The importance of specificity in Intelligence-related laws

Over the next week, I will be publishing my detailed thoughts on the  draft Investigatory Powers Bill Be warned – they’ll be long, and boring…

But before I do that, I want to discuss something which never seems to be covered. When discussing bills to do with surveillance and intelligence matters, there is always a discussion of the morality of the laws, of the interminable tug of war between privacy and safety. The debates in parliament often cover that, as well as some specific modifications, but what never seems to be discussed is how very different such bills are compared to most others, from a judicial and enforcement perspective.

The legal system in the UK is based around Common Law, generally through an adversarial system. I will below make the case that the legislation created for Intelligence and Surveillance related matters is insufficient, because of shortcomings in our legal system.

But first a bit of background… And a caveat – I am not a lawyer – the below is my understanding of the process and problems, and I would love to be corrected where I’ve made errors. Note: I have used civil liberties groups as an example of the opposition to government, but the relevant aspects could apply to any member of public.

Primary Legislation

Law generally begins with a need. The government decides that something should be made illegal, or should definitively be made legal. The government, or rather the specific departments, will provide a description of what they want to accomplish and pass this to the Office of Parliamentary Council. The OPC will draft a Bill. Eventually this Bill (after multiple iterations) will go through parliament, be voted on, and maybe become an Act of parliament, and law. See [1] for more details.

Secondary Legislation

An aim for Primary Legislation is for it to change slowly and rarely. However, the world changes – government departments are opened, closed, and disbanded. Technology changes. If the Primary Legislation is overly detailed, then parliament would spend all its time updating this legislation for minor tweaks rather than looking at the big picture. Most Primary Legislation therefore normally allows the government to provide minor updates, and more detailed instructions, through the use of Secondary Legislation.

This Secondary Legislation is limited by the Primary – i.e. the Primary specifically says what limited powers are conferred on the government. The Secondary Legislation, normally “Statutory Instruments” such as regulations, are written by the government and normally still need parliament to vote on and pass. However, these votes are generally quite pro-forma, and don’t have the large debates or proposed amendments that occur with primary legislation.

Common Law

A third class of law is created by the courts, rather than government. As cases are brought to the courts for judgement, case law [2] is created. Essentially, during the process of a trial the defendant and prosecution argue with each other (the adversarial system [3]). Ultimately the judge (and jury to a lesser extent) try to make a determination of what the law actually means, and whether the defendant is guilty or at fault. When a decision is made, case law is created – i.e. the court decides that the law, in this instance and any other similar/identical one, means x.

This case law can then be relied on for future interpretation of the primary and secondary legislation. Over time, a set of case law is created for any primary legislation, which will be much more detailed than anything parliament could, or would want to, create.

The Problem

Lack of case law

Intelligence related laws go through the normal process in their creation, both as primary and secondary legislation. However, I assert that they aren’t treated the same at the Common Law stage.

Intelligence related matters are necessarily secret. It is vital that the details of methods and techniques remain out of the hands of the country’s adversaries, as knowledge of them would allow these adversaries to avoid our intelligence agencies. This is a key reason why much intelligence-type surveillance is not allowed as evidence in trials. If included in evidence, then due to the adversarial system the defence would be able and indeed required to delve into how the evidence was obtained. As court proceedings are generally public, this would lead to sensitive information on methods and techniques becoming public.

Under some Acts of parliament, evidence may be introduced in secret, at closed hearings. A ‘special advocate’ is normally nominated to argue the defendants case in such a situation – however it should be noted that the defendant themself generally doesn’t know what happens in such courts, nor do their lawyers. There is therefore a lot of nervousness about whether the ‘special advocate’ is doing their job and has access to all relevant information. Furthermore, the detailed conclusions of such hearings do not become public, leading to such either not becoming case law, or leading to a secret set of case law such as that created by the US FISA courts [7].

Therefore, the main route by which intelligence-related law is tested in the courts and case law created, does not occur.

