Investigatory Powers Research Articles

Independent Review of the Investigatory Powers Act 2016

Independent Review of the Investigatory Powers Act 2016

In Search of Legal Certainty Regarding 'Effective Redress' In International Data Transfers: Unpacking The Conceptual Complexities and Clarifying The Substantive Requirements

While effective redress has emerged as a decisive issue in the context of international data transfers, it is shrouded by legal uncertainty due to several conceptual and practical challenges. First, the CJEU rulings on the right to an effective (judicial) remedy raise issues regarding its role in the international domain as well as in relation to EU data protection primary and secondary law. Second, the extraterritorial application of substantive requirements for redress remains unclear and limited to ad hoc assessments. In particular, questions relating to the administrative and/or judicial nature of remedies as well as the according constitutive elements of redress are yet to be determinately answered. The present article aims to address this gap by proposing a roadmap of what effective redress should entail in the context of international data transfers by focusing on i) the EU autonomous definition of tribunal as developed within the CJEU case-law on Article 267 TFEU and, ii) the United Kingdom's Investigatory Powers Tribunal (IPT) as providing for an effective judicial remedy in the context of secret surveillance.

미국법상 스마트폰 잠금 해제 거부와 법원모욕

What should the government do if they fail to unlock or hack suspect’s locked or encrypted smartphone when executing a legitimate search and seizure warrant? Currently, in South Korea, there is no criminal provision to punish someone for refusing the government’s request to unlock the smartphone. In contrast, Article 49(2) of the Regulation of Investigatory Powers Act 2000 in the U.K., Article 434-15-2 of the French Criminal Code, and Article 3LA of the Crimes Act 1914 in Australia allow the government to require anyone to cooperate in unlocking or decrypting his or her smartphone in limited conditions. The courts in the U.S. have laid down different decisions on the issue of whether compelling the suspect to produce the smartphone in a condition of being unlocked or encrypted is repugnant to his or her privilege against self-incrimination under the Fifth Amendment. The courts, then, have ruled that there would be an exception to the privilege when any potential testimonial communication is the “foregone conclusion doctrine” that adds little or nothing to the total sum of the government’s information. Courts, therefore, usually order suspect to unlock or decrypt his or her smartphone when the government can independently prove some facts regarding the doctrine despite the suspect’s privilege. The courts have indirectly compelled suspect to unlock or encrypt his or her smartphone by holding the suspect in contempt of court if he or she fails to do so. The right to remain silent under the Constitution of the Republic of Korea is not an absolute constitutional right, therefore the right may be limited only by a statutory Act if necessary. According to the proportionality doctrine, it is time to consider if we should adopt a new law which allows courts to order suspect to unlock or decrypt his or her smartphone or to issue a warrant requesting his or her to cooperate with the government by unlocking or decrypting it on condition that the government reasonably places his or her a suspicion of committing a serious felony viewed on the prosecution service’s request and submitted evidence showing the facts not only that it would be impossible or seriously difficult to collect evidence through other investigative methods but also that it seems reasonable to conclude that the suspect knows the passwords and the government identifies the contents it seeks with reasonable particularity.

Investigatory Powers and the Overseas Territories

Investigatory Powers and the Overseas Territories

UTJECAJ ODLUKA I NAČELA EUROPSKOG SUDA ZA LJUDSKA PRAVA NA UREĐENJE INSTITUTA POSEBNIH DOKAZNIH RADNJI U UJEDINJENOJ KRALJEVINI S POSEBNIM NAGLASKOM NA PRESRETANJE KOMUNIKACIJA

