ECHR Jurisdiction and Mass Surveillance: Scrutinising the UK Investigatory Power Tribunal’s Recent Ruling
This is originally appeared here and was written by Privacy International Legal Officer Scarlet Kim.
Last week, as discussed in a post by Marko Milanovic, the UK Investigatory Powers Tribunal (IPT) ruled that it lacked jurisdiction under the European Convention of Human Rights (ECHR) to adjudicate Article 8 and 10 claims brought by persons “situated outside” of the UK (para. 60). The IPT is a specialised judicial body that hears complaints about surveillance by public bodies, including British security and intelligence agencies. IPT decisions are not subject to direct appeal in the UK. We are therefore likely to see this ruling quickly challenged before the European Court of Human Rights (ECtHR).
Background
The backdrop to this litigation is convoluted. I sketch out the context in this post as I believe it will enrich discussion of the jurisdictional issues which are at the heart of this dispute. In 2013, following the Snowden disclosures, Privacy International, together with nine other NGOs, filed a case before the IPT challenging two aspects of the UK’s surveillance regime. First, the claimants challenged UK access to the communications of persons located within the UK collected by the US National Security Agency (NSA) under PRISM and Upstream. Under PRISM, the NSA collected data from US companies including Yahoo and Google. Under Upstream, the NSA intercepted data in bulk from hundreds of undersea fibre optic cables. Second, the claimants challenged Tempora, the British counterpart to Upstream, under which the Government Communications Headquarters (GCHQ) intercepted data in bulk from over 200 cables landing in the UK.
In February 2015, the IPT found that US-UK intelligence sharing — pursuant to PRISM and Upstream — was unlawful prior to 5 December 2014 because the legal framework governing it was hidden from the public (according to the IPT, that framework was sufficiently disclosed over the course of the proceedings so as to render the sharing of intelligence legal from that point forward). In June 2015, the IPT further found that GCHQ had, under Tempora, unlawfully subjected two of the claimants — Amnesty International and the South African Legal Resources Centre — to surveillance however, it ruled that the program was, in principle, legal.
Following these rulings, Privacy International organised a campaign so that others might request the IPT to determine whether they too had been subject to unlawful surveillance. Human Rights Watch was one of the first to submit a complaint and 662 others followed suit. Each complaint asserts a domestic law claim — i.e. failure to comply with internal policies and procedures — as well as ECHR claims — i.e. violation of Articles 8 and 10.
In December 2015, the UK Government requested that the IPT consider the first 10 claims so as to determine an appropriate response to the remainder. At the same time, it submitted that the IPT should dismiss all 663 claims on the basis that its prior rulings with respect to the 10 NGOs sufficed as a response to all claims. The UK Government argued that, in the alternative, the IPT should dismiss the ECHR claims of non-UK residents for falling outside ECHR jurisdiction.
The IPT’s recent decision is the outcome of that request. The IPT held that all claimants — UK and non-UK resident alike — will have their domestic law claims considered so long as they submit additional information demonstrating that they are “potentially at risk” of surveillance (para. 64, applying Zakharov v Russia, para. 171). Claimants “situated” within the UK will also have their ECHR claims considered on this basis, whereas the ECHR claims of those “situated” outside the UK will be dismissed (para. 60).
Intuition and a Familiar Fact Pattern
The IPT’s ruling may be the first time that a British court has expressly considered ECHR jurisdiction in the surveillance context however, the constellation of facts has cropped up in prior litigation. In fact, the UK Government failed to challenge ECHR jurisdiction in the predecessor 10 NGOs case, where claimants included organisations based in Ireland, Hungary, the US, Canada, Egypt, South Africa and Pakistan. In 2008, the UK Government similarly failed to raise a jurisdictional point in Liberty and Others v. United Kingdom, an ECHR case where two of the applicants were Irish organisations alleging that the British Ministry of Defence had intercepted their communications to and from the UK.
Of course, the UK Government remains free to raise a jurisdictional challenge in these proceedings but I suspect that its past silence rests on intuition. In the American legal tradition, intuition has also been characterized, typically in the judicial context, as a “hunch”. As described by Judge Joseph Hutcheson, “hunching” means that “the vital, motivating impulse for the decision is an intuitive sense of what is right or wrong for that cause” (p. 285). In his article discussing the application of human rights treaties to foreign surveillance, Milanovic identifies intuition as a thread running through — or rather resolving the inconsistencies in — various extraterritorial models. It helps explain why the US citizenship model — “citizenship as a basis for fundamental rights” — makes an exception for foreigners “once they are in US territory” (pp. 56, 92–93). Or why the spatial model — whereby “an individual who is located in a territory under a state’s control […] has human rights vis-à-vis the state” — would ever consider the location of any violation (p. 112). And yet, “our intuitions . . . do seem to favour the application of human rights treaties in such circumstances” (p. 125).
Milanovic suggests that intuition helps us see that “the question of […] extraterritorial application” is as much “a moral choice” as a legal formulation (p. 93). It may warn us when the application of a particular extraterritorial model results in a decision with alarming moral implications. Sometimes a disquieting outcome is a product of evolving circumstances. Here, those circumstances involve rapid technological change, which has allowed governments to deploy mass surveillance. It is now possible for a state to record and store every telephone call made in a foreign country. And for Tempora, for example, to intercept all data transiting through more than 200 fibre optic cables landing in the UK, which carry as much as 11% of global internet bandwidth.
