IN THE EUROPEAN COURT OF HUMAN RIGHTS

BETWEEN:

(1) BUREAU OF INVESTIGATIVE JOURNALISM (“BIJ”);

(2) ALICE ROSS

APPLICANTS

V

THE UNITED KINGDOM

RESPONDENT

__________________________________

APPLICATION___________________________________

1

A. INTRODUCTION

1. The Applicants are a respected public interest media / newsgathering organisation and one

of its journalists. Both undertake journalistic investigations into, and publish content about,

controversial global issues concerning the military, the intelligence services/the secret

state, national security issues, corruption and bribery as well as sensitive aspects of the

United Kingdom’s foreign policy. The Applicants challenge: first, the inadequacies of the

United Kingdom’s domestic legal framework for the protection of journalistic sources and

material amidst the interception, storage, dissemination and exploitation by the state of a

vast range of material treated as “external communications” under the United Kingdom’s

Regulation of Investigatory Powers Act PA; and secondly the inadequate protection afforded

to the same in relation to the interception, storage, dissemination and exploitation of

“communications data” or metadata under the 2000 Act. Their challenge is brought under

Article 8 and Article 10 of the European Convention on Human Rights (“the Convention” or

“ECHR”).

B. SUMMARY

2. The present application by the Bureau of Investigative Journalism (“BIJ” or “the Bureau”)

and Alice Ross, an investigative reporter with the Bureau, raises important issues regarding

journalistic free expression, the protection of confidential journalistic communications and

the mass scale interception of communications in the United Kingdom under the Regulation

of Investigatory Powers Act 2000.

3. The present application arises from the substantial body of information which has now

come to light indicating that communications deemed “external communications”1 for

purposes of the Regulation of Investigatory Powers Act 2000, are subject to mass scale

interception, collation, storage and analysis by government agencies in the United Kingdom,

notably Government Communications Headquarters (“GCHQ”). Furthermore, it is now

apparently that the interception, storage and analysis of data concerns not only

communications content but also includes “meta data” (e.g. data about communications).

Importantly, technological advances in recent years mean that such metadata can be used

and exploited in a way that is every bit, if not more, intrusive of confidentiality or

journalistic free expression as the interception of, for example, the content of journalistic

1 Section 20 Regulation of Investigatory Powers Act 2000

2

communications. This is because metadata can be subject to hugely powerful computer

programmes which collate, link analyse and synthesise masses of data, enabling a

sophisticated picture to be developed of an individual or organization’s network of contacts,

sources, lines of enquiry as well as materials, subjects and persons of interest to them.

Without rigorous and effective legal safeguards, it is plain that the use of these powerful

technologies may now fundamentally undermine journalistic free expression in a way that

could not previously have been envisaged.

4. The interception and exploitation of journalistic communications in this manner, in the

absence of proper safeguards, may undermine the confidentiality of journalistic sources,

materials and information, a necessary and basic precondition for press freedom in a

democratic society.2 The threat to journalistic freedom of expression from mass interception

of external communications is all the greater where journalists, such as the present

applicants, are covering sensitive matters touching on issues of national security, counter

terrorism or sensitive aspects of foreign policy. Here investigative journalism often relies

heavily on human sources or data and material located outside a single jurisdiction. The

Court has held on many occasions that it is “incumbent on the press to convey information

and ideas on political issues, even divisive ones” (Ozgur Gundem v. Turkey, Merits,

Application No. 23144/93 [§ 58]; and Lingens v. Austria, (1986) 8 EHRR 407 [§ 41]). By

much the same token, it is also incumbent on journalists and the free press to report on

matters which may be very sensitive, including matters touching on national security or the

conduct of international affairs. Surveillance practices which inhibit the ability of the press

to investigate and report in these areas call for careful scrutiny.

5. As detailed in the main body of the Claimant’s application the Applicants submit that the

requirements of Articles 8 and 10 of the Convention are not satisfied by the United

Kingdom’s legal framework for the interception of external communications and

communications data (or “metadata”). The Applicants bring the present challenge in light of

the press revelations, in the United Kingdom and across the world, about mass scale

interception and surveillance of electronic communications by the United Kingdom’s

Government Communications Headquarters (“GCHQ”) both for use by the United Kingdom’s

intelligence services and for dissemination within government. The mass scale interception

of data (both content data and metadata) is conducted using, inter alia, the Tempora

programme and a range of other covert mechanisms. These programmes, mechanisms and

2 Godwin v. the United Kingdom (1996) 22 EHRR 123, [§ 39]

3

capabilities are described in detail by Doctor George Danezis of University College London,

Department of Computer Science in his witness statement.

In short, the Applicants submit:

a. First, that the conduct of the United Kingdom in relation to the soliciting, receipt,

search, analysis, dissemination, storage and destruction of interception data in

respect of “external communications”, in particular with regard to their impact on

journalism and newsgathering organizations and their privileged information and

communications, is incompatible with Articles 8 and/or 10 ECHR;

b. Secondly, that the conduct of the United Kingdom in relation to the soliciting,

receipt, search, analysis, dissemination, storage and destruction of communications

data (“metadata”), is incompatible with Articles 8 and/or 10 ECHR, with particular

regard to its impact on journalism and privileged or confidential journalistic

information including sources.

6. The Applicants therefore seek declarations that their rights under Articles 8 and/or 10 of the

Convention have been violated and that the legal framework of the law of the United

Kingdom in respect of the interception of communications under Section 8 RIPA 2000

and/or the legal framework pertaining to the interception of communications data under

UK law does not comply with the requirements of the Convention in the respects set out

above and costs.

7. No effective remedy for the matters raised in the present application exists in UK law. The only

avenue in the domestic legal system by which the applicants could bring their present

complaint is the Investigatory Powers Tribunal. By virtue of Section 65 (2) (a) of RIPA 2000,

the Tribunal is the “only appropriate tribunal” for the purposes of challenging either the

interception of communications generally or to the compatibility of the conduct of the

intelligence services with Convention rights of the Applicants.

8. The Investigatory Powers Tribunal has no power to issue a declaration that the legislative

scheme subject to challenge in the present complaint is incompatible with the Convention

rights of the media/journalist Applicants. This is clear from the terms of Section 4 (5) of the

Human Rights Act 1998 which does not define the Investigatory Powers Tribunal as a

“Court” for the purposes of Section 4 of the Human Rights Act with the consequence that it

4

has no power to make a Section 4 (2) declaration of incompatibility. Thus, even if the

Applicants were to bring the present complaint in respect of the statutory regime laid down

in Primary legislation before the Investigatory Powers Tribunal, the Tribunal would have no

power to declare the scheme incompatible with the Applicants’ Convention rights (still less

require that any such incompatibility be legally remedied under domestic law).

9. Furthermore, although the High Court does have a general power to issue a declaration of

incompatibility in relation to domestic legislation, the jurisdiction of the High Court (and,

indeed, any other superior court in the United Kingdom) to hear a challenge to a decision

made by the Investigatory Powers Tribunal is ousted by Section 67 (8) of RIPA. This states

that “[e]xcept to such extent as the Secretary of State may by order otherwise provide,

determinations, awards, orders and other decisions of the Tribunal (including decisions as

to whether they have jurisdiction) shall not be subject to appeal or be liable to be

questioned in any court”. In R (A) v. B [2009] UKSC 12, it was confirmed that the

Investigatory Powers Tribunal has exclusive and final jurisdiction in respect of such

proceedings. There is therefore no possibility of the Applicants obtaining a Section 4

declaration from the domestic courts to the effect that the statutory scheme in RIPA 2000

and elsewhere is incompatible with their Convention rights as a media and newsgathering

organization / a journalist. Although the Investigatory Powers Tribunal may be able to issue

a judgment offering an opinion as to the compatibility of the statutory scheme with the

Applicants’ Convention rights, such an opinion (being other than a declaration under Section

4 of the Human Rights Act 1998) would be of no legal or practical benefit to the Applicants.

The Tribunal does not have the power to annul any of the provisions about which complaint

is made nor does it have power to declare unlawful the statutory scheme or the provisions

of which it is comprised (See Kennedy v. the United Kingdom, Merits, Application No.

26839/05, [§ 119]). There is therefore no effective remedy available for the applicants to

exhaust to challenge the legislative scheme in question.

10. In any event, it is well established in the case law of the ECtHR that a declaration of

incompatibility under s.4 of the Human Rights Act does not in itself yet constitute an

effective remedy for the purposes of the Convention. In Kennedy, the Court held that “the

practice of giving effect to the national courts’ declarations of incompatibility by amendment

of offending legislation is not yet sufficiently certain as to indicate that section 4 of the

Human Rights Act is to be interpreted as imposing a binding obligation giving rise to a

remedy which an applicant is required to exhaust” (Kennedy v. the United Kingdom, Merits,

Application No. 26839/05, [§ 120]; Burden v. the United Kingdom, [GC], (2008) 47 E.H.R.R.

5

38). The position remains the same today. A declaration of incompatibility still does not

impose any obligation to amend or supplement legislation incompatible with an individual’s

Convention rights. Furthermore, the challenge here is, in part, to the insufficiency of

legislative protection, including safeguards, in respect of the Applicant’s Convention rights.

A declaration of incompatibility (even if it were available) offers no redress where there is

an insufficiency of legislative protection and insufficient safeguards enshrined in law. Courts

in the UK have no power to require Parliament to legislate, even where there exists an

insufficiency of safeguards to afford protection to fundamental Convention rights in a

particular context. In short, the Applicants’ application cannot be rejected on grounds of

failure to exhaust domestic remedies.

C. STATEMENT OF FACTS

(I) The Applicants

The First Applicant

11. The Bureau of Investigative Journalism (“the Bureau” or “BIJ”) is an independent not-for-profit

organisation. Established in April 2010, the Bureau works to produce high quality, public

interest journalism. It is philanthropically funded. The Bureau undertakes in depth

investigations into the governance of public, private and third sector organisations and their

influence. Its content is freely available under a Creative Commons licence.

12. BIJ collaborates with other, larger, media organizations so as to ensure that the product of its

investigation work reaches as wide an audience as is possible. To this end it has worked to

produce broadcast/published content with BBC Panorama, BBC Newsnight,  Channel 4

Dispatches, Channel 4 News, al Jazeera English, the Independent, the Financial Times, the

Daily Telegraph, the Sunday Times, Le Monde, mediapart, the Guardian, the Independent,

the Observer and the Daily Mirror.

13. It will be noted that some of these media organizations are based in the United Kingdom, while

others are based overseas.

14. In 2011 the Bureau won the Thomson Reuters “Reporting Europe Award” for a BBC 4 radio

programme, “Europe’s Missing Millions” (about fraud involving EU regional funding

schemes). Its investigation into drone warfare was shortlisted in the Foreign Press

Association Awards. In 2012 the Bureau and its journalists were shortlisted in four

6

categories at the first Press Gazette British Journalism Awards, which emphasise journalism

in the public interest. Shortlisted investigations included the Bureau’s investigation into

drone warfare and the Bureau’s work in relation to financial lobbying. In 2013 the Bureau’s

drones team won the Martha Gellhorn prize for journalism.

15. Many of the investigations undertaken by the Bureau and its journalists concern issues of high

public importance outside of the territorial jurisdiction of the United Kingdom. Many others

seek to report about such issues concerning the United Kingdom but rely on human sources

or material outside of the United Kingdom.

16. Its investigations, at times, touch on matters of national security or other matters likely to be of

interest to the United Kingdom’s intelligence services or the intelligence services of foreign

countries, including the United States.

17. The Bureau is currently conducting a number of high-profile investigations, often relying on

overseas journalistic sources. The Bureau has, for a number of years, had ongoing a complex

investigation into the practice of covert drone warfare, examining, in particular, drone

warfare in Pakistan, Somalia and Yemen. This investigation has resulted in the publication of

numerous articles by the Bureau considering issues such as the high number of civilian

casualties inflicted by such strikes, the legality or otherwise of these forms of covert

operations,3 the reliability of the means by which intelligence for the targeting of such

strikes is obtained, the sharing of intelligence by the United Kingdom and other countries in

targeting drone strikes4 and the international diplomacy and politics that surrounds drone

warfare. In the course of its investigation into drone warfare, the Bureau has obtained and

reported on confidential government documentation regarding drone strikes. This has

included documentation potentially indicating serious failure to comply with applicable

international law in the conduct of drone strikes.5 In this reporting the Bureau has often

relied on sources of information (material and human) from outside the United Kingdom.

18. In addition, the Bureau has conducted a major investigation into the activities of State agencies

involved in surveillance, “The State of Surveillance”. This examined in particular the global

surveillance industry and surveillance technology. This investigation resulted in published

3 http://www.thebureauinvestigates.com/2012/09/24/us-and-others-given-licence-to-ignore-international-law-in-somalia/

4 http://www.thebureauinvestigates.com/2014/02/20/uk-shared-ops-room-where-drone-targets-were-identified-yemen-president/.

5 See e.g. http://www.thebureauinvestigates.com/2013/07/22/exclusive-leaked-pakistani-report-confirms-high-civilian-death-toll-in-cia-drone-strikes/

7

reports on, for instance, the supply of surveillance software to repressive regimes actively

engaged in committing atrocities against their citizens6 as well as the surveillance capacities

of governments and their intelligence agencies.7

19. Other investigations the Bureau has conducted, often requiring use of overseas journalistic

sources, include investigations into the treatment of prisoners in Afghanistan,8 the hidden

wealth of world leaders,9 the misuse of aid to foreign countries given by the United Kingdom

government,10 and the use of secret justice in UK courts, including in cases involving issues

of national security.11

The Second Applicant

20. Alice Ross, is a reporter with the Bureau of Investigative Journalism. She specializes in national

security and foreign policy. All of her current investigations require her to talk to people and

organisations that are likely to be of interest to the intelligence services.  One of these

concerns the use of drones in Pakistan. As part of this, Ms Ross regularly communicates with

individuals located in Pakistan in an attempt to gather information about where the strikes

have occurred and the identity and background of persons killed and injured. BIJ is

presently compiling a database which seeks reliably to identify, insofar as possible, the

number of civilians killed in these strikes. Ms. Ross has spoken to family members and

associates of persons killed in drone strikes. These communications may well be of interest

to the intelligence services, both in the United Kingdom and elsewhere. Ms. Ross is also

involved in an investigation into the deprivation of citizenship by the United Kingdom

government on grounds that the citizens concerned are deemed prejudicial to the vital

interests of the United Kingdom. This work has involved identifying individuals who have

had their British citizenship revoked on purported terrorism grounds and communicating

with individuals connected to some of these persons who are now based in Pakistan,

Afghanistan and Turkey. A number of these individuals are believed to be of interest to, and

monitored by, the United Kingdom’s intelligence services.