In the United Kingdom, the regulatory mechanism for intercepting communications has undergone substantial changes in the last few decades. Until the European Court of Human Rights (ECtHR) judgment in the Malone case (1984), in which it found a violation of the right to protection of private and family life pursuant to Art. 8 of the European Convention for the Protection of Fundamental Rights and Freedoms (ECHR), the United Kingdom did not have a concise legislative framework governing the interception of communications. Legislative frameworks governing the subject matter have also been changed by the standards set by the practice of the ECtHR. The implementation of the ECHR into the British legal system has imposed higher privacy protection standards as guaranteed by Art. 8 ECHR, in an environment where the common law approach that “the police can do whatever they want as long as it is not prohibited by law” was no longer sustainable. The specific feature of the legislative regulation of special evidentiary actions in the United Kingdom is manifested, for some special evidentiary actions, through the absence of judicial control, at least in the phase of issuing and extending orders for their implementation. Today, the area in question is governed by a special Regulation of Investigatory Powers Act 2000 (RIPA), Investigatory Powers Act 2016 (IPA), and related Codes of Practice, however not by the Criminal Procedure Code, as is the case in the countries with a continental legal tradition. In this paper, the author analyses the legislative changes that preceded the enactment of the Regulation of Investigatory Powers Act 2000, as well as the new Investigatory Powers Act 2016 that be described as the biggest reform of British interception regulation, as it has, for the first time in the UK, incorporated a judicial element for the power to interception. In this context, the question arises as to whether recent legislative changes meet the standards as established by the ECtHR. Consequently, conclusions are presented concerning the revised concept of the subject matter.

Authorising Crime: The Covert Human Intelligence Sources (Criminal Conduct) Act 2021

The enactment of the Covert Human Intelligence Sources (Criminal Conduct) Act 2021 pre‐empted the outcome of the appeal against the decision of the Investigatory Powers Tribunal in the so‐called ‘third direction’ case. This legislation article considers the background to the statute in the form both of the (absence of a) legal regime governing informant participation in criminality as revealed by reviews of events within the Northern Irish Troubles and the recent litigation. It analyses the key legal issues raised by the Act and locates it within the modern project of rationalising the law related to national security.

The Investigatory Powers Act 2016 and Connected Vehicles: A New Form of Panspectric Veillance Looming?

Abstract Connected and autonomous vehicles (CAVs) currently exist in varying states of readiness to, at one end of the spectrum, assist the driver in normal driving activities and at the other operate in fully autonomous mode, requiring no driver input at all. In facilitating these features, CAVs create, give access to, and allow communication of the data produced. The further along the autonomous scale CAVs progress, the greater the data generated, which are being harvested by original equipment manufacturers (OEMs), often unwittingly by the end user. The operation of the Investigatory Powers Act 2016 gives government agencies power to compel the retention and access to these data. Here we argue that the definitions within the Act result in CAV OEMs being subject to retention notices of the data generated by these vehicles. This issue, its extent and potential for abuse, and the lack of protection for those associated with the use of CAVs, hitherto unexamined in the legal academic literature, is the focus of this paper.

The Evolution Of Elucidation: The Snowden Cases Before The Investigatory Powers Tribunal

AbstractIn 2018 the European Court of Human Rights found that the UK's Investigatory Powers Tribunal is an ‘effective remedy’ when it comes to reviewing the compatibility of the UK's domestic legal framework governing the interception of communication and other communications surveillance powers with the requirements of the European Convention on Human Rights. In particular, the Court praised the Tribunal's ‘elucidatory function’, which it performed during a series of cases that arose in the aftermath of Edward Snowden's disclosures in 2013. This article analyses and historicises the elucidatory function by comparing it with previous cases where the High Court and the IPT resolved questions of law arising from similar problems. Using insights derived from systems theory, the article argues that the elucidatory function evolved as a containment measure in response to unexpected crises of control over classified information. The procedure resolves conflicts between secrecy, security, and the publicity required by the law itself.

