Another Case Against GCHQ Filed At The European Court Of Human Rights; Could Overturn UK's Main Snooping Law

from the pressure-keeps-building dept

Just last week we wrote about the growing number of legal challenges to GCHQ spying. Now here's another one, from The Bureau of Investigative Journalism, which is concerned about how blanket surveillance threatens the workings of a free press:

The Bureau of Investigative Journalism is asking a European court to rule on whether UK legislation properly protects journalists' sources and communications from government scrutiny and mass surveillance.

That's an issue because GCHQ's approach of routinely collecting all communications for detailed analysis inevitably means that some data involving journalists will be swept up. As the lawyer Gavin Millar explains:

No one knows anything about what GCHQ does with the journalistic information it pulls in. This is because, startlingly, neither the legislation nor government guidance about its use says anything at all about this.

But it is inevitable that some of GCHQ's minute analysis of the data will be giving it selective access to confidential journalistic material and identifying sources. There is already much evidence that law enforcement agencies increasingly seek to access such information for their own purposes. It is an easy way of advancing their investigations. It can help to identify and deal with embarrassing whistleblowers and can forewarn of awkward stories in the offing. The same is true for the security and intelligence agencies.

Fortunately, Articles 8 and 10 of the European Convention on Human Rights give strong protection to the right to privacy and to freedom of expression. As Millar explains, in earlier judgments the European Court of Human Rights (ECHR) has made it clear that:

this Article 10 right can only be overridden by an order of a judge. And the journalist must first have the opportunity to argue before the court that there is no competing public interest which makes such an order necessary. The law under the Convention is quite clear. Covert state surveillance and accessing of journalistic information cannot be used to circumvent these important rights.

Other journalistic information and activity can only be the subject of such covert surveillance in certain circumstances. Most importantly it must be carried out under laws which are clear, accessible and foreseeable in their effects. These laws must give journalists an adequate indication of how these discretionary surveillance powers might be used against them. They also have to provide protection against arbitrary or disproportionate surveillance measures.

However, the UK law that governs this area, the Regulation of Investigatory Powers Act 2000 (RIPA), is outdated, and does not comply with those rules, Millar believes. So this latest attack on GCHQ's mass surveillance is not just an empty gesture to express annoyance: if the ECHR rules in favor of The Bureau of Investigative Journalism, the British government will be required to review the regulations around the mass collection of communications data -- to update the anachronistic RIPA, in other words.

The good news is that the ECHR has already indicated that it will accept this new case. That offers the hope that the court may be preparing to put it in the fast track along with a similar one that calls into question the UK's compliance with Article 8 of the European Convention on Human Rights. Even if the pace of Snowden's revelations has slowed somewhat in recent months, the impact of earlier leaks continues to grow.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: eu court of human rights, gchq, human rights, investigative journalism, journalism, privacy, snooping, surveillance
Companies: the bureau of investigative journalism

European Court Of Human Rights Fast-tracks Case Against GCHQ; More Organizations Launch Legal Challenges To UK Spying

from the on-the-defensive dept

Back in December, we wrote about a legal action that a group of digital rights activists had brought against GCHQ, alleging that the UK's mass online surveillance programs have breached the privacy of tens of millions of people across the UK and Europe. In an unexpected turn of events, the court involved -- the European Court of Human Rights -- has put the case in the fast lane:

The court has completed its preliminary examination of the case and has communicated it to the British government, asking it to justify how GCHQ's practices and the current system of oversight comply with the right to privacy under Article 8 of the European Convention. The court has also given the case a rare 'priority' designation. The government now has until 2 May to respond, after which the case will move into the final stages before judgment.

Any hopes the UK government may have had that the case would amble slowly through the legal system until people had forgotten about it have now been dashed. Moreover, it has been put on the spot by the court, which has asked a very specific question about how the UK government thinks it can square mass surveillance with the EU European right to privacy. It will be interesting to see how the UK responds.

Nor is this the only legal challenge to GCHQ's activities. In the December post, we reported that Amnesty International was using the UK's Investigatory Powers Tribunal to argue that spying on communications breaches the UK's Human Rights Act. Now we learn it has been joined by two others groups -- one from inside, the other from outside the UK:

Privacy International's partner organisation, Bytes for All, has filed a complaint against the Government, decrying the human rights violations inherent in such extensive surveillance and demonstrating how the UK's mass surveillance operations and its policies have a disproportionate impact on those who live outside the country.

Bytes for All, a Pakistan-based human rights organization, filed its complaint in the UK Investigatory Powers Tribunal (IPT), the same venue in which Privacy International lodged a similar complaint last July.

