Bulk powers equal mass surveillance equals unlawful suspicionless interference with privacy

The Investigatory Powers Bill introduced on Tuesday 1 March contains the same range of ‘bulk powers’ envisaged in the earlier draft: bulk interception warrants; bulk acquisition warrants; bulk equipment interference warrants; and bulk personal dataset warrants.

These powers, if adopted as currently envisaged in the Bill, would codify a practice of mass, untargeted surveillance by the UK intelligence services.

In the last couple of years, some of the mass surveillance powers used by GCHQ have been revealed and, in some cases, reluctantly publicly avowed by the Government. These include bulk interception of undersea cables that carry the vast majority of the internet traffic in and out of the UK; bulk collection and data mining of domestic phone records from telecommunications companies and hacking.

Now the Government is finally seeking to put mass surveillance powers on to a clear lawful footing, in the Investigatory Powers Bill. However, we seriously question such mass suspicionless surveillance can ever be lawful. Such powers are neither necessary nor proportionate. Nor have they proven to be effective. They should be removed from the Bill.

Are these “bulk” powers new?

The Home Office argued that these bulk powers are currently available to the security agencies in existing legislation (notably under section 20 of RIPA, section 94 of the Telecommunications Act 1984 and section 5 and section 7 of the Intelligence Services Act 1994.)

This is misleading. The fact that the intelligence agencies are relying on very broad and vague provisions in current legislation to justify mass surveillance does not make these practices lawful. Rule of law requires a degree of transparency and ‘foreseeability’ of how those laws might be used. If it were not for recent public avowals, sometimes forced by court cases brought by Privacy International and others, many of the mass surveillance capabilities of the UK intelligence services would still be secret and hidden even from Parliamentary scrutiny.

Are these powers lawful?

The fact that the Investigatory Powers Bill seeks to regulate these “bulk” powers may well enhance transparency, but that does not make them compatible with the UK’s human rights obligations . Mass suspicionless surveillance falls short of the requirements to respect the right to privacy.

Article 8 of the European Convention on Human Rights requires certain minimum safeguards in legal frameworks regulating surveillance activities, to protect against arbitrary interference with privacy and abuse.

In two recent judgments the European Court of Human Rights considered the use of surveillance powers and the level of specificity needed to ensure interception powers were not used arbitrarily. It confirmed that to ensure the test of necessity and proportionality had been properly applied the interception authorisation must clearly identify “a specific person to be placed under surveillance or a single set of premises as the premises in respect of which the authorisation is ordered. Such identification may be made by names, addresses, telephone numbers or other relevant information.” (European Court of Human Rights, Zakharov v Russia (2015) application no. 47143/06, para. 264)

Furthermore, in October 2015, the Grand Chamber of the Court of Justice of the European Union (CJEU) ruled that “legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life.”

Suspicionless surveillance

Nothing in the Investigatory Powers Bill imposes any limit to the amount of communications or other data that can be obtained by bulk warrants. Bulk warrants will not require any suspicion whatsoever on the part of the authorities that a person has committed a criminal offence or is a threat to the interests of national security (or other relevant grounds.)

Similarly these warrants do not have to define the categories of persons who are liable to have their communications monitored. Instead bulk warrants need only state the operational purposes for which data is to be obtained, and the Investigatory Powers Bill expressly notes that these can be “general purposes”.

The Intelligence and Security Committee’s report on the draft Bill picked up on this glaring shortcoming by noting that “no detail is provided as to what these operational purposes may be.“ The Committee considered “this completely unsatisfactory: it contradicts the primary purpose of the draft Bill, to provide some much-needed transparency in this area.”

In this respect, the revised Bill introduced on 1st March does not address this concern. In its operational case for Bulk Powers, the Home Office included examples of “operational purposes” which are so broad as to make their scope almost limitless (e.g. counter-terrorism, cyber security).

In turn, the broad scope of the ‘bulk’ warrants would leave the authorities (including the envisaged Judicial Commissioners) unable to verify whether there is a reasonable suspicion or whether the measures are necessary and proportionate to achieving their stated aim, including whether it is possible to achieve the aims by less restrictive means. The Government came very close to conceding this point, when in explaining the differences between Bulk and Thematic Equipment Interferences it stated that “a bulk EI warrant is likely to be required in circumstances where the Secretary of State or Judicial Commissioner is not be able to assess the necessity and proportionality to a sufficient degree at the time of issuing the warrant.” In other words, if they cannot assess necessity and proportionality of a thematic warrant, they would opt for a bulk warrant, where such an assessment of necessity and proportionality would not be needed.

Conclusions

The bulk powers contained in the Investigatory Powers Bill set a terrible international precedent. The underlining rationale that supports these bulk surveillance powers is an approach to security and counter-terrorism that treats the privacy of individuals as an impediment to the pursuit of security aims - wrongly arguing that we can have either security or privacy, but not both.

As the Intelligence and Security Committee noted when commenting on the previous draft “privacy protections should form the backbone of the draft legislation, around which the exceptional powers are then built.”  Mass surveillance, as envisaged in these proposed ’bulk’ warrants, turn the exception into the rule. They do not belong in any law seeking to be “world-leading”, as the UK Government has claimed yet again this week. These unjustifiable powers need to be removed from this Bill.