|
by Asaf Lubin
The world was a different place when, in October 2015, the Court of Justice of the European Union (CJEU) struck down the "Safe Harbour" data-sharing agreement that allowed the transfer of European citizens' data to the US.
The Court's decision concluded that the indiscriminate nature of the surveillance programs carried out by U.S. intelligence agencies, exposed two years earlier by NSA-contractor-turned-whistleblower Edward Snowden, had made it impossible to ensure that the personal data of E.U. citizens would be adequately protected when shared with American companies.
The ruling thus served to further solidify the long-standing conventional wisdom that Continental Europe is better at protecting privacy than America.
However, Europe's ability to continue to take this moral high ground is rapidly declining.
In recent months, and in the wake of a series of terrorist attacks across Europe, Germany, France and the United Kingdom - Europe's biggest superpowers - have passed laws granting their surveillance agencies virtually unfettered power to conduct bulk interception of communications across Europe and beyond, with limited to no effective oversight or procedural safeguards from abuse.
The same political leaders and legislators that once rebuked the NSA on the ethics of its mass surveillance practices, seem to now be taking a page out of the NSA's playbook.
This post surveys these three national legal frameworks, highlighting their troubling similarities, with the aim of showing how legislators from these countries are treading a dangerous line of surveillance expansion and overreach, paving the way for more European countries to follow in their footsteps.
Indeed, European countries are increasingly chiming in to an ever-growing chorus of supporters for wholesale global surveillance in the name of perceived security.
This rhetoric finds especially fertile ground in modern-day Europe, which has been engulfed by populist messaging surrounding the refugee crisis, immigration and heightened security threats.
However, rushed and vague mass surveillance laws, while they might increase public approval ratings in the short term, are not a true panacea to the fundamental flaws in European intelligence cooperation that were exposed by the recent attacks.
Moreover, such laws may not only fail to solve the problems they seek to address, but rather they could help foster new problems.
As Marc Trévidic, the former chief terrorism investigator for the French judicial system, said about the French legislation:
This is even more worrying in the context of foreign mass surveillance where the victims of potential overreach are non-citizens with even fewer statutory protections and avenues for redress.
To understand how these new laws endanger privacy protections across Europe, it's important to examine the legislation carefully, including, the new powers granted, the oversight mechanisms available, and the protections put in place for privileged communications, for example, conversations between an attorney and a client or communications subject to diplomatic inviolability.
United Kingdom
On Nov. 29, the UK adopted the Investigatory Powers Act (IPA), nicknamed by privacy experts as the "Snoopers Charter," because it authorizes the Government Communications Headquarters (GCHQ) to engage in bulk interception, acquisition, and equipment interference of 'overseas-related' communications and communications systems, comprising of communications,
Germany
On Oct. 21, Germany adopted the Communications Intelligence Gathering Act.
The act authorizes the Federal Intelligence Service (BND) to gather and process communications of foreign nationals abroad. Some of the world's largest internet exchange points (IXPs) are situated in Germany, thus making the country a central hub for significant portions of the world's internet traffic.
While the Act authorizes for interceptions against foreigners to be conducted only from within Germany's territory, a legislative move which might seem limiting, in actuality in light of Germany's unique geographical position, it authorizes the BND to tap these exchange points in a broader effort to maximize global surveillance.
In fact, the operator of one of these commercial IXPs, De-Cix, has recently brought a case before the Leipzig administrative court, challenging BND's demands to allow the mass monitoring of international communications flowing through its hub.
France
Two weeks after the November 2015 terrorist attacks in Paris, during which 130 people were killed, France adopted the International Electronic Communications Law.
The law officially recognizes the powers of the French Directorate General for External Security (DGSE) to intercept, collect, and monitor communications "sent or received abroad."
This encompasses all those communications which are associated with "subscription numbers or identifiers" that are not traceable to the national territory of France.
France has long been suspected of being involved in global electronic communications surveillance, codenamed by the media as "Franchelon," a take on Echelon, a mass surveillance program launched in the late 1960s by the NSA in cooperation with its Five Eyes' partner organizations.
Dangerous Precedent Setting for the Continent and Beyond
All three laws share a number of disturbing similarities.
First, the laws allow for mass foreign surveillance on broad and ambiguous grounds.
As the Human Rights Committee has already found in relation to the French legislation, for a law to meet the principles of legality, necessity, and proportionality, it must state,
Similarly, the ECtHR noted in Kennedy that while the standard of foreseeability,
Surveillance laws therefore must be adequately precise in their terms to give citizens an indication of the circumstances that might give rise to a surveillance measure.
Grounds such as,
...are specific enough to meet the above requirements.
