduct of international affairs. Surveillance practices which inhibit the ability of the press
to investigate and report in these areas call for careful scrutiny.
5. As detailed in the main body of the Claimant’s application the Applicants submit that the
requirements of Articles 8 and 10 of the Convention are not satisfied by the United
Kingdom’s legal framework for the interception of external communications and
communications data (or “metadata”). The Applicants bring the present challenge in light of
the press revelations, in the United Kingdom and across the world, about mass scale
interception and surveillance of electronic communications by the United Kingdom’s
Government Communications Headquarters (“GCHQ”) both for use by the United Kingdom’s
intelligence services and for dissemination within government. The mass scale interception
of data (both content data and metadata) is conducted using, inter alia, the Tempora
programme and a range of other covert mechanisms. These programmes, mechanisms and
2 Godwin v. the United Kingdom (1996) 22 EHRR 123, [§ 39]
3
![Page 4: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/4.jpg)
capabilities are described in detail by Doctor George Danezis of University College London,
Department of Computer Science in his witness statement.
In short, the Applicants submit:
a. First, that the conduct of the United Kingdom in relation to the soliciting, receipt,
search, analysis, dissemination, storage and destruction of interception data in
respect of “external communications”, in particular with regard to their impact on
journalism and newsgathering organizations and their privileged information and
communications, is incompatible with Articles 8 and/or 10 ECHR;
b. Secondly, that the conduct of the United Kingdom in relation to the soliciting,
receipt, search, analysis, dissemination, storage and destruction of communications
data (“metadata”), is incompatible with Articles 8 and/or 10 ECHR, with particular
regard to its impact on journalism and privileged or confidential journalistic
information including sources.
6. The Applicants therefore seek declarations that their rights under Articles 8 and/or 10 of the
Convention have been violated and that the legal framework of the law of the United
Kingdom in respect of the interception of communications under Section 8 RIPA 2000
and/or the legal framework pertaining to the interception of communications data under
UK law does not comply with the requirements of the Convention in the respects set out
above and costs.
7. No effective remedy for the matters raised in the present application exists in UK law. The only
avenue in the domestic legal system by which the applicants could bring their present
complaint is the Investigatory Powers Tribunal. By virtue of Section 65 (2) (a) of RIPA 2000,
the Tribunal is the “only appropriate tribunal” for the purposes of challenging either the
interception of communications generally or to the compatibility of the conduct of the
intelligence services with Convention rights of the Applicants.
8. The Investigatory Powers Tribunal has no power to issue a declaration that the legislative
scheme subject to challenge in the present complaint is incompatible with the Convention
rights of the media/journalist Applicants. This is clear from the terms of Section 4 (5) of the
Human Rights Act 1998 which does not define the Investigatory Powers Tribunal as a
“Court” for the purposes of Section 4 of the Human Rights Act with the consequence that it
4
![Page 5: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/5.jpg)
has no power to make a Section 4 (2) declaration of incompatibility. Thus, even if the
Applicants were to bring the present complaint in respect of the statutory regime laid down
in Primary legislation before the Investigatory Powers Tribunal, the Tribunal would have no
power to declare the scheme incompatible with the Applicants’ Convention rights (still less
require that any such incompatibility be legally remedied under domestic law).
9. Furthermore, although the High Court does have a general power to issue a declaration of
incompatibility in relation to domestic legislation, the jurisdiction of the High Court (and,
indeed, any other superior court in the United Kingdom) to hear a challenge to a decision
made by the Investigatory Powers Tribunal is ousted by Section 67 (8) of RIPA. This states
that “[e]xcept to such extent as the Secretary of State may by order otherwise provide,
determinations, awards, orders and other decisions of the Tribunal (including decisions as
to whether they have jurisdiction) shall not be subject to appeal or be liable to be
questioned in any court”. In R (A) v. B [2009] UKSC 12, it was confirmed that the
Investigatory Powers Tribunal has exclusive and final jurisdiction in respect of such
proceedings. There is therefore no possibility of the Applicants obtaining a Section 4
declaration from the domestic courts to the effect that the statutory scheme in RIPA 2000
and elsewhere is incompatible with their Convention rights as a media and newsgathering
organization / a journalist. Although the Investigatory Powers Tribunal may be able to issue
a judgment offering an opinion as to the compatibility of the statutory scheme with the
Applicants’ Convention rights, such an opinion (being other than a declaration under Section
4 of the Human Rights Act 1998) would be of no legal or practical benefit to the Applicants.
The Tribunal does not have the power to annul any of the provisions about which complaint
is made nor does it have power to declare unlawful the statutory scheme or the provisions
of which it is comprised (See Kennedy v. the United Kingdom, Merits, Application No.
26839/05, [§ 119]). There is therefore no effective remedy available for the applicants to
exhaust to challenge the legislative scheme in question.
10. In any event, it is well established in the case law of the ECtHR that a declaration of
incompatibility under s.4 of the Human Rights Act does not in itself yet constitute an
effective remedy for the purposes of the Convention. In Kennedy, the Court held that “the
practice of giving effect to the national courts’ declarations of incompatibility by amendment
of offending legislation is not yet sufficiently certain as to indicate that section 4 of the
Human Rights Act is to be interpreted as imposing a binding obligation giving rise to a
remedy which an applicant is required to exhaust” (Kennedy v. the United Kingdom, Merits,
Application No. 26839/05, [§ 120]; Burden v. the United Kingdom, [GC], (2008) 47 E.H.R.R.
5
![Page 6: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/6.jpg)
38). The position remains the same today. A declaration of incompatibility still does not
impose any obligation to amend or supplement legislation incompatible with an individual’s
Convention rights. Furthermore, the challenge here is, in part, to the insufficiency of
legislative protection, including safeguards, in respect of the Applicant’s Convention rights.
A declaration of incompatibility (even if it were available) offers no redress where there is
an insufficiency of legislative protection and insufficient safeguards enshrined in law. Courts
in the UK have no power to require Parliament to legislate, even where there exists an
insufficiency of safeguards to afford protection to fundamental Convention rights in a
particular context. In short, the Applicants’ application cannot be rejected on grounds of
failure to exhaust domestic remedies.
C. STATEMENT OF FACTS
(I) The Applicants
The First Applicant
11. The Bureau of Investigative Journalism (“the Bureau” or “BIJ”) is an independent not-for-profit
organisation. Established in April 2010, the Bureau works to produce high quality, public
interest journalism. It is philanthropically funded. The Bureau undertakes in depth
investigations into the governance of public, private and third sector organisations and their
influence. Its content is freely available under a Creative Commons licence.
12. BIJ collaborates with other, larger, media organizations so as to ensure that the product of its
investigation work reaches as wide an audience as is possible. To this end it has worked to
produce broadcast/published content with BBC Panorama, BBC Newsnight, Channel 4
Dispatches, Channel 4 News, al Jazeera English, the Independent, the Financial Times, the
Daily Telegraph, the Sunday Times, Le Monde, mediapart, the Guardian, the Independent,
the Observer and the Daily Mirror.
13. It will be noted that some of these media organizations are based in the United Kingdom, while
others are based overseas.
14. In 2011 the Bureau won the Thomson Reuters “Reporting Europe Award” for a BBC 4 radio
programme, “Europe’s Missing Millions” (about fraud involving EU regional funding
schemes). Its investigation into drone warfare was shortlisted in the Foreign Press
Association Awards. In 2012 the Bureau and its journalists were shortlisted in four
6
![Page 7: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/7.jpg)
categories at the first Press Gazette British Journalism Awards, which emphasise journalism
in the public interest. Shortlisted investigations included the Bureau’s investigation into
drone warfare and the Bureau’s work in relation to financial lobbying. In 2013 the Bureau’s
drones team won the Martha Gellhorn prize for journalism.
15. Many of the investigations undertaken by the Bureau and its journalists concern issues of high
public importance outside of the territorial jurisdiction of the United Kingdom. Many others
seek to report about such issues concerning the United Kingdom but rely on human sources
or material outside of the United Kingdom.
16. Its investigations, at times, touch on matters of national security or other matters likely to be of
interest to the United Kingdom’s intelligence services or the intelligence services of foreign
countries, including the United States.
17. The Bureau is currently conducting a number of high-profile investigations, often relying on
overseas journalistic sources. The Bureau has, for a number of years, had ongoing a complex
investigation into the practice of covert drone warfare, examining, in particular, drone
warfare in Pakistan, Somalia and Yemen. This investigation has resulted in the publication of
numerous articles by the Bureau considering issues such as the high number of civilian
casualties inflicted by such strikes, the legality or otherwise of these forms of covert
operations,3 the reliability of the means by which intelligence for the targeting of such
strikes is obtained, the sharing of intelligence by the United Kingdom and other countries in
targeting drone strikes4 and the international diplomacy and politics that surrounds drone
warfare. In the course of its investigation into drone warfare, the Bureau has obtained and
reported on confidential government documentation regarding drone strikes. This has
included documentation potentially indicating serious failure to comply with applicable
international law in the conduct of drone strikes.5 In this reporting the Bureau has often
relied on sources of information (material and human) from outside the United Kingdom.
18. In addition, the Bureau has conducted a major investigation into the activities of State agencies
involved in surveillance, “The State of Surveillance”. This examined in particular the global
surveillance industry and surveillance technology. This investigation resulted in published
3 http://www.thebureauinvestigates.com/2012/09/24/us-and-others-given-licence-to-ignore-international-law-in-somalia/
4 http://www.thebureauinvestigates.com/2014/02/20/uk-shared-ops-room-where-drone-targets-were-identified-yemen-president/.
5 See e.g. http://www.thebureauinvestigates.com/2013/07/22/exclusive-leaked-pakistani-report-confirms-high-civilian-death-toll-in-cia-drone-strikes/
7
![Page 8: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/8.jpg)
reports on, for instance, the supply of surveillance software to repressive regimes actively
engaged in committing atrocities against their citizens6 as well as the surveillance capacities
of governments and their intelligence agencies.7
19. Other investigations the Bureau has conducted, often requiring use of overseas journalistic
sources, include investigations into the treatment of prisoners in Afghanistan,8 the hidden
wealth of world leaders,9 the misuse of aid to foreign countries given by the United Kingdom
government,10 and the use of secret justice in UK courts, including in cases involving issues
of national security.11
The Second Applicant
20. Alice Ross, is a reporter with the Bureau of Investigative Journalism. She specializes in national
security and foreign policy. All of her current investigations require her to talk to people and
organisations that are likely to be of interest to the intelligence services. One of these
concerns the use of drones in Pakistan. As part of this, Ms Ross regularly communicates with
individuals located in Pakistan in an attempt to gather information about where the strikes
have occurred and the identity and background of persons killed and injured. BIJ is
presently compiling a database which seeks reliably to identify, insofar as possible, the
number of civilians killed in these strikes. Ms. Ross has spoken to family members and
associates of persons killed in drone strikes. These communications may well be of interest
to the intelligence services, both in the United Kingdom and elsewhere. Ms. Ross is also
involved in an investigation into the deprivation of citizenship by the United Kingdom
government on grounds that the citizens concerned are deemed prejudicial to the vital
interests of the United Kingdom. This work has involved identifying individuals who have
had their British citizenship revoked on purported terrorism grounds and communicating
with individuals connected to some of these persons who are now based in Pakistan,
Afghanistan and Turkey. A number of these individuals are believed to be of interest to, and
monitored by, the United Kingdom’s intelligence services.
(II) The Factual Background to the Application
6 http://www.thebureauinvestigates.com/2011/12/01/british-software-helped-syrian-regime-crush-dissidents/
7 http://www.thebureauinvestigates.com/2011/11/30/the-state-of-surveillance/ 8 http://www.thebureauinvestigates.com/category/projects/prisoners-afghanistan/ 9 http://www.thebureauinvestigates.com/category/projects/rulers-riches/?view=all 10 http://www.thebureauinvestigates.com/category/projects/charitable-aid-projects/?view=all 11 http://www.thebureauinvestigates.com/category/projects/secret-justice/
8
![Page 9: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/9.jpg)
21. The present application is made following the publication of information concerning mass scale
data interception, storage and exploitation by the United Kingdom (in conjunction with
third states, including the United States), in particular through the disclosure of information
by Edward Snowden, a systems administrator and contractor for the US National Security
Agency (“NSA”). The existence of programmes, further described below, for mass scale data
interception and exploitation has been confirmed by the President of the United States and
other senior US government officials.12 The detail of these programmes of data interception,
so far as it is known, is set out below.
Tempora
22. In June 2013 it was disclosed that GCHQ had placed data interceptors on fibre optic cables
conveying internet data in and out of the United Kingdom. These UK-based fibre optic cables
include transatlantic cables between the United States and Europe, giving GCHQ access to a
vast amount of data transiting through these transatlantic cables to destinations in the UK
or to external destinations in third States. It is understood that this is termed the Tempora
programme. It has been running since around October 2011 and it is reported to have been
created as part of the United Kingdom’s, Mastering the Internet (“MTI”) programme for
mass communications interception.
23. It is understood that through the Tempora programme, all content data is stored for 3 days,
while metadata is stored for 30 days.13 All data conveyed by means of such cables is
susceptible to this interception, including internet and telephone communications data as
well as any associated identifying metadata.14 It is understood that interceptors have been
placed on at least 200 data channels carried by fibre optic cables, near to the points where
they come ashore. It is reported that this interception occurs with the cooperation of the
private companies which operate the cables. These cables carry the vast majority of
electronic telecommunications into and out of the United Kingdom. Moreover a vast
quantity of external data is routed via these cables between Continental Europe and North
America.
12 See “Clapper admits secret NSA surveillance program to access user data”, Guardian, 7 June 2013: http://www.theguardian.com/world/2013/jun/07/clapper-secret-nsa-surveillance-prism and Transcript: Obama’s Remarks on NSA Controversy, Wall Street Journal, 7 June 2013: http://blogs.wsj.com/washwire/2013/06/07/transcript-what-obama-said-on-nsa-controversy/.
13 “GCHQ taps fibre-optic cables for secret access to world's communications”, The Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa
14 Ibid.
9
![Page 10: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/10.jpg)
24. The programme’s technology allows the interception of data on a gargantuan scale. It is
reported that this method of interception gives the United Kingdom intelligence services
access to around 21 Petabytes of data a day (equivalent to 21 thousand terabytes). To
convey the scale of this amount of data, the Guardian report that this is the equivalent to
intercepting all the information in all the books in the British Library, in electronic form, 192
times every day.15
Exploitation of Metadata
25. Importantly, this data includes both “content” and “metacontent”. In this context the term
“content” connotes the substance of the communicated data. This includes not only emails
but any data which is electronically transferred online, including information stored and
shared by means of software like Dropbox (a programme for the remote storage or sharing
of large quantities of electronic data) or stored through similar “cloud” computing services.