An alternate route to bring such laws into review and interpretation by the courts is through the public either suing the government because they believe the law has been broken (e.g. Amnesty and others over surveillance[4]), or seeking a judicial review if they think the process by which a law has come into effect was incorrect (e.g. David Davis MP and Tom Watson MP over DRIPA[5]).

A judicial review can only be used if there has been an error in process, in the case above the error being that EU law wasn’t correctly applied/followed when creating DRIPA. The result will generally to quash, or allow, law or specific parts. It will not, I believe, generally result in case law about the interpretation of meaning existing law.

The public can only sue if they have evidence that wrongdoing has taken place. Due to the secrecy inherent in intelligence matters, such evidence does not generally become public. Subjects of surveillance are not, as a rule, aware that they are under surveillance, irrespective of whether it is lawful or not. The suit brought by Amnesty et al was only possible due to the Snowden leaks.

Ultimately therefore, except when egregious errors are made in process, or whistleblowers leak possible areas of unlawfulness, the courts do not get to see these matters in public, and so no case law can be created.

Difference of opinion

Another way of saying the above is that there is no way to clarify what the government thinks a law says, and whether that tallies with what the public thinks it says. Primary Legislation is very vague, and Secondary Legislation is often not much less so. Furthermore, Secondary Legislation generally goes through much less rigourous examination.

A concrete example is that of the phrase “external connection” in RIPA. The government believed it referred to any communication with an external endpoint, including any servers the data routes through. So, for example, if your email server is external to the UK, then it is an external connection, even when using that email to talk to another person in the UK [6]. This was at odds with what a lot of people, including civil liberties organisations, believed to be the case.

Due to our adversarial system, a judge cannot act as inquisitor, delving into the truth. Instead, they remain an impartial arbiter as two parties fight to convince the judge of their interpretation. Without the laws going through the courts, there is no opportunity for this fight, leaving the legislation wide open for interpretation, and without any realistic check or balance that the government is interpreting. Oversight bodies are limited in their powers. They additionally run the ever-present danger of internalising the government’s interpretations (especially within, for example, the Intelligence and Security Committee of Parliament) without realising they are doing so.

Possible Solutions

Ultimately, I think a combination of things are needed for Intelligence-related (which includes Surveillance, such as the draft Investigatory Powers Bill) legislation. This includes changes in the way that such legislation is drafted, the government being more open of interpretation, and ways to create case law outside of traditional approaches.

The first item needed is greater specificity in both primary and secondary legislation. This runs the risk of creating law which needs changing more often, and so a case can be made that this should be done in regulations rather than the bills themselves. However, it must be recognised that secondary legislation normally go through on the nod, without much or any debate. If specifics will be implemented in secondary legislation then there must be a recognition that more debate and review will be needed at that stage.

The next is that the government should be open about interpretation of law, even when it applies to potential methods and techniques. This will help build trust between civil liberties groups and the government, and will also help the government avoid situations such as that which the IPT found in the Amnesty case – that the government had been breaking the law but that due to the leaks of Snowden it was now not doing so, because the leaks had made public facts that should already have been public.

Finally, there must be a recognition that the courts do not have the opportunity to create case law in these matters – a situation the current draft Investigatory Powers Bill makes no better, and indeed s171(3) of that draft may make worse. Alternate approaches should therefore be considered. For example, an approach somewhat akin to Moot courts [8] where civil liberties groups and government can work together to introduce representative test cases, with the government taking part in a neither-confirm-nor-deny approach with respect to methods and techniques actually being used. The results of such moot trials could be allowed as case law, which the government would be required to treat as real case law.

I submit that the status quo is insufficient, and has contributed to the current breakdown in trust between the people and government. We must look outside normal practices, while staying inside established principles of legislation and jurisprudence, in order to help heal this wound. Failure to do so will only lead to increased recriminations on all sides.