(II) The Factual Background to the Application

6 http://www.thebureauinvestigates.com/2011/12/01/british-software-helped-syrian-regime-crush-dissidents/

7 http://www.thebureauinvestigates.com/2011/11/30/the-state-of-surveillance/ 8 http://www.thebureauinvestigates.com/category/projects/prisoners-afghanistan/ 9 http://www.thebureauinvestigates.com/category/projects/rulers-riches/?view=all 10 http://www.thebureauinvestigates.com/category/projects/charitable-aid-projects/?view=all 11 http://www.thebureauinvestigates.com/category/projects/secret-justice/

8

21. The present application is made following the publication of information concerning mass scale

data interception, storage and exploitation by the United Kingdom (in conjunction with

third states, including the United States), in particular through the disclosure of information

by Edward Snowden, a systems administrator and contractor for the US National Security

Agency (“NSA”). The existence of programmes, further described below, for mass scale data

interception and exploitation has been confirmed by the President of the United States and

other senior US government officials.12 The detail of these programmes of data interception,

so far as it is known, is set out below.

Tempora

22. In June 2013 it was disclosed that GCHQ had placed data interceptors on fibre optic cables

conveying internet data in and out of the United Kingdom. These UK-based fibre optic cables

include transatlantic cables between the United States and Europe, giving GCHQ access to a

vast amount of data transiting through these transatlantic cables to destinations in the UK

or to external destinations in third States. It is understood that this is termed the Tempora

programme. It has been running since around October 2011 and it is reported to have been

created as part of the United Kingdom’s, Mastering the Internet (“MTI”) programme for

mass communications interception.

23. It is understood that through the Tempora programme, all content data is stored for 3 days,

while metadata is stored for 30 days.13 All data conveyed by means of such cables is

susceptible to this interception, including internet and telephone communications data as

well as any associated identifying metadata.14 It is understood that interceptors have been

placed on at least 200 data channels carried by fibre optic cables, near to the points where

they come ashore. It is reported that this interception occurs with the cooperation of the

private companies which operate the cables. These cables carry the vast majority of

electronic telecommunications into and out of the United Kingdom. Moreover a vast

quantity of external data is routed via these cables between Continental Europe and North

America.

12 See “Clapper admits secret NSA surveillance program to access user data”, Guardian, 7 June 2013: http://www.theguardian.com/world/2013/jun/07/clapper-secret-nsa-surveillance-prism and Transcript: Obama’s Remarks on NSA Controversy, Wall Street Journal, 7 June 2013: http://blogs.wsj.com/washwire/2013/06/07/transcript-what-obama-said-on-nsa-controversy/.

13 “GCHQ taps fibre-optic cables for secret access to world's communications”, The Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa

14 Ibid.

9

24. The programme’s technology allows the interception of data on a gargantuan scale. It is

reported that this method of interception gives the United Kingdom intelligence services

access to around 21 Petabytes of data a day (equivalent to 21 thousand terabytes). To

convey the scale of this amount of data, the Guardian report that this is the equivalent to

intercepting all the information in all the books in the British Library, in electronic form, 192

times every day.15

Exploitation of Metadata

25. Importantly, this data includes both “content” and “metacontent”. In this context the term

“content” connotes the substance of the communicated data. This includes not only emails

but any data which is electronically transferred online, including information stored and

shared by means of software like Dropbox (a programme for the remote storage or sharing

of large quantities of electronic data) or stored through similar “cloud” computing services.

“Metadata” connotes data about the communicated data, for example records of the means

by which content has been created, concerning the recipient/s, the time at which it is being

sent and where the recipient is located.

26. The media reports about Tempora have described the manner in which intercepted data is

exploited. It is reported that high volume, low-value traffic such as peer to peer downloads

is first sifted out of the metadata and content. The remaining data is then searched using

keywords, email addresses, phone numbers or other identifiers or selectors of interest.

These selectors are understood to have been agreed between both the NSA and GCHQ. In the

region of between 30, 000 and 40,000 selectors are understood to have been identified. 16

Where information of interest is identified a log is created.17

27. It is understood that Tempora operates in conjunction with hugely powerful datamining and

link analysis programmes. Such programmes afford additional means by which metadata,

can be aggregated and exploited. Sophisticated computing tools permit the creation and

analysis of vast datasets to identify embedded patterns and relationships, which can include

personal and professional relationships as well as information regarding an individual or

organization’s network of contacts (and, in turn, their contacts). It can also provide

indication of the nature of the relationship between different persons or organizations, the

strength or significance of that contact. As a result individual pieces of data that previously 15 “GCHQ taps fibre-optic cables for secret access to world's communications”, The Guardian,

21 June 2013: http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa

16 Ibid17 Ibid

10

carried little potential to expose confidential or privileged information can now be used to

do so. Datamining and link analysis can now provide, for example, detailed information

relating to a journalist’s network of human and material sources.

28. There is significant cooperation between the United Kingdom authorities and the NSA in

relation to the operation of Tempora. It is reported that as many as 850,000 US Government

employees and private companies, working in partnership with the US Government, have

access to this information. The direct access of US officials to Tempora and the information

it produces appears to be confirmed by official US government training material, published

in The Guardian.18 In addition, the NSA is reported to have had 250 analysts working full-

time on Tempora data as at May 2012.19

Section 8 (4) Certification Process in Practice

29. The purported, internal legal justification for Tempora has been reported in The Guardian. It is

understood to be authorized by certificates issued to GCHQ under Section 8 (4) of RIPA

which pertains to external communications (as set out further below). The Guardian

reports:

Lawyers at GCHQ speak of having 10 basic certificates, including a "global"

one that covers the agency's support station at Bude in Cornwall, Menwith

Hill in North Yorkshire, and Cyprus”.20

Each certificate, it is understood, permits the interception of external data for a broad

range of purposes including prevention of “terrorism” or “organized crime”, the

protection of “national security” or the promotion of the “economic well-being” of the

United Kingdom. The Guardian reports:

The categories of material have included fraud, drug trafficking and terrorism,

but the criteria at any one time are secret and are not subject to any public

debate. GCHQ's compliance with the certificates is audited by the agency

itself, but the results of those audits are also secret.

An indication of how broad the dragnet can be was laid bare in advice from

GCHQ's lawyers, who said it would be impossible to list the total number of

18 “GCHQ taps fibre-optic cables for secret access to world's communications”, The Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa

19 Ibid. 20 “The Legal Loopholes that Allow GCHQ to Spy on the World”, Guardian, 21 June 2013:

http://www.theguardian.com/uk/2013/jun/21/legal-loopholes-gchq-spy-world

11

people targeted because "this would be an infinite list which we couldn't

manage".21

30. There is no requirement in UK law that these certificates for the interception of external

communications must specify persons, premises or even categories of persons to be

targeted. It is understood that, in practice, there is no such specification. The Foreign

Secretary must approve the renewal of these certificates every six months. It appears that

such approval is a matter of routine.

Global Telecoms Exploitation

The Guardian has also revealed the existence of another UK programme for mass data

interception, called “Global Telecoms Exploitation”. The Guardian reports that the

“documents [it saw] reveal that by last year GCHQ was handling 600m ‘telephone events’

each day, had tapped more than 200 fibre-optic cables and was able to process data from at

least 46 of them at a time”.22

Optic Nerve

31. It has also been reported that GCHQ has engaged in mass scale interception of images and other

data from online conversations between internet users. It is reported that as many of 1.8

million online images were intercepted in a six month period in 2008.23 The Optic Nerve

programme is understood to have been in existence until at least 2012. Information

gathered on the system has been exploited using the NSA’s “Xkeyscore” programme and

image recognition software. It is understood that bulk searches of the data gathered was

limited to metadata but that the interception, storage and collation of the data has been

indiscriminate.24

Prism

21 “GCHQ taps fibre-optic cables for secret access to world's communications”, The Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa

22 “GCHQ taps fibre-optic cables for secret access to world's communications”, The Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa

23 “Optic Nerve: millions of Yahoo webcam images intercepted by GCHQ”, Guardian 28 February 2014: http://www.theguardian.com/world/2014/feb/27/gchq-nsa-webcam-images-internet-yahoo

24 “Optic Nerve: millions of Yahoo webcam images intercepted by GCHQ”, Guardian 28 February 2014: http://www.theguardian.com/world/2014/feb/27/gchq-nsa-webcam-images-internet-yahoo

12

32. Prism is an intelligence gathering system, similar to Tempora, but run by the United States’

National Security Agency (the United States equivalent to GCHQ). The programme enables

the United States to access the full range of internet telecommunications content (images

whether live or still, messages, social networking sites, emails and a range of other content

and metadata).25 This programme enables access to data held on the private servers of large

US internet companies including Google, Facebook, Apple and Skype. It is understood that

the programme does not involve the tapping of communications “in transit” but allows for

access by the NSA to these servers operated by US information technology corporations.

33. The Guardian has suggested that on average over 2,000 Prism related reports about intercepted

communications are made each month by the NSA and more than 77,000 intelligence

reports based on that data had been made by June 2013.26

34. The operation of the Prism system is understood to be justified by reference to US Code § 1881

(a), US Foreign Intelligence and Surveillance Act 1978 which permits “the targeting of

persons reasonably believed to be located outside the United States to acquire foreign

intelligence information”.27 There is no requirement that the surveillance must be

proportionate, nor even that it must be necessary to protect specific interests such as

national security.

35. The NSA is understood to operate another programme of mass scale data interception alongside

Prism. This is called “Upstream” and it provides access to nearly all the traffic passing

through fibre optic cables owned by US-based telecommunications providers, enabling

access to communications content and metadata. Whereas Prism provides access to servers

of major corporations such as Google and Microsoft, Upstream provides collects

communications on fiber cables and infrastructure as data flows past.28 Data collected

25 “NSA Prism program taps in to user data of Apple, Google and others”, Guardian, 7 June 2013: http://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data

26 Ibid. 27 The definition of “foreign intelligence information” is set out in s 1801. It is very broad. Pursuant

to section 1801(e) “foreign intelligence information” includes “information with respect to a foreign power or foreign territory that relates to ... the conduct of the foreign affairs of the United States.” The term “foreign power” is defined in section 1801(a) to include not only foreign governments or entities directed or controlled by foreign governments, but also pursuant to section 1801(a)(5) “a foreign-based political organization, not substantially composed of United States persons.” Foreign-intelligence information thus covers information with respect to any foreign-based political organisation or government that relates to the foreign affairs of the US. It would thus, for example, include the contents of private and lawful discussions by those who are members of, or are communicating with, political organizations or governments that in any way relates to US foreign policy.

28 See “The NSA Slide You Haven’t Seen”, Washington Post, 10 July 2013: http://www.washingtonpost.com/business/economy/the-nsa-slide-you-havent-seen/

13

through Upstream (or Prism) can also be searched and analysed through the NSA’s

Xkeyscore system.

Report of the Intelligence and Security Committee of the United Kingdom Parliament

(“ISC”), 17 July 2013

36. On 17 July 2013 the ISC Published a report following these revelations about mass surveillance

by the intelligence services in the United Kingdom and the United States [Report of

Intelligence and Security Committee, 17 July 2013]. The report deals specifically with the

question of whether GCHQ had obtained evidence, in violation of United Kingdom law,

through making requests for information through the Prism programme. The report notes:

It has been alleged that GCHQ circumvented UK law by using the NSA’s PRISM

programme to access the content of private communications. From the evidence

we have seen, we have concluded that this is unfounded.

We have reviewed the reports that GCHQ produced on the basis of intelligence

sought from the US, and we are satisfied that they conformed with GCHQ’s

statutory duties. The legal authority for this is contained in the Intelligence

Services Act 1994 (emphasis added).

Further, in each case where GCHQ sought information from the US, a warrant

for interception, signed by a Minister, was already in place, in accordance with

the legal safeguards contained in the Regulation of Investigatory Powers Act

2000.

37. The report does not deal with the question of whether the interception, storage and exploitation

of external communications data (e.g. data communicated via the United Kingdom to a

person, place or thing outside the jurisdiction of the United Kingdom) was lawful or whether

the legal framework for this was compatible with the United Kingdom’s domestic law or

international obligations. As regards the finding that the use of information by GCHQ

gathered by the NSA –Prism Programme is compatible with UK law, no elaboration or

analysis is provided (beyond that stated above). Furthermore, the findings of the report are

limited to information “sought from the United States” (see above).29 The ISC did not

consider or investigate information shared spontaneously by the United States or

2013/07/10/32801426-e8e6-11e2-aa9f-c03a72e2d342_story.html 29 “Inquiry Into Snooping Laws as Committee Clears G.C.H.Q.”, Guardian 18 July 2013:

http://www.theguardian.com/world/2013/jul/17/prism-nsa-gchq-review-framework-surveillance

14

information to which the United Kingdom had, in any event, direct access through its

participation in the programmes in question.

D. LEGAL FRAMEWORK

38. The United Kingdom’s intelligence services, their functions and specifically their powers in

respect of the interception of data are regulated, in the main, by three pieces of legislation

the Regulation of Investigatory Powers Act 2000, the Intelligence Services Act 1994 and the

Justice and Security Act 2013.

Regulation of Investigatory Powers Act 2000 (“RIPA”)

39. Part I of RIPA is concerned with the interception, acquisition and disclosure of communications

data. Part II addresses directed or intrusive surveillance or the use of covert human

intelligence sources. For present purposes, Part I comprises the legislative provisions of

most relevance. Part I is divided into two Chapters. Chapter I of Part I deals with the

interception of data. Chapter II of Part I deals with the acquisition and disclosure of

“communications data” (e.g. metadata).

Chapter I, Part I, RIPA 2000; Interception of Data

40. Section 1 (1), RIPA provides as follows:

(1) It shall be an offence for a person intentionally and without lawful authority

to intercept, at any place in the United Kingdom, any communication in the

course of its transmission by means of–(a) a public postal service; or (b) a public

telecommunication system.

41. As regards the concept of “interception”, Section 2 (2), RIPA stipulates:

2(2) For the purposes of this Act [...] a person intercepts a communication in the

course of its transmission by means of a telecommunication system if, and only if,

he–

(a) so modifies or interferes with the system, or its operation,

(b) so monitors transmissions made by means of the system, or

15

(c) so monitors transmissions made by wireless telegraphy to or from apparatus

comprised in the system,

as to make some or all of the contents of the communication available, while being

transmitted, to a person other than the sender or intended recipient of the

communication.

42. Given that it is a criminal offence pursuant to Section 1 (1) of RIPA to intercept public

communications without “lawful authority”, this concept is crucial. It is defined in Section 1

(5) of RIPA, as follows “[c]onduct has lawful authority for the purposes of this section if, and

only if– [...] (b) it takes place in accordance with a warrant under section 5 (“an interception

warrant”); [...]”