“Metadata” connotes data about the communicated data, for example records of the means
by which content has been created, concerning the recipient/s, the time at which it is being
sent and where the recipient is located.
26. The media reports about Tempora have described the manner in which intercepted data is
exploited. It is reported that high volume, low-value traffic such as peer to peer downloads
is first sifted out of the metadata and content. The remaining data is then searched using
keywords, email addresses, phone numbers or other identifiers or selectors of interest.
These selectors are understood to have been agreed between both the NSA and GCHQ. In the
region of between 30, 000 and 40,000 selectors are understood to have been identified. 16
Where information of interest is identified a log is created.17
27. It is understood that Tempora operates in conjunction with hugely powerful datamining and
link analysis programmes. Such programmes afford additional means by which metadata,
can be aggregated and exploited. Sophisticated computing tools permit the creation and
analysis of vast datasets to identify embedded patterns and relationships, which can include
personal and professional relationships as well as information regarding an individual or
organization’s network of contacts (and, in turn, their contacts). It can also provide
indication of the nature of the relationship between different persons or organizations, the
strength or significance of that contact. As a result individual pieces of data that previously 15 “GCHQ taps fibre-optic cables for secret access to world's communications”, The Guardian,
21 June 2013: http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa
16 Ibid17 Ibid
10
![Page 11: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/11.jpg)
carried little potential to expose confidential or privileged information can now be used to
do so. Datamining and link analysis can now provide, for example, detailed information
relating to a journalist’s network of human and material sources.
28. There is significant cooperation between the United Kingdom authorities and the NSA in
relation to the operation of Tempora. It is reported that as many as 850,000 US Government
employees and private companies, working in partnership with the US Government, have
access to this information. The direct access of US officials to Tempora and the information
it produces appears to be confirmed by official US government training material, published
in The Guardian.18 In addition, the NSA is reported to have had 250 analysts working full-
time on Tempora data as at May 2012.19
Section 8 (4) Certification Process in Practice
29. The purported, internal legal justification for Tempora has been reported in The Guardian. It is
understood to be authorized by certificates issued to GCHQ under Section 8 (4) of RIPA
which pertains to external communications (as set out further below). The Guardian
reports:
Lawyers at GCHQ speak of having 10 basic certificates, including a "global"
one that covers the agency's support station at Bude in Cornwall, Menwith
Hill in North Yorkshire, and Cyprus”.20
Each certificate, it is understood, permits the interception of external data for a broad
range of purposes including prevention of “terrorism” or “organized crime”, the
protection of “national security” or the promotion of the “economic well-being” of the
United Kingdom. The Guardian reports:
The categories of material have included fraud, drug trafficking and terrorism,
but the criteria at any one time are secret and are not subject to any public
debate. GCHQ's compliance with the certificates is audited by the agency
itself, but the results of those audits are also secret.
An indication of how broad the dragnet can be was laid bare in advice from
GCHQ's lawyers, who said it would be impossible to list the total number of
18 “GCHQ taps fibre-optic cables for secret access to world's communications”, The Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa
19 Ibid. 20 “The Legal Loopholes that Allow GCHQ to Spy on the World”, Guardian, 21 June 2013:
http://www.theguardian.com/uk/2013/jun/21/legal-loopholes-gchq-spy-world
11
![Page 12: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/12.jpg)
people targeted because "this would be an infinite list which we couldn't
manage".21
30. There is no requirement in UK law that these certificates for the interception of external
communications must specify persons, premises or even categories of persons to be
targeted. It is understood that, in practice, there is no such specification. The Foreign
Secretary must approve the renewal of these certificates every six months. It appears that
such approval is a matter of routine.
Global Telecoms Exploitation
The Guardian has also revealed the existence of another UK programme for mass data
interception, called “Global Telecoms Exploitation”. The Guardian reports that the
“documents [it saw] reveal that by last year GCHQ was handling 600m ‘telephone events’
each day, had tapped more than 200 fibre-optic cables and was able to process data from at
least 46 of them at a time”.22
Optic Nerve
31. It has also been reported that GCHQ has engaged in mass scale interception of images and other
data from online conversations between internet users. It is reported that as many of 1.8
million online images were intercepted in a six month period in 2008.23 The Optic Nerve
programme is understood to have been in existence until at least 2012. Information
gathered on the system has been exploited using the NSA’s “Xkeyscore” programme and
image recognition software. It is understood that bulk searches of the data gathered was
limited to metadata but that the interception, storage and collation of the data has been
indiscriminate.24
Prism
21 “GCHQ taps fibre-optic cables for secret access to world's communications”, The Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa
22 “GCHQ taps fibre-optic cables for secret access to world's communications”, The Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa
23 “Optic Nerve: millions of Yahoo webcam images intercepted by GCHQ”, Guardian 28 February 2014: http://www.theguardian.com/world/2014/feb/27/gchq-nsa-webcam-images-internet-yahoo
24 “Optic Nerve: millions of Yahoo webcam images intercepted by GCHQ”, Guardian 28 February 2014: http://www.theguardian.com/world/2014/feb/27/gchq-nsa-webcam-images-internet-yahoo
12
![Page 13: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/13.jpg)
32. Prism is an intelligence gathering system, similar to Tempora, but run by the United States’
National Security Agency (the United States equivalent to GCHQ). The programme enables
the United States to access the full range of internet telecommunications content (images
whether live or still, messages, social networking sites, emails and a range of other content
and metadata).25 This programme enables access to data held on the private servers of large
US internet companies including Google, Facebook, Apple and Skype. It is understood that
the programme does not involve the tapping of communications “in transit” but allows for
access by the NSA to these servers operated by US information technology corporations.
33. The Guardian has suggested that on average over 2,000 Prism related reports about intercepted
communications are made each month by the NSA and more than 77,000 intelligence
reports based on that data had been made by June 2013.26
34. The operation of the Prism system is understood to be justified by reference to US Code § 1881
(a), US Foreign Intelligence and Surveillance Act 1978 which permits “the targeting of
persons reasonably believed to be located outside the United States to acquire foreign
intelligence information”.27 There is no requirement that the surveillance must be
proportionate, nor even that it must be necessary to protect specific interests such as
national security.
35. The NSA is understood to operate another programme of mass scale data interception alongside
Prism. This is called “Upstream” and it provides access to nearly all the traffic passing
through fibre optic cables owned by US-based telecommunications providers, enabling
access to communications content and metadata. Whereas Prism provides access to servers
of major corporations such as Google and Microsoft, Upstream provides collects
communications on fiber cables and infrastructure as data flows past.28 Data collected
25 “NSA Prism program taps in to user data of Apple, Google and others”, Guardian, 7 June 2013: http://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data
26 Ibid. 27 The definition of “foreign intelligence information” is set out in s 1801. It is very broad. Pursuant
to section 1801(e) “foreign intelligence information” includes “information with respect to a foreign power or foreign territory that relates to ... the conduct of the foreign affairs of the United States.” The term “foreign power” is defined in section 1801(a) to include not only foreign governments or entities directed or controlled by foreign governments, but also pursuant to section 1801(a)(5) “a foreign-based political organization, not substantially composed of United States persons.” Foreign-intelligence information thus covers information with respect to any foreign-based political organisation or government that relates to the foreign affairs of the US. It would thus, for example, include the contents of private and lawful discussions by those who are members of, or are communicating with, political organizations or governments that in any way relates to US foreign policy.
28 See “The NSA Slide You Haven’t Seen”, Washington Post, 10 July 2013: http://www.washingtonpost.com/business/economy/the-nsa-slide-you-havent-seen/
13
![Page 14: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/14.jpg)
through Upstream (or Prism) can also be searched and analysed through the NSA’s
Xkeyscore system.
Report of the Intelligence and Security Committee of the United Kingdom Parliament
(“ISC”), 17 July 2013
36. On 17 July 2013 the ISC Published a report following these revelations about mass surveillance
by the intelligence services in the United Kingdom and the United States [Report of
Intelligence and Security Committee, 17 July 2013]. The report deals specifically with the
question of whether GCHQ had obtained evidence, in violation of United Kingdom law,
through making requests for information through the Prism programme. The report notes:
It has been alleged that GCHQ circumvented UK law by using the NSA’s PRISM
programme to access the content of private communications. From the evidence
we have seen, we have concluded that this is unfounded.
We have reviewed the reports that GCHQ produced on the basis of intelligence
sought from the US, and we are satisfied that they conformed with GCHQ’s
statutory duties. The legal authority for this is contained in the Intelligence
Services Act 1994 (emphasis added).
Further, in each case where GCHQ sought information from the US, a warrant
for interception, signed by a Minister, was already in place, in accordance with
the legal safeguards contained in the Regulation of Investigatory Powers Act
2000.
37. The report does not deal with the question of whether the interception, storage and exploitation
of external communications data (e.g. data communicated via the United Kingdom to a
person, place or thing outside the jurisdiction of the United Kingdom) was lawful or whether
the legal framework for this was compatible with the United Kingdom’s domestic law or
international obligations. As regards the finding that the use of information by GCHQ
gathered by the NSA –Prism Programme is compatible with UK law, no elaboration or
analysis is provided (beyond that stated above). Furthermore, the findings of the report are
limited to information “sought from the United States” (see above).29 The ISC did not
consider or investigate information shared spontaneously by the United States or
2013/07/10/32801426-e8e6-11e2-aa9f-c03a72e2d342_story.html 29 “Inquiry Into Snooping Laws as Committee Clears G.C.H.Q.”, Guardian 18 July 2013:
http://www.theguardian.com/world/2013/jul/17/prism-nsa-gchq-review-framework-surveillance
14
![Page 15: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/15.jpg)
information to which the United Kingdom had, in any event, direct access through its
participation in the programmes in question.
D. LEGAL FRAMEWORK
38. The United Kingdom’s intelligence services, their functions and specifically their powers in
respect of the interception of data are regulated, in the main, by three pieces of legislation
the Regulation of Investigatory Powers Act 2000, the Intelligence Services Act 1994 and the
Justice and Security Act 2013.
Regulation of Investigatory Powers Act 2000 (“RIPA”)
39. Part I of RIPA is concerned with the interception, acquisition and disclosure of communications
data. Part II addresses directed or intrusive surveillance or the use of covert human
intelligence sources. For present purposes, Part I comprises the legislative provisions of
most relevance. Part I is divided into two Chapters. Chapter I of Part I deals with the
interception of data. Chapter II of Part I deals with the acquisition and disclosure of
“communications data” (e.g. metadata).
Chapter I, Part I, RIPA 2000; Interception of Data
40. Section 1 (1), RIPA provides as follows:
(1) It shall be an offence for a person intentionally and without lawful authority
to intercept, at any place in the United Kingdom, any communication in the
course of its transmission by means of–(a) a public postal service; or (b) a public
telecommunication system.
41. As regards the concept of “interception”, Section 2 (2), RIPA stipulates:
2(2) For the purposes of this Act [...] a person intercepts a communication in the
course of its transmission by means of a telecommunication system if, and only if,
he–
(a) so modifies or interferes with the system, or its operation,
(b) so monitors transmissions made by means of the system, or
15
![Page 16: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/16.jpg)
(c) so monitors transmissions made by wireless telegraphy to or from apparatus
comprised in the system,
as to make some or all of the contents of the communication available, while being
transmitted, to a person other than the sender or intended recipient of the
communication.
42. Given that it is a criminal offence pursuant to Section 1 (1) of RIPA to intercept public
communications without “lawful authority”, this concept is crucial. It is defined in Section 1
(5) of RIPA, as follows “[c]onduct has lawful authority for the purposes of this section if, and
only if– [...] (b) it takes place in accordance with a warrant under section 5 (“an interception
warrant”); [...]”
43. Section 5, RIPA sets out the power of the Secretary of State to issue an interception warrant.
According to 5 (1) “the Secretary of State may issue a warrant authorising or requiring the
person to whom it is addressed, by any such conduct as may be described in the warrant, to
secure ...”, the interception of communications, the disclosure of intercepted material or the
provision of intercepted materials to other States in accordance with an applicable mutual
assistance treaty. Section 5(6) provides that conduct authorised by an interception warrant
shall be taken to include conduct; as is necessary to undertake in order to do what is
expressly authorised or required by the warrant; for obtaining related communications
data; and required of another by way of assistance to the person to whom the warrant is
addressed (aimed at giving effect to the warrant).
44. Section 5 (2) sets out certain limitations on the exercise of this power, explained in ss.(3)-(5), as
follows:
(2) The Secretary of State shall not issue an interception warrant unless he
believes–
(a) that the warrant is necessary on grounds falling within subsection (3);
and
(b) that the conduct authorised by the warrant is proportionate to what is
sought to be achieved by that conduct.
16
![Page 17: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/17.jpg)
(3) Subject to the following provisions of this section, a warrant is necessary
on grounds falling within this subsection if it is necessary–
(a) in the interests of national security;
(b) for the purpose of preventing or detecting serious crime;
(c) for the purpose of safeguarding the economic well—being of the United
Kingdom; or
(d) for the purpose, in circumstances appearing to the Secretary of State to
be equivalent to those in which he would issue a warrant by virtue of
paragraph (b), of giving effect to the provisions of any international mutual
assistance agreement.
(4) The matters to be taken into account in considering whether the
requirements of subsection (2) are satisfied in the case of any warrant shall
include whether the information which it is thought necessary to obtain under
the warrant could reasonably be obtained by other means.
(5) A warrant shall not be considered necessary on the ground falling within
subsection (3)(c) unless the information which it is thought necessary to obtain
is information relating to the acts or intentions of persons outside the British
Islands.
45. Requirements relating to the contents of warrants are set out in Section 8 of RIPA 2000.
8.— Contents of warrants.
(1) An interception warrant must name or describe either–
(a) one person as the interception subject; or
(b) a single set of premises as the premises in relation to which the
interception to which the warrant relates is to take place.
(2) The provisions of an interception warrant describing communications the
interception of which is authorised or required by the warrant must comprise
one or more schedules setting out the addresses, numbers, apparatus or other
17
![Page 18: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/18.jpg)
factors, or combination of factors, that are to be used for identifying the
communications that may be or are to be intercepted.
(3) Any factor or combination of factors set out in accordance with subsection
(2) must be one that identifies communications which are likely to be or to
include–
(a) communications from, or intended for, the person named or
described in the warrant in accordance with subsection (1); or
(b) communications originating on, or intended for transmission to, the
premises so named or described.
