Regulating Signals intelligence

Iain Cameron is professor in public international law at Uppsala University

Introduction

For European states, an important factor pushing towards better regulation of security agencies generally has been the ECHR. The work of “signals intelligence” agencies (collecting metadata and the content of electronic mail and voice communications) came to prominence following the allegations of “mass surveillance” made by former NSA-contractor Edward Snowden in 2013. Compared to law enforcement or internal security agencies, signals intelligence agencies tend to possess much more powerful computing facilities, and they thus have abilities to process and analyse vast amounts of data. Data, both content data (telephone conversations, email etc.) and metadata are collected in bulk and then analysed using selectors. The ECtHR has recently looked at the systems for regulation and control of signals intelligence operating in two states, Sweden and the UK, in the cases of Centrum för Rättvisa v. Sweden (CFR) and Big Brother Watch and others v. UK (BBW) (see blogposts for these cases here and here). Both these cases have been appealed to the Grand Chamber which held an oral hearing on 10 July 2019. A judgment is expected soon. The present blog article will look at four issues of principle at stake in the two cases, namely bulk collection, judicial authorization, notification and discrimination. In each of these issues, there is some tension between the regional (ECHR) and sub-regional (EU) human rights standards applicable to signals intelligence.

There were three basic questions in BBW: these concerned the UK rules on bulk collection, on metadata and on intelligence sharing. The majority of the Court found violations of Article 8 and Article 10 as regards the first two issues. In CFR the issue was more simply whether the Swedish signals intelligence law and practice as a whole satisfied Article 8 and the Court unanimously found that it did. Both cases involved many sub-issues, and were detailed examinations of the foreseeability, accessibility etc. of the laws, and their necessity in a democratic society (which mainly centered around the adequacy of the control systems). The Court applies eight criteria in making its assessment, developed from its case law on targeted interception, and the Weber and Saravia v. Germany case. It declined the offer to develop new or additional criteria, taking into account improvements in technology, and designed for bulk interception specifically (previously discussed by the Venice Commission). Continue reading