43. Section 5, RIPA sets out the power of the Secretary of State to issue an interception warrant.

According to 5 (1) “the Secretary of State may issue a warrant authorising or requiring the

person to whom it is addressed, by any such conduct as may be described in the warrant, to

secure ...”, the interception of communications, the disclosure of intercepted material or the

provision of intercepted materials to other States in accordance with an applicable mutual

assistance treaty. Section 5(6) provides that conduct authorised by an interception warrant

shall be taken to include conduct; as is necessary to undertake in order to do what is

expressly authorised or required by the warrant; for obtaining related communications

data; and required of another by way of assistance to the person to whom the warrant is

addressed (aimed at giving effect to the warrant).

44. Section 5 (2) sets out certain limitations on the exercise of this power, explained in ss.(3)-(5), as

follows:

(2) The Secretary of State shall not issue an interception warrant unless he

believes–

(a) that the warrant is necessary on grounds falling within subsection (3);

and

(b) that the conduct authorised by the warrant is proportionate to what is

sought to be achieved by that conduct.

16

(3) Subject to the following provisions of this section, a warrant is necessary

on grounds falling within this subsection if it is necessary–

(a) in the interests of national security;

(b) for the purpose of preventing or detecting serious crime;

(c) for the purpose of safeguarding the economic well—being of the United

Kingdom; or

(d) for the purpose, in circumstances appearing to the Secretary of State to

be equivalent to those in which he would issue a warrant by virtue of

paragraph (b), of giving effect to the provisions of any international mutual

assistance agreement.

(4) The matters to be taken into account in considering whether the

requirements of subsection (2) are satisfied in the case of any warrant shall

include whether the information which it is thought necessary to obtain under

the warrant could reasonably be obtained by other means.

(5) A warrant shall not be considered necessary on the ground falling within

subsection (3)(c) unless the information which it is thought necessary to obtain

is information relating to the acts or intentions of persons outside the British

Islands.

45. Requirements relating to the contents of warrants are set out in Section 8 of RIPA 2000.

8.— Contents of warrants.

(1) An interception warrant must name or describe either–

(a) one person as the interception subject; or

(b) a single set of premises as the premises in relation to which the

interception to which the warrant relates is to take place.

(2) The provisions of an interception warrant describing communications the

interception of which is authorised or required by the warrant must comprise

one or more schedules setting out the addresses, numbers, apparatus or other

17

factors, or combination of factors, that are to be used for identifying the

communications that may be or are to be intercepted.

(3) Any factor or combination of factors set out in accordance with subsection

(2) must be one that identifies communications which are likely to be or to

include–

(a) communications from, or intended for, the person named or

described in the warrant in accordance with subsection (1); or

(b) communications originating on, or intended for transmission to, the

premises so named or described.

(4) Subsections (1) and (2) shall not apply to an interception warrant if–

(a) the description of communications to which the warrant relates

confines the conduct authorised or required by the warrant to

conduct falling within subsection (5); and

(b) at the time of the issue of the warrant, a certificate applicable to

the warrant has been issued by the Secretary of State certifying–

(i) the descriptions of intercepted material the examination

of which he considers necessary; and

(ii) that he considers the examination of material of those

descriptions necessary as mentioned in section 5(3)(a), (b)

or (c)” [ e.g. national security etc ].

(5) Conduct falls within this subsection if it consists in–

(a) the interception of external communications in the course of

their transmission by means of a telecommunication system; and

(b) any conduct authorised in relation to any such interception by

section 5(6).

18

(6) A certificate for the purposes of subsection (4) shall not be issued

except under the hand of the Secretary of State. (emphasis added).

46. The definition of “external communications” is therefore critical. It is defined in section 20 of the

Act in the following terms “external communication means a communication sent or

received outside the British Islands”. “Communication” is, in turn, defined in Section 81 (1)

of RIPA as “(a) … anything transmitted by means of a postal service; (b) anything

comprising speech, music, sounds, visual images or data of any description; and (c)

signals serving either for the impartation of anything between persons, between a

person and a thing or between things or for the actuation or control of any apparatus”

(emphasis added).

Section 8 (4) (b) Certificate

47. Data of any description sent from a thing (e.g. a computer or server etc) located in the United

Kingdom to a thing (e.g. a computer, server, database etc) outside the United Kingdom,

constitutes an “external communication” under RIPA 2000. So does such data passing from a

“thing” located outside the United Kingdom to a person or place inside the United Kingdom.

It also encompasses data, of course, which is communicated entirely outside the United

Kingdom. Such material may be intercepted under RIPA 2000 by reference to a very broad,

generic description of the material, identified in a Section 8 (4) (b) certificate, as set out

above. According to Section 9 (1) “[a]n interception warrant– (a) shall cease to have effect

at the end of the relevant period; but (b) may be renewed, at any time before the end of that

period, by an instrument under the hand of the Secretary of State [...]”.

48. As regards the duration of the “relevant period” for a warrant issued by the Secretary of State in

respect of the interception of external communications, Section 9(6)(ab) states that “in

relation to an unrenewed warrant which is endorsed under the hand of the Secretary of

State with a statement that the issue of the warrant is believed to be necessary on grounds

falling within section 5(3)(a) or (c), means the period of six months beginning with the day

of the warrant's issue...”

General Safeguards

49. A number of general safeguards are set out in Section 15 RIPA 2000 which require “the

Secretary of State to ensure, in relation to all interception warrants, that such arrangements

19

are in force as he considers necessary for securing...” the fulfilment of requirements

specified in Section 15 (2) and (3). Subsection (2) stipulates:

(a) the number of persons to whom any of the material or data is disclosed

or otherwise made available,

(b) the extent to which any of the material or data is disclosed or otherwise

made available,

(c) the extent to which any of the material or data is copied, and

(d) the number of copies that are made,

is limited to the minimum that is necessary for the authorised purposes.

50. Section 15(3) requires that “in relation to the intercepted material and any related

communications data...each copy made of any of the material or data (if not destroyed

earlier) is destroyed as soon as there are no longer any grounds for retaining it as necessary

for any of the authorised purposes”

Safeguards for Interception of External Communications

51. Very limited safeguards are also set out in Section 16 dealing with Section 8 (4) warrants

(which concern so-called “external communications”). Section 16 (2) requires that

intercepted material pursuant to a Section 8 (4) certificate may be “read, looked at or

listened to” only so far as it is selected “otherwise than according to a factor which – (a) is

referable to an individual who is known to be for the time being in the British Islands; and

(b) has as its purpose, or one of its purposes, the identification of material contained in

communications sent by him, or intended for him”.

52. The scope and effect of this safeguard is, however, limited by the exception to it set out in

Section 16 (3). This allows the interception of material referable to an individual, (or

individuals) present in the United Kingdom or contained in communications sent or

received by such a person, where: (a) “it is certified by the Secretary of State for the

purposes of section 8(4) that the examination of material selected according to factors

referable to the individual in question is necessary as mentioned in subsection 5(3)(a), (b)

or (c) [e.g. national security etc]; and (b) the material relates only to communications sent

20

during a period specified in the certificate that is no longer than the permitted maximum”.

The Maximum period is dealt with in Section 16 (3) (3A). It is six months in the case of

national security and three months in other cases.

The Broad Concepts of National Security and Economic Well-being and the Prevention and

Detection of Serious Crime

53. “External communications” may thus be intercepted (en masse) by reference to a description of

the communications where the Secretary of State “considers the examination of material of

those descriptions necessary” (a) in the interests of national security; (b) for the purpose of

preventing or detecting serious crime; (c) for the purpose of safeguarding the economic well

—being of the United Kingdom. The concepts of “national security”, the “prevention or

detection of serious crime” and “the economic well-being of the United Kingdom” as used in

RIPA 2000 are therefore crucial in understanding the nature and scope of the authorisation

powers conferred on the Secretary of State and the resulting powers of the intelligence

services where a RIPA section 8 (4) certificate is signed off by the Secretary of State.

54. The Secretary of State’s approach to the interpretation of the term “the economic well-being of

the United Kingdom”, the is set out in Section 4.4 of the Interception of Communications:

Code of Practice. This states:

In exercising his power to issue an interception warrant for the purpose of

safeguarding the economic well-being of the United Kingdom (as provided for

by section 5(3)(c) of the Act), the Secretary of State will consider whether the

economic well-being of the United Kingdom which is to be safeguarded is, on

the facts of each case, directly related to state security. The term “state

security”, which is used in Directive 97/66/EC (concerning the processing of

personal data and the protection of privacy in the telecommunications

sector), should be interpreted in the same way as the term “national security”

which is used elsewhere in the Act and this Code. The Secretary of State will

not issue a warrant on section 5(3)(c) grounds if this direct link between the

economic well-being of the United Kingdom and state security is not

established. Any application for a warrant on section 5(3)(c) grounds should

therefore explain how, in the applicant’s view, the economic well-being of the

United Kingdom which is to be safeguarded is directly related to state security

on the facts of the case.

21

55. The concept of “national security” in the Law of England and Wales is a wide one. The leading

case is Secretary of State for the Home Department v. Rehman [2003] 1 AC 153. Lord Wolf,

giving judgment in the Court of Appeal, held that the Secretary of State had “correctly

submitted that "national security" is a protean concept, "designed to encompass the many,

varied and (it may be) unpredictable ways in which the security of the nation may best be

promoted” (Secretary of State for the Home Department v. Rehman, [2013] 3 W.L.R. 1227, [§

35]). In its later judgment, upholding the decision of the Court of Appeal, the Judicial

Committee of the House of Lords emphasised that the question of the nature and scope of

the Secretary of State’s national security interests was a matter involving considerable

elements of policy and a matter for the Secretary of State’s discretion (See e.g. Secretary of

State v. Rehman [2003] 1 AC 153, [§ 17]).

56. The concept of “serious crime” is not defined in RIPA 2000. It offers substantial discretion to the

decision taker as to the offence or offences which may fall within its ambit. An uncertain

number of crimes fall within its ambit, the concept of serious criminality being an inherently

relative concept.

Interception of Communications Code of Practice

57. Section 71 of RIPA 2000 requires that the Secretary of State “shall issue one or more codes of

practice relating to the exercise and performance of the powers...” set out in Parts I, II and III

of the 2000 Act. In exercise of this power the Secretary of State has issued codes including

the Interception of Communications: Code of Practice and the Acquisition and Disclosure of

Communications Data: Code of Practice. The Former code regulates the interception of

communications under Chapter I, Part I of RIPA, in particular the interception of

communications content. The latter Code concerns the acquisition of “communications data”

by public authorities or the intelligence services (e.g. metadata).

58. The Codes of Practice are not, as such, legally binding. Section 72 of RIPA 2000 states that “[a]

person exercising or performing any power or duty in relation to which provision may be

made by a code of practice under section 71 shall, in doing so, “have regard to the

provisions (so far as they are applicable) of every code of practice for the time being

in force under that section” (emphasis added).

59. Chapter 6 of the Interception of Communications Code of Practice sets out some general

safeguards in relation to the interception of data with a warrant. Section 6.1 and 6.2

provides:

22

All material (including related communications data) intercepted under the

authority of a warrant complying with section 8(l) or section 8(4) of the Act must

be handled in accordance with safeguards which the Secretary of State has

approved in conformity with the duty imposed upon him by the Act. These

safeguards are made available to the Interception of Communications

Commissioner, and they must meet the requirements of section 15 of the Act

which are set out below. In addition, the safeguards in section 16 of the Act apply

to warrants complying with section 8(4). Any breach of these safeguards must be

reported to the Interception of Communications Commissioner.

Section 15 of the Act requires that disclosure, copying and retention of intercept

material be limited to the minimum necessary for the authorised purposes. The

authorised purposes defined in section 15(4) of the Act include: if the material

continues to be, or is likely to become, necessary for any of the purposes set out

in section 5(3) – namely, in the interests of national security, for the purpose of

preventing or detecting serious crime, for the purpose of safeguarding the

economic wellbeing of the United Kingdom.

60. As regards the dissemination of intercepted material, the Code provides that “[t]he number of

persons to whom any of the material is disclosed, and the extent of disclosure, must be

limited to the minimum that is necessary for the authorised purposes set out in section

15(4) of the Act”. As regards destruction, Section 6.8 provides that “[i]ntercepted material,

and all copies, extracts and summaries which can be identified as the product of an

interception, must be securely destroyed as soon as it is no longer needed for any of the

authorised purposes”.

61. A number of sections of the Interception of Communications Code deal with the question of

confidentiality. These are in Chapter 3. Section 3.1 states:

3.1 Consideration should be given to any infringement of the privacy of individuals

who are not the subject of the intended interception, especially where

communications relating to religious, medical, journalistic or legally privileged

material may be involved.

23

An application for an interception warrant should draw attention to any

circumstances which give rise to an unusual degree of collateral infringement of

privacy, and this will be taken into account by the Secretary of State when

considering a warrant application. Should an interception operation reach the

point where individuals other than the subject of the authorisation are identified

as directly relevant to the operation, consideration should be given to applying for

separate warrants covering those individuals.

Confidential Information

3.2 Particular consideration should also be given in cases where the subject of the

interception might reasonably assume a high degree of privacy, or where

confidential information is involved. Confidential information consists of matters

subject to legal privilege, confidential personal information or confidential

journalistic material (see paragraphs 3.9-3.11). For example, extra consideration

should be given where interception might involve communications between a

minister of religion and an individual relating to the latter’s spiritual welfare, or

where matters of medical or journalistic confidentiality or legal privilege may be

involved.

62. The Code does not set out specific safeguards for the protection of journalistically confidential

information. It does, however, state that “similar considerations” apply in the treatment of

journalistically privileged material as apply in respect of those applicable to legally

privileged material. As regards the latter, Section 3.6 states:

In general, any application for a warrant which is likely to result in the

interception of legally privileged communications should include, in addition to

the reasons why it is considered necessary for the interception to take place, an

assessment of how likely it is that communications which are subject to legal

privilege will be intercepted.

In addition, it should state whether the purpose (or one of the purposes) of the

interception is to obtain privileged communications. This assessment will be taken

into account by the Secretary of State in deciding whether an interception is

necessary under section 5(3) of the Act and whether it is proportionate.

24

Where a lawyer is the subject of an interception, it is possible that a substantial

proportion of the communications which will be intercepted will be between the

lawyer and his client(s) and will be subject to legal privilege. Any case where a

lawyer is the subject of an investigation should be notified to the Interception of

Communications Commissioner during his inspections and any material which has

been retained should be made available to him if requested.

63. No further guidance is provided as to what exceptions are permitted to this “general”

requirement to identify the necessity of intercepting material that is likely to be legally

privileged. There is no indication that this requirement is applicable in principle (or applied

in practice) to the mass interception of “external communications” now revealed by the

media (but not acknowledged in the Code).

64. As regards journalistic information, the guidance states somewhat vaguely [at 3.9]:

Similar consideration to that given to legally privileged communications must also

be given to the interception of communications that involve confidential personal

information and confidential journalistic material. [...] Confidential journalistic

material includes material acquired or created for the purposes of journalism and

held subject to an undertaking to hold it in confidence, as well as communications

resulting in information being acquired for the purposes of journalism and held

subject to such an undertaking.