(4) Subsections (1) and (2) shall not apply to an interception warrant if–
(a) the description of communications to which the warrant relates
confines the conduct authorised or required by the warrant to
conduct falling within subsection (5); and
(b) at the time of the issue of the warrant, a certificate applicable to
the warrant has been issued by the Secretary of State certifying–
(i) the descriptions of intercepted material the examination
of which he considers necessary; and
(ii) that he considers the examination of material of those
descriptions necessary as mentioned in section 5(3)(a), (b)
or (c)” [ e.g. national security etc ].
(5) Conduct falls within this subsection if it consists in–
(a) the interception of external communications in the course of
their transmission by means of a telecommunication system; and
(b) any conduct authorised in relation to any such interception by
section 5(6).
18
![Page 19: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/19.jpg)
(6) A certificate for the purposes of subsection (4) shall not be issued
except under the hand of the Secretary of State. (emphasis added).
46. The definition of “external communications” is therefore critical. It is defined in section 20 of the
Act in the following terms “external communication means a communication sent or
received outside the British Islands”. “Communication” is, in turn, defined in Section 81 (1)
of RIPA as “(a) … anything transmitted by means of a postal service; (b) anything
comprising speech, music, sounds, visual images or data of any description; and (c)
signals serving either for the impartation of anything between persons, between a
person and a thing or between things or for the actuation or control of any apparatus”
(emphasis added).
Section 8 (4) (b) Certificate
47. Data of any description sent from a thing (e.g. a computer or server etc) located in the United
Kingdom to a thing (e.g. a computer, server, database etc) outside the United Kingdom,
constitutes an “external communication” under RIPA 2000. So does such data passing from a
“thing” located outside the United Kingdom to a person or place inside the United Kingdom.
It also encompasses data, of course, which is communicated entirely outside the United
Kingdom. Such material may be intercepted under RIPA 2000 by reference to a very broad,
generic description of the material, identified in a Section 8 (4) (b) certificate, as set out
above. According to Section 9 (1) “[a]n interception warrant– (a) shall cease to have effect
at the end of the relevant period; but (b) may be renewed, at any time before the end of that
period, by an instrument under the hand of the Secretary of State [...]”.
48. As regards the duration of the “relevant period” for a warrant issued by the Secretary of State in
respect of the interception of external communications, Section 9(6)(ab) states that “in
relation to an unrenewed warrant which is endorsed under the hand of the Secretary of
State with a statement that the issue of the warrant is believed to be necessary on grounds
falling within section 5(3)(a) or (c), means the period of six months beginning with the day
of the warrant's issue...”
General Safeguards
49. A number of general safeguards are set out in Section 15 RIPA 2000 which require “the
Secretary of State to ensure, in relation to all interception warrants, that such arrangements
19
![Page 20: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/20.jpg)
are in force as he considers necessary for securing...” the fulfilment of requirements
specified in Section 15 (2) and (3). Subsection (2) stipulates:
(a) the number of persons to whom any of the material or data is disclosed
or otherwise made available,
(b) the extent to which any of the material or data is disclosed or otherwise
made available,
(c) the extent to which any of the material or data is copied, and
(d) the number of copies that are made,
is limited to the minimum that is necessary for the authorised purposes.
50. Section 15(3) requires that “in relation to the intercepted material and any related
communications data...each copy made of any of the material or data (if not destroyed
earlier) is destroyed as soon as there are no longer any grounds for retaining it as necessary
for any of the authorised purposes”
Safeguards for Interception of External Communications
51. Very limited safeguards are also set out in Section 16 dealing with Section 8 (4) warrants
(which concern so-called “external communications”). Section 16 (2) requires that
intercepted material pursuant to a Section 8 (4) certificate may be “read, looked at or
listened to” only so far as it is selected “otherwise than according to a factor which – (a) is
referable to an individual who is known to be for the time being in the British Islands; and
(b) has as its purpose, or one of its purposes, the identification of material contained in
communications sent by him, or intended for him”.
52. The scope and effect of this safeguard is, however, limited by the exception to it set out in
Section 16 (3). This allows the interception of material referable to an individual, (or
individuals) present in the United Kingdom or contained in communications sent or
received by such a person, where: (a) “it is certified by the Secretary of State for the
purposes of section 8(4) that the examination of material selected according to factors
referable to the individual in question is necessary as mentioned in subsection 5(3)(a), (b)
or (c) [e.g. national security etc]; and (b) the material relates only to communications sent
20
![Page 21: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/21.jpg)
during a period specified in the certificate that is no longer than the permitted maximum”.
The Maximum period is dealt with in Section 16 (3) (3A). It is six months in the case of
national security and three months in other cases.
The Broad Concepts of National Security and Economic Well-being and the Prevention and
Detection of Serious Crime
53. “External communications” may thus be intercepted (en masse) by reference to a description of
the communications where the Secretary of State “considers the examination of material of
those descriptions necessary” (a) in the interests of national security; (b) for the purpose of
preventing or detecting serious crime; (c) for the purpose of safeguarding the economic well
—being of the United Kingdom. The concepts of “national security”, the “prevention or
detection of serious crime” and “the economic well-being of the United Kingdom” as used in
RIPA 2000 are therefore crucial in understanding the nature and scope of the authorisation
powers conferred on the Secretary of State and the resulting powers of the intelligence
services where a RIPA section 8 (4) certificate is signed off by the Secretary of State.
54. The Secretary of State’s approach to the interpretation of the term “the economic well-being of
the United Kingdom”, the is set out in Section 4.4 of the Interception of Communications:
Code of Practice. This states:
In exercising his power to issue an interception warrant for the purpose of
safeguarding the economic well-being of the United Kingdom (as provided for
by section 5(3)(c) of the Act), the Secretary of State will consider whether the
economic well-being of the United Kingdom which is to be safeguarded is, on
the facts of each case, directly related to state security. The term “state
security”, which is used in Directive 97/66/EC (concerning the processing of
personal data and the protection of privacy in the telecommunications
sector), should be interpreted in the same way as the term “national security”
which is used elsewhere in the Act and this Code. The Secretary of State will
not issue a warrant on section 5(3)(c) grounds if this direct link between the
economic well-being of the United Kingdom and state security is not
established. Any application for a warrant on section 5(3)(c) grounds should
therefore explain how, in the applicant’s view, the economic well-being of the
United Kingdom which is to be safeguarded is directly related to state security
on the facts of the case.
21
![Page 22: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/22.jpg)
55. The concept of “national security” in the Law of England and Wales is a wide one. The leading
case is Secretary of State for the Home Department v. Rehman [2003] 1 AC 153. Lord Wolf,
giving judgment in the Court of Appeal, held that the Secretary of State had “correctly
submitted that "national security" is a protean concept, "designed to encompass the many,
varied and (it may be) unpredictable ways in which the security of the nation may best be
promoted” (Secretary of State for the Home Department v. Rehman, [2013] 3 W.L.R. 1227, [§
35]). In its later judgment, upholding the decision of the Court of Appeal, the Judicial
Committee of the House of Lords emphasised that the question of the nature and scope of
the Secretary of State’s national security interests was a matter involving considerable
elements of policy and a matter for the Secretary of State’s discretion (See e.g. Secretary of
State v. Rehman [2003] 1 AC 153, [§ 17]).
56. The concept of “serious crime” is not defined in RIPA 2000. It offers substantial discretion to the
decision taker as to the offence or offences which may fall within its ambit. An uncertain
number of crimes fall within its ambit, the concept of serious criminality being an inherently
relative concept.
Interception of Communications Code of Practice
57. Section 71 of RIPA 2000 requires that the Secretary of State “shall issue one or more codes of
practice relating to the exercise and performance of the powers...” set out in Parts I, II and III
of the 2000 Act. In exercise of this power the Secretary of State has issued codes including
the Interception of Communications: Code of Practice and the Acquisition and Disclosure of
Communications Data: Code of Practice. The Former code regulates the interception of
communications under Chapter I, Part I of RIPA, in particular the interception of
communications content. The latter Code concerns the acquisition of “communications data”
by public authorities or the intelligence services (e.g. metadata).
58. The Codes of Practice are not, as such, legally binding. Section 72 of RIPA 2000 states that “[a]
person exercising or performing any power or duty in relation to which provision may be
made by a code of practice under section 71 shall, in doing so, “have regard to the
provisions (so far as they are applicable) of every code of practice for the time being
in force under that section” (emphasis added).
59. Chapter 6 of the Interception of Communications Code of Practice sets out some general
safeguards in relation to the interception of data with a warrant. Section 6.1 and 6.2
provides:
22
![Page 23: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/23.jpg)
All material (including related communications data) intercepted under the
authority of a warrant complying with section 8(l) or section 8(4) of the Act must
be handled in accordance with safeguards which the Secretary of State has
approved in conformity with the duty imposed upon him by the Act. These
safeguards are made available to the Interception of Communications
Commissioner, and they must meet the requirements of section 15 of the Act
which are set out below. In addition, the safeguards in section 16 of the Act apply
to warrants complying with section 8(4). Any breach of these safeguards must be
reported to the Interception of Communications Commissioner.
Section 15 of the Act requires that disclosure, copying and retention of intercept
material be limited to the minimum necessary for the authorised purposes. The
authorised purposes defined in section 15(4) of the Act include: if the material
continues to be, or is likely to become, necessary for any of the purposes set out
in section 5(3) – namely, in the interests of national security, for the purpose of
preventing or detecting serious crime, for the purpose of safeguarding the
economic wellbeing of the United Kingdom.
60. As regards the dissemination of intercepted material, the Code provides that “[t]he number of
persons to whom any of the material is disclosed, and the extent of disclosure, must be
limited to the minimum that is necessary for the authorised purposes set out in section
15(4) of the Act”. As regards destruction, Section 6.8 provides that “[i]ntercepted material,
and all copies, extracts and summaries which can be identified as the product of an
interception, must be securely destroyed as soon as it is no longer needed for any of the
authorised purposes”.
61. A number of sections of the Interception of Communications Code deal with the question of
confidentiality. These are in Chapter 3. Section 3.1 states:
3.1 Consideration should be given to any infringement of the privacy of individuals
who are not the subject of the intended interception, especially where
communications relating to religious, medical, journalistic or legally privileged
material may be involved.
23
![Page 24: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/24.jpg)
An application for an interception warrant should draw attention to any
circumstances which give rise to an unusual degree of collateral infringement of
privacy, and this will be taken into account by the Secretary of State when
considering a warrant application. Should an interception operation reach the
point where individuals other than the subject of the authorisation are identified
as directly relevant to the operation, consideration should be given to applying for
separate warrants covering those individuals.
Confidential Information
3.2 Particular consideration should also be given in cases where the subject of the
interception might reasonably assume a high degree of privacy, or where
confidential information is involved. Confidential information consists of matters
subject to legal privilege, confidential personal information or confidential
journalistic material (see paragraphs 3.9-3.11). For example, extra consideration
should be given where interception might involve communications between a
minister of religion and an individual relating to the latter’s spiritual welfare, or
where matters of medical or journalistic confidentiality or legal privilege may be
involved.
62. The Code does not set out specific safeguards for the protection of journalistically confidential
information. It does, however, state that “similar considerations” apply in the treatment of
journalistically privileged material as apply in respect of those applicable to legally
privileged material. As regards the latter, Section 3.6 states:
In general, any application for a warrant which is likely to result in the
interception of legally privileged communications should include, in addition to
the reasons why it is considered necessary for the interception to take place, an
assessment of how likely it is that communications which are subject to legal
privilege will be intercepted.
In addition, it should state whether the purpose (or one of the purposes) of the
interception is to obtain privileged communications. This assessment will be taken
into account by the Secretary of State in deciding whether an interception is
necessary under section 5(3) of the Act and whether it is proportionate.
24
![Page 25: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/25.jpg)
Where a lawyer is the subject of an interception, it is possible that a substantial
proportion of the communications which will be intercepted will be between the
lawyer and his client(s) and will be subject to legal privilege. Any case where a
lawyer is the subject of an investigation should be notified to the Interception of
Communications Commissioner during his inspections and any material which has
been retained should be made available to him if requested.
63. No further guidance is provided as to what exceptions are permitted to this “general”
requirement to identify the necessity of intercepting material that is likely to be legally
privileged. There is no indication that this requirement is applicable in principle (or applied
in practice) to the mass interception of “external communications” now revealed by the
media (but not acknowledged in the Code).
64. As regards journalistic information, the guidance states somewhat vaguely [at 3.9]:
Similar consideration to that given to legally privileged communications must also
be given to the interception of communications that involve confidential personal
information and confidential journalistic material. [...] Confidential journalistic
material includes material acquired or created for the purposes of journalism and
held subject to an undertaking to hold it in confidence, as well as communications
resulting in information being acquired for the purposes of journalism and held
subject to such an undertaking.
65. No further guidance is given as to what “similar consideration” means in this context or as to
precisely how the “consideration” given to the protection of journalistically privileged
material ought to be “similar” to legally privileged material.
Chapter II, Part I, RIPA: Acquisition and Disclosure of Communications Data
66. A very different (and less rigorous) legal regime controls the interception and disclosure of
“communications data” (e.g. metadata) than that which regulates communications content.
The rationale for this appears to be that the interception and disclosure of “communications
data” is necessarily less intrusive of privacy or journalistic confidentiality than the
interception of the content of data. For the reasons set out below it is submitted that this
apparent rationale is wholly misconceived.
Communications Data
25
![Page 26: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/26.jpg)
67. Communications data, in simple terms, refers to data about communications. The term is
defined in Section 21 (4) RIPA 2000 as including:
(a) any traffic data comprised in or attached to a communication (whether by the
sender or otherwise) for the purposes of any postal service or
telecommunication system by means of which it is being or may be
transmitted;
(b) any information which includes none of the contents of a communication
(apart from any information falling within paragraph (a)) and is about the use
made by any person–
(i) of any postal service or telecommunications service; or
(ii) in connection with the provision to or use by any person of any
telecommunications service, of any part of a telecommunication
system;
(c) any information not falling within paragraph (a) or (b) that is held or obtained,
in relation to persons to whom he provides the service, by a person providing a
postal service or telecommunications service.
68. “Traffic data” is an important term in understanding the concept of “communications data”. It is
defined in section 21 (6), RIPA 2000 as meaning:
(a) any data identifying, or purporting to identify, any person, apparatus or
location to or from which the communication is or may be transmitted;
(b) any data identifying or selecting, or purporting to identify or select, apparatus
through which, or by means of which, the communication is or may be
transmitted;
(c) any data comprising signals for the actuation of apparatus used for the
purposes of a telecommunication system for effecting (in whole or in part) the
transmission of any communication, and
26
![Page 27: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/27.jpg)
(d) any data identifying the data or other data as data comprised in or attached to
a particular communication,
but that expression includes data identifying a computer file or computer program
access to which is obtained, or which is run, by means of the communication to the
extent only that the file or program is identified by reference to the apparatus in
which it is stored.