[1] https://www.gov.uk/guidance/legislative-process-taking-a-bill-through-parliament
[2] https://en.wikipedia.org/wiki/Common_law
[3] https://en.wikipedia.org/wiki/Adversarial_system
[4] http://www.ipt-uk.com/docs/Liberty_Ors_Judgment_6Feb15.pdf
[5] https://www.judiciary.gov.uk/wp-content/uploads/2015/07/davis_judgment.pdf
[6] http://www.theguardian.com/world/2014/jun/17/mass-surveillance-social-media-permitted-uk-law-charles-farr
[7] https://en.wikipedia.org/wiki/United_States_Foreign_Intelligence_Surveillance_Court#Secret_law
[8] https://en.wikipedia.org/wiki/Moot_court

Missing the point on Edward Snowden

I’ve been watching the Snowden/NSA stories with some interest. There’s the information which keeps dribbling out into the press. There’s the ongoing saga of his search for asylum. There’s the over-reaction of the US government, and the maneuvers behind the scenes with other governments worldwide. And there’s the views of the citizens – covering the entire spectrum from the ‘he deserves a Nobel prize’ camp to the ‘hang him!’ lynch mobs.

It’s been a fun journey, and a small amount of valid and interesting information has sneaked into the press reporting. Unfortunately though, as time has passed, it has increasingly become apparent that most of the press, and the majority of lay people, seem to have missed the point. Instead, stories have deviated into the inconsequential – in fact the same pattern has occurred as we previously saw with wikileaks. Whether this is due to incompetent journalism, the race for ratings, or excellent PR, spin, and redirection by the US government I don’t know – probably a mix of them all.

Initial stories

The first story appeared on 5th June in The Guardian, and revealed that the US government was forcing Verizon to share the phone records of all calls on its system. This was followed by the disclosure of the Prism programme, and related stories on the same theme – that of the widespread surveillance of US (and other) citizens by the US government. This later broadened to include the UK government via GCHQ.

These stories were, and are, important. The widespread compromise of civil liberties in the western world, under cover of the fight against terrorism, child pornography, and other abhorrent acts, should be of concern to anyone. Knowledge of the scope of these compromises is vital, as is an understanding of the oversight bodies and processes that in theory balance security needs with privacy rights. Democracy thrives on information, as only a well informed populace have a chance to make informed decisions on which leaders they want to elect; whether the populace actually pays attention or not, or makes informed decisions is another subject altogether.

The Snowden Story

The focus of the reporting changed on 9th June, when Snowden decided to go public. For the next week the story became Snowden, and not the information he was leaking. Where was he hiding, what was his plans, how hot was his ex-girlfriend? Domestic intelligence stories largely disappeared in the press and while a few more stories cropped up on 20th and 21st June, the focus appears to have irrevocably moved on.

This was a repeat of the progress of the wikileaks story – where it morphed into the Assange story. And with the same effect.

I wonder if maybe a press which is constantly on the hunt for more page hits, and a society which cares more about the Kardashians than the incompetence of the US Congress, are happy to concentrate on these human interest stories rather than spending the time and effort necessary to do good quality journalism.

Hidden within these stories though are some nuggets of reporting on newsworthy events. The international machinations behind Snowden’s search for asylum are valid stories, as are related events like the blocking of the Bolivian president’s flight.

International Espionage

The focus partially moved on on 16th June, when the next leak occurred – with the Guardian reporting that GCHQ had intercepted politician’s comms at the 2009 G20. Many commentators conflated this with the earlier domestic surveillance reports, but this was an egregious error in reporting. I’m not sure if this was a continuation of the search for ratings, a naivety of the realities of international politics, or something else. I am however sure that this leak and the hypocritical and self-serving furor which followed, have managed to dilute and obfuscate the original point.

Governments spy on other governments. Any nation which says otherwise is lying. The scale of that spying will be limited by affordability, and to a lesser extent political concerns. Anyone who isn’t aware of this is, I believe, naive. Reporting that country A has spied on country B isn’t really news, although it may be interesting in the same way that knowing that pop star A is banging TV star B. Titillation rather than news. And in no way constructive.

This is very different from the initial stories. Nations which talk about freedom, while at the same time spying on their own citizens, with minimal, incomplete, or incompetent regulatory frameworks and oversight, should be reported on. Civil servants and militaries who lie to the public, public servants, and oversight bodies, should absolutely be investigated, called out, and brought to task. This is where whistleblowing is vital and should be protected, and where good quality journalism comes in.