Privacy International's post quoted above points out that, just like the US, the UK offers fewer safeguards when it comes to overseas surveillance:

While such mass surveillance, in and of itself, is violative of human rights, that infringement is compounded where foreigners' phone calls, emails, or internet searches are intercepted as they currently receive even fewer legal protections than the communications of those who reside in the UK. In addition to violating Articles 8 and 10 of the European Convention of Human Rights (ECHR), which protect private communications, such disparate treatment is a violation of Article 14 that prohibits discrimination of all sorts, including based on nationality.

None of these legal challenges on its own represents a serious threat to the UK government, but together they ensure that GCHQ's surveillance activities remain in the spotlight, and that the UK government is forced to justify its activities -- just what it is trying to avoid.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: eu court of human rights, europe, gchq, privacy, surveillance

Rejection Of The Pirate Bay Founders' Appeal Sets Dangerous Precedent On Liability & Free Expression

from the not-a-good-ruling-at-all dept

As others have noted, the European Court of Human Rights has rejected appeals from two founders of The Pirate Bay, Peter Sunde and Fredrik Neij, of their conviction under Swedish law. The decision is worth reading in its entirety, in that it tries to lay out a "balanced" approach concerning freedom of expression against other rights, such as copyright, and appears to come down on the side of saying copyright is more important than freedom of expression. That seems like a dangerous outcome in a variety of ways.

The court quite readily admits that forcing Sunde and Neij to block content from being exchanged via TPB violates their free expression rights, but says that this is a legitimate restriction on such rights:

In the present case, the applicants put in place the means for others to impart and receive information within the meaning of Article 10 of the Convention. The Court considers that the actions taken by the applicants are afforded protection under Article 10 § 1 of the Convention and, consequently, the applicants' convictions interfered with their right to freedom of expression. Such interference breaches Article 10 unless it was "prescribed by law", pursued one or more of the legitimate aims referred to in Article 10 § 2 and was "necessary in a democratic society" to attain such aim or aims.

They then look at whether or not the restriction of free expression was "prescribed by law" and conclude that it was, because it happened under the Copyright Act, and there was a "legitimate aim" behind the convictions. That's pretty broad, of course. It also looks at whether or not this restriction was "necessary in a democratic society," which is where it spends the most of its time.

The court seems heavily influenced by the fact that TPB did not remove torrents when asked to do so, despite no law requiring such actions. Furthermore, that sets a bizarre and dangerous precedent that just because someone "urges" you to remove content from an internet website or service, that you must do so or be held liable for it.

The part that troubles me most, however, is that the court more or less completely sidesteps the questions of secondary liability. While it mentions, a few times, that both Sunde and Neij have pointed out that TPB was just the service provider, and any actual infringement was done by users, it never properly addresses this issue, other than to suggest that secondary liability is perfectly reasonable. For those of us who have studied just how important protections for secondary liability are in promoting innovation, this suggests a very dangerous precedent for innovation in Europe. When service providers -- or even those who just worked on the platform -- are held directly liable for actions of their users, you create a very big chilling effect on other companies and services. While it may be more understandable for Neij, who worked directly on building and maintaining the site, Sunde's connection to the actual operations has always been remote. The EHCR reiterates the silly point that, among other things, Sunde "configured a load balancing service for TPB" as if that has anything to do with the overall operations of the site. While it does also talk about his minimal work in working with advertisers on the site, setting up a load balancer and advertising relationships are perfectly legitimate activities, and have nothing to do with any infringement that may have occurred on the site.

Having recently watched the documentary on the TPB trial, TPB AFK (and recognizing that it likely does not tell the full story in the short time frame allowed in a documentary flick), you begin to recognize that there is something of a language and technology literacy gap between those prosecuting the TPB founders and the founders themselves, and, if anything, I think that contributes to the situation the founders are in now. Many of their explanations make perfect sense from a technology standpoint, and are completely obvious, normal things that any online service would do. But, the founders seem to think that these things are so obvious and so non-troublesome that they don't appear to do a very good job of explaining them in ways that the court would understand. It's for that reason that I think the case has not gone that well for the founders. It often appears that they assume that those who are judging them (and prosecuting them) have a level of technological literacy and sophistication that they do not have. There would be ways to dumb down the arguments for why they should be protected under secondary liability theories, but it almost appears that the founders believe that it is the responsibility of those in the court to understand the more sophisticated arguments. I can certainly understand where such a position comes from -- and it makes sense in an ideal world. But in the real world, where that sophistication is lacking, the TPB founders glib explanations for the actions taken come off as semantics and rationalizations, rather than a compelling judicial argument. That is unfortunate, because the end result is a decision like the one today.

Filed Under: copyright, ehcr, eu court of human rights, europe, frederik neij, free expression, peter sunde, secondary liability
Companies: the pirate bay