69. Section 21 (7) further clarifies:
(a) references, in relation to traffic data comprising signals for the actuation of
apparatus, to a telecommunication system by means of which a communication
is being or may be transmitted include references to any telecommunication
system in which that apparatus is comprised; and (b) references to traffic data
being attached to a communication include references to the data and the
communication being logically associated with each other;
70. Authorizations for interception/disclosure of communications data are governed by section 22
of RIPA. The safeguards are much less stringent than those that apply in relation to contents
data.
Authorization of Interception or Disclosure or of Communications Data
71. Section 21(2) of RIPA 2000 makes it lawful to intercept or disclose “communications data”
where such conduct is authorized or required by an authorisation or notice under Chapter
II, Part I of RIPA or where “the conduct is in accordance with, or in pursuance of, the
authorisation or requirement”. Authorization is provided, under Section 22 RIPA by
“designated persons”. Section 22 (3) provides that “... the designated person may grant an
authorisation for persons holding offices, ranks or positions with the same relevant public
authority as the designated person to engage in any conduct to which this Chapter applies”.
Thus, the public body seeking the “communications data” in question is also the public body,
through its designated person, able to grant authorization for such data to be intercepted
and disclosed. This is subject to a requirement of proportionality under Section 22 (5)
(assessed by the designated person). Section 22 (5) states that “[t]he designated person
shall not grant an authorisation under subsection (3)... unless he believes that obtaining the
27
![Page 28: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/28.jpg)
data in question by the conduct authorised or required by the authorisation or notice is
proportionate to what is sought to be achieved by so obtaining the data”.
72. The public bodies with designated persons empowered to authorise the interception
communications data under RIPA (or to order a telecommunications operator to disclose
such data) currently includes the police and law enforcement and intelligence services; a
number of government departments including the Home Office, Ministry of Justice, and
Ministry of Transport; various emergency services (eg, fire and ambulance services etc.);
local authorities and National Health Service Trusts; and an assorted range of more than
100 other public bodies including the Charity Commission, the Food Standards Agency and
the Pensions Regulator. Secondary legislation defines the necessary rank of each person
empowered to obtain communications data in each of these organizations (see Schedule 1,
Regulation of Investigatory Powers (Communications Data) Order 2010/480).
Permissible Bases for Authorization – communications data
73. The basis on which “communications data” may be disclosed is also addressed in RIPA Section
22. This provides that a designated person may require communication service providers to
provide data (where that person believes it “necessary” and proportionate) on the following
grounds in s.22(2), namely:
(a) in the interests of national security; (b) for the purpose of preventing or
detecting crime or of preventing disorder; (c) in the interests of the economic
well-being of the United Kingdom; (d) in the interests of public safety; (e) for
the purpose of protecting public health; (f) for the purpose of assessing or
collecting any tax, duty, levy or other imposition, contribution or charge
payable to a government department; (g) for the purpose, in an emergency,
of preventing death or injury or any damage to a person's physical or mental
health, or of mitigating any injury or damage to a person's physical or mental
health; or (h) for any purpose (not falling within paragraphs (a) to (g)) which
is specified for the purposes of this subsection by an order made by the
Secretary of State.
74. The range of bases on which communications data may be intercepted and disclosed is
therefore very broad indeed.
28
![Page 29: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/29.jpg)
75. A person known as a “Single Point of Contact” may be appointed and trained to facilitate “the
lawful acquisition of communications data and effective co-operation between a public
authority and a Communication Service Provider (“CSP”) (See Acquisition and Disclosure of
Communications Data: Code of Practice, [§ 23]). The SPC may advise a designated person as
to the legal requirements (including under the ECHR) regarding the disclosure of data.
There is no obligation to give such advice in each case and, further, no obligation on the
designated person to accept it. The role of the SPC is described in the Code of Practice as to
“encourage the public authority to regulate itself”. (Acquisition and Disclosure of
Communications Data: Code of Practice, [§ 24]).
Acquisition and Disclosure of Communications Data: Code of Practice
76. In contrast to the Interception of Communications Code of Practice, there are no safeguards
whatsoever with regard to the protection of journalistically privileged or confidential
material (including, for instance, the identity or whereabouts of sources or the location of
material to which they have access). Designated persons are not specifically required to
given “particular consideration” the question of whether the interception or disclosure of
communications data may reveal privileged or confidential information.
77. Moreover, there is no rule against designated persons granting authorizations in operations or
investigations in which they are involved. This is clear from Section 3:11 of the Guidance
which states:
Designated persons should not be responsible for granting authorisations or
giving notices in relation to investigations or operations in which they are
directly involved, although it is recognised that this may sometimes be
unavoidable, especially in the case of small organisations or where it is necessary
to act urgently or for security reasons. Where a designated person is directly
involved in the investigation or operation their involvement and their
justification for undertaking the role of the designated person must be explicit in
their recorded considerations.
78. As regards the authorization itself, Section 3:28 of the Code of Practice states that it must: be in
writing or in a manner which produced a record of it having been granted; “describe the
conduct which is authorised and describe the communications data to be acquired by that
conduct specifying, where relevant, any historic or future date(s) and, where appropriate,
29
![Page 30: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/30.jpg)
time period(s)”; specify the purpose for which authorization has been granted; and record
the date of authorization.
Oversight of Investigatory Powers
79. Section 57 RIPA creates the office of Interception of Communications Commissioner. The
Commissioner is required to supervise the exercise of the functions under Chapters I and II
of Part I of the Act, and to notify the Prime Minister of any contraventions of the Act. These
reports are to be placed before Parliament but may be redacted. Section 59 RIPA provides
for the appointment of an Intelligence Services Commissioner required to supervise the
exercise of functions of the intelligence services. The Commissioner must also report to the
Prime Minister who, again, must place the report before Parliament.
80. The ISC, whose members are drawn from Parliament and appointed by the Prime Minister, also
has a role in overseeing the intelligence services. The ISC’s powers are set out in the Justice
and Security Act 2013. Its role is to oversee the expenditure, administration, policy and
operations of the intelligence services (Section 2 of the 2013 Act). It prepares an annual
report for Parliament on the discharge of its functions. It must first send this report to the
PM and the report may again be redacted before being placed before Parliament.
81. Section 65 RIPA establishes the Investigatory Powers Tribunal. The Tribunal is granted
exclusive jurisdiction over any judicial review or civil claim in respect of the compatibility of
the interception of communications by the intelligence services with rights under the ECHR.
In R (A) v. B [2009] UKSC 12, it was confirmed that the IPT has exclusive and final
jurisdiction in respect of such proceedings, which cannot be brought before the courts.
Section 68 (1) of RIPA 2000 empowers the Tribunal to determine its own rules of
procedure. These are enshrined in the Investigatory Powers Tribunal Rules S.I 2000/2665.
82. Very few claims have ever been upheld by the IPT. None have ever been upheld against the
intelligence services. The official figures are set out below:
Year Complaints Upheld
2001 95 0
2002 137 0
2003 110 0
2004 90 0
30
![Page 31: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/31.jpg)
2005 80 2
2006 86 0
2007 66 0
2008 136 2
2009 157 1
2010 164 6
2011 180 0
2012 168 0
Total 1469 11
83. The Investigatory Powers Tribunal has no power to make a declaration of incompatibility in
respect of the legislative scheme under challenge in the present case. The power of a court
in England and Wales to make a declaration of incompatibility is set out in Section 4 of the
Human Rights Act 1998. According to Section 4 (2), “[i]f the court is satisfied that the
provision is incompatible with a Convention right, it may make a declaration of that
incompatibility”. Under Section 4 (4) “a court” may make such a declaration where satisfied:
(a) that the provision is incompatible with a Convention right, and (b) that
(disregarding any possibility of revocation) the primary legislation concerned
prevents removal of the incompatibility...”
84. The term “court” is defined in Section 4 (5) as “the Supreme Court; the Judicial Committee of the
Privy Council; the Court Martial Appeal Court; in Scotland, the High Court of Justiciary
sitting otherwise than as a trial court or the Court of Session; in England and Wales or
Northern Ireland, the High Court or the Court of Appeal; the Court of Protection, in any
matter being dealt with by the President of the Family Division, the Chancellor of the High
Court or a puisne judge of the High Court”. The Investigatory Powers Tribunal is not a court.
85. Moreover, section 67 (8) of RIPA, ousts the jurisdiction of the High Court to judicially review the
decisions of the IPT. It states that “[e]xcept to such extent as the Secretary of State may by
order otherwise provide, determinations, awards, orders and other decisions of the
Tribunal (including decisions as to whether they have jurisdiction) shall not be subject to
appeal or be liable to be questioned in any court”. No order permitting the decisions of the
IPT to be questioned in any other court has been made by the Secretary of State.
Non-Binding Guidance and Principles
31
![Page 32: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/32.jpg)
86. Several international instruments concern the protection of journalistic sources. These include
amongst others: the Resolution on Journalistic Freedoms and Human Rights, adopted at the
4th European Ministerial Conference on Mass Media Policy (Prague, 7-8 December 1994);
and the Resolution on the Confidentiality of Journalists’ Sources by the European Parliament
(18 January 1994, Official Journal of the European Communities No. C 44/34).
87. Recommendation No. R(2000) 7 on the right of journalists not to disclose their sources of
information was adopted by the Committee of Ministers of the Council of Europe on 8 March
2000 and states, in so far as relevant: “[The Committee of Ministers] Recommends to the
governments of member States:
1. to implement in their domestic law and practice the principles appended to
this recommendation,
2. to disseminate widely this recommendation and its appended principles,
where appropriate accompanied by a translation, and
3. to bring them in particular to the attention of public authorities, police
authorities and the judiciary as well as to make them available to journalists, the
media and their professional organisations.
88. The Appendix to Recommendation No. R (2000) 7 states:
Principles concerning the right of journalists not to disclose their sources of
information
Definitions
For the purposes of this Recommendation:
a. the term ‘journalist’ means any natural or legal person who is regularly or
professionally engaged in the collection and dissemination of information to the
public via any means of mass communication;
b. the term ‘information’ means any statement of fact, opinion or idea in the
form of text, sound and/or picture;
c. the term ‘source’ means any person who provides information to a journalist;
32
![Page 33: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/33.jpg)
d. the term ‘information identifying a source’ means, as far as this is likely to
lead to the identification of a source:
i. the name and personal data as well as voice and image of a source,
ii. the factual circumstances of acquiring information from a source by a
journalist,
iii. the unpublished content of the information provided by a source to a
journalist, and
iv. personal data of journalists and their employers related to their
professional work.
Principle 1 (Right of non-disclosure of journalists)
Domestic law and practice in member States should provide for explicit and
clear protection of the right of journalists not to disclose information identifying
a source in accordance with Article 10 of the Convention for the Protection of
Human Rights and Fundamental Freedoms (hereinafter: the Convention) and the
principles established herein, which are to be considered as minimum standards
for the respect of this right.
Principle 2 (Right of non-disclosure of other persons)
Other persons who, by their professional relations with journalists, acquire
knowledge of information identifying a source through the collection, editorial
processing or dissemination of this information, should equally be protected
under the principles established herein.
Principle 6 (Interception of communication, surveillance and judicial search and
seizure)
a. The following measures should not be applied if their purpose is to
circumvent the right of journalists, under the terms of these principles, not to
disclose information identifying a source:
i. interception orders or actions concerning communication or
correspondence of journalists or their employers,
ii. surveillance orders or actions concerning journalists, their contacts or
their employers, or
33
![Page 34: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/34.jpg)
iii. search or seizure orders or actions concerning the private or business
premises, belongings or correspondence of journalists or their employers
or personal data related to their professional work.
b. Where information identifying a source has been properly obtained by police
or judicial authorities by any of the above actions, although this might not have
been the purpose of these actions, measures should be taken to prevent the
subsequent use of this information as evidence before courts, unless the
disclosure would be justified under Principle 3.
E. ADMISSIBILITY
89. No effective remedy for the matters raised in the present application exists in UK law. The only
avenue in the domestic legal system by which the media/journalist Applicants could bring
their present complaint the Investigatory Powers Tribunal. As indicated above, by virtue of
Section 65 (2) (a) of RIPA 2000, the Tribunal is the “only appropriate tribunal” for the
purposes of challenging either the interception of communications generally or to the
compatibility of the conduct of the intelligence services with Convention rights of the
Applicants.
90. As also indicated above the Investigatory Powers Tribunal has no power to issue a declaration
that the legislative scheme subject to challenge in the present complaint is incompatible
with the Convention rights of the media/journalist Applicants. This is clear from the terms
of Section 4 (5) of the Human Rights Act 1998 which does not define the Investigatory
Powers Tribunal as a “Court” for the purposes of Section 4 of the Human Rights Act with the
consequence that it has no power to make a Section 4 (2) declaration of incompatibility.
Thus, even if the Applicants were to bring the present complaint in respect of the statutory
regime laid down in Primary legislation before the Investigatory Powers Tribunal, the
Tribunal would have no power to declare the scheme incompatible with the Applicants’
Convention rights (still less require that any such incompatibility be legally remedied under
domestic law).
91. Furthermore, although the High Court does have a general power to issue a declaration of
incompatibility in relation to domestic legislation, the jurisdiction of the High Court (and,
indeed, any other superior court in the United Kingdom) to hear a challenge to a decision
34
![Page 35: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/35.jpg)
made by the Investigatory Powers Tribunal is ousted by Section 67 (8) of RIPA. This states
that “[e]xcept to such extent as the Secretary of State may by order otherwise provide,
determinations, awards, orders and other decisions of the Tribunal (including decisions as
to whether they have jurisdiction) shall not be subject to appeal or be liable to be
questioned in any court”. In R (A) v. B [2009] UKSC 12, it was confirmed that the
Investigatory Powers Tribunal has exclusive and final jurisdiction in respect of such
proceedings. There is therefore no possibility of the Applicants obtaining a Section 4
declaration from the domestic courts to the effect that the statutory scheme in RIPA 2000
and elsewhere is incompatible with their Convention rights as a media and newsgathering
organization / a journalist. Although the Investigatory Powers Tribunal may be able to issue
a judgment offering an opinion as to the compatibility of the statutory scheme with the
Applicants’ Convention rights, such an opinion (being other than a declaration under Section
4 of the Human Rights Act 1998) would be of no legal or practical benefit to the Applicants.
The Tribunal does not have the power to annul any of the provisions about which complaint
is made nor does it have power to declare unlawful the statutory scheme or the provisions
of which it is comprised (See Kennedy v. the United Kingdom, Merits, Application No.
26839/05, [§ 119]).
