12_tribes - Fotolia

News

Regulator takes tougher line than expected on surveillance warrants

The Investigatory Powers Commissioner’s Office has signalled to government that it will take a tough line when scrutinising surveillance warrants under the controversial Investigatory Powers Act

Bill Goodwin
By
Published: 12 Mar 2018 10:15

The investigatory powers commissioner will take a critical approach to scrutinising surveillance warrants requested by government departments and intelligence agencies to spy on the public’s email, telephone and internet activities.

An advisory notice issued last week by the investigatory powers commissioner, Sir Adrian Fulford, goes further than many commentators had expected in giving judicial commissioners the right to challenge the necessity and proportionality of surveillance warrants issued by ministers.  

David Anderson QC, former independent reviewer of terrorism and author of an influential report on bulk surveillance powers, said the Investigatory Powers Commissioner’s Office (IPCO) had “planted a flag on the government’s lawn” in guidelines for approving surveillance warrants issued last week.

“IPCO appears to be rolling up its sleeves and demonstrating that in all the ways that matter, it will be holding the authorities properly to account,” he told Computer Weekly. “If this makes them feel a little uncomfortable, then the new commissioner is doing his job.”

The Investigatory Powers Act 2016, also known as the snoopers’ charter, gives police, intelligence agencies and other government departments sweeping powers to  conduct suspicionless interception of communications, bulk or mass surveillance, and to hack phone or computer systems.

About 600 government departments and agencies, including local councils, have the ability to access communications data on private individuals, but the largest users are MI5, MI6, GCHQ, police forces, the National Crime Agency and HM Revenue & Customs.

The intelligence services have powers to collect and retain huge databases containing people’s personal details, which might include bank statements and travel records, or to order technology companies to install “back doors” in their services.

These powers will be overseen by the commissioner, Sir Adrian Fulford, who will be the first regulator empowered to review and challenge warrants at the time they are issued, rather than conduct retrospective audits.

Judicial commissioners – working for IPCO – will be responsible for scrutinising and challenging warrants issued by the Home Office, the Foreign Office, the Ministry of Defence, and their equivalents in Northern Ireland and Scotland – a principle known as the “double lock”.

“Independence is one of IPCO’s core values,” said an IPCO spokesman. “It is crucial that it is generally understood that IPCO – as was the case with its predecessors – and the judicial commissioners perform their duties wholly independent of government and all other external bodies and individuals.”

Is interception warranted?

Judicial commissioners will ask the following questions:  

  • Whether what is sought to be achieved by the warrant, authorisation or notice could reasonably be achieved by other less intrusive means.
  • Whether the level of protection to be applied in relation to any obtaining of information by virtue of the warrant, authorisation or notice is higher because of the particular sensitivity of that information.
  • The public interest in the integrity and security of telecommunication systems and postal services.
  • Any other aspects of the public interest in the protection of privacy.

Additional considerations under the European Court of Justice and European Court of Human Rights:

  • Whether the objective is sufficiently important to justify the limitation of a fundamental right.
  • Whether the measure sought is rationally connected to the objective.
  • Whether a less intrusive measure could have been used.
  • Whether, having regard to these matters and to the severity of the consequences, a fair balance has been struck between the rights of the individual and the interests of the community. 

There are further safeguards in place for journalistic material, journalistic sources and communications protected by legal and professional privilege.

IPCO has rejected the approach previously taken by courts in judicial reviews – known as the Wednesbury test – that as long as a decision is seen to fall within the bounds of reasonableness, it cannot be challenged. Instead, judicial commissioners will assess whether each warrant is necessary, proportionate and legal.

“They will look at it more substantively, scrutinising it on legality, proportionality and necessity,” said Graham Smith, an internet law specialist and partner at legal firm Bird and Bird. “What they are not going to do is limit themselves to that old Wednesbury test, which is whether a decision is in the range of reasonable decisions. So it means they are going to give greater scrutiny to it.”