The other part of the international espionage part of the story is the reactions of the ‘victims’. The other G20 members, and later the EU, have been vocal in their righteous indignation. The hypocrisy of their response stinks. Does anyone really believe that the French DGSE only spends their 500 million Euro annual budget on chasing terrorists? That said, the pique shown appears to be in accord with norms of international behaviour – country A spies on country B, gets caught, country B complains, and life goes on. This context seems not to be reported on in the press. To quote Hunter S Thompson, “In a closed society where everybody’s guilty, the only crime is getting caught.”

Overreaction of the US government

Running in parallel to these stories, and of considerable interest, is the (over-)reaction of the US (and to a lesser extent UK) government. The US has declared that Snowden is a traitor, has revoked his passport, and behind the scenes threatened governments worldwide not to accept his asylum requests – all allegedly without an international arrest warrant. There are reports that a secret warrant has been issued – which would be somewhat ironic if true.

The US appears to be spending an immense amount of political capital on chasing down a single individual, one who cannot do any more harm than he has already done (given that he has apparently made secure backup copies of all his files). The US again seems to seek revenge rather than justice – a depressingly common attitude in the last couple of decades.

Reporting on the behaviour of the US in this area is definitely worthwhile. The issue is that the press appears to only be able to focus on a couple of things at once; the original civil liberties discussion has disappeared. Whether it will reappear is unknown, but given past history I’m not holding my breath. Binney, Wiebe, Loomis, Roark, Klein, Drake – this particular NSA whistle has been blown many times before, and has consistently failed to elicit any improvement in oversight and civil liberties.

The missed point – Proportionality and Oversight

I have no problem with government agencies having taps on IT and telephony, and performing interception. That is their role, and it is a necessary evil – not just for counter-terrorism, but also serious and organised crime and, yes, military/political espionage. I have no problem with one nation spying on another nation, including against any government or quasi-governmental staff.

It’s a more gray area when espionage is performed for ‘economic’ purposes, most famously by China. But heh, according to RIPA that’s legal in the UK, and (unlike China) we sort-of admit it – it is in a publicly available law after all. Ultimately I think state-sponsored economic espionage is acceptable, with the caveat that those states must realise that when they are caught then they will likely face calls for reparations and sanctions.

I have no issue with police and intelligence having access to citizens data when there’s need. There are lots of bad people in the world, and a lot of them live or operate in the UK.

I stand by all of the above, with a couple of major and all encompassing caveats. Firstly, proportionality – any intrusion on privacy must be proportionate to the crime. Hoovering up everyone’s data and storing it for long periods is potentially very disproportionate. Note that this isn’t limited to SIGINT/COMINT. This also relates to issues such as retention of DNA, criminal records recording arrests without charge and being used against you, etc.

The second issue is oversight. The purpose of the oversight is to enforce proportionality and ensure only that which is necessary is done. Transparency is related to this – there must be transparency of process, and of oversight, but not transparency of each decision – there are often valid reasons for secrecy.

My issues with the US, and possibly the UK, is due to failings in oversight, which has led to failings in proportionality. In the UK there is at least transparency of the oversight process, although there are definitely loopholes in legislation which can be leveraged, whereas US oversight is cloaked in shadows. I don’t blame NSA/GCHQ/whomever for using these failings and loopholes; they have a job to do and can, will, and indeed should, push the limits of what they are allowed to legally do in order to do their job. The failing is in the legal frameworks and oversight which have apparently allowed these organisations to exceed acceptable (nb: a very subjective issue) levels of proportionality.

Ultimately the blame lies with our political masters. It is their job to set these frameworks, and enforce the oversight. In my opinion they have certainly not done so in the US, and to a lesser extent have failed in the UK. To quote Vladimir Putin, “you do have to obtain a warrant for specific policing activities domestically, so why shouldn’t this requirement be valid for intelligence agencies as well?” When you’re being schooled in civil liberties by Putin, worry.