92. In any event, it is well established in the case law of the ECtHR that a declaration of
incompatibility under s.4 of the Human Rights Act does not in itself yet constitute an
effective remedy for the purposes of the Convention. In Kennedy, the Court held that “the
practice of giving effect to the national courts’ declarations of incompatibility by amendment
of offending legislation is not yet sufficiently certain as to indicate that section 4 of the
Human Rights Act is to be interpreted as imposing a binding obligation giving rise to a
remedy which an applicant is required to exhaust” (Kennedy v. the United Kingdom, Merits,
Application No. 26839/05, [§ 120]; Burden v. the United Kingdom, [GC], (2008) 47 E.H.R.R.
38). The position remains the same today. A declaration of incompatibility still does not
impose any obligation to amend or supplement legislation incompatible with an individual’s
Convention rights. Furthermore, the challenge here is, in part, to the insufficiency of
legislative protection, including safeguards, in respect of the Applicant’s Convention rights.
A declaration of incompatibility (even if it were available) offers no redress where there is
an insufficiency of legislative protection and insufficient safeguards enshrined in law. Courts
in the UK have no power to require Parliament to legislate, even where there exists an
insufficiency of safeguards to afford protection to fundamental Convention rights in a
particular context.
35
![Page 36: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/36.jpg)
93. In short, the Applicants’ application cannot be rejected on grounds of failure to exhaust
domestic remedies.
F. SUBMISSIONS
(I) Status of Applicants under Article 34 of the Convention
94. An individual is to be treated as a “victim” for the purposes of Article 34 of the Convention in
cases concerning secret surveillance, even in the absence of evidence demonstrating that
they have been the subject of surveillance. In Klass and others v. Germany, 2 EHRR 214
(1978), [§ 34], the Court held:
[T]he effectiveness (l’effet utile) of the Convention implies in such circumstances
some possibility of having access to the Commission. If this were not so, the
efficiency of the Convention’s enforcement machinery would be materially
weakened. The procedural provisions of the Convention must, in view of the fact
that the Convention and its institutions were set up to protect the individual, be
applied in a manner which serves to make the system of individual applications
efficacious.
The Court therefore accepts that an individual may, under certain conditions,
claim to be the victim of a violation occasioned by the mere existence of secret
measures or of legislation permitting secret measures, without having to allege
that such measures were in fact applied to him.
95. Following this decision the Court has repeatedly held that where an individual establishes “a
reasonable likelihood” of an interference with their right to private and family life as a result
of covert surveillance he or she is entitled to be treated as a “victim” for the purposes of the
Convention. The Court has applied this principle in numerous covert surveillance cases (eg
Klass v. Germany (1989) 2 EHRR 214; Halford v United Kingdom (1997) 24 E.H.R.R. 523 [at §
47-48]; and Nimmo v. the United Kingdom, Decision, 11 October 1988, Application No.
12327/86).
96. Insofar as the Applicant’s case concerns interference with their right to freedom of expression,
specifically journalistic expression, there is no justification, principled or otherwise, for a
different approach to be adopted. Although the Court has developed the Klass v. Germany
jurisprudence in the context of the protection of the right to private and family life, the
36
![Page 37: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/37.jpg)
rationale underpinning the approach to surveillance cases set out in Klass is equally
applicable in circumstances where secret surveillance may interfere with the free
expression rights of journalists and newsgathering organizations. This has been confirmed
by the Court in Weber and Saravia v. Germany (2008) 46 EHRR SE 47, [§§ 144-145]. If it
were not possible to challenge secret surveillance in the absence of concrete evidence that
an individual journalist or media organization has been made subject to it, the effectiveness
of Article 10 in this context would be wholly undermined.
97. Applying this approach, there can be little doubt that there exists a reasonable likelihood that
the Applicants have, in the course of their work, been subject to secret surveillance.
a. BIJ have, for a number of years, been involved in investigating controversial issues
concerning the military, national security and very sensitive aspects of foreign
policy. Since around 2011 BIJ has been involved in a major investigation into drone
strikes by the US armed forces in Pakistan, Somalia and Yemen, touching on matters
including the supply of intelligence material for use in such strikes by the United
Kingdom’s intelligence services, among others. As part of this work, BIJ journalists
have spoken to and been in communication with persons injured in such strikes,
including in a number of instances, persons who may have been targeted by drone
strikes. It is very likely that these communications would be of great interest to the
United Kingdom’s intelligence services (and the intelligence services of other
States); The nature of BIJ’s work is set out in the attached witness statements of
Christo Hird, Director of the BIJ, and in the statement of the Second Applicant, Alice
Ross, a reporter with BIJ. This work includes matters such as the security response
to terrorism, the activities of the intelligence services, drone strikes in Pakistan and
elsewhere, deprivation of citizenship on grounds of national security and so forth.
b. Recently, BIJ has been investigating the use by the Secretary of State of the power to
strip an individual of British Citizenship. The BIJ considers this to be a matter of
considerable public importance generally not explored, to any great extent, by
commercially funded newsgathering organizations. The power of deprivation of
nationality may be used where the Secretary of State considers an individual to pose
a risk seriously prejudicial to the interests of the United Kingdom, including its
national security. Over two dozen individuals have been stripped of citizenship since
2006. Indeed, in two instances, the BIJ has discovered that individuals stripped of
citizenship were subsequently killed in drone strikes in Yemen. In this investigation
37
![Page 38: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/38.jpg)
the Bureau has, on a number occasions, spoken to individuals connected to persons
who have been stripped of their citizenship. The Bureau has also been in
communication with persons (necessarily located overseas) who have been stripped
of citizenship on grounds of conduct “seriously prejudicial” to the vital interests of
the United Kingdom. Again, it is very likely that the Bureau’s contact with these
individuals will be of great interest to the United Kingdom’s intelligence services and
has been intercepted, stored and/or analysed using processes and technology
described above. Further details of this investigation and sensitive work carried out
by BIJ in respect of it is set out in the witness statement of Alice Ross. She explains
that as part of this investigation she has inevitably been in contact both directly and
indirectly, with those likely to be of interest to the intelligence services (not least
since proceedings have been undertaken in a number of instances to deprive the
individuals in question of citizenship on national security grounds). She states: My
work monitoring the use of deprivation of citizenship legislation without question
involves us accessing material and speaking to individuals that are of interest to the
British authorities. These powers [e.g. those in respect of the deprivation of
citizenship] are used against people classed as terrorists, or behaving in a manner
that suggests they are likely to act against the good of the British public. In other
words these people are of high interest to the authorities. And we know from
documents produced in the Special Immigration Court in London that the
intelligence services are monitoring or have monitored many of these individuals.
98. BIJ’s work in relation to the deprivation of citizenship and drones, outlined above, provide
indicative examples of the kind of investigative activities in which the Bureau has been
involved and which are “reasonably likely” (indeed, very likely) to have brought BIJ’s
communications to the attention of the UK intelligence services utilizing the powers
conferred by RIPA 2000 discussed above. Further examples of BIJ’s work in these fields are
set out in the witness statement of Christo Hird, Managing Editor of the Bureau of
Investigative Journalism, and Alice Ross.
99. Furthermore, the very scale of the Tempora programme (and allied programmes) described
above, the vast quantity of data intercepted and the scale and sophistication of the
technology for the analysis and processing of this information also means that it is very
likely that the Applicants’ communications with persons located overseas have been
intercepted. Moreover, the Applicants, in the course of their work, have used software such
as Dropbox (a programme for the remote storage or sharing of large quantities of electronic
38
![Page 39: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/39.jpg)
data) for the storage and transfer of their journalistic material. This has included sensitive
journalistic material pertaining to investigations such as the drones investigation. Where
this material is stored on servers located outside the United Kingdom, it is very likely to pass
through transatlantic fibre-optic cables and be subject to interception and storage through
the Tempora programme as described above.
100. In all the circumstances, the Applicants’ data and material is likely to have been
intercepted in purported exercise of powers conferred upon the intelligence services by
RIPA 2000 and they can, in consequence, claim to be victims for the purposes of the
application of Articles 8 and 10, ECHR.
(II) Applicability of Articles 8 and 10
101. There is no doubt that Articles 8 and 10 are engaged by the provisions under challenge
in the present application and by the exercise of powers by the intelligence services
pursuant to these provisions. The Applicants challenge the inadequacies of the United
Kingdom’s domestic legal framework for the protection of journalistic sources and material
in respect of the interception, storage, dissemination and exploitation of the vast range of
material treated as “external communications” under RIPA 2000 and secondly the
inadequate protection afforded in respect of the interception, storage, dissemination and
exploitation of “communications data” or metadata under RIPA 2000.
102. There is no doubt that Article 8 is engaged by the interception, storage and exploitation
of the Applicants’ communications. The Court has, in the context of the covert interception
of journalistic material, found on a number of occasions that such measures engage Article 8
(See Weber and Saravia v. Germany (2008) 46 EHRR SE 47, [§§ 78-79]; Telegraaf Media
Nederland Landelijke Media B.V. and Others v. the Netherlands (2012) 34 BHRC 193, [§§ 84-
88]. Such interference arises in two ways. The interception and obtaining of journalistic
material by one state entity clearly constitutes an interference with Article 8, but so too does
the transmission to and/or use of the data by other authorities (Weber and Saravia v.
Germany (2008) 46 EHRR SE 47, [§§ 78]. The Applicants challenge the compatibility of the
domestic legal framework with regard to both of these aspects of the protection afforded by
Article 8.
103. Article 10 is also applicable. The Court has repeatedly emphasised that the protection of
journalistic sources and material is an important guarantee afforded by the right to free
39
![Page 40: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/40.jpg)
expression. In the specific context of secret state surveillance of journalists, the Court
reaffirmed in Weber and Saravia v. Germany (2008) 46 EHRR SE 47, [§§ 143] that:
[F]reedom of expression constitutes one of the essential foundations of a
democratic society and that the safeguards to be afforded to the press are of
particular importance. The protection of journalistic sources is one of the
cornerstones of freedom of the press. Without such protection, sources may be
deterred from assisting the press in informing the public about matters of
public interest. As a result the vital public-watchdog role of the press may be
undermined, and the ability of the press to provide accurate and reliable
information be adversely affected.
104. Just as the interception, retention and dissemination of journalistic material (including
material tending to identify journalistic sources) engages Article 8 so does it engage Article
10. In Telegraaf Media Nederland Landelijke Media B.V. and Others v. the Netherlands , a case
concerning the covert surveillance of journalists, the Court observed that “[a]lthough
questions raised by surveillance measures are usually considered under Article 8 alone, in
the present case they are so intertwined with the Article 10 issue that the Court finds it
appropriate to consider the matter under Articles 8 and 10 concurrently.”
(III) Failure to Comply with the Requirements of Legality under Articles 8 and
10 of the Convention
105. The Court has, on numerous occasions, identified a number of requirements which a
legal regime for covert surveillance must satisfy in order for it to meet the requirement of
legality under the Convention (e.g. being “in accordance with law”, Article 8 and being
“prescribed by law”, Article 10). In the context of the secret surveillance of journalists these
requirements were summarized as follows in Telegraaf Media Nederland Landelijke Media
B.V. and Others v. the Netherlands, [§ 90]:
The Court reiterates its case-law according to which the expression “in
accordance with the law” not only requires the impugned measure to have
some basis in domestic law, but also refers to the quality of the law in question,
requiring that it should be accessible to the person concerned and foreseeable
as to its effects. The law must be compatible with the rule of law, which means
that it must provide a measure of legal protection against arbitrary
interference by public authorities with the rights safeguarded by Article 8 § 1
40
![Page 41: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/41.jpg)
and Article 10 § 1. Especially where, as here, a power of the executive is
exercised in secret, the risks of arbitrariness are evident. Since the
implementation in practice of measures of secret surveillance is not open to
scrutiny by the individuals concerned or the public at large, it would be
contrary to the rule of law for the legal discretion granted to the executive to be
expressed in terms of an unfettered power. Consequently, the law must
indicate the scope of any such discretion conferred on the competent
authorities and the manner of its exercise with sufficient clarity, having regard
to the legitimate aim of the measure in question, to give the individual adequate
protection against arbitrary interference.
106. The Applicants submit that these requirements are not satisfied by the United Kingdom’s
regulatory framework for surveillance, either in respect of the interception and use of
external communications (including the communication or storage of journalistic material)
or in respect of the interception and use of “communications data” (including in particular
data tending to reveal journalists sources), as defined in sections 20 and 21 (4) of RIPA
2000.
Accessibility and Foreseeability: The Interception of Data Content
107. In Weber and Saravia v. Germany [§ 93], the Court explained the requirement of
foreseeability in the context of covert surveillance in the following terms:
[F]oreseeability in the special context of secret measures of surveillance, such as
the interception of communications, cannot mean that an individual should be
able to foresee when the authorities are likely to intercept his communications so
that he can adapt his conduct accordingly […]. However, especially where a power
vested in the executive is exercised in secret, the risks of arbitrariness are evident
[…]. It is therefore essential to have clear, detailed rules on interception of
telephone conversations, especially as the technology available for use is
continually becoming more sophisticated […]. The domestic law must be
sufficiently clear in its terms to give citizens an adequate indication as to the
circumstances in which and the conditions on which public authorities are
empowered to resort to any such measures (emphasis added).
108. Where discretion in relation to covert surveillance has been conferred upon a public official,
it must be reasonably clear which elements of the power to intercept have been
41
![Page 42: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/42.jpg)
incorporated in law as legal requirements and which elements remain at the discretion of
the executive (See Malone v. the United Kingdom, (1984) 7 EHRR 14, [§§ 69-80]; MM v. the
United Kingdom, Merits, 29 April 2013, Application No. 24029/07).
109. The UK’s domestic legal framework for the interception and use of external
communications, using powers conferred by RIPA 2000, does not comply with the
requirements outlined above, especially insofar as the nature, and exercise of these powers
impacts upon journalistically privileged material and sources.
110. First the discretionary power of the Secretary of State to issue a generic certificate for the
interception of external communications pursuant to Section 8 (4) of RIPA 2000 is
extraordinarily broad in scope. Section 8 (4) (b) RIPA 2000 empowers the Secretary of State
to issue a warrant for the interception of “external communications” in respect of “the
descriptions of intercepted material the examination of which he considers necessary” for
reasons set out in Section 5 (3) (b) of RIPA (e.g. for the protection of national security, for
the detection and prevention of serious crime or for the purposes of safe-guarding the
economic well-being of the United Kingdom). Any category of “external” communication
may be intercepted using a Section 8 (4) (b) warrant so long as the Secretary of State
considers the mass interception of a particular category of information to be “necessary” for
the promotion of national security, the economic well being of the United Kingdom or the
prevention and detection of serious crime. This creates the real likelihood that significant
quantities of journalistic material will be intercepted.
