So. The NSA and GCHQ piggyback on Angry Birds to spy on its 1.7 billion users. potential terrorists. Not only that, but everything on smartphones can be compromised: “if its on the phone, we can get it”. Will it ever stop? A few days ago, the European Court of Human Rights (‘ECHR’) made the unique move to fast-track a case on the legality of mass surveillance practices by the GCHQ. A judgement is now expected in months, rather than years – in time to have a huge impact on the global debate on mass surveillance. Time for some analysis.
In September 2013 ‘Privacy not PRISM’, a group of NGOs and activists, challenged the UK government’s surveillance directly with the ECHR. Last week, the ECHR wrote to the group [pdf] that it gives the case priority – which it hardly ever does. Then again, the practices attack the core of the right to privacy. 2 May 2014 is the deadline for the UK government to provide information to the ECHR on three essential questions. The letter also reveals some interesting details on how the ECHR will approach the third, critical question.
Firstly, “can the applicants claim that their privacy rights have been violated?” This seems a no-brainer. As I blogged before, in contrast with the U.S. Supreme Court’s stance on ‘actual harm’ in Clapper v. Amnesty, the ECHR accepts the ‘mere existence’ of vague surveillance law and practices as a sufficient basis for applicants.
Secondly, have the ‘domestic means been exhausted’? The UK government told the group to file their case with the “Investigatory Powers Tribunal” of the executive branch. Not so smart: in 2010, Kennedy v. The UK, the ECHR ruled that this UK Tribunal does not provide an effective judicial remedy for privacy victims. While the UK government will try everything in its power to let the case proceed on a national level, it would be suprising if the ECHR allows that to happen.
The third question is the most relevant. Actually, three sub-questions need to be separated. Are PRISM and TEMPORA i) ‘in accordance with the law’?; ii) ‘necessary in a democratic society?’ and, what the ECHR did not ask the UK government, iii) what about all those other revelations?
The ECHR has ruled on a similar case in 2008; Liberty a.o. v. The UK, discussed here. The key outcome was that the mass surveillance under scrutiny wasn’t even known and regulated, so the ECHR could not even assess whether its procedural criteria had been met. The resulting potential for arbitrariness and misuse are inherently not ‘in accordance with the law’. Violation, full stop. So in Liberty, the ECHR could conveniently stop at that, before it would have to tackle the next, more controversial question.
Are PRISM and TEMPORA ‘necessary in a democratic society?’ Although the ECHR could avoid this question before, it will probably have to assess it this time around. Interestingly, it pointed at three prior cases. The Liberty case, but also Weber and Saravia v. Germany and Iordachi a.o. v. Moldovia. Even though the ECHR grants a wide ‘margin of appreciation’ to states for their national security policies, it has ruled countless times that states cannot destroy democracy on grounds of defending national security. And that violations should be an exception, not the rule. I have a hard time seeing how mass taps on sea cables in the TEMPORA program can be justified. There’s a lot more to say, so I will go into more details in a separate post. Especially, a critical issue will be whether the ECHR decides that the 47 countries of the Council of Europe have a duty to protect their citizens against NSA surveillance – or any other foreign intel agency for that matter – of privately-owned communications networks like sea cables and telco wires within a country.
Finally, what about all those new revelations? This boils down to how the ECHR operates. The ECHR – not the European Union Court – rules about specific facts brought before it. Dr. Ian Brown has done a terrific job describing [pdf] the technical details and implications of PRISM and TEMPORA as an expert witness in this case. Of course, countless revelations have been added to the mix; especially the revelations about the NSA and GCHQ subverting and hacking into technologies and 100.000 boxes around the world: BULLRUN, QUANTUM and of course VERYANGRYBIRDS – total smartphone hacking. Those newer developments might not be addressed in this case, but other cases have been launched and will in the end reach the ECHR. Maybe not in months, but indeed in years.
The ECHR clearly sees the ‘Privacy not PRISM’ case as a priority. This is a boost for Europeans seeking to end mass surveillance via courts, rather than through the political process. And it will stimulate journalists working on these issues to continue revealing mass surveillance practices. So yes, regardless of what some pundits may claim, it does matter what the NSA – and GCHQ for that matter – are doing. Eventually, VERYANGRYBIRDS will drop their bombs.