65. No further guidance is given as to what “similar consideration” means in this context or as to

precisely how the “consideration” given to the protection of journalistically privileged

material ought to be “similar” to legally privileged material.

Chapter II, Part I, RIPA: Acquisition and Disclosure of Communications Data

66. A very different (and less rigorous) legal regime controls the interception and disclosure of

“communications data” (e.g. metadata) than that which regulates communications content.

The rationale for this appears to be that the interception and disclosure of “communications

data” is necessarily less intrusive of privacy or journalistic confidentiality than the

interception of the content of data. For the reasons set out below it is submitted that this

apparent rationale is wholly misconceived.

Communications Data

25

67. Communications data, in simple terms, refers to data about communications. The term is

defined in Section 21 (4) RIPA 2000 as including:

(a) any traffic data comprised in or attached to a communication (whether by the

sender or otherwise) for the purposes of any postal service or

telecommunication system by means of which it is being or may be

transmitted;

(b) any information which includes none of the contents of a communication

(apart from any information falling within paragraph (a)) and is about the use

made by any person–

(i) of any postal service or telecommunications service; or

(ii) in connection with the provision to or use by any person of any

telecommunications service, of any part of a telecommunication

system;

(c) any information not falling within paragraph (a) or (b) that is held or obtained,

in relation to persons to whom he provides the service, by a person providing a

postal service or telecommunications service.

68. “Traffic data” is an important term in understanding the concept of “communications data”. It is

defined in section 21 (6), RIPA 2000 as meaning:

(a) any data identifying, or purporting to identify, any person, apparatus or

location to or from which the communication is or may be transmitted;

(b) any data identifying or selecting, or purporting to identify or select, apparatus

through which, or by means of which, the communication is or may be

transmitted;

(c) any data comprising signals for the actuation of apparatus used for the

purposes of a telecommunication system for effecting (in whole or in part) the

transmission of any communication, and

26

(d) any data identifying the data or other data as data comprised in or attached to

a particular communication,

but that expression includes data identifying a computer file or computer program

access to which is obtained, or which is run, by means of the communication to the

extent only that the file or program is identified by reference to the apparatus in

which it is stored.

69. Section 21 (7) further clarifies:

(a) references, in relation to traffic data comprising signals for the actuation of

apparatus, to a telecommunication system by means of which a communication

is being or may be transmitted include references to any telecommunication

system in which that apparatus is comprised; and (b) references to traffic data

being attached to a communication include references to the data and the

communication being logically associated with each other;

70. Authorizations for interception/disclosure of communications data are governed by section 22

of RIPA. The safeguards are much less stringent than those that apply in relation to contents

data.

Authorization of Interception or Disclosure or of Communications Data

71. Section 21(2) of RIPA 2000 makes it lawful to intercept or disclose “communications data”

where such conduct is authorized or required by an authorisation or notice under Chapter

II, Part I of RIPA or where “the conduct is in accordance with, or in pursuance of, the

authorisation or requirement”. Authorization is provided, under Section 22 RIPA by

“designated persons”. Section 22 (3) provides that “... the designated person may grant an

authorisation for persons holding offices, ranks or positions with the same relevant public

authority as the designated person to engage in any conduct to which this Chapter applies”.

Thus, the public body seeking the “communications data” in question is also the public body,

through its designated person, able to grant authorization for such data to be intercepted

and disclosed. This is subject to a requirement of proportionality under Section 22 (5)

(assessed by the designated person). Section 22 (5) states that “[t]he designated person

shall not grant an authorisation under subsection (3)... unless he believes that obtaining the

27

data in question by the conduct authorised or required by the authorisation or notice is

proportionate to what is sought to be achieved by so obtaining the data”.

72. The public bodies with designated persons empowered to authorise the interception

communications data under RIPA (or to order a telecommunications operator to disclose

such data) currently includes the police and law enforcement and intelligence services; a

number of government departments including the Home Office, Ministry of Justice, and

Ministry of Transport; various emergency services (eg, fire and ambulance services etc.);

local authorities and National Health Service Trusts; and an assorted range of more than

100 other public bodies including the Charity Commission, the Food Standards Agency and

the Pensions Regulator. Secondary legislation defines the necessary rank of each person

empowered to obtain communications data in each of these organizations (see Schedule 1,

Regulation of Investigatory Powers (Communications Data) Order 2010/480).

Permissible Bases for Authorization – communications data

73. The basis on which “communications data” may be disclosed is also addressed in RIPA Section

22. This provides that a designated person may require communication service providers to

provide data (where that person believes it “necessary” and proportionate) on the following

grounds in s.22(2), namely:

(a) in the interests of national security; (b) for the purpose of preventing or

detecting crime or of preventing disorder; (c) in the interests of the economic

well-being of the United Kingdom; (d) in the interests of public safety; (e) for

the purpose of protecting public health; (f) for the purpose of assessing or

collecting any tax, duty, levy or other imposition, contribution or charge

payable to a government department; (g) for the purpose, in an emergency,

of preventing death or injury or any damage to a person's physical or mental

health, or of mitigating any injury or damage to a person's physical or mental

health; or (h) for any purpose (not falling within paragraphs (a) to (g)) which

is specified for the purposes of this subsection by an order made by the

Secretary of State.

74. The range of bases on which communications data may be intercepted and disclosed is

therefore very broad indeed.

28

75. A person known as a “Single Point of Contact” may be appointed and trained to facilitate “the

lawful acquisition of communications data and effective co-operation between a public

authority and a Communication Service Provider (“CSP”) (See Acquisition and Disclosure of

Communications Data: Code of Practice, [§ 23]). The SPC may advise a designated person as

to the legal requirements (including under the ECHR) regarding the disclosure of data.

There is no obligation to give such advice in each case and, further, no obligation on the

designated person to accept it. The role of the SPC is described in the Code of Practice as to

“encourage the public authority to regulate itself”. (Acquisition and Disclosure of

Communications Data: Code of Practice, [§ 24]).

Acquisition and Disclosure of Communications Data: Code of Practice

76. In contrast to the Interception of Communications Code of Practice, there are no safeguards

whatsoever with regard to the protection of journalistically privileged or confidential

material (including, for instance, the identity or whereabouts of sources or the location of

material to which they have access). Designated persons are not specifically required to

given “particular consideration” the question of whether the interception or disclosure of

communications data may reveal privileged or confidential information.

77. Moreover, there is no rule against designated persons granting authorizations in operations or

investigations in which they are involved. This is clear from Section 3:11 of the Guidance

which states:

Designated persons should not be responsible for granting authorisations or

giving notices in relation to investigations or operations in which they are

directly involved, although it is recognised that this may sometimes be

unavoidable, especially in the case of small organisations or where it is necessary

to act urgently or for security reasons. Where a designated person is directly

involved in the investigation or operation their involvement and their

justification for undertaking the role of the designated person must be explicit in

their recorded considerations.

78. As regards the authorization itself, Section 3:28 of the Code of Practice states that it must: be in

writing or in a manner which produced a record of it having been granted; “describe the

conduct which is authorised and describe the communications data to be acquired by that

conduct specifying, where relevant, any historic or future date(s) and, where appropriate,

29

time period(s)”; specify the purpose for which authorization has been granted; and record

the date of authorization.

Oversight of Investigatory Powers

79. Section 57 RIPA creates the office of Interception of Communications Commissioner. The

Commissioner is required to supervise the exercise of the functions under Chapters I and II

of Part I of the Act, and to notify the Prime Minister of any contraventions of the Act. These

reports are to be placed before Parliament but may be redacted. Section 59 RIPA provides

for the appointment of an Intelligence Services Commissioner required to supervise the

exercise of functions of the intelligence services. The Commissioner must also report to the

Prime Minister who, again, must place the report before Parliament.

80. The ISC, whose members are drawn from Parliament and appointed by the Prime Minister, also

has a role in overseeing the intelligence services. The ISC’s powers are set out in the Justice

and Security Act 2013. Its role is to oversee the expenditure, administration, policy and

operations of the intelligence services (Section 2 of the 2013 Act). It prepares an annual

report for Parliament on the discharge of its functions. It must first send this report to the

PM and the report may again be redacted before being placed before Parliament.

81. Section 65 RIPA establishes the Investigatory Powers Tribunal. The Tribunal is granted

exclusive jurisdiction over any judicial review or civil claim in respect of the compatibility of

the interception of communications by the intelligence services with rights under the ECHR.

In R (A) v. B [2009] UKSC 12, it was confirmed that the IPT has exclusive and final

jurisdiction in respect of such proceedings, which cannot be brought before the courts.

Section 68 (1) of RIPA 2000 empowers the Tribunal to determine its own rules of

procedure. These are enshrined in the Investigatory Powers Tribunal Rules S.I 2000/2665.

82. Very few claims have ever been upheld by the IPT. None have ever been upheld against the

intelligence services. The official figures are set out below:

Year Complaints Upheld

2001 95 0

2002 137 0

2003 110 0

2004 90 0

30

2005 80 2

2006 86 0

2007 66 0

2008 136 2

2009 157 1

2010 164 6

2011 180 0

2012 168 0

Total 1469 11

83. The Investigatory Powers Tribunal has no power to make a declaration of incompatibility in

respect of the legislative scheme under challenge in the present case. The power of a court

in England and Wales to make a declaration of incompatibility is set out in Section 4 of the

Human Rights Act 1998. According to Section 4 (2), “[i]f the court is satisfied that the

provision is incompatible with a Convention right, it may make a declaration of that

incompatibility”. Under Section 4 (4) “a court” may make such a declaration where satisfied:

(a) that the provision is incompatible with a Convention right, and (b) that

(disregarding any possibility of revocation) the primary legislation concerned

prevents removal of the incompatibility...”

84. The term “court” is defined in Section 4 (5) as “the Supreme Court; the Judicial Committee of the

Privy Council; the Court Martial Appeal Court; in Scotland, the High Court of Justiciary

sitting otherwise than as a trial court or the Court of Session; in England and Wales or

Northern Ireland, the High Court or the Court of Appeal; the Court of Protection, in any

matter being dealt with by the President of the Family Division, the Chancellor of the High

Court or a puisne judge of the High Court”. The Investigatory Powers Tribunal is not a court.

85. Moreover, section 67 (8) of RIPA, ousts the jurisdiction of the High Court to judicially review the

decisions of the IPT. It states that “[e]xcept to such extent as the Secretary of State may by

order otherwise provide, determinations, awards, orders and other decisions of the

Tribunal (including decisions as to whether they have jurisdiction) shall not be subject to

appeal or be liable to be questioned in any court”. No order permitting the decisions of the

IPT to be questioned in any other court has been made by the Secretary of State.

Non-Binding Guidance and Principles

31

86. Several international instruments concern the protection of journalistic sources. These include

amongst others: the Resolution on Journalistic Freedoms and Human Rights, adopted at the

4th European Ministerial Conference on Mass Media Policy (Prague, 7-8 December 1994);

and the Resolution on the Confidentiality of Journalists’ Sources by the European Parliament

(18 January 1994, Official Journal of the European Communities No. C 44/34).

87. Recommendation No. R(2000) 7 on the right of journalists not to disclose their sources of

information was adopted by the Committee of Ministers of the Council of Europe on 8 March

2000 and states, in so far as relevant: “[The Committee of Ministers] Recommends to the

governments of member States:

1. to implement in their domestic law and practice the principles appended to

this recommendation,

2. to disseminate widely this recommendation and its appended principles,

where appropriate accompanied by a translation, and

3. to bring them in particular to the attention of public authorities, police

authorities and the judiciary as well as to make them available to journalists, the

media and their professional organisations.

88. The Appendix to Recommendation No. R (2000) 7 states:

Principles concerning the right of journalists not to disclose their sources of

information

Definitions

For the purposes of this Recommendation:

a.  the term ‘journalist’ means any natural or legal person who is regularly or

professionally engaged in the collection and dissemination of information to the

public via any means of mass communication;

b.  the term ‘information’ means any statement of fact, opinion or idea in the

form of text, sound and/or picture;

c.  the term ‘source’ means any person who provides information to a journalist;

32

d.  the term ‘information identifying a source’ means, as far as this is likely to

lead to the identification of a source:

i.  the name and personal data as well as voice and image of a source,

ii.  the factual circumstances of acquiring information from a source by a

journalist,

iii.  the unpublished content of the information provided by a source to a

journalist, and

iv.  personal data of journalists and their employers related to their

professional work.

Principle 1 (Right of non-disclosure of journalists)

Domestic law and practice in member States should provide for explicit and

clear protection of the right of journalists not to disclose information identifying

a source in accordance with Article 10 of the Convention for the Protection of

Human Rights and Fundamental Freedoms (hereinafter: the Convention) and the

principles established herein, which are to be considered as minimum standards

for the respect of this right.

Principle 2 (Right of non-disclosure of other persons)

Other persons who, by their professional relations with journalists, acquire

knowledge of information identifying a source through the collection, editorial

processing or dissemination of this information, should equally be protected

under the principles established herein.

Principle 6 (Interception of communication, surveillance and judicial search and

seizure)

a.  The following measures should not be applied if their purpose is to

circumvent the right of journalists, under the terms of these principles, not to

disclose information identifying a source:

i.  interception orders or actions concerning communication or

correspondence of journalists or their employers,

ii.  surveillance orders or actions concerning journalists, their contacts or

their employers, or

33

iii.  search or seizure orders or actions concerning the private or business

premises, belongings or correspondence of journalists or their employers

or personal data related to their professional work.

b.  Where information identifying a source has been properly obtained by police

or judicial authorities by any of the above actions, although this might not have

been the purpose of these actions, measures should be taken to prevent the

subsequent use of this information as evidence before courts, unless the

disclosure would be justified under Principle 3.

E. ADMISSIBILITY

89. No effective remedy for the matters raised in the present application exists in UK law. The only

avenue in the domestic legal system by which the media/journalist Applicants could bring

their present complaint the Investigatory Powers Tribunal. As indicated above, by virtue of

Section 65 (2) (a) of RIPA 2000, the Tribunal is the “only appropriate tribunal” for the

purposes of challenging either the interception of communications generally or to the

compatibility of the conduct of the intelligence services with Convention rights of the

Applicants.

90. As also indicated above the Investigatory Powers Tribunal has no power to issue a declaration

that the legislative scheme subject to challenge in the present complaint is incompatible

with the Convention rights of the media/journalist Applicants. This is clear from the terms

of Section 4 (5) of the Human Rights Act 1998 which does not define the Investigatory

Powers Tribunal as a “Court” for the purposes of Section 4 of the Human Rights Act with the

consequence that it has no power to make a Section 4 (2) declaration of incompatibility.