111. The breadth of the Secretary of State’s discretion to issue a Section 8 (4) warrant in relation
to external communications and to determine the scope of such a warrant is enlarged even
further by the very broad meaning attached to the concept of “national security” in domestic
law. In the leading case of Secretary of State for the Home Department v. Rehman, Lord Wolf,
giving judgment in the Court of Appeal, endorsed the Secretary of State’s submissions that
“national security is a protean concept, designed to encompass the many, varied and (it may
be) unpredictable ways in which the security of the nation may best be promoted”
(Secretary of State for the Home Department v. Rehman, [2013] 3 W.L.R. 1227, [§ 35]). In a
subsequent judgment, upholding the decision of the Court of Appeal, the Judicial Committee
of the House of Lords emphasised that the question of the nature and scope of the national
security interests identified by the Secretary of State was a matter involving considerable
elements of policy and a matter largely for the Secretary of State’s discretion (See e.g.
Secretary of State v. Rehman [2003] 1 AC 153, [§ 17]). There can be little doubt therefore
42
![Page 43: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/43.jpg)
that the discretion afforded to the Secretary of State to issue Section 8 (4) warrants for the
interception of external communications is indeed extraordinarily broad.
112. Furthermore, the breadth of material which can be intercepted under a Section 8 (4)
warrant is vast. Section 8 (4) authorization may be granted in relation to any “external
communication”, which is defined in section 20 of the Act as “a communication sent or
received outside the British Islands”. “Communication” is, in turn, defined widely in Section
81 (1) of RIPA as
“(a) … anything transmitted by means of a postal service; (b) anything
comprising speech, music, sounds, visual images or data of any
description; and (c) signals serving either for the impartation of
anything between persons, between a person and a thing or between
things or for the actuation or control of any apparatus” (emphasis added).
The concept of “external communications” therefore encompasses a vast quantity of
information and material, including material not communicated in any traditional or
conventional sense. Data storage software programmes such as Dropbox, commonly
used by investigative journalists, would amount to an “external communication”
susceptible to interception where, as may well be the case, the data is stored on servers
located outside the United Kingdom.
113. Furthermore, such is the breath of the discretion conferred upon the Secretary of State
under Section 8 (4), he or she can (and, in practice, it appears, does) define the class of
information subject to the section 8 (4) warrant very broadly indeed. The breadth of the
Section 8 (4) warrants, in practice, is indicated by the Guardian, which reports:
Lawyers at GCHQ speak of having 10 basic certificates, including a
"global" one that covers the agency's support station at Bude in
Cornwall, Menwith Hill in North Yorkshire, and Cyprus”.30
[…]
The categories of material have included fraud, drug trafficking and
terrorism, but the criteria at any one time are secret and are not subject
30 “The Legal Loopholes that Allow GCHQ to Spy on the World”, Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/legal-loopholes-gchq-spy-world
43
![Page 44: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/44.jpg)
to any public debate. GCHQ's compliance with the certificates is audited
by the agency itself, but the results of those audits are also secret.
An indication of how broad the dragnet can be was laid bare in advice
from GCHQ's lawyers, who said it would be impossible to list the total
number of people targeted because "this would be an infinite list which
we couldn't manage".31
114. The legal discretion granted to the executive for the physical capture of external
communications is therefore subject to few limitations.
115. The scope of the power of interception is of particular concern to the Applicants in the
present case as it is almost certain that substantial quantities of sensitive journalistically
privileged material is captured through exercise of this expansive power of interception.
116. Second, given the breadth of the Secretary of State’s discretion, detailed safeguards are
essential for the regime to satisfy the requirements of legality under the Convention. Few
safeguards are, however, in place. Significantly, the safeguards specified in respect of the
interception of internal communications in Section 8 (1) of RIPA 2000 are expressly
disapplied in relation to external communications by Section 8 (4) RIPA 2000 with the
result that interception under Section 8 (4) can occur in a wholly untargeted manner, and
capture privileged material, including journalistically privileged material. In relation to
communications which are not “external”, Section 8 (1) RIPA specifies that the interception
warrant must specify the person or premises subject of the interception warrant. Moreover,
under Section 5 (2) RIPA 2000 the Secretary of State must be satisfied that the interception
of communications in respect of a specific person or premises is “necessary” on grounds of
national security, serious crime prevention or for the economic well-being of the United
Kingdom. In contrast, interception of external communications under Section 8 (4) appears
to occur on a mass scale and in an untargeted manner, giving rise to the very real risk that
privileged and confidential journalistic material will regularly be captured.
117. Third, Section 8(4) and 16 RIPA 2000 also confer an enormously wide discretion as regards
which external communications, out of all of those captured, are looked at, listened to or
31 “GCHQ taps fibre-optic cables for secret access to world's communications”, The Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa
44
![Page 45: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/45.jpg)
read. If the Secretary of State deems it “necessary” in the interests of national security, the
prevention of serious crime or the protection of the United Kingdom’s economy any external
communication can be read or listened to (see RIPA 2000, Section 16 (3)). Again, this is of
particular concern to the Applicants given that it creates a real likelihood that
journalistically privileged material may be read, looked at or listened to pursuant to an
overbroad Section 8 (4) certificate.
118. Fourth, not only is no special protection afforded to journalistically privileged material
under RIPA 2000, but the statutory guidance on the interception of communications, The
Interception of Communications Code of Practice, provides almost no additional safeguards,
much less detailed safeguards. The guidance itself is short, vague and wholly imprecise as
regards what arrangements (if any) are in place to protect journalistic material in the
context of 8 (4) warrants. Sections 3.1 and 3.2 of the Code of Practice state, vaguely, that
“[c]onsideration should be given to any infringement of the privacy of individuals who are
not the subject of the intended interception, especially where communications relating to …
journalistic … privileged material may be involved” and that “particular consideration” or
“extra consideration” should be given to cases where the “subject” of the interception, such
as a journalist, might reasonably expect a high degree of privacy. Of course, given that there
will not be a “subject” of a section 8 (4) warrant in relation to external communications,
even this limited safeguard is not strictly applicable as a safeguard in respect of a Section 8
(4) warrant.
119. In any event, what, precisely, the exhortation to afford “consideration” actually requires
remains largely unspecified in the Code. Section 3.1 states that an application for a warrant
should “draw attention” to any “unusual degree” of collateral infringement of privacy
(including journalistic privilege), to enable the Secretary of State to take this “into account”
in deciding whether to grant a warrant. But there is no requirement that any additional
safeguards be observed where such information is intercepted. Nor does the guidance give
any concrete indication as to the kinds of safeguards (if any) which are available to the
Secretary of State to protect privileged and confidential information, nor the kinds of
circumstances where they are likely to be considered appropriate. There is no indication for
instance, that where journalists are exploring matters pertaining to allegations of
wrongdoing by the security services themselves or by persons for whom they are
responsible or working with that arrangements be put in place to ensure such information is
not misused.
45
![Page 46: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/46.jpg)
120. Some further guidance is provided at sections 3.3 - 3.11. Again, this guidance is notably
vague. It provides few concrete or practical safeguards for the protection of journalistic
information. Section 3.9 of the Code states that “similar consideration” should be given to
journalistically privileged material as is afforded to legally privileged material. Again what
this “similar consideration” requires is not clear. Section 3.6 states that in relation to legally
privileged material, an application should state whether its purpose is to obtain privileged
material so that this may be taken into account by the Secretary of State in deciding whether
the interception warrant is “necessary”. The difficulty with Section 8 (4) generic warrants is,
however, that potentially so much information is captured that it is almost inevitable that
many different kinds of information will be intercepted even if not targeted in terms. The
power of the Secretary of State to impose additional conditions in granting a warrant is
noted in the guidance but what these conditions may, in practice, entail or the circumstances
in which they are likely to be considered appropriate is left entirely unspecified. Aside from
this no further specific, practical safeguards for journalistically privileged material are set
out in the Code.
121. Fifth, under section 15 (1) of RIPA the Secretary of State, when issuing a warrant for the
interception of external communications, is required to ensure “that such arrangements are
in force as he considers necessary for securing…” that the nature and extent of disclosure for
authorized purposes is the minimum necessary to achieve those purposes (see Section 15
(2) and (3), RIPA 2000). These “arrangements” in respect of a Section 8 (4) warrant are not
publicly available and are only made available to the Interception of Communications
Commissioner. This is clear from Section 6.1 of the Interception of Communications Code of
Practice which states:
All material (including related communications data) intercepted under
the authority of a warrant complying with section 8(l) or section 8(4) of
the Act must be handled in accordance with safeguards which the
Secretary of State has approved in conformity with the duty imposed
upon him by the Act. These safeguards are made available to the
Interception of Communications Commissioner, and they must meet the
requirements of section 15 of the Act which are set out below.
122. It is not clear precisely what “arrangements” (if any) have been put in place by the Secretary
of State to meet these obligations (in particular with regard to privileged/confidential
material). The Court in Liberty v. the United Kingdom (2009) 48 EHRR 1 rejected the
46
![Page 47: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/47.jpg)
submission that internal, unpublished arrangements were sufficient to meet the
requirements of foreseeability and accessibility under the Convention (Liberty v. the United
Kingdom, [§ 67]). The fact that the arrangements are made known to the Interception of
Communications Commissioner, whilst desirable, self-evidently does not assist with the
accessibility or foreseeability of the scheme. Other than the limited, vague principles dealing
with journalistically privileged material in the Interception of Communications Code of
Practice, the “arrangements” and safeguards in place (if any) to deal with concerns about
privileged material are not in the public domain and not accessible to journalists or the
public at large. It is therefore entirely unclear to investigative journalists when their
privileged/confidential material and communications may be intercepted and, further,
when and how such information may be disseminated within government or amongst
government agencies. This could potentially serve to undermine the public watchdog role of
the press, the importance of which has been emphasized by the court on many occasions.
123. Sixth, although a Section 8 (4) RIPA certificate remains in place for up to six months (at least
insofar as matters of national security are concerned), such generic warrants can (and, it
appears, are) extended, in effect, on a rolling basis, following six monthly ministerial
review.32 The absence of limitations on the circumstances in which an interception warrant
may be extended was deprecated by the Court in Iordachi and others v. Moldova Merits, 14
September 2009, Application No. 25198/02, [§ 45].
124. Seventh, to the extent the United Kingdom seeks to rely on unpublished, internal or secret
guidelines, protocols or safeguards for the protection of confidential or journalistically
privileged material, such unpublished guidance or protocols cannot satisfy the requirements
of accessibility. A similar argument was made by the United Kingdom in Liberty v. the United
Kingdom and emphatically rejected by the Court in the following terms:
66. According to the Government (see paragraphs 48-51 above), there
were at the relevant time internal regulations, manuals and instructions
applying to the processes of selection for examination, dissemination and
storage of intercepted material, which provided a safeguard against
abuse of power. The Court observes, however, that details of these
“arrangements” made under section 6 were not contained in
legislation or otherwise made available to the public. (emphasis
added)
32 “The Legal Loopholes that Allow GCHQ to Spy on the World”, Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/legal-loopholes-gchq-spy-world
47
![Page 48: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/48.jpg)
67. The fact that the Commissioner in his annual reports concluded that
the Secretary of State’s “arrangements” had been complied with (see
paragraphs 32-33 above), while an important safeguard against abuse of
power, did not contribute towards the accessibility and clarity of the
scheme, since he was not able to reveal what the “arrangements” were. In
this connection the Court recalls its above case-law to the effect that
the procedures to be followed for examining, using and storing
intercepted material, inter alia , should be set out in a form which is
open to public scrutiny and knowledge (emphasis added).
125. Unpublished guidance, protocols or rules cannot therefore sensibly be said to rectify the
problems of foreseeability, accessibility and clarity arising in the statutory scheme for the
interception of communications.
Foreseeability, Accessibility: The Interception of Communications Data
126. The same points regarding accessibility and foreseeability arise with equal, if not greater,
force in relation to the legal regime for the interception of communications data. Such
interception is subject to substantially less detailed (and even less rigorous) safeguards than
the interception of communications content.
127. The rationale for the less rigorous safeguarding of communications data appears to be
based on an assumption that the interception of communications data is necessarily less
invasive of privacy or confidentiality than the content of communications. If this assumption
were ever true, developments in data analysis technology now render it thoroughly unsafe,
certainly as regards the interception of communications data pertaining to journalists or
newsgathering organizations.
128. Recent advances in mass data analysis technology has had a profound effect on the ways
and speed with which vast quantities of data can be processed, sorted and analyzed.
Powerful datamining and link analysis programmes in particular have led to new ways of
exploiting aggregated digital information, on a mass scale. This technology permits the
analysis of large datasets to identify embedded patterns and relationships, including
personal or professional information, habits and behaviour. As a result, individual pieces of
data that previously carried little potential to expose private or confidential information
may now, through datamining and link analysis software, reveal sensitive privileged or
professional information pertaining to individuals or newsgathering organizations and their
48
![Page 49: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/49.jpg)
contacts, including journalistic sources. Such programmes may also reveal avenues of
investigation or persons, places, materials or issues of interest to journalists of
newsgathering organizations. Thus, in light of new technology, exploitation of
communications data can be as intrusive, if not more so, than interception of content. This is
especially so in the context of journalism. The impact on privacy and/or freedom of
journalistic expression of collecting all communications metadata about a journalist, source
or organization over time (and aggregating and link analysing this data) is likely to be much
greater than the impact of collecting specific communications content about a single person,
group or organization.
129. In his expert statement, Dr George Danezis points out, paragraphs 64-65:
Meta-data of communication can be used to identify devices and
communications belonging to specific individuals; map their contacts, the
volume of their communications with others, as well as infer the nature of their
relationship over time. It also allows a detailed view of the information
individuals’ access ... habits, and inferences about their personality, sexuality,
mental state and social status within an organization or group. Meta-data also
provides the current and past location of devices, and can be used for physical
tracking.
Access to meta-data may uncover journalists’ sources when communications and
locations are tracked; may threaten journalists’ physical safety when their home
addresses, and travel addresses are uncovered. [It] provides a trail of their
research interests into particular topics and particular persons. The fear of
tracking and identification may also dissuade sources from contacting
journalists, as well as dissuading readers, listeners or viewers for accessing their
stories.
130. Dr. Danezis also notes at paragraphs 68-69:
Direct access to meta-data can be used to observe who is talking with whom. This
is the typical justification for the analysis of meta-data, since it allows the
construction of “friendship graphs” and “communities of interest”. This
information may be used to identify associates of the targets for tasking and
analysis. Chris Inglis, deputy director of the NSA, suggests33 that not only direct
33 Philip Bump. The NSA Admits It Analyzes More People's Data Than Previously Revealed. The Wire, 17 July 2013.
49
![Page 50: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/50.jpg)
contacts are tasked, but their contacts (second degree) and possibly the contacts
of their contacts (third degree). Estimates of the number of each individual’s
contacts range from a few hundred (real life “friends”) to a few thousand (casual
on-line contacts). If a journalist was to be the subject of such targeting, their
sources would be revealed (1-hop); which other journalist their sources have been
talking to would also be revealed (2-hop). If a source or contact of a journalist
would be targeted, their relation with the journalist would be revealed (1-hop),
but also all the relations of the journalist to other, potentially unrelated sources,
would be revealed.
