What the 2018 European Court Ruling Means for Mass Spying Around the World

Written jointly by Privacy International and the American Civil Liberties Union (ACLU).

In a landmark decision earlier this month, the European Court of Human Rights ruled that one of the mass surveillance programs revealed by Edward Snowden violates the rights to privacy and freedom of expression. While the case challenges the U.K. government’s mass interception of internet traffic transiting its borders, the court’s judgment has broader implications for mass spying programs in Europe and around the world, including those operated by the U.S. National Security Agency.

The lawsuit was brought by over a dozen human rights groups and journalists from different countries. Consistent with bedrock human rights principles, the court held that the protections it articulated are not dependent on a person’s nationality or geographic location. The European Convention on Human Rights — the international human rights treaty that the court enforces — speaks in universal terms, making this judgment’s defense of privacy and freedom of expression a guidepost for the rest of the world, including the United States.

Indeed, the U.S. government operates multiple mass interception programs analogous to the U.K. program that the court ruled against. The NSA sifts through internet traffic — including the emails, chats, and online messages of Americans — as that information flows across the internet’s physical backbone, whether inside the U.S. or at other points around the globe. Like its British counterpart GCHQ, the NSA copies these communications and combs through them in near real-time, often using keywords to determine what to ultimately retain and discard.

The court’s ruling significantly undermines a key refrain of the U.S government: that a “search” doesn’t occur until a human reads or listens to the intercepted communications. Rather, the court explicitly recognized that the government intrudes upon our right to privacy even when it uses surveillance technology to intercept and digitally examine “a communication, even it if it is subsequently discarded in near real-time.”

The court also laid to rest the pervasive myth, perpetuated by the U.S. and U.K. governments alike, that the collection of communications “metadata” — the who, what, when and where of our communications — is less intrusive than collecting content. For years, intelligence agencies have mined this data while downplaying how revelatory it can be. The court dismantled this narrative, explaining that “the patterns that will emerge” through metadata are “capable of painting an intimate picture of a person through the mapping of social networks, location tracking, Internet browsing tracking, mapping of communication patterns, and insight into who a person interacted with.”

This ruling is in line with recent U.S. Supreme Court decisions that have recognized the sensitivity of the digital trails we leave behind us every day, including our internet browsing histories and location information. Lower federal courts have also acknowledged just how much metadata can reveal about a person’s private life and beliefs.

The European court ruled that the way the U.K. government filters and searches intercepted communications and metadata is unlawful. Both the U.S. and U.K. governments lack meaningful oversight of how intelligence analysts select and use keywords to search through their vast troves of our communications. There is no independent or judicial approval of these keyword searches, whose broad scope inevitably captures the communications of millions of people not suspected of any wrongdoing.

Of particular concern to us is intelligence agencies’ spying on communications belonging to people who engage in sensitive work such as journalists, human rights advocates and lawyers. This concern is not hypothetical: At an earlier stage of the case, a British court determined that the U.K. government’s mass interception program had unlawfully interfered with the communications of two prominent human rights organizations — Amnesty International and the Legal Resources Centre, based in South Africa.

The court explicitly recognized the “chilling effect” that mass surveillance can have on freedom of the press. Under its mass surveillance programs, the U.S. government reviews communications between journalists and their sources without any special protection for the confidentiality that is essential for journalism.

Finally, the court’s judgment addresses one of the most overlooked but pernicious by-products of mass surveillance programs — the unregulated sharing of vast troves of information with other intelligence agencies. For decades, the U.S. and U.K. governments have granted each other nearly unfettered access to their respective intelligence databases, swapping enormous amounts of private data. The court’s judgment makes clear that safeguards applying to a government’s direct spying must apply equally to information it obtains from other countries and warns that, otherwise, “States could use intelligence sharing to circumvent stronger domestic surveillance procedures and/or any legal limits.”

Although the court’s decision focuses on the British government’s mass surveillance activities, the U.K. program surely intercepts the communications and data of Americans, who will also directly benefit from the ruling. More broadly, the ruling sends a vital message about mass spying in the digital era. All nations — including the United States — must honor their human rights obligations by providing far more robust safeguards for privacy and free expression.