Thus, even if the Applicants were to bring the present complaint in respect of the statutory

regime laid down in Primary legislation before the Investigatory Powers Tribunal, the

Tribunal would have no power to declare the scheme incompatible with the Applicants’

Convention rights (still less require that any such incompatibility be legally remedied under

domestic law).

91. Furthermore, although the High Court does have a general power to issue a declaration of

incompatibility in relation to domestic legislation, the jurisdiction of the High Court (and,

indeed, any other superior court in the United Kingdom) to hear a challenge to a decision

34

made by the Investigatory Powers Tribunal is ousted by Section 67 (8) of RIPA. This states

that “[e]xcept to such extent as the Secretary of State may by order otherwise provide,

determinations, awards, orders and other decisions of the Tribunal (including decisions as

to whether they have jurisdiction) shall not be subject to appeal or be liable to be

questioned in any court”. In R (A) v. B [2009] UKSC 12, it was confirmed that the

Investigatory Powers Tribunal has exclusive and final jurisdiction in respect of such

proceedings. There is therefore no possibility of the Applicants obtaining a Section 4

declaration from the domestic courts to the effect that the statutory scheme in RIPA 2000

and elsewhere is incompatible with their Convention rights as a media and newsgathering

organization / a journalist. Although the Investigatory Powers Tribunal may be able to issue

a judgment offering an opinion as to the compatibility of the statutory scheme with the

Applicants’ Convention rights, such an opinion (being other than a declaration under Section

4 of the Human Rights Act 1998) would be of no legal or practical benefit to the Applicants.

The Tribunal does not have the power to annul any of the provisions about which complaint

is made nor does it have power to declare unlawful the statutory scheme or the provisions

of which it is comprised (See Kennedy v. the United Kingdom, Merits, Application No.

26839/05, [§ 119]).

92. In any event, it is well established in the case law of the ECtHR that a declaration of

incompatibility under s.4 of the Human Rights Act does not in itself yet constitute an

effective remedy for the purposes of the Convention. In Kennedy, the Court held that “the

practice of giving effect to the national courts’ declarations of incompatibility by amendment

of offending legislation is not yet sufficiently certain as to indicate that section 4 of the

Human Rights Act is to be interpreted as imposing a binding obligation giving rise to a

remedy which an applicant is required to exhaust” (Kennedy v. the United Kingdom, Merits,

Application No. 26839/05, [§ 120]; Burden v. the United Kingdom, [GC], (2008) 47 E.H.R.R.

38). The position remains the same today. A declaration of incompatibility still does not

impose any obligation to amend or supplement legislation incompatible with an individual’s

Convention rights. Furthermore, the challenge here is, in part, to the insufficiency of

legislative protection, including safeguards, in respect of the Applicant’s Convention rights.

A declaration of incompatibility (even if it were available) offers no redress where there is

an insufficiency of legislative protection and insufficient safeguards enshrined in law. Courts

in the UK have no power to require Parliament to legislate, even where there exists an

insufficiency of safeguards to afford protection to fundamental Convention rights in a

particular context.

35

93. In short, the Applicants’ application cannot be rejected on grounds of failure to exhaust

domestic remedies.

F. SUBMISSIONS

(I) Status of Applicants under Article 34 of the Convention

94. An individual is to be treated as a “victim” for the purposes of Article 34 of the Convention in

cases concerning secret surveillance, even in the absence of evidence demonstrating that

they have been the subject of surveillance. In Klass and others v. Germany, 2 EHRR 214

(1978), [§ 34], the Court held:

[T]he effectiveness (l’effet utile) of the Convention implies in such circumstances

some possibility of having access to the Commission. If this were not so, the

efficiency of the Convention’s enforcement machinery would be materially

weakened. The procedural provisions of the Convention must, in view of the fact

that the Convention and its institutions were set up to protect the individual, be

applied in a manner which serves to make the system of individual applications

efficacious.

The Court therefore accepts that an individual may, under certain conditions,

claim to be the victim of a violation occasioned by the mere existence of secret

measures or of legislation permitting secret measures, without having to allege

that such measures were in fact applied to him.

95. Following this decision the Court has repeatedly held that where an individual establishes “a

reasonable likelihood” of an interference with their right to private and family life as a result

of covert surveillance he or she is entitled to be treated as a “victim” for the purposes of the

Convention. The Court has applied this principle in numerous covert surveillance cases (eg

Klass v. Germany (1989) 2 EHRR 214; Halford v United Kingdom (1997) 24 E.H.R.R. 523 [at §

47-48]; and Nimmo v. the United Kingdom, Decision, 11 October 1988, Application No.

12327/86).

96. Insofar as the Applicant’s case concerns interference with their right to freedom of expression,

specifically journalistic expression, there is no justification, principled or otherwise, for a

different approach to be adopted. Although the Court has developed the Klass v. Germany

jurisprudence in the context of the protection of the right to private and family life, the

36

rationale underpinning the approach to surveillance cases set out in Klass is equally

applicable in circumstances where secret surveillance may interfere with the free

expression rights of journalists and newsgathering organizations. This has been confirmed

by the Court in Weber and Saravia v. Germany (2008) 46 EHRR SE 47, [§§ 144-145]. If it

were not possible to challenge secret surveillance in the absence of concrete evidence that

an individual journalist or media organization has been made subject to it, the effectiveness

of Article 10 in this context would be wholly undermined.

97. Applying this approach, there can be little doubt that there exists a reasonable likelihood that

the Applicants have, in the course of their work, been subject to secret surveillance.

a. BIJ have, for a number of years, been involved in investigating controversial issues

concerning the military, national security and very sensitive aspects of foreign

policy. Since around 2011 BIJ has been involved in a major investigation into drone

strikes by the US armed forces in Pakistan, Somalia and Yemen, touching on matters

including the supply of intelligence material for use in such strikes by the United

Kingdom’s intelligence services, among others. As part of this work, BIJ journalists

have spoken to and been in communication with persons injured in such strikes,

including in a number of instances, persons who may have been targeted by drone

strikes. It is very likely that these communications would be of great interest to the

United Kingdom’s intelligence services (and the intelligence services of other

States); The nature of BIJ’s work is set out in the attached witness statements of

Christo Hird, Director of the BIJ, and in the statement of the Second Applicant, Alice

Ross, a reporter with BIJ. This work includes matters such as the security response

to terrorism, the activities of the intelligence services, drone strikes in Pakistan and

elsewhere, deprivation of citizenship on grounds of national security and so forth.

b. Recently, BIJ has been investigating the use by the Secretary of State of the power to

strip an individual of British Citizenship. The BIJ considers this to be a matter of

considerable public importance generally not explored, to any great extent, by

commercially funded newsgathering organizations. The power of deprivation of

nationality may be used where the Secretary of State considers an individual to pose

a risk seriously prejudicial to the interests of the United Kingdom, including its

national security. Over two dozen individuals have been stripped of citizenship since

2006. Indeed, in two instances, the BIJ has discovered that individuals stripped of

citizenship were subsequently killed in drone strikes in Yemen. In this investigation

37

the Bureau has, on a number occasions, spoken to individuals connected to persons

who have been stripped of their citizenship. The Bureau has also been in

communication with persons (necessarily located overseas) who have been stripped

of citizenship on grounds of conduct “seriously prejudicial” to the vital interests of

the United Kingdom. Again, it is very likely that the Bureau’s contact with these

individuals will be of great interest to the United Kingdom’s intelligence services and

has been intercepted, stored and/or analysed using processes and technology

described above. Further details of this investigation and sensitive work carried out

by BIJ in respect of it is set out in the witness statement of Alice Ross. She explains

that as part of this investigation she has inevitably been in contact both directly and

indirectly, with those likely to be of interest to the intelligence services (not least

since proceedings have been undertaken in a number of instances to deprive the

individuals in question of citizenship on national security grounds). She states: My

work monitoring the use of deprivation of citizenship legislation without question

involves us accessing material and speaking to individuals that are of interest to the

British authorities. These powers [e.g. those in respect of the deprivation of

citizenship] are used against people classed as terrorists, or behaving in a manner

that suggests they are likely to act against the good of the British public. In other

words these people are of high interest to the authorities. And we know from

documents produced in the Special Immigration Court in London that the

intelligence services are monitoring or have monitored many of these individuals.

98. BIJ’s work in relation to the deprivation of citizenship and drones, outlined above, provide

indicative examples of the kind of investigative activities in which the Bureau has been

involved and which are “reasonably likely” (indeed, very likely) to have brought BIJ’s

communications to the attention of the UK intelligence services utilizing the powers

conferred by RIPA 2000 discussed above. Further examples of BIJ’s work in these fields are

set out in the witness statement of Christo Hird, Managing Editor of the Bureau of

Investigative Journalism, and Alice Ross.

99. Furthermore, the very scale of the Tempora programme (and allied programmes) described

above, the vast quantity of data intercepted and the scale and sophistication of the

technology for the analysis and processing of this information also means that it is very

likely that the Applicants’ communications with persons located overseas have been

intercepted. Moreover, the Applicants, in the course of their work, have used software such

as Dropbox (a programme for the remote storage or sharing of large quantities of electronic

38

data) for the storage and transfer of their journalistic material. This has included sensitive

journalistic material pertaining to investigations such as the drones investigation. Where

this material is stored on servers located outside the United Kingdom, it is very likely to pass

through transatlantic fibre-optic cables and be subject to interception and storage through

the Tempora programme as described above.

100. In all the circumstances, the Applicants’ data and material is likely to have been

intercepted in purported exercise of powers conferred upon the intelligence services by

RIPA 2000 and they can, in consequence, claim to be victims for the purposes of the

application of Articles 8 and 10, ECHR.

(II) Applicability of Articles 8 and 10

101. There is no doubt that Articles 8 and 10 are engaged by the provisions under challenge

in the present application and by the exercise of powers by the intelligence services

pursuant to these provisions. The Applicants challenge the inadequacies of the United

Kingdom’s domestic legal framework for the protection of journalistic sources and material

in respect of the interception, storage, dissemination and exploitation of the vast range of

material treated as “external communications” under RIPA 2000 and secondly the

inadequate protection afforded in respect of the interception, storage, dissemination and

exploitation of “communications data” or metadata under RIPA 2000.

102. There is no doubt that Article 8 is engaged by the interception, storage and exploitation

of the Applicants’ communications. The Court has, in the context of the covert interception

of journalistic material, found on a number of occasions that such measures engage Article 8

(See Weber and Saravia v. Germany (2008) 46 EHRR SE 47, [§§ 78-79]; Telegraaf Media

Nederland Landelijke Media B.V. and Others v. the Netherlands (2012) 34 BHRC 193, [§§ 84-

88]. Such interference arises in two ways. The interception and obtaining of journalistic

material by one state entity clearly constitutes an interference with Article 8, but so too does

the transmission to and/or use of the data by other authorities (Weber and Saravia v.

Germany (2008) 46 EHRR SE 47, [§§ 78]. The Applicants challenge the compatibility of the

domestic legal framework with regard to both of these aspects of the protection afforded by

Article 8.

103. Article 10 is also applicable. The Court has repeatedly emphasised that the protection of

journalistic sources and material is an important guarantee afforded by the right to free

39

expression. In the specific context of secret state surveillance of journalists, the Court

reaffirmed in Weber and Saravia v. Germany (2008) 46 EHRR SE 47, [§§ 143] that:

[F]reedom of expression constitutes one of the essential foundations of a

democratic society and that the safeguards to be afforded to the press are of

particular importance. The protection of journalistic sources is one of the

cornerstones of freedom of the press. Without such protection, sources may be

deterred from assisting the press in informing the public about matters of

public interest. As a result the vital public-watchdog role of the press may be

undermined, and the ability of the press to provide accurate and reliable

information be adversely affected.

104. Just as the interception, retention and dissemination of journalistic material (including

material tending to identify journalistic sources) engages Article 8 so does it engage Article

10. In Telegraaf Media Nederland Landelijke Media B.V. and Others v. the Netherlands , a case

concerning the covert surveillance of journalists, the Court observed that “[a]lthough

questions raised by surveillance measures are usually considered under Article 8 alone, in

the present case they are so intertwined with the Article 10 issue that the Court finds it

appropriate to consider the matter under Articles 8 and 10 concurrently.”

(III) Failure to Comply with the Requirements of Legality under Articles 8 and

10 of the Convention

105. The Court has, on numerous occasions, identified a number of requirements which a

legal regime for covert surveillance must satisfy in order for it to meet the requirement of

legality under the Convention (e.g. being “in accordance with law”, Article 8 and being

“prescribed by law”, Article 10). In the context of the secret surveillance of journalists these

requirements were summarized as follows in Telegraaf Media Nederland Landelijke Media

B.V. and Others v. the Netherlands, [§ 90]:

The Court reiterates its case-law according to which the expression “in

accordance with the law” not only requires the impugned measure to have

some basis in domestic law, but also refers to the quality of the law in question,

requiring that it should be accessible to the person concerned and foreseeable

as to its effects. The law must be compatible with the rule of law, which means

that it must provide a measure of legal protection against arbitrary

interference by public authorities with the rights safeguarded by Article 8 § 1

40

and Article 10 § 1. Especially where, as here, a power of the executive is

exercised in secret, the risks of arbitrariness are evident. Since the

implementation in practice of measures of secret surveillance is not open to

scrutiny by the individuals concerned or the public at large, it would be

contrary to the rule of law for the legal discretion granted to the executive to be

expressed in terms of an unfettered power. Consequently, the law must

indicate the scope of any such discretion conferred on the competent

authorities and the manner of its exercise with sufficient clarity, having regard

to the legitimate aim of the measure in question, to give the individual adequate

protection against arbitrary interference.

106. The Applicants submit that these requirements are not satisfied by the United Kingdom’s

regulatory framework for surveillance, either in respect of the interception and use of

external communications (including the communication or storage of journalistic material)

or in respect of the interception and use of “communications data” (including in particular

data tending to reveal journalists sources), as defined in sections 20 and 21 (4) of RIPA

2000.

Accessibility and Foreseeability: The Interception of Data Content

107. In Weber and Saravia v. Germany [§ 93], the Court explained the requirement of

foreseeability in the context of covert surveillance in the following terms:

[F]oreseeability in the special context of secret measures of surveillance, such as

the interception of communications, cannot mean that an individual should be

able to foresee when the authorities are likely to intercept his communications so

that he can adapt his conduct accordingly […]. However, especially where a power

vested in the executive is exercised in secret, the risks of arbitrariness are evident

[…]. It is therefore essential to have clear, detailed rules on interception of

telephone conversations, especially as the technology available for use is

continually becoming more sophisticated […]. The domestic law must be

sufficiently clear in its terms to give citizens an adequate indication as to the

circumstances in which and the conditions on which public authorities are

empowered to resort to any such measures (emphasis added).