Direct observation of meta-data uncovers the timing, duration, directionality,
intensity and volume of communications. It is therefore possible to infer directly
which party was most actively contributing to a conversation, how long the
conversation was, or how frequently the target discussed with particular
associates. The availability of timing information associated with target traffic is
key for more advanced inferences. For example, a journalist may be observed to
contact a number of organisation in a foreign country indicating an increased
interest in the area. Similarly, a journalist may be suddenly seen as contacting a
number of people with knowledge of a certain company, and having a couple of
long conversations with some of them – this would be consistent with trying to
confirm a story about the company, and the length of the conversation may be
indicating of the actual contacts that confirmed it.
131. In the context of investigative journalism, therefore, safeguards in respect of the
interception, exploitation and dissemination of communications data is as crucial, if not
more so, than the targeted interception of content.
132. The UK’s legal regime for the interception of communications data does not satisfy the
requirements of legality, including foresseeability and accessibility set out in cases including
Weber and Saravia v. Germany and Telegraaf Media Nederland Landelijke Media B.V. and
Others v. the Netherlands (as discussed above). The discretion available to public officials in
intercepting communications data is even greater than the discretion available in respect of
content. Moreover, the safeguards in place to protect confidentiality and freedom of
expression in relation to the interception, storage and dissemination of communications
data are even less rigorous than those pertaining to the content of communications. A
number of deficiencies in the legal regime are clear.
50
![Page 51: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/51.jpg)
133. First, the discretion afforded to public officials to access “communications data” is even
greater than the extensive discretion to intercept the content of communications. A
“designated person” may require that data be intercepted on a host of grounds by no means
limited to the protection of national security such as the prevention of crime (of any
gravity), public safety or the protection of health (see Section 22 of RIPA 2000). The
designated person need only believe that the interception of communications data is
“necessary” and proportionate in the interests of one of these grounds. Many hundreds of
persons in different public sector organizations are empowered to act as designated persons
(see (Communications Data) Order 2010/480). These individuals may have some training
but no guidance or principles are identified in the Code of Practice, to regulate the exercise
of their discretion where communications data (or its analysis) may reveal journalistically
privileged material or material tending to identify confidential journalistic sources.
Moreover, designated persons empowered to authorize interception are usually public
officials in the same agency as that which seeks to obtain the interception warrant in the
first place.
134. Second, given the breadth of this discretion afforded to all manner of public officials to
obtain communications data, detailed rules preventing the arbitrary exercise of the
discretion to obtain communications data are essential. Yet the regulatory regime in respect
of communications data is even less detailed than that regulating the interception of
content. A statutory Code of Practice provides guidance to public authorities on the
acquisition of communications data (Acquisition and Disclosure of Communications Data:
Code of Practice). However, the guidance does not recognize how (and the extent to which)
the interception and analysis of communications data may interfere with the protection of
journalistic sources or material or otherwise engage the right to free journalistic expression
under Article 10, ECHR. No guidance, principles safeguards or rules at all are set forth in the
Code of Practice to deal with circumstances where the interception and analysis of
intercepted communications data may risk revealing journalistically privileged information,
confidential material or sources.
135. Third and similarly, no publicly accessible guidance, principles or safeguards exist
specifically to regulate and/or limit the dissemination within the intelligence services or
between the intelligence services and government departments of communications data or
the results of the analysis of such data which tends to reveal journalistically privileged
information or sources. There is no provision at all for, for example, “Chinese Walls” or
information barriers.
51
![Page 52: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/52.jpg)
136. Fourth, given that a designated person under RIPA 2000 may well be a public official in the
same organization as that seeking the journalistically privileged communications data or
authorizing interception where such data may incidentally be intercepted, detailed rules are
clearly required to ensure that the designated person has sufficient independence in the
authorization process. This is particularly important where the agency requiring the
interception or its officials is the subject of a journalist’s or newsgathering organization’s
activities. Detailed rules, however, do not exist to deal with this issue. The Code does state
that the designated person should, generally, not be involved in any investigation for the
purposes of which the communication data’s interception is required (see Section 3.11
Acquisition and Disclosure of Communications Data: Code of Practice), but this provides no
assistance as a guarantee of independence where the activities of an agency as a whole are
the subject of scrutiny by a journalist or newsgathering organization. A person termed a
Single Point of Contact (“SPC”) may be appointed and trained to facilitate “the lawful
acquisition of communications data and effective co-operation between a public authority
and a Communication Service Provider (see Acquisition and Disclosure of Communications
Data: Code of Practice, [§ 23]). The SPC may advise a designated person as to the legal
requirements (including under the ECHR) regarding the disclosure of data. While this is a
helpful safeguard, there is no obligation to give such advice in each case and, further, no
obligation on the designated person to accept it. The role of the SPC is described in the Code
of Practice as to “encourage the public authority to regulate itself” (Acquisition and
Disclosure of Communications Data: Code of Practice, [§ 24]. The absence of detailed
arrangements to ensure the independence of authorization is particularly troubling given
the requirement under Article 8 (and, by analogy it is submitted Article 10) that the body
issuing authorizations for interception should be independent and that there must be either
judicial control or control by an independent body over the issuing body’s activities
(Iordachi and others v. Romania, Merits, 14 September 2009, Application No. 25198/02, [§
40]; See also Uzun v. Germany, (2011) 53 E.H.R.R. 24, [§ 71]).
137. It is submitted where the collation and exploitation of metadata, in aggregate, may risk
identifying journalistic sources, safeguards at least as rigorous as those required in respect
of interception of content are required.
138. Fifth, as set out above, unpublished or unavailable rules, procedures and guidance cannot
remedy or inaccessibility or unforseeability of the legal regime regulating the interception
of communications data (Liberty v. the United Kingdom).
52
![Page 53: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/53.jpg)
Protection from Arbitrary Interference
139. A second element of the requirement of legality under the Convention insofar as secret
surveillance is concerned is that surveillance powers must be compatible with the rule of
law, which means that the regulatory framework must provide a measure of legal protection
against arbitrary interference by public authorities with the rights safeguarded by Article 8
§ 1 and Article 10 § 1 (Telegraaf Media Nederland Landelijke Media B.V. and Others v. the
Netherlands, [§ 90]); Iordachi and others v. Romania, Merits, 14 September 2009,
Application No. 25198/02, [§ 37 ]; and Kennedy v. the United Kingdom, [§ 151]).
140. Safeguards are of particular importance in respect of the use of surveillance powers where
journalistically privileged material, information or sources may be captured, stored,
searched, analysed and disseminated. The special protection afforded to journalism, as an
element of the right of free expression in a democratic society, is a settled principle within
the jurisprudence of the Court and has been widely recognized by many other international
and regional human rights mechanisms. The Court has held on many occasions that
“freedom of expression constitutes one of the essential foundations of a democratic society
and that the safeguards to be afforded to the press are of particular importance” ( Goodwin v
the United Kingdom, (1996) 22 E.H.R.R. 123 [§ 29]; Jersild v. Denmark, (1994) 19 E.H.R.R. 1,
[§ 31]). These principles have also been re-iterated in a range of Council of Europe
instruments34 as well as a number of other international declarations.35 The ECtHR has, on
many previous occasions, recalled the need for “strict” or “careful scrutiny” of measures or
practices which risk hindering or inhibiting journalistic free expression (e.g. Independent
News and Media and Independent Newspapers Ireland Limited v. Ireland (2006) 42 EHRR
1024 [§ 114]). There can be little doubt that the interception of journalistic
communications, information and material could have this effect. In view of this, measures
which discourage or hinder journalists from researching, retaining and sharing information
in the development of investigative articles, especially those which touch on sensitive
matters such as questions of national security or counter-terrorism, must be subject to
careful scrutiny.
34 Resolution No. 2: Journalistic Freedoms and Human Rights 4th European Ministerial Conference on Mass Media Policy (1994); CoE Recommendation No. R (2000) 7 on the Right of Journalists not to Disclose their Sources of Information, CoE Declaration by the Committee of Ministers on the Protection and Promotion of Investigative Journalism Adopted by the Committee of Ministers on 26 September 2007.
35 E.g. Inter-American Declaration of Principles on Freedom of Expression, Approved by the Inter American Commission on Human Rights during its 108 regular session and Declaration of Principles on Freedom of Expression in Africa adopted by the Inter-American Commission on Human Rights 17 - 23 October, 2002: Banjul, The Gambia.
53
![Page 54: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/54.jpg)
Insufficient Protection from Arbitrary Interference: Interception of Content
141. The United Kingdom’s legal framework regulating the interception of communications
offers limited and insufficient legal protection against the arbitrary use of surveillance
powers to comply with the requirements of Articles 8 and/or 10. In particular, the regime
offers insufficient safeguards to prevent the arbitrary or incidental interception, storage or
dissemination of journalistically privileged material or sources. A variety of factors,
individually and cumulatively, account for the insufficiency of the regime.
142. First, it will be recalled that the important safeguards which impressed the court in Kennedy
v. the United Kingdom, set out in Section 8 (1) of RIPA 2000 (that an interception warrant
must name or describe a person or premises subject to the interception), are expressly
disapplied by Section 8 (4) in respect of the interception of external communications.
Section 8 (4) therefore permits indiscriminate, untargeted monitoring of communications.
This has particularly serious implications for the present Applicants insofar as it gives rise
to the likelihood of the interception, storage, analysis and dissemination of journalistically
privileged material through the blanket monitoring and interception of “external
communications”.
143. Indeed, the impact of Section 8 (4) RIPA on journalists and journalism is all the more
pronounced given that journalists will often rely, entirely or in part, on sources or materials
located outside the United Kingdom in researching and preparing their articles. Moreover,
the fact that “external communications” may also include data or material which is stored on
servers outside the United Kingdom exacerbates these concerns. The Applicants and other
journalists for reasons of practicality and convenience often use publicly available services
such as Dropbox for the remote storage of drafts, sources and material as part of their
investigative work, which inevitably often requires travel outside the United Kingdom.
Where this information is uploaded outside the United Kingdom or stored on servers
outside UK jurisdiction when uploaded in the UK, such information is liable to blanket
strategic interception under a Section 8 (4) certificate. Journalists will often have no way of
knowing or predicting where information or data is stored by a service provider such as
Dropbox when using publicly available data storage programme. For reasons of costs or
efficiency IT companies may well use non-UK based servers for the services they provide to
UK customers.
54
![Page 55: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/55.jpg)
144. Second, there is no legislative limit on the scope of “external communication” which may be
subject to a Section 8 (4) warrant. Under Section 8 (4) (b) (i) the Secretary of State need
only specify “the descriptions of intercepted material the examination of which he considers
necessary”. There is therefore no limit in law in respect of the category of information or
communication which can be subject to interception. Again, this leads to the very real risk
that substantial quantities of journalistically privileged material may be subject to
untargeted, incidental interception. Indeed, in practice it appears that all data being
transferred into and out of the United Kingdom is presently being intercepted, stored and
analysed. Although the Secretary of State is required to consider any collateral intrusion
into, inter alia, journalistic privilege in deciding whether to grant a Section 8 (4)
interception warrant in the first instance, any such consideration is inevitably highly
abstract, divorced from the circumstances of specific cases. Given that a proper assessment
of proportionality is a highly fact intensive exercise, very much dependent on the particular
circumstances, consideration of necessity and proportionality in this abstract manner
affords little or no protection against arbitrary interception of privileged communications in
practice.
145. Third, once intercepted, there are no specific, accessible legal safeguards in place to identify
journalistically privileged material and to prevent or restrict its onward dissemination or to
restrict its disclosure to persons, officials or agencies subject to the investigative journalism
in question.
146. In addition to these points, as it well known, the Court has, on a number of occasions,
identified various indispensible, “essential safeguards” which must be set out in “statute law
in order to avoid abuses of power” in respect of the interception of communications. These
include (i) clear definition of the nature of the offences which may give rise to an
interception order; (ii) a definition of the categories of people liable to be subject to
interception; (iii) a limit on the duration of interception; (iv) the procedure to be followed
for examining, using and storing the data obtained; (v) the precautions to be taken when
communicating the data to other parties; and (vi) the circumstances in which records may
or must be erased or destroyed (Weber and Saravia v. Germany [§ 95]; Liberty v. the United
Kingdom, [§ 62]). The United Kingdom’s legal framework does not satisfy these
requirements.
147. As regards the first of these criteria, the permissibility of interception under Section 8 (4) is
not contingent on a clearly defined offence or offences. Rather, the purposes for which
55
![Page 56: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/56.jpg)
interception is justified under Section 8 (4) are, as noted above, very broad, relying on
amorphous concepts such as the interests of national security or the economic well being of
the United Kingdom or the prevention of “serious crime”. As noted earlier, the concept of
national security is very broadly defined in the law of the United Kingdom, allowing for
substantial executive discretion in determining its scope in a given situation.
148. Similarly, the concept of “serious crime” is not defined in RIPA 2000 and offers substantial
discretion as to the offence or offences which fall within its ambit. The significance of this is
emphasised by Iordachi and others v. Moldova, Merits, 14 September 2009, Application No.
25198/02, [§ 43], where the court found that, although Moldova had specified that persons
suspected of “serious”, “very serious” or “exceptionally serious” criminal offences risked
being subject to interception,
the nature of the offences which may give rise to the issue of an interception
warrant is not, in the Court’s opinion, sufficiently clearly defined in the impugned
legislation. In particular, the Court notes that more than one half of the offences
provided for in the criminal code fall within the category of offences eligible for
interception warrants.
In the United Kingdom the category of “serious crime” is even more uncertain.
149. All of this, gives rise to the very real prospect that privileged journalistic material could be
arbitrarily intercepted, by reference to being “necessary” in the interests of national security
or for the prevention or detection of “serious” crime. This position contrasts sharply with
the position which faced the Court in Weber and Saravia v. Germany [§ 96], where the
legislation challenged by the Applicants “defined in a clear and precise manner the offence
which could give rise to the interception order”. In the present case, the position is the
opposite.
