Mass internet surveillance threatens international law, UN report claims

Mass surveillance of the internet by intelligence agencies is “corrosive of online privacy” and threatens to undermine international law, according to a report to the United Nations general assembly.

The critical study by Ben Emmerson QC, the UN’s special rapporteur on counter-terrorism, released on Wednesday is a response to revelations by the whistleblower Edward Snowden about the extent of monitoring carried out by GCHQ in the UK and the National Security Agency (NSA) in the US.

Emmerson’s study poses a direct challenge to the claims of both governments that their bulk surveillance programs, which the barrister finds endanger the privacy of “literally every internet user,” are proportionate to the terrorist threat and robustly constrained by law. To combat the danger, Emmerson endorses the ability of Internet users to mount legal challenges to bulk surveillance.

“Bulk access technology is indiscriminately corrosive of online privacy and impinges on the very essence of the right guaranteed by [the UN’s International Covenant on Civil and Political Rights],” Emmerson, a prominent human rights lawyer, concludes. The programmes, he said, “pose a direct and ongoing challenge to an established norm of international law.”

Article 17 of the covenant, Emmerson points out, states that “no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home and correspondence, nor to unlawful attacks on his or her honour and reputation”.

The 22-page report warns that the use of mass surveillance technology, through interception programs developed by the NSA and GCHQ such as Prism and Tempora, “effectively does away with the right to privacy of communications on the internet altogether”.

It also highlights more intrusive methods, such as the NSA’s Quantum program, which enables the agency to take “secret control over servers in key locations” and by impersonating websites “inject unauthorized remote control software into the computers and Wi-Fi-enabled devices of those who visit the clone site”.

Most countries possess the technical capacity to intercept and monitor calls made on a landline or mobile telephone, enabling an individual’s location to be determined, his or her movements to be tracked through cell site analysis and his or her text messages to be read and recorded, Emmerson says. An increasing number of countries also use malware systems that infiltrate individuals’ computer or smartphone, to override settings and monitor its activity.

But Emmerson differentiates between targeted surveillance, which follows a belief that its subject is involved in a specific act of wrongdoing, with bulk surveillance, which indiscriminately swallows up digital or telephonic communications data. The latter practice gives countries like the US and the UK access to an “effectively unlimited number of users,” Emmerson writes.

“This amounts to a systematic interference with the right to respect for the privacy of communications, and requires a correspondingly compelling justification,” Emmerson maintains.

“Merely to assert – without particularization – that mass surveillance technology can contribute to the suppression and prosecution of acts of terrorism does not provide an adequate human rights law justification for its use. The fact that something is technically feasible, and that it may sometimes yield useful intelligence, does not by itself mean that it is either reasonable or lawful.”

The argument that anything online should be considered to be in the public domain is demolished by Emmerson. “Merely using the internet as a means of private communication cannot conceivably constitute an informed waiver of the right to privacy,” he states. “The internet is not a purely public space. It is composed of many layers of private as well as social and public realms.”

Mass surveillance of digital content and communications data is “a serious challenge to an established norm of international law”, according to the report. “The very existence of mass surveillance programmes constitutes a potentially disproportionate interference with the right to privacy.

“It is incompatible with existing concepts of privacy for states to collect all communications or metadata all the time indiscriminately. The very essence of the right to the privacy of communication is that infringements must be exceptional, and justified on a case-by-case basis.”

Emmerson’s report follows a finding this summer from Navi Pillay, the UN’s high commissioner for human rights, that criticised the US and its allies for a “disturbing lack of transparency” about their surveillance practices. Pillay stated in July that Snowden ought not to be prosecuted for disclosing the extent of the surveillance dragnets.

Within the US, where a tumultuous year-long debate over surveillance reform appears to have stalled, intelligence officials insist that their surveillance activities are restrained by laws like the Foreign Intelligence Surveillance Act (Fisa) and the Patriot Act - passed by the US Congress and subject the watchful judicial eye of the secret Fisa court.

While Emmerson’s report does not explicitly criticise the US, it rejects those assertions. The sheer volume of US surveillance, by its nature, cannot “be spelled out in legislation”, meaning Americans’ and foreigners’ privacy rights can be violated “without commensurate safeguards”.

Deriving authority for bulk surveillance from laws that, on their face, do not authorise the practice amount to “secret legal frameworks”, an echo of a criticism made by US senators Ron Wyden and Mark Udall.

“Nothing short of detailed and explicit authorization in primary legislation suffices to meet the principle of legality,” Emmerson writes.

Emmerson also proposes a remedy for the vulnerability of digital communications data. “Any Internet user,” he concludes, ought to have legal standing to “challenge the legality, necessity and proportionality” of mass surveillance.

Courts in the US have not viewed that contention favourably. Before Snowden’s leaks, several judges rejected legal challenges because those bringing the suit had no way of knowing their specific communications were collected.

Even after Snowden disclosed the bulk collection of Americans’ phone data, US justice department lawyers began arguing that surveillance only truly occurred once the collected communications data was analysed, something else users cannot know.

During arguments in a New York federal court last month, government lawyers argued the judges themselves have no authority to review the NSA’s bulk phone-records collection.

The report refers to revelations first published in the Guardian last year about the NSA’s mass collection of telecommunications data and its authorisation under a secret court order.

“The right to privacy is not,” Emmerson’s report acknowledges, “an absolute right. Once an individual is under suspicion and subject to formal investigation by intelligence or law enforcement agencies, that individual may be subjected to surveillance for entirely legitimate counter-terrorism and law enforcement purposes.”

But he adds: “There is an urgent need for states to revise national laws regulating modern forms of surveillance to ensure that these practices are consistent with international human rights law.

“The absence of clear and up-to-date legislation creates an environment in which arbitrary interferences with the right to privacy can occur without commensurate safeguards. Explicit and detailed laws are essential for ensuring legality and proportionality in this context.”

The report concludes: “The prevention and suppression of terrorism is a public interest imperative of the highest importance and may in principle form the basis of an arguable justification for mass surveillance of the internet.

“However, the technical reach of the programmes currently in operation is so wide that they could be compatible with article 17 of the covenant only if relevant States are in a position to justify as proportionate the systematic interference with the internet privacy rights of a potentially unlimited number of innocent people located in any part of the world.”