108. Where discretion in relation to covert surveillance has been conferred upon a public official,

it must be reasonably clear which elements of the power to intercept have been

41

incorporated in law as legal requirements and which elements remain at the discretion of

the executive (See Malone v. the United Kingdom, (1984) 7 EHRR 14, [§§ 69-80]; MM v. the

United Kingdom, Merits, 29 April 2013, Application No. 24029/07).

109. The UK’s domestic legal framework for the interception and use of external

communications, using powers conferred by RIPA 2000, does not comply with the

requirements outlined above, especially insofar as the nature, and exercise of these powers

impacts upon journalistically privileged material and sources.

110. First the discretionary power of the Secretary of State to issue a generic certificate for the

interception of external communications pursuant to Section 8 (4) of RIPA 2000 is

extraordinarily broad in scope. Section 8 (4) (b) RIPA 2000 empowers the Secretary of State

to issue a warrant for the interception of “external communications” in respect of “the

descriptions of intercepted material the examination of which he considers necessary” for

reasons set out in Section 5 (3) (b) of RIPA (e.g. for the protection of national security, for

the detection and prevention of serious crime or for the purposes of safe-guarding the

economic well-being of the United Kingdom). Any category of “external” communication

may be intercepted using a Section 8 (4) (b) warrant so long as the Secretary of State

considers the mass interception of a particular category of information to be “necessary” for

the promotion of national security, the economic well being of the United Kingdom or the

prevention and detection of serious crime. This creates the real likelihood that significant

quantities of journalistic material will be intercepted.

111. The breadth of the Secretary of State’s discretion to issue a Section 8 (4) warrant in relation

to external communications and to determine the scope of such a warrant is enlarged even

further by the very broad meaning attached to the concept of “national security” in domestic

law. In the leading case of Secretary of State for the Home Department v. Rehman, Lord Wolf,

giving judgment in the Court of Appeal, endorsed the Secretary of State’s submissions that

“national security is a protean concept, designed to encompass the many, varied and (it may

be) unpredictable ways in which the security of the nation may best be promoted”

(Secretary of State for the Home Department v. Rehman, [2013] 3 W.L.R. 1227, [§ 35]). In a

subsequent judgment, upholding the decision of the Court of Appeal, the Judicial Committee

of the House of Lords emphasised that the question of the nature and scope of the national

security interests identified by the Secretary of State was a matter involving considerable

elements of policy and a matter largely for the Secretary of State’s discretion (See e.g.

Secretary of State v. Rehman [2003] 1 AC 153, [§ 17]). There can be little doubt therefore

42

that the discretion afforded to the Secretary of State to issue Section 8 (4) warrants for the

interception of external communications is indeed extraordinarily broad.

112. Furthermore, the breadth of material which can be intercepted under a Section 8 (4)

warrant is vast. Section 8 (4) authorization may be granted in relation to any “external

communication”, which is defined in section 20 of the Act as “a communication sent or

received outside the British Islands”. “Communication” is, in turn, defined widely in Section

81 (1) of RIPA as

“(a) … anything transmitted by means of a postal service; (b) anything

comprising speech, music, sounds, visual images or data of any

description; and (c) signals serving either for the impartation of

anything between persons, between a person and a thing or between

things or for the actuation or control of any apparatus” (emphasis added).

The concept of “external communications” therefore encompasses a vast quantity of

information and material, including material not communicated in any traditional or

conventional sense. Data storage software programmes such as Dropbox, commonly

used by investigative journalists, would amount to an “external communication”

susceptible to interception where, as may well be the case, the data is stored on servers

located outside the United Kingdom.

113. Furthermore, such is the breath of the discretion conferred upon the Secretary of State

under Section 8 (4), he or she can (and, in practice, it appears, does) define the class of

information subject to the section 8 (4) warrant very broadly indeed. The breadth of the

Section 8 (4) warrants, in practice, is indicated by the Guardian, which reports:

Lawyers at GCHQ speak of having 10 basic certificates, including a

"global" one that covers the agency's support station at Bude in

Cornwall, Menwith Hill in North Yorkshire, and Cyprus”.30

[…]

The categories of material have included fraud, drug trafficking and

terrorism, but the criteria at any one time are secret and are not subject

30 “The Legal Loopholes that Allow GCHQ to Spy on the World”, Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/legal-loopholes-gchq-spy-world

43

to any public debate. GCHQ's compliance with the certificates is audited

by the agency itself, but the results of those audits are also secret.

An indication of how broad the dragnet can be was laid bare in advice

from GCHQ's lawyers, who said it would be impossible to list the total

number of people targeted because "this would be an infinite list which

we couldn't manage".31

114. The legal discretion granted to the executive for the physical capture of external

communications is therefore subject to few limitations.

115. The scope of the power of interception is of particular concern to the Applicants in the

present case as it is almost certain that substantial quantities of sensitive journalistically

privileged material is captured through exercise of this expansive power of interception.

116. Second, given the breadth of the Secretary of State’s discretion, detailed safeguards are

essential for the regime to satisfy the requirements of legality under the Convention. Few

safeguards are, however, in place. Significantly, the safeguards specified in respect of the

interception of internal communications in Section 8 (1) of RIPA 2000 are expressly

disapplied in relation to external communications by Section 8 (4) RIPA 2000 with the

result that interception under Section 8 (4) can occur in a wholly untargeted manner, and

capture privileged material, including journalistically privileged material. In relation to

communications which are not “external”, Section 8 (1) RIPA specifies that the interception

warrant must specify the person or premises subject of the interception warrant. Moreover,

under Section 5 (2) RIPA 2000 the Secretary of State must be satisfied that the interception

of communications in respect of a specific person or premises is “necessary” on grounds of

national security, serious crime prevention or for the economic well-being of the United

Kingdom. In contrast, interception of external communications under Section 8 (4) appears

to occur on a mass scale and in an untargeted manner, giving rise to the very real risk that

privileged and confidential journalistic material will regularly be captured.

117. Third, Section 8(4) and 16 RIPA 2000 also confer an enormously wide discretion as regards

which external communications, out of all of those captured, are looked at, listened to or

31 “GCHQ taps fibre-optic cables for secret access to world's communications”, The Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa

44

read. If the Secretary of State deems it “necessary” in the interests of national security, the

prevention of serious crime or the protection of the United Kingdom’s economy any external

communication can be read or listened to (see RIPA 2000, Section 16 (3)). Again, this is of

particular concern to the Applicants given that it creates a real likelihood that

journalistically privileged material may be read, looked at or listened to pursuant to an

overbroad Section 8 (4) certificate.

118. Fourth, not only is no special protection afforded to journalistically privileged material

under RIPA 2000, but the statutory guidance on the interception of communications, The

Interception of Communications Code of Practice, provides almost no additional safeguards,

much less detailed safeguards. The guidance itself is short, vague and wholly imprecise as

regards what arrangements (if any) are in place to protect journalistic material in the

context of 8 (4) warrants. Sections 3.1 and 3.2 of the Code of Practice state, vaguely, that

“[c]onsideration should be given to any infringement of the privacy of individuals who are

not the subject of the intended interception, especially where communications relating to …

journalistic … privileged material may be involved” and that “particular consideration” or

“extra consideration” should be given to cases where the “subject” of the interception, such

as a journalist, might reasonably expect a high degree of privacy. Of course, given that there

will not be a “subject” of a section 8 (4) warrant in relation to external communications,

even this limited safeguard is not strictly applicable as a safeguard in respect of a Section 8

(4) warrant.

119. In any event, what, precisely, the exhortation to afford “consideration” actually requires

remains largely unspecified in the Code. Section 3.1 states that an application for a warrant

should “draw attention” to any “unusual degree” of collateral infringement of privacy

(including journalistic privilege), to enable the Secretary of State to take this “into account”

in deciding whether to grant a warrant. But there is no requirement that any additional

safeguards be observed where such information is intercepted. Nor does the guidance give

any concrete indication as to the kinds of safeguards (if any) which are available to the

Secretary of State to protect privileged and confidential information, nor the kinds of

circumstances where they are likely to be considered appropriate. There is no indication for

instance, that where journalists are exploring matters pertaining to allegations of

wrongdoing by the security services themselves or by persons for whom they are

responsible or working with that arrangements be put in place to ensure such information is

not misused.

45

120. Some further guidance is provided at sections 3.3 - 3.11. Again, this guidance is notably

vague. It provides few concrete or practical safeguards for the protection of journalistic

information. Section 3.9 of the Code states that “similar consideration” should be given to

journalistically privileged material as is afforded to legally privileged material. Again what

this “similar consideration” requires is not clear. Section 3.6 states that in relation to legally

privileged material, an application should state whether its purpose is to obtain privileged

material so that this may be taken into account by the Secretary of State in deciding whether

the interception warrant is “necessary”. The difficulty with Section 8 (4) generic warrants is,

however, that potentially so much information is captured that it is almost inevitable that

many different kinds of information will be intercepted even if not targeted in terms. The

power of the Secretary of State to impose additional conditions in granting a warrant is

noted in the guidance but what these conditions may, in practice, entail or the circumstances

in which they are likely to be considered appropriate is left entirely unspecified. Aside from

this no further specific, practical safeguards for journalistically privileged material are set

out in the Code.

121. Fifth, under section 15 (1) of RIPA the Secretary of State, when issuing a warrant for the

interception of external communications, is required to ensure “that such arrangements are

in force as he considers necessary for securing…” that the nature and extent of disclosure for

authorized purposes is the minimum necessary to achieve those purposes (see Section 15

(2) and (3), RIPA 2000). These “arrangements” in respect of a Section 8 (4) warrant are not

publicly available and are only made available to the Interception of Communications

Commissioner. This is clear from Section 6.1 of the Interception of Communications Code of

Practice which states:

All material (including related communications data) intercepted under

the authority of a warrant complying with section 8(l) or section 8(4) of

the Act must be handled in accordance with safeguards which the

Secretary of State has approved in conformity with the duty imposed

upon him by the Act. These safeguards are made available to the

Interception of Communications Commissioner, and they must meet the

requirements of section 15 of the Act which are set out below.

122. It is not clear precisely what “arrangements” (if any) have been put in place by the Secretary

of State to meet these obligations (in particular with regard to privileged/confidential

material). The Court in Liberty v. the United Kingdom (2009) 48 EHRR 1 rejected the

46

submission that internal, unpublished arrangements were sufficient to meet the

requirements of foreseeability and accessibility under the Convention (Liberty v. the United

Kingdom, [§ 67]). The fact that the arrangements are made known to the Interception of

Communications Commissioner, whilst desirable, self-evidently does not assist with the

accessibility or foreseeability of the scheme. Other than the limited, vague principles dealing

with journalistically privileged material in the Interception of Communications Code of

Practice, the “arrangements” and safeguards in place (if any) to deal with concerns about

privileged material are not in the public domain and not accessible to journalists or the

public at large. It is therefore entirely unclear to investigative journalists when their

privileged/confidential material and communications may be intercepted and, further,

when and how such information may be disseminated within government or amongst

government agencies. This could potentially serve to undermine the public watchdog role of

the press, the importance of which has been emphasized by the court on many occasions.

123. Sixth, although a Section 8 (4) RIPA certificate remains in place for up to six months (at least

insofar as matters of national security are concerned), such generic warrants can (and, it

appears, are) extended, in effect, on a rolling basis, following six monthly ministerial

review.32 The absence of limitations on the circumstances in which an interception warrant

may be extended was deprecated by the Court in Iordachi and others v. Moldova Merits, 14

September 2009, Application No. 25198/02, [§ 45].

124. Seventh, to the extent the United Kingdom seeks to rely on unpublished, internal or secret

guidelines, protocols or safeguards for the protection of confidential or journalistically

privileged material, such unpublished guidance or protocols cannot satisfy the requirements

of accessibility. A similar argument was made by the United Kingdom in Liberty v. the United

Kingdom and emphatically rejected by the Court in the following terms:

66. According to the Government (see paragraphs 48-51 above), there

were at the relevant time internal regulations, manuals and instructions

applying to the processes of selection for examination, dissemination and

storage of intercepted material, which provided a safeguard against

abuse of power. The Court observes, however, that details of these

“arrangements” made under section   6 were not contained in

legislation or otherwise made available to the public. (emphasis

added)

32 “The Legal Loopholes that Allow GCHQ to Spy on the World”, Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/legal-loopholes-gchq-spy-world

47

67. The fact that the Commissioner in his annual reports concluded that

the Secretary of State’s “arrangements” had been complied with (see

paragraphs 32-33 above), while an important safeguard against abuse of

power, did not contribute towards the accessibility and clarity of the

scheme, since he was not able to reveal what the “arrangements” were. In

this connection the Court recalls its above case-law to the effect that

the procedures to be followed for examining, using and storing

intercepted material, inter alia , should be set out in a form which is

open to public scrutiny and knowledge (emphasis added).

125. Unpublished guidance, protocols or rules cannot therefore sensibly be said to rectify the

problems of foreseeability, accessibility and clarity arising in the statutory scheme for the

interception of communications.

Foreseeability, Accessibility: The Interception of Communications Data

126. The same points regarding accessibility and foreseeability arise with equal, if not greater,

force in relation to the legal regime for the interception of communications data. Such

interception is subject to substantially less detailed (and even less rigorous) safeguards than

the interception of communications content.

127. The rationale for the less rigorous safeguarding of communications data appears to be

based on an assumption that the interception of communications data is necessarily less

invasive of privacy or confidentiality than the content of communications. If this assumption

were ever true, developments in data analysis technology now render it thoroughly unsafe,

certainly as regards the interception of communications data pertaining to journalists or

newsgathering organizations.

128. Recent advances in mass data analysis technology has had a profound effect on the ways

and speed with which vast quantities of data can be processed, sorted and analyzed.

Powerful datamining and link analysis programmes in particular have led to new ways of

exploiting aggregated digital information, on a mass scale. This technology permits the

analysis of large datasets to identify embedded patterns and relationships, including

personal or professional information, habits and behaviour. As a result, individual pieces of

data that previously carried little potential to expose private or confidential information

may now, through datamining and link analysis software, reveal sensitive privileged or

professional information pertaining to individuals or newsgathering organizations and their

48

contacts, including journalistic sources. Such programmes may also reveal avenues of

investigation or persons, places, materials or issues of interest to journalists of

newsgathering organizations. Thus, in light of new technology, exploitation of

communications data can be as intrusive, if not more so, than interception of content. This is

especially so in the context of journalism. The impact on privacy and/or freedom of

journalistic expression of collecting all communications metadata about a journalist, source

or organization over time (and aggregating and link analysing this data) is likely to be much

greater than the impact of collecting specific communications content about a single person,

group or organization.

129. In his expert statement, Dr George Danezis points out, paragraphs 64-65:

Meta-data of communication can be used to identify devices and

communications belonging to specific individuals; map their contacts, the

volume of their communications with others, as well as infer the nature of their

relationship over time. It also allows a detailed view of the information

individuals’ access ... habits, and inferences about their personality, sexuality,

mental state and social status within an organization or group. Meta-data also

provides the current and past location of devices, and can be used for physical

tracking.