150. Furthermore, the categories of person liable to interception are not identified in RIPA 2000
or other statutes. The United Kingdom authorities have not made available the search terms
or other search parameters by which strategic monitoring of external communications is
conducted nor stated in statute or elsewhere the nature or purpose of the search
parameters used to exploit the data intercepted. Again, this is in contrast to the position in
Weber and Saravia v. Germany, where German law specified that the persons concerned
“either had to have used catchwords capable of triggering an investigation into the dangers
listed in section 3 (1), points 1-6...” of the relevant statute or be foreign nationals/companies
56
![Page 57: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/57.jpg)
(See Weber and Saravia v. Germany [§§ 97 and 32] and Liberty v. the United Kingdom [[§
68]).
151. As regards the duration of the interception, in the case of national security, a Section 8 (4)
certificate is valid for six months, while in other cases it remains valid for three months (see
Section 16 (3) (3A) RIPA 2000). There is nothing, however, to prevent a certificate being re-
issued prior to the end of the six month period. Indeed, it appears that, in effect, certificates
are renewed on a rolling basis. Precisely this situation was considered by the Court to
provide insufficient protection against arbitrariness in Iordachi and others v. Moldova,
Merits, 14 September 2009, Application No. 25198/02, [§ 45]. Similar criticism was made in
Gillan and Quinton v. the United Kingdom (2010) 50 EHRR 45, [§ 81].
152. The general safeguards in Sections 15 and 16, RIPA 2000 are of limited assistance in
compensating for the deficiencies identified above.
a. As regards Section 15 this requires the Secretary of State to ensure that
“arrangements” are in place to ensure that intercepted material is intercepted and
disclosed to the extent necessary for authorised purposes. However, as previously
noted, these arrangements are not in the public domain and, further, the “authorised
purposes” themselves are enormously broad.
b. As for Section 16 (which provides additional safeguards in respect of Section 8 (4)
warrants), these are similarly limited. It imposes no limitation on the untargeted
interception of communications by persons in the United Kingdom. (See Section 16
(2), RIPA 2000). This gives rise to real concern as to the extent to which privileged
material is intercepted through mass scale, strategic interception. Furthermore the
safeguards set out in Section 16 (2) in respect of the targeted interception of
communications by persons resident in the United Kingdom by way of targeted
interception, can be circumvented where necessary in the interests of national
security etc by the Secretary of State (See Section 16 (3) , RIPA 2000). Thus, where
journalistic sources or materials are located outside the United Kingdom, Section 16
offers them little protection against interception using a Section 8 (4) warrant. Their
communications can be intercepted where they fall under the broad umbrella of the
interests of national security.
57
![Page 58: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/58.jpg)
153. Finally, no proper arrangements are in place for effective independent authorization or
oversight of interception in respect of Section 8 (4) certificates. In Iordachi and others v.
Moldova [§ 40] the Court held that “the body issuing authorizations for interception should
be independent and there must be either judicial control or control by an independent body
over the issuing body’s activities”. The desirability of judicial oversight was emphasised by
the Court in Telegraaf Media v. the Netherlands [§ 98] “[i]n a field where abuse is potentially
so easy in individual cases and could have such harmful consequences for democratic
society as a whole, it is in principle desirable to entrust supervisory control to a judge” (See
also Klass and Others v Federal Republic of Germany (1979-80) 2 E.H.R.R. 214, [§ 56]).
154. Thus, although prior judicial authorization is not always an indispensible prerequisite for
the interception of communications, independent authorization is required. Insofar as
journalistic privilege is concerned, the Secretary of State cannot offer guarantees of
independence. A journalist or newsgathering organization may be engaged in the
investigation of activities for which the Secretary of State bears ultimate responsibility.
Indeed, an investigation (such as, for instance, BIJ’s investigation into the deprivation of
citizenship in the United Kingdom) may consider decisions which the government and,
specifically, the Secretary of State has taken and the circumstances surrounding those
decisions and their propriety. Given the potentially enormously broad reach of the Section 8
(4) certificate and the equally broad ambit of the Secretary of State’s own responsibilities,
he or she simply cannot offer sufficient guarantees of independence in relation to the
making of a Section 8 (4) certification decision.
155. The position is not assisted by the role of Interception of Communication Commissioner
under RIPA 2000. S/he has no power to quash a warrant issued under Section 8 (4). The
Commissioner’s powers are set out in Section 57 et seq RIPA 2000. The Commissioner is
required to supervise the exercise of functions under – inter alia – Chapters I and II of RIPA,
and to notify the Prime Minister of any contraventions of the Act. Furthermore if the
Commissioner is of the view that arrangements made pursuant to Section 15 of RIPA 2000
are inadequate, the Commissioner will make a report to Parliament. The Commissioner has
no power to determine that new arrangements must be made nor does he or she have the
power to determine how deficiencies ought to be remedied. In relation to Section 8 (4)
warrants, the Commissioner’s role is one of ad hoc, ex post facto review. Although the
Commissioner provides a relevant and necessary safeguard, the role in no way compensates
for the absence of judicial or independent authorization or oversight in respect of section 8
(4) warrants.
58
![Page 59: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/59.jpg)
156. For its part, the Investigatory Powers Tribunal also in no way compensates for the absence
of judicial or independent oversight of Section 8 (4) certificates. The IPT’s role is reactive,
dealing with complaints regarding interception made by members of the public. It has no
role in authorizing or proactively supervising the issuance of interception warrants.
Insufficient Protection from Arbitrary Interference: Interception of Communications
Data
157. Similar deficiencies to those identified above in relation to the interception of
communications under Chapter I of RIPA 2000, apply with even greater force to the
interception of communications data under Chapter II. As earlier noted, exploitation of
communications data can be as intrusive, if not more so, than the interception of content.
The impact on privacy or freedom of journalistic expression of collecting all
communications metadata about a journalist, source or organization over time (and
aggregating and link analysing this data) is often vastly greater than the impact of collecting
specific communications content about a single person, group or organization. Rigorous
safeguards are therefore essential but lacking.
158. The system for the authorization of the interception of communications data is wholly
lacking in independence. As earlier noted, a “designated person” in the relevant public body
(including the intelligence services) is authorized to approve the interception of
communications data. The person empowered to require the interception of
communications data is an official in the same agency as that which seeks the
communications data in the first instance. Institutional independence is therefore wholly
lacking. Moreover, there is also no requirement of functional/operational independence
either in RIPA 2000 or relevant secondary legislation.36 There is some guidance on this issue
in the Acquisition and Disclosure of Communications Data: Code of Practice , which requires at
3.11 that Designated Persons should not be responsible for granting authorisation in
relation to investigations or operations in which they are “directly” involved. The guidance,
however, goes on to state that such situations may be unavoidable for reasons of urgency,
for “security reasons” or in small organizations. The Code of Practice is not legally binding
on the public officials. Section 71 of RIPA merely requires that in exercising functions
officials must “have regard” to the relevant provisions of the code of practice. Moreover,
even on the face of the code, functional or operational independence is not guaranteed.
36 See Regulation of Investigatory Powers (Communications Data) Order 2010/480.
59
![Page 60: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/60.jpg)
There is nothing, for instance, to stop an official in the intelligence services connected
indirectly to an investigation or operation, perhaps in a management capacity, from
authorising the interception of communications data pertaining to that investigation. It is
notable that local authorities in England and Wales which wish to obtain communications
data must apply to the Magistrates Court in order for an authorization granted by a
designated person to take effect (Section 23A RIPA 2000). No analogous requirement is
applicable to public bodies, such as the intelligence services, where they seek to obtain
communications data in respect of individuals or organizations despite the very great
potential for the gathering of such information by the intelligence services to interfere with
Convention rights.
159. Post facto oversight is also inadequate. While prior judicial authorization is not necessarily
an essential prerequisite for lawful interception of communications data, it constitutes an
“important safeguard” (Uzun v. Germany, (2011) 53 E.H.R.R. 24, [§ 71]). The significance of
this safeguard in the context of the protection of journalistically privileged information is all
the greater, given the potential for such information, for reasons already explained, to be
used in a way which gravely damages the Article 8 and 10 rights of journalists and
newsgathering organizations. Moreover, in the United Kingdom (in contrast to the position
in Germany under consideration in Uzun), there is no possibility of judicial review of the
legality of the interception of communications data in the context of criminal or civil
proceedings since the use of intercepted communications in this manner in criminal
proceedings is prohibited by Section 17 RIPA 2000. The UK is one of the very few countries
which completely prohibits the use of intercept evidence in civil or criminal proceedings,
despite the recommendation of the Privy Council that this position should end.37
160. While the IPT does have the power to review whether the interception or dissemination of
communications data has violated Article 10, it can only do so where a complaint is brought.
Its jurisdiction is only triggered in the few cases where an individual brings a complaint
despite the inevitable uncertainty as to whether their communications data has been
obtained and or impermissibly exploited. The IPT cannot therefore compensate for an
inadequately independent system of authorization. Although the Interception of
Communications Commissioner provides a helpful safeguard, s/he has no powers to quash
an authorization for interception and, as with interception under Chapter 1 RIPA, the
37 See Privy Council Review Intercept as Evidence : Report to the Prime Minister and Home Secretary , 2008, p. 31 Cm 7324.
60
![Page 61: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/61.jpg)
powers of the Commissioner are supervisory. Chapter II authorizations are examined, post
facto on a random basis.
161. In addition, there are no safeguards or arrangements set out in RIPA, secondary legislation
or the statutory code of practice for identifying communications data which is, or which may
be, journalistically privileged. Nor are there rules in RIPA or statutory guidance which
regulate the circumstances in which privileged communications data may be shared or
disseminated (e.g. “Chinese Walls” or other information barriers).
(IV) Proportionality
162. The blanket interception, storage and exploitation of communications and communications
data is an inherently disproportionate interference with journalistic free expression and
journalistic privilege. The Applicants, in this regard, rely on all of the matters described
above as indicating the obvious disproportionality of the legal regime challenged in the
present application.
163. In assessing proportionality of the measures in question, their substantial implications for
journalism and the work of media organizations will be born in mind. These are set out in
detail in the statement of Dr. Danezis. Some of the most significant implications , identified
in the report of Dr Danezis, include the following: (i) the inability of journalists to safeguard
sources, both material and human, hampering or even preventing sources from
communicating with journalists and vice versa in respect of sensitive issues about which
reporting in a democratic society is crucial; (ii) relatedly, the risk, that through modern
systems for the exploitation and link analysis of meta-data networks of collaborators,
sources and materials will be revealed; (iii) the implications of mass scale interception of
content and meta data as regards the ability of journalists to confidentially research
evidence, materials and lines of enquiry; (iv) the inability of journalists to store information
with a reasonable assurance that the confidentiality of the information will be respected,
given the vulnerability of (increasingly common) “cloud storage” and the use of “backdoors”
into otherwise “secure” storage devices or mechanisms; (v) as set out in the Statement of
the Managing Editor of BIJ, the real risk that sources will be deterred from contacting
journalists or media organizations – particularly those persons dealing with sensitive issues
pertaining to matters in which the intelligence services are likely to have an interest, ;
61
![Page 62: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/62.jpg)
164. As regards the legal framework in place, various factors demonstrate the disproportionality
of the sweeping powers of data and meta data interception which have been accrued:
a. First, the blanket, indiscriminate nature of the interception permitted under Section
8 (4) RIPA, with only a few, ill-defined safeguards. In particular: the wide and
imprecise scope of the power to intercept communications under Section 8 (4)
defined by reference to expansive, policy-laden, concepts such as the “interests of
national security” or the “economic wellbeing” of the United Kingdom, rather than,
for example, narrow, specifically defined offences; the enormously broad categories
of persons or materials which may be subject to interception under Section 8 (4),
giving rise to the real risk that privileged communications will be intercepted; the
inadequate limitations on the duration of a Section 8 (4) certificate, in effect,
permitting such certificates to be issued on a rolling basis.
b. The fact that communications appear to be intercepted and monitored by reference
to the means of communication rather than on a basis clearly or directly linked to
the purpose for which interception is purportedly justified, resulting in the
interception of journalistically privileged communications and data unnecessarily
and without a firm rational basis.
c. Further, the very substantial number (many thousands) of search terms and
parameters reportedly used to exploit the data strategically intercepted using the
Tempora programme and the absence of any clear, accessible indication of those
terms or the basis on which they are selected and determined. The Applicants note
the report in the Guardian Newspaper relying on a lawyer from GCHQ:
An indication of how broad the dragnet can be was laid bare in advice from
GCHQ's lawyers, who said it would be impossible to list the total number of
people targeted because "this would be an infinite list which we couldn't
manage".38
Further, the absence of any publicly accessible information as to the basis on
which such search terms are used and whether they are tailored, as much as
possible, to avoid the unnecessary interception of privileged material and data.
38 “GCHQ taps fibre-optic cables for secret access to world's communications”, The Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa
62
![Page 63: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/63.jpg)
d. The absence of accessible and clear parameters (both as regards communications
and communications data) indicating the manner in which and the circumstances in
which intercepted material will be subject to further exploitation, creating real
potential for disproportionate exploitation taking insufficient account of important
matters such as journalistic privilege.
e. The wholly imprecise (and enormously broad) definition of “external
communication”, under Section 20 RIPA 2000. External communication being
defined as “a communication sent or received outside the British Islands” with
“communication” being, in turn, defined to include “signals serving either for the
impartation of anything between persons, between a person and a thing or between
things”. This results in an enormous range of communications and data, including
those which a user would not intuitively consider “external”, subject to Section 8 (4)
interception.
f. The inapplicability of the safeguards set out in Section 8 (1) of RIPA 2000, in the
context of the interception of external communications under Section 8 (4).
g. Insufficiently clear, accessible information as to the circumstances in which and the
conditions under which information gathered under a Section 8 (4) warrant is
destroyed or the basis on which it is retained.
h. The absence of independent authorization for the interception of communications
pursuant to a Section 8 (4) certificate or for the interception of communications data
by the intelligence services and/or the absence of sufficiently robust, independent
oversight arrangements, as set out above.
165. Individually and collectively, the Applicants submit that the regulatory framework for the
interception, storage, search, analysis, dissemination and destruction of communications
data and communications intercepted under Section 8 (4), RIPA 2000 is disproportionate.
(V) Relief
166. The Applicants seek
a. Declarations that their rights under Articles 8 and/or 10 of the Convention have
been violated and that the legal framework of the law of the United Kingdom in
respect of the interception of communications under Section 8 (4) RIPA 2000
63
![Page 64: The Bureau's application to the European Court of Human Rights](https://reader030.vdocuments.mx/reader030/viewer/2022020519/577cc4a81a28aba7119a0282/html5/thumbnails/64.jpg)
and/or the interception of communications data does not comply with the
requirements of the Convention in the respects set out above;
b. Reasonable costs and expenses in these proceedings;
Gavin Millar QC
Conor McCarthy
Doughty Street Chambers
Monckton Chambers
64