The IPT’s decision means that that the ECHR framework — i.e. is the interference prescribed by law? does it serve a legitimate aim? is it proportionate to that aim? — simply does not apply to surveillance directed at those outside the state. In this day and age, surveillance may involve collecting, mining and extrapolating information from the communications of millions of individuals, including everyone resident in a particular country. The intuitive lens probes this outcome and asks us to consider it beyond an application of jurisdictional principle and in terms of its human impact.
A Decision Lacking Legal Rigor
Setting aside intuition, the IPT’s decision falters legally. In his prior post discussing this decision, Milanovic notes that “the applicability of the Convention becomes more attractive […] when the surveillance actually takes place within the surveilling state’s territory, even if the affected individual is outside it.” He continues that “in its judgment, the IPT addresses this scenario, if all too briefly and less than convincingly” and doubts whether “the point was extensively argued.”
To be clear, that scenario is precisely the jurisdictional issue in this case. And it was extensively argued by the claimants. In their written reply to the UK Government’s submissions, they made it the crux of their position regarding jurisdiction: “Where intercept is carried out by a Contracting state on its own territory, it occurs within the jurisdiction of the Convention.” They elaborated on this position in oral submissions. And, the IPT’s decision itself identifies the claimants’ core submission on ECHR jurisdiction to be that “on a true analysis, the impugned acts have […] occurred in the territory of the United Kingdom” and “[t]herefore, it does not matter that the person whose Article 8 rights may have been infringed was at all material times abroad.”
The IPT’s engagement with this scenario was lackluster. The heart of its conclusion rests on the following reasoning:
In so far as [the] claim [of persons not situated in the UK] is founded on belief that their right to respect for their private life has been infringed, [none] of them allege that, at any material time, they enjoyed a private life in the United Kingdom. Accordingly, under Article 1, the United Kingdom was under no obligation to respect it. The analogy with Banković is close.
The first two sentences are difficult to parse. If “the United Kingdom was under no obligation to respect it” — i.e. a private life in the United Kingdom — doesn’t that presume that “it” exists?
As for the Banković analogy, the IPT does not explain how it is “close”. Banković v Belgium deals with a scenario where the nature of the violation — i.e. an airstrike — requires the victim to be physically located at the site of the violation. Moreover, in that scenario, both the violation and the victim are outside the territory of the contracting state. Modern surveillance, by contrast, typically occurs at a site removed from the physical location of the affected person. Here, that site is located within UK territory.
A better analogy would be to an interference that, like surveillance, is at a remove from the target. The claimants cited two such examples where the ECtHR established Article 1 jurisdiction: (1) Bosphorus v. Ireland, where Turkish lessors of a plane impounded by Ireland claimed a violation of Article 1, Protocol 1 and (2) Markovic v Italy, where Serbian residents whose civil claims in Italy were dismissed claimed a violation of Article 6.
If Articles 8 and 10 warrant a different conclusion, the IPT’s attempt to distinguish them from these examples was half-baked. It first suggests that in Bosphorus and Markovic, the applicants “had voluntarily submitted to the jurisdiction of a contracting state” (para. 57) but it fails to follow that logic through to a conclusion that persons whose communications route through the UK have not similarly “voluntarily submitted” to ECHR jurisdiction. Nor does it explain any principle behind that distinction. It then implies that Bosphorus, at least, can be distinguished on the grounds that it involved property — i.e. a plane — while “information about a person is not property” (para. 58). The IPT fails to elaborate on the relevance of the concept of “property” to its Article 8 analysis. Its own confusion is apparent by its clear conflation of Article 8 with Article 1, Protocol 1:
Even in the autonomous Convention meaning, [information about a person] has never been held to amount to a “possession”, for the purposes of Article 1, Protocol 1. Accordingly, the retention by GCHQ of information shared with it by the NSA . . . could not amount to a breach of the [non-UK] Claimants’ right to respect for their private life (para. 58).
What Happens Next
As noted above, all claimants are invited to submit additional information demonstrating that they are “potentially at risk” of surveillance. On the basis of this information, the IPT will determine whether a claimant is “situated” inside or outside the UK and whether it can proceed to investigate the domestic law and/or ECHR claims.
The jurisdictional issues before the IPT are far from resolved. In fact, the IPT appears ignorant of how difficult and arbitrary a line-drawing exercise it has before it. Milanovic’s example in his prior post is instructive: “Imagine, for example, if the UK police searched my flat in Nottingham while I was visiting family in Serbia — surely I would have Article 8 rights, even though I would not be on UK territory when the search took place.” What if the opposite were true, a claimant resides abroad but visits the UK? Why should any Article 8 interference be cognizable only while he happens to touch British soil?
Still, it is worth noting the opportunity this case presents to test intuitions and jurisdictional theories long debated in the hypothetical. Even in Europe, where a number of surveillance cases have proceeded to an examination on the merits, the claimants have never represented as diverse an array of factual circumstances as they do here. And in that sense, they represent tangibly the effects of foreign mass surveillance. An inevitable feature of these activities is that they will affect many people scattered across the globe. The jurisdictional question asks whether a country’s borders meaningfully distinguish who among the affected is entitled to seek a remedy under human rights law.