IPCO replaced three regulators – the Interception of Communications Commissioner’s Office (IOCCO), the Office of Surveillance Commissioners (OSC) and the Intelligence Services Commissioner (ISComm) – in September 2017, each of which was responsible for overseeing aspects of the Regulation of Investigatory Powers Act (RIPA).

About 15 current and recently retired judges from the High Court, the Court of Appeal and the Supreme Court will work as judicial commissioners for IPCO, with new powers to scrutinise and challenge surveillance warrants issued by secretaries of state before they are enacted. They will work alongside a team of about 30 inspectors, who will carry out audits of the way powers are applied in government bodies. The new body will have a total staff of 70.

“Compared with the situation under the existing legislation, RIPA, this is a huge change,” said Smith. “This notice reinforces the impression that there will be real independent scrutiny of warrants, authorisation and so on.”

Most applications for warrants will be routine or renewals of existing warrants. They will not require as much detailed information in the warrant application, or detailed consideration by the judicial commissioners, and will be considered within short time scales, the advisory notice revealed.

Warrant-granting departments

  • Home Office
  • Foreign Office
  • Ministry of Defence
  • Northern Ireland Office
  • Scottish Government Justice Directorate

But judicial commissioners will give greater scrutiny to warrants that require novel or controversial techniques. The commissioners will have access to advice from technical specialists, and a technical advisory panel of external experts and scientists.

Commissioners will also be able to request legal advice from an independent barrister, known as a standing counsel.

Anderson said there could be cases where the judicial commissioners would hear arguments from the standing counsel and the government agency requesting the warrant.

This would be particularly important for more contentious bulk and thematic warrants that allow government agencies to gather information on a wide range of people – for example, all the mobile phone users in a particular town.

“That takes us some way towards the kind of contested hearing that operates for certain categories of warrant in the US and Canada, and can only be good for the rigour of  the warranty process,” said Anderson.

The advisory notice gives the government the duty to disclose any material that might undermine the case for approving the warrant, both to the secretary of state and the judicial commissioners.

That includes whether there would be collateral intrusion on the privacy of people not subject to the operation, whether there is any credible evidence that the target may not be a legitimate subject of interest, and whether the information could be gathered in less obtrusive ways.

Government bodies will also be expected to state where the law on surveillance is unclear, or where they are proposing a novel or contentious interpretation of the law to justify granting a warrant.

Deterrent to government agencies

IPCO’s team of inspectors will effectively act as a deterrent to government agencies that may want to withhold details that may adversely affect their warrant application.

They will be able to inform the judicial commissioners if they discover examples of non-compliance, which may make the judge less willing to authorise warrants from that department in future.

IPCO’s advisory notice revealed that, in a move to raise transparency beyond the levels of RIPA, the judicial commissioners will consider making decisions on warrant approvals public.

In practice, IPCO is expected to publish details of the number of warrants it approves, and refuses, and what the reasons for a refusal might be.

How far the commissioners will go beyond that will depend partly on how far the government is prepared to go in allowing IPCO to publish warrant applications that might mention sensitive surveillance techniques, such as bulk interception.

Although IPCO has said it aims to be as transparent as possible in its annual report, in practice, some of the details may be held back to the report’s confidential annex.

The judicial commissioners will have less discretion to make decisions on whether surveillance warrants are legitimate ways to achieve foreign policy or national security aims – which are regarded as matters for politicians. “Judicial commissioners will afford a very wide margin of judgment to the secretary of state in determining such matters,” the document said.

In his review of bulk surveillance powers in 2016, Anderson argued for a technical advisory panel to advise the investigatory powers commissioner on developments in technology. He said IPCO appeared to be making good strides to providing an effective form of oversight to surveillance.

“IPCO’s ambition is to create a world-leading oversight mechanism by adding a strong and technically aware judicial approval mechanism to the skilled inspectorate that, for several years now, has been following up on errors and best practice,” he said. “These are early days, but on the strength of this notice, it seems to be on the right track.”

Read more on Privacy and data protection