Access to meta-data may uncover journalists’ sources when communications and

locations are tracked; may threaten journalists’ physical safety when their home

addresses, and travel addresses are uncovered. [It] provides a trail of their

research interests into particular topics and particular persons. The fear of

tracking and identification may also dissuade sources from contacting

journalists, as well as dissuading readers, listeners or viewers for accessing their

stories.

130. Dr. Danezis also notes at paragraphs 68-69:

Direct access to meta-data can be used to observe who is talking with whom. This

is the typical justification for the analysis of meta-data, since it allows the

construction of “friendship graphs” and “communities of interest”. This

information may be used to identify associates of the targets for tasking and

analysis. Chris Inglis, deputy director of the NSA, suggests33 that not only direct

33 Philip Bump. The NSA Admits It Analyzes More People's Data Than Previously Revealed. The Wire, 17 July 2013.

49

contacts are tasked, but their contacts (second degree) and possibly the contacts

of their contacts (third degree). Estimates of the number of each individual’s

contacts range from a few hundred (real life “friends”) to a few thousand (casual

on-line contacts). If a journalist was to be the subject of such targeting, their

sources would be revealed (1-hop); which other journalist their sources have been

talking to would also be revealed (2-hop). If a source or contact of a journalist

would be targeted, their relation with the journalist would be revealed (1-hop),

but also all the relations of the journalist to other, potentially unrelated sources,

would be revealed.

Direct observation of meta-data uncovers the timing, duration, directionality,

intensity and volume of communications. It is therefore possible to infer directly

which party was most actively contributing to a conversation, how long the

conversation was, or how frequently the target discussed with particular

associates. The availability of timing information associated with target traffic is

key for more advanced inferences. For example, a journalist may be observed to

contact a number of organisation in a foreign country indicating an increased

interest in the area. Similarly, a journalist may be suddenly seen as contacting a

number of people with knowledge of a certain company, and having a couple of

long conversations with some of them – this would be consistent with trying to

confirm a story about the company, and the length of the conversation may be

indicating of the actual contacts that confirmed it.

131. In the context of investigative journalism, therefore, safeguards in respect of the

interception, exploitation and dissemination of communications data is as crucial, if not

more so, than the targeted interception of content.

132. The UK’s legal regime for the interception of communications data does not satisfy the

requirements of legality, including foresseeability and accessibility set out in cases including

Weber and Saravia v. Germany and Telegraaf Media Nederland Landelijke Media B.V. and

Others v. the Netherlands (as discussed above). The discretion available to public officials in

intercepting communications data is even greater than the discretion available in respect of

content. Moreover, the safeguards in place to protect confidentiality and freedom of

expression in relation to the interception, storage and dissemination of communications

data are even less rigorous than those pertaining to the content of communications. A

number of deficiencies in the legal regime are clear.

50

133. First, the discretion afforded to public officials to access “communications data” is even

greater than the extensive discretion to intercept the content of communications. A

“designated person” may require that data be intercepted on a host of grounds by no means

limited to the protection of national security such as the prevention of crime (of any

gravity), public safety or the protection of health (see Section 22 of RIPA 2000). The

designated person need only believe that the interception of communications data is

“necessary” and proportionate in the interests of one of these grounds. Many hundreds of

persons in different public sector organizations are empowered to act as designated persons

(see (Communications Data) Order 2010/480). These individuals may have some training

but no guidance or principles are identified in the Code of Practice, to regulate the exercise

of their discretion where communications data (or its analysis) may reveal journalistically

privileged material or material tending to identify confidential journalistic sources.

Moreover, designated persons empowered to authorize interception are usually public

officials in the same agency as that which seeks to obtain the interception warrant in the

first place.

134. Second, given the breadth of this discretion afforded to all manner of public officials to

obtain communications data, detailed rules preventing the arbitrary exercise of the

discretion to obtain communications data are essential. Yet the regulatory regime in respect

of communications data is even less detailed than that regulating the interception of

content. A statutory Code of Practice provides guidance to public authorities on the

acquisition of communications data (Acquisition and Disclosure of Communications Data:

Code of Practice). However, the guidance does not recognize how (and the extent to which)

the interception and analysis of communications data may interfere with the protection of

journalistic sources or material or otherwise engage the right to free journalistic expression

under Article 10, ECHR. No guidance, principles safeguards or rules at all are set forth in the

Code of Practice to deal with circumstances where the interception and analysis of

intercepted communications data may risk revealing journalistically privileged information,

confidential material or sources.

135. Third and similarly, no publicly accessible guidance, principles or safeguards exist

specifically to regulate and/or limit the dissemination within the intelligence services or

between the intelligence services and government departments of communications data or

the results of the analysis of such data which tends to reveal journalistically privileged

information or sources. There is no provision at all for, for example, “Chinese Walls” or

information barriers.

51

136. Fourth, given that a designated person under RIPA 2000 may well be a public official in the

same organization as that seeking the journalistically privileged communications data or

authorizing interception where such data may incidentally be intercepted, detailed rules are

clearly required to ensure that the designated person has sufficient independence in the

authorization process. This is particularly important where the agency requiring the

interception or its officials is the subject of a journalist’s or newsgathering organization’s

activities. Detailed rules, however, do not exist to deal with this issue. The Code does state

that the designated person should, generally, not be involved in any investigation for the

purposes of which the communication data’s interception is required (see Section 3.11

Acquisition and Disclosure of Communications Data: Code of Practice), but this provides no

assistance as a guarantee of independence where the activities of an agency as a whole are

the subject of scrutiny by a journalist or newsgathering organization. A person termed a

Single Point of Contact (“SPC”) may be appointed and trained to facilitate “the lawful

acquisition of communications data and effective co-operation between a public authority

and a Communication Service Provider (see Acquisition and Disclosure of Communications

Data: Code of Practice, [§ 23]). The SPC may advise a designated person as to the legal

requirements (including under the ECHR) regarding the disclosure of data. While this is a

helpful safeguard, there is no obligation to give such advice in each case and, further, no

obligation on the designated person to accept it. The role of the SPC is described in the Code

of Practice as to “encourage the public authority to regulate itself” (Acquisition and

Disclosure of Communications Data: Code of Practice, [§ 24]. The absence of detailed

arrangements to ensure the independence of authorization is particularly troubling given

the requirement under Article 8 (and, by analogy it is submitted Article 10) that the body

issuing authorizations for interception should be independent and that there must be either

judicial control or control by an independent body over the issuing body’s activities

(Iordachi and others v. Romania, Merits, 14 September 2009, Application No. 25198/02, [§

40]; See also Uzun v. Germany, (2011) 53 E.H.R.R. 24, [§ 71]).

137. It is submitted where the collation and exploitation of metadata, in aggregate, may risk

identifying journalistic sources, safeguards at least as rigorous as those required in respect

of interception of content are required.

138. Fifth, as set out above, unpublished or unavailable rules, procedures and guidance cannot

remedy or inaccessibility or unforseeability of the legal regime regulating the interception

of communications data (Liberty v. the United Kingdom).

52

Protection from Arbitrary Interference

139. A second element of the requirement of legality under the Convention insofar as secret

surveillance is concerned is that surveillance powers must be compatible with the rule of

law, which means that the regulatory framework must provide a measure of legal protection

against arbitrary interference by public authorities with the rights safeguarded by Article 8

§ 1 and Article 10 § 1 (Telegraaf Media Nederland Landelijke Media B.V. and Others v. the

Netherlands, [§ 90]); Iordachi and others v. Romania, Merits, 14 September 2009,

Application No. 25198/02, [§ 37 ]; and Kennedy v. the United Kingdom, [§ 151]).

140. Safeguards are of particular importance in respect of the use of surveillance powers where

journalistically privileged material, information or sources may be captured, stored,

searched, analysed and disseminated. The special protection afforded to journalism, as an

element of the right of free expression in a democratic society, is a settled principle within

the jurisprudence of the Court and has been widely recognized by many other international

and regional human rights mechanisms. The Court has held on many occasions that

“freedom of expression constitutes one of the essential foundations of a democratic society

and that the safeguards to be afforded to the press are of particular importance” ( Goodwin v

the United Kingdom, (1996) 22 E.H.R.R. 123 [§ 29]; Jersild v. Denmark, (1994) 19 E.H.R.R. 1,

[§ 31]). These principles have also been re-iterated in a range of Council of Europe

instruments34 as well as a number of other international declarations.35 The ECtHR has, on

many previous occasions, recalled the need for “strict” or “careful scrutiny” of measures or

practices which risk hindering or inhibiting journalistic free expression (e.g. Independent

News and Media and Independent Newspapers Ireland Limited v. Ireland (2006) 42 EHRR

1024 [§ 114]). There can be little doubt that the interception of journalistic

communications, information and material could have this effect. In view of this, measures

which discourage or hinder journalists from researching, retaining and sharing information

in the development of investigative articles, especially those which touch on sensitive

matters such as questions of national security or counter-terrorism, must be subject to

careful scrutiny.

34 Resolution No. 2: Journalistic Freedoms and Human Rights 4th European Ministerial Conference on Mass Media Policy (1994); CoE Recommendation No. R (2000) 7 on the Right of Journalists not to Disclose their Sources of Information, CoE Declaration by the Committee of Ministers on the Protection and Promotion of Investigative Journalism Adopted by the Committee of Ministers on 26 September 2007.

35 E.g. Inter-American Declaration of Principles on Freedom of Expression, Approved by the Inter American Commission on Human Rights during its 108 regular session and Declaration of Principles on Freedom of Expression in Africa adopted by the Inter-American Commission on Human Rights 17 - 23 October, 2002: Banjul, The Gambia.

53

Insufficient Protection from Arbitrary Interference: Interception of Content

141. The United Kingdom’s legal framework regulating the interception of communications

offers limited and insufficient legal protection against the arbitrary use of surveillance

powers to comply with the requirements of Articles 8 and/or 10. In particular, the regime

offers insufficient safeguards to prevent the arbitrary or incidental interception, storage or

dissemination of journalistically privileged material or sources. A variety of factors,

individually and cumulatively, account for the insufficiency of the regime.

142. First, it will be recalled that the important safeguards which impressed the court in Kennedy

v. the United Kingdom, set out in Section 8 (1) of RIPA 2000 (that an interception warrant

must name or describe a person or premises subject to the interception), are expressly

disapplied by Section 8 (4) in respect of the interception of external communications.

Section 8 (4) therefore permits indiscriminate, untargeted monitoring of communications.

This has particularly serious implications for the present Applicants insofar as it gives rise

to the likelihood of the interception, storage, analysis and dissemination of journalistically

privileged material through the blanket monitoring and interception of “external

communications”.

143. Indeed, the impact of Section 8 (4) RIPA on journalists and journalism is all the more

pronounced given that journalists will often rely, entirely or in part, on sources or materials

located outside the United Kingdom in researching and preparing their articles. Moreover,

the fact that “external communications” may also include data or material which is stored on

servers outside the United Kingdom exacerbates these concerns. The Applicants and other

journalists for reasons of practicality and convenience often use publicly available services

such as Dropbox for the remote storage of drafts, sources and material as part of their

investigative work, which inevitably often requires travel outside the United Kingdom.

Where this information is uploaded outside the United Kingdom or stored on servers

outside UK jurisdiction when uploaded in the UK, such information is liable to blanket

strategic interception under a Section 8 (4) certificate. Journalists will often have no way of

knowing or predicting where information or data is stored by a service provider such as

Dropbox when using publicly available data storage programme. For reasons of costs or

efficiency IT companies may well use non-UK based servers for the services they provide to

UK customers.

54

144. Second, there is no legislative limit on the scope of “external communication” which may be

subject to a Section 8 (4) warrant. Under Section 8 (4) (b) (i) the Secretary of State need

only specify “the descriptions of intercepted material the examination of which he considers

necessary”. There is therefore no limit in law in respect of the category of information or

communication which can be subject to interception. Again, this leads to the very real risk

that substantial quantities of journalistically privileged material may be subject to

untargeted, incidental interception. Indeed, in practice it appears that all data being

transferred into and out of the United Kingdom is presently being intercepted, stored and

analysed. Although the Secretary of State is required to consider any collateral intrusion

into, inter alia, journalistic privilege in deciding whether to grant a Section 8 (4)

interception warrant in the first instance, any such consideration is inevitably highly

abstract, divorced from the circumstances of specific cases. Given that a proper assessment

of proportionality is a highly fact intensive exercise, very much dependent on the particular

circumstances, consideration of necessity and proportionality in this abstract manner

affords little or no protection against arbitrary interception of privileged communications in

practice.

145. Third, once intercepted, there are no specific, accessible legal safeguards in place to identify

journalistically privileged material and to prevent or restrict its onward dissemination or to

restrict its disclosure to persons, officials or agencies subject to the investigative journalism

in question.

146. In addition to these points, as it well known, the Court has, on a number of occasions,

identified various indispensible, “essential safeguards” which must be set out in “statute law

in order to avoid abuses of power” in respect of the interception of communications. These

include (i) clear definition of the nature of the offences which may give rise to an

interception order; (ii) a definition of the categories of people liable to be subject to

interception; (iii) a limit on the duration of interception; (iv) the procedure to be followed

for examining, using and storing the data obtained; (v) the precautions to be taken when

communicating the data to other parties; and (vi) the circumstances in which records may

or must be erased or destroyed (Weber and Saravia v. Germany [§ 95]; Liberty v. the United

Kingdom, [§ 62]). The United Kingdom’s legal framework does not satisfy these

requirements.

147. As regards the first of these criteria, the permissibility of interception under Section 8 (4) is

not contingent on a clearly defined offence or offences. Rather, the purposes for which

55

interception is justified under Section 8 (4) are, as noted above, very broad, relying on

amorphous concepts such as the interests of national security or the economic well being of

the United Kingdom or the prevention of “serious crime”. As noted earlier, the concept of

national security is very broadly defined in the law of the United Kingdom, allowing for

substantial executive discretion in determining its scope in a given situation.

148. Similarly, the concept of “serious crime” is not defined in RIPA 2000 and offers substantial

discretion as to the offence or offences which fall within its ambit. The significance of this is

emphasised by Iordachi and others v. Moldova, Merits, 14 September 2009, Application No.

25198/02, [§ 43], where the court found that, although Moldova had specified that persons

suspected of “serious”, “very serious” or “exceptionally serious” criminal offences risked

being subject to interception,

the nature of the offences which may give rise to the issue of an interception

warrant is not, in the Court’s opinion, sufficiently clearly defined in the impugned

legislation. In particular, the Court notes that more than one half of the offences

provided for in the criminal code fall within the category of offences eligible for

interception warrants.

In the United Kingdom the category of “serious crime” is even more uncertain.