On the other hand, all three laws also include more ambiguous and open ended categories such as the catch-all "national security" ground in,
In this regard, specific attention should be given to the question of whether advancing economic interests constitutes a legitimate objective for foreign surveillance.
While the German law expressly prohibits economic espionage,
According to Wikileaks, Hillary Clinton's Campaign Manager John Podesta, in a policy brief on U.S.-German Surveillance relations concluded that,
This position is in line with the approach laid down in the U.S.-China "common understanding" against cyber economic espionage adopted in 2015, as well as PPD-28 which authorizes,
...only to the extent it is necessary to protect the national security of the United States or its partners and allies.
Any collection done for the sole purpose of promoting the competitive advantage of the U.S. business sector is expressly prohibited by the Directive.
Setting aside the looming future of PPD-28 or any understanding between the U.S. and China under a Trump administration, this stark divergence between the German and French laws signals that the fight against the legitimacy of foreign "economic espionage" has far from been won.
Second, the laws all share a lack of adequate oversight and safeguards from abuse.
The U.K. government, for example, has taken pride in solidifying the 'double lock' mechanism.
However, the law limits the scope of review by the Judicial Commissioners, which means that judges will not be given full authority to assess the merits of proposed surveillance measures.
Moreover, in the case of bulk warrants the authorization requests can be formulated in such broad and vague ways that making judicial assessments on the merits of the application becomes essentially impossible.
The German Independent Panel, which reviews the surveillance directives, also offers only limited oversight.
Not only could this process be circumvented in situations where the Federal Chancellery believes the objective of the measure might be,
Even more egregious, the French law does not establish any mandatory pre-authorization or consultation process and only allows for post factum investigations by an administrative committee, conducted on its own initiative and lacking statutory bite.
Deprived of local structured oversight, the laws in essence shift the onus of control from domestic parliaments, commissioners, and courts to European regional bodies, further broadening the gap between the positions taken by the judges in Luxembourg and Strasbourg and those offered at the national level.
The judgment of the CJEU in the Watson case, announced late December, exemplifies this trend.
The Court found that "general and indiscriminate" retention of metadata, under a recently expired U.K. legislation called the Data Retention and Investigatory Powers Act (DRIPA), violated EU directives and the Charter of Fundamental Rights of the European Union.
DRIPA has since been replaced by the IPA which only expanded on its data retention regime, and is thus likely to be subjected to judicial scrutiny.
The case was heard by 15 CJEU judges, who addressed directly the government's claims on the importance of bulk powers in the age of global terrorism.
The judges noted that:
This ruling offers a push back against mass collection and interception of communications, such as that promoted in the three laws, and widens the chasm between policies in the EU and EC levels and the laws and regulations of their member States.
This is of particular concern, when taken in light of the fact that all three laws explicitly allow for spying on EU institutions.
Moreover, the laws set limited to no protections on the collection and analysis of privileged communications including those of foreign public officials, parliamentarians, journalists, lawyers, and doctors both inside and outside the borders of Europe. In the case of Kopp, which concerned the tapping of the phone lines of a lawyer and his law firm by the Swiss Government, the ECtHR expressly noted the need for establishing distinct and clear protections and safeguards by law for the interception of such privileged communications (paras. 71-75).
Finally, while the German law does establish some general provisions on interstate sharing of intelligence, both the U.K. and the French laws leave such intelligence cooperation arrangements intentionally outside of the scope of primary regulation.
As Privacy International argued before the ECtHR in a pending case, minimum safeguards are required when a government accesses information intercepted by a foreign government or when it shares such information with foreign agencies.
Failure to set statutory parameters for such arrangements, let alone disclose them to oversight bodies and the general public, further exacerbates the possibility for abuse.
Conclusion
Across Europe, from Poland to Austria, from Italy to Sweden, parliaments have been adopting expansive domestic and foreign surveillance legislation in recent months and years.
This wave of legislation, pushed by populist agendas and public outrage in the wake of recent terrorist attacks on European soil, is a flagrant disregard to decades of jurisprudence by the ECtHR and more recent jurisprudence by CJEU, and it puts in danger privacy protections across the continent.
The leaders of Germany, France and the UK are setting a dangerous precedent which echoes within the European Community and far beyond it:
To show how much has changed, it's worth remembering the speech German Chancellor Angela Merkel gave to the German Parliament, just three years ago, in January 2014, when she warned Western governments against promoting surveillance policies that collect everything that is "technically possible."
She noted that these foreign mass surveillance programs not only,
The end result, she concluded,
NOTE:
Privacy International (PI) is a London-based charity which advocates for strong national, regional, and international laws that protect privacy and investigates and litigates to ensure that surveillance is consistent with the rule of law.
We wish to thank Tilly Berkhout, a former intern with PI, for her assistance in the research towards this post.
|