149. All of this, gives rise to the very real prospect that privileged journalistic material could be

arbitrarily intercepted, by reference to being “necessary” in the interests of national security

or for the prevention or detection of “serious” crime. This position contrasts sharply with

the position which faced the Court in Weber and Saravia v. Germany [§ 96], where the

legislation challenged by the Applicants “defined in a clear and precise manner the offence

which could give rise to the interception order”. In the present case, the position is the

opposite.

150. Furthermore, the categories of person liable to interception are not identified in RIPA 2000

or other statutes. The United Kingdom authorities have not made available the search terms

or other search parameters by which strategic monitoring of external communications is

conducted nor stated in statute or elsewhere the nature or purpose of the search

parameters used to exploit the data intercepted. Again, this is in contrast to the position in

Weber and Saravia v. Germany, where German law specified that the persons concerned

“either had to have used catchwords capable of triggering an investigation into the dangers

listed in section 3 (1), points 1-6...” of the relevant statute or be foreign nationals/companies

56

(See Weber and Saravia v. Germany [§§ 97 and 32] and Liberty v. the United Kingdom [[§

68]).

151. As regards the duration of the interception, in the case of national security, a Section 8 (4)

certificate is valid for six months, while in other cases it remains valid for three months (see

Section 16 (3) (3A) RIPA 2000). There is nothing, however, to prevent a certificate being re-

issued prior to the end of the six month period. Indeed, it appears that, in effect, certificates

are renewed on a rolling basis. Precisely this situation was considered by the Court to

provide insufficient protection against arbitrariness in Iordachi and others v. Moldova,

Merits, 14 September 2009, Application No. 25198/02, [§ 45]. Similar criticism was made in

Gillan and Quinton v. the United Kingdom (2010) 50 EHRR 45, [§ 81].

152. The general safeguards in Sections 15 and 16, RIPA 2000 are of limited assistance in

compensating for the deficiencies identified above.

a. As regards Section 15 this requires the Secretary of State to ensure that

“arrangements” are in place to ensure that intercepted material is intercepted and

disclosed to the extent necessary for authorised purposes. However, as previously

noted, these arrangements are not in the public domain and, further, the “authorised

purposes” themselves are enormously broad.

b. As for Section 16 (which provides additional safeguards in respect of Section 8 (4)

warrants), these are similarly limited. It imposes no limitation on the untargeted

interception of communications by persons in the United Kingdom. (See Section 16

(2), RIPA 2000). This gives rise to real concern as to the extent to which privileged

material is intercepted through mass scale, strategic interception. Furthermore the

safeguards set out in Section 16 (2) in respect of the targeted interception of

communications by persons resident in the United Kingdom by way of targeted

interception, can be circumvented where necessary in the interests of national

security etc by the Secretary of State (See Section 16 (3) , RIPA 2000). Thus, where

journalistic sources or materials are located outside the United Kingdom, Section 16

offers them little protection against interception using a Section 8 (4) warrant. Their

communications can be intercepted where they fall under the broad umbrella of the

interests of national security.

57

153. Finally, no proper arrangements are in place for effective independent authorization or

oversight of interception in respect of Section 8 (4) certificates. In Iordachi and others v.

Moldova [§ 40] the Court held that “the body issuing authorizations for interception should

be independent and there must be either judicial control or control by an independent body

over the issuing body’s activities”. The desirability of judicial oversight was emphasised by

the Court in Telegraaf Media v. the Netherlands [§ 98] “[i]n a field where abuse is potentially

so easy in individual cases and could have such harmful consequences for democratic

society as a whole, it is in principle desirable to entrust supervisory control to a judge” (See

also Klass and Others v Federal Republic of Germany (1979-80) 2 E.H.R.R. 214, [§ 56]).

154. Thus, although prior judicial authorization is not always an indispensible prerequisite for

the interception of communications, independent authorization is required. Insofar as

journalistic privilege is concerned, the Secretary of State cannot offer guarantees of

independence. A journalist or newsgathering organization may be engaged in the

investigation of activities for which the Secretary of State bears ultimate responsibility.

Indeed, an investigation (such as, for instance, BIJ’s investigation into the deprivation of

citizenship in the United Kingdom) may consider decisions which the government and,

specifically, the Secretary of State has taken and the circumstances surrounding those

decisions and their propriety. Given the potentially enormously broad reach of the Section 8

(4) certificate and the equally broad ambit of the Secretary of State’s own responsibilities,

he or she simply cannot offer sufficient guarantees of independence in relation to the

making of a Section 8 (4) certification decision.

155. The position is not assisted by the role of Interception of Communication Commissioner

under RIPA 2000. S/he has no power to quash a warrant issued under Section 8 (4). The

Commissioner’s powers are set out in Section 57 et seq RIPA 2000. The Commissioner is

required to supervise the exercise of functions under – inter alia – Chapters I and II of RIPA,

and to notify the Prime Minister of any contraventions of the Act. Furthermore if the

Commissioner is of the view that arrangements made pursuant to Section 15 of RIPA 2000

are inadequate, the Commissioner will make a report to Parliament. The Commissioner has

no power to determine that new arrangements must be made nor does he or she have the

power to determine how deficiencies ought to be remedied. In relation to Section 8 (4)

warrants, the Commissioner’s role is one of ad hoc, ex post facto review. Although the

Commissioner provides a relevant and necessary safeguard, the role in no way compensates

for the absence of judicial or independent authorization or oversight in respect of section 8

(4) warrants.

58

156. For its part, the Investigatory Powers Tribunal also in no way compensates for the absence

of judicial or independent oversight of Section 8 (4) certificates. The IPT’s role is reactive,

dealing with complaints regarding interception made by members of the public. It has no

role in authorizing or proactively supervising the issuance of interception warrants.

Insufficient Protection from Arbitrary Interference: Interception of Communications

Data

157. Similar deficiencies to those identified above in relation to the interception of

communications under Chapter I of RIPA 2000, apply with even greater force to the

interception of communications data under Chapter II. As earlier noted, exploitation of

communications data can be as intrusive, if not more so, than the interception of content.

The impact on privacy or freedom of journalistic expression of collecting all

communications metadata about a journalist, source or organization over time (and

aggregating and link analysing this data) is often vastly greater than the impact of collecting

specific communications content about a single person, group or organization. Rigorous

safeguards are therefore essential but lacking.

158. The system for the authorization of the interception of communications data is wholly

lacking in independence. As earlier noted, a “designated person” in the relevant public body

(including the intelligence services) is authorized to approve the interception of

communications data. The person empowered to require the interception of

communications data is an official in the same agency as that which seeks the

communications data in the first instance. Institutional independence is therefore wholly

lacking. Moreover, there is also no requirement of functional/operational independence

either in RIPA 2000 or relevant secondary legislation.36 There is some guidance on this issue

in the Acquisition and Disclosure of Communications Data: Code of Practice , which requires at

3.11 that Designated Persons should not be responsible for granting authorisation in

relation to investigations or operations in which they are “directly” involved. The guidance,

however, goes on to state that such situations may be unavoidable for reasons of urgency,

for “security reasons” or in small organizations. The Code of Practice is not legally binding

on the public officials. Section 71 of RIPA merely requires that in exercising functions

officials must “have regard” to the relevant provisions of the code of practice. Moreover,

even on the face of the code, functional or operational independence is not guaranteed.

36 See Regulation of Investigatory Powers (Communications Data) Order 2010/480.

59

There is nothing, for instance, to stop an official in the intelligence services connected

indirectly to an investigation or operation, perhaps in a management capacity, from

authorising the interception of communications data pertaining to that investigation. It is

notable that local authorities in England and Wales which wish to obtain communications

data must apply to the Magistrates Court in order for an authorization granted by a

designated person to take effect (Section 23A RIPA 2000). No analogous requirement is

applicable to public bodies, such as the intelligence services, where they seek to obtain

communications data in respect of individuals or organizations despite the very great

potential for the gathering of such information by the intelligence services to interfere with

Convention rights.

159. Post facto oversight is also inadequate. While prior judicial authorization is not necessarily

an essential prerequisite for lawful interception of communications data, it constitutes an

“important safeguard” (Uzun v. Germany, (2011) 53 E.H.R.R. 24, [§ 71]). The significance of

this safeguard in the context of the protection of journalistically privileged information is all

the greater, given the potential for such information, for reasons already explained, to be

used in a way which gravely damages the Article 8 and 10 rights of journalists and

newsgathering organizations. Moreover, in the United Kingdom (in contrast to the position

in Germany under consideration in Uzun), there is no possibility of judicial review of the

legality of the interception of communications data in the context of criminal or civil

proceedings since the use of intercepted communications in this manner in criminal

proceedings is prohibited by Section 17 RIPA 2000. The UK is one of the very few countries

which completely prohibits the use of intercept evidence in civil or criminal proceedings,

despite the recommendation of the Privy Council that this position should end.37

160. While the IPT does have the power to review whether the interception or dissemination of

communications data has violated Article 10, it can only do so where a complaint is brought.

Its jurisdiction is only triggered in the few cases where an individual brings a complaint

despite the inevitable uncertainty as to whether their communications data has been

obtained and or impermissibly exploited. The IPT cannot therefore compensate for an

inadequately independent system of authorization. Although the Interception of

Communications Commissioner provides a helpful safeguard, s/he has no powers to quash

an authorization for interception and, as with interception under Chapter 1 RIPA, the

37 See Privy Council Review Intercept as Evidence : Report to the Prime Minister and Home Secretary , 2008, p. 31 Cm 7324.

60

powers of the Commissioner are supervisory. Chapter II authorizations are examined, post

facto on a random basis.

161. In addition, there are no safeguards or arrangements set out in RIPA, secondary legislation

or the statutory code of practice for identifying communications data which is, or which may

be, journalistically privileged. Nor are there rules in RIPA or statutory guidance which

regulate the circumstances in which privileged communications data may be shared or

disseminated (e.g. “Chinese Walls” or other information barriers).

(IV) Proportionality

162. The blanket interception, storage and exploitation of communications and communications

data is an inherently disproportionate interference with journalistic free expression and

journalistic privilege. The Applicants, in this regard, rely on all of the matters described

above as indicating the obvious disproportionality of the legal regime challenged in the

present application.

163. In assessing proportionality of the measures in question, their substantial implications for

journalism and the work of media organizations will be born in mind. These are set out in

detail in the statement of Dr. Danezis. Some of the most significant implications , identified

in the report of Dr Danezis, include the following: (i) the inability of journalists to safeguard

sources, both material and human, hampering or even preventing sources from

communicating with journalists and vice versa in respect of sensitive issues about which

reporting in a democratic society is crucial; (ii) relatedly, the risk, that through modern

systems for the exploitation and link analysis of meta-data networks of collaborators,

sources and materials will be revealed; (iii) the implications of mass scale interception of

content and meta data as regards the ability of journalists to confidentially research

evidence, materials and lines of enquiry; (iv) the inability of journalists to store information

with a reasonable assurance that the confidentiality of the information will be respected,

given the vulnerability of (increasingly common) “cloud storage” and the use of “backdoors”

into otherwise “secure” storage devices or mechanisms; (v) as set out in the Statement of

the Managing Editor of BIJ, the real risk that sources will be deterred from contacting

journalists or media organizations – particularly those persons dealing with sensitive issues

pertaining to matters in which the intelligence services are likely to have an interest, ;

61

164. As regards the legal framework in place, various factors demonstrate the disproportionality

of the sweeping powers of data and meta data interception which have been accrued:

a. First, the blanket, indiscriminate nature of the interception permitted under Section

8 (4) RIPA, with only a few, ill-defined safeguards. In particular: the wide and

imprecise scope of the power to intercept communications under Section 8 (4)

defined by reference to expansive, policy-laden, concepts such as the “interests of

national security” or the “economic wellbeing” of the United Kingdom, rather than,

for example, narrow, specifically defined offences; the enormously broad categories

of persons or materials which may be subject to interception under Section 8 (4),

giving rise to the real risk that privileged communications will be intercepted; the

inadequate limitations on the duration of a Section 8 (4) certificate, in effect,

permitting such certificates to be issued on a rolling basis.

b. The fact that communications appear to be intercepted and monitored by reference

to the means of communication rather than on a basis clearly or directly linked to

the purpose for which interception is purportedly justified, resulting in the

interception of journalistically privileged communications and data unnecessarily

and without a firm rational basis.

c. Further, the very substantial number (many thousands) of search terms and

parameters reportedly used to exploit the data strategically intercepted using the

Tempora programme and the absence of any clear, accessible indication of those

terms or the basis on which they are selected and determined. The Applicants note

the report in the Guardian Newspaper relying on a lawyer from GCHQ:

An indication of how broad the dragnet can be was laid bare in advice from

GCHQ's lawyers, who said it would be impossible to list the total number of

people targeted because "this would be an infinite list which we couldn't

manage".38

Further, the absence of any publicly accessible information as to the basis on

which such search terms are used and whether they are tailored, as much as

possible, to avoid the unnecessary interception of privileged material and data.

38 “GCHQ taps fibre-optic cables for secret access to world's communications”, The Guardian, 21 June 2013: http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa

62

d. The absence of accessible and clear parameters (both as regards communications

and communications data) indicating the manner in which and the circumstances in

which intercepted material will be subject to further exploitation, creating real

potential for disproportionate exploitation taking insufficient account of important

matters such as journalistic privilege.

e. The wholly imprecise (and enormously broad) definition of “external

communication”, under Section 20 RIPA 2000. External communication being

defined as “a communication sent or received outside the British Islands” with

“communication” being, in turn, defined to include “signals serving either for the

impartation of anything between persons, between a person and a thing or between

things”. This results in an enormous range of communications and data, including

those which a user would not intuitively consider “external”, subject to Section 8 (4)

interception.

f. The inapplicability of the safeguards set out in Section 8 (1) of RIPA 2000, in the

context of the interception of external communications under Section 8 (4).

g. Insufficiently clear, accessible information as to the circumstances in which and the

conditions under which information gathered under a Section 8 (4) warrant is

destroyed or the basis on which it is retained.

h. The absence of independent authorization for the interception of communications

pursuant to a Section 8 (4) certificate or for the interception of communications data

by the intelligence services and/or the absence of sufficiently robust, independent

oversight arrangements, as set out above.

165. Individually and collectively, the Applicants submit that the regulatory framework for the

interception, storage, search, analysis, dissemination and destruction of communications

data and communications intercepted under Section 8 (4), RIPA 2000 is disproportionate.

(V) Relief

166. The Applicants seek

a. Declarations that their rights under Articles 8 and/or 10 of the Convention have

been violated and that the legal framework of the law of the United Kingdom in

respect of the interception of communications under Section 8 (4) RIPA 2000

63

and/or the interception of communications data does not comply with the

requirements of the Convention in the respects set out above;

b. Reasonable costs and expenses in these proceedings;

Gavin Millar QC

Conor McCarthy

Doughty Street Chambers

Monckton Chambers

64