Law and Policy on Mandatory Key Disclosure - A case Study of UK Regulation of Investigatory Powers Act 2000

Law and Policy on Mandatory Key Disclosure - A case Study of UK Regulation of Investigatory Powers Act 2000

Encrypting human rights: The intertwining of resistant voices in the UK state surveillance debate

The Snowden revelations in 2013 redrew the lines of debate surrounding surveillance, exposing the extent of state surveillance across multiple nations and triggering legislative reform in many. In the UK, this was in the form of the Investigatory Powers Act (2016). As a contribution to understanding resistance to expanding state surveillance activities, this article reveals the intertwining of diverse interests and voices which speak in opposition to UK state surveillance. Through a computational topic modelling-based mixed methods analysis of the submissions made to the draft Investigatory Powers Bill consultation, the article demonstrates the diversity and intersection of discourses within different actor groups, including civil society and the technology industry. We demonstrate that encryption is a key issue for these groups, and is additionally conflated with a human rights discourse. This serves to unite seemingly disparate interests by imbuing encryption with a responsibility for the protection of human rights, but also threatens to legitimate corporate interests and distract from their own data-driven activities of surveillance capitalism.

The Investigatory Powers Tribunal and Bulk Communications Data Acquisition: Lacking Respect for the Right to Privacy and Fundamental Rights?

In 2016, the Grand Chamber of the Court of Justice of the European Union in Tele2 and Watson ruled that blanket indiscriminate data retention was incompatible with European Union law. This ruling did not mean that the Court of Justice’s interpretation of the requirements of the Charter of Fundamental Rights was ‘limited only to this set of surveillance measures.’ Thus, a year later, the Investigatory Powers Tribunal in Privacy International v the Secretary of State for Foreign and Commonwealth Affairs and Others handed down a judgment regarding the lawfulness under EU law of the acquisition and use of Bulk Communications Data under s.94 of the Telecommunications Act 1984. The Investigatory Powers Tribunal subsequently referred this matter to the Court of Justice. This article’s primary focus is not with the preliminary reference itself, but the underlying flawed logic of the Investigatory Powers Tribunal’s reasoning with regards to privacy which subsequently weakens fundamental rights protection. Keywords: Privacy | Article 8 ECHR | Respect | Fundamental Rights

Is the incompatibility of UK data retention law with EU law really a victory?

AbstractThe Court of Justice of the European Union (ECJ) in 2014 ruled in Digital Rights Ireland that the Data Retention Directive was invalid for exceeding the limits of proportionality in light of Articles 7, 8 and 52(1) of the EU Charter of Fundamental Rights (Charter). Subsequently, preliminary references from the England and Wales Court of Appeal and the Swedish Administrative Court of Appeal sought clarification from the ECJ as to whether EU law permitted a general obligation to retain traffic data covering all persons, all means of electronic communication and all traffic data without any distinctions, limitations or exceptions for the purpose of combating crime. The ECJ in Tele2 and Watson ruled that in light of Articles 7, 8, 11 and 52(1) of the Charter, EU Member States were precluded from adopting national measures which provided general and indiscriminate retention of traffic and location data of all subscribers and registered users relating to all means of electronic communication. The ECJ also ruled that Member States were only permitted to adopt data retention measures for the purpose of fighting serious crime, and only when access to retained data was subject to prior review by a court or an independent administrative body.In 2018, the issue of the UK's data retention regime envisaged in Part 4 of the Investigatory Powers Act 2016 came before the England and Wales High Court. The High Court ruled that Part 4 was incompatible with EU law because access to retained communications data was not limited to the purpose of fighting serious crime, and it was not subject to prior review by a court or an independent administrative body. This judgment was regarded by the claimants, Liberty, as a ‘landmark victory for privacy rights’. However, this paper questions whether certain aspects of the High Court ruling are indeed a victory, by assessing its compatibility with EU law and the European Convention on Human Rights (ECHR).

Surveillance and Cyber Operations

This chapter examines the extent to and the basis on which human rights treaties apply extraterritorially to state surveillance and cyber operations. Consider only the following examples: (1) The targeted surveillance of a specific individual outside a state’s territory – as, for instance, with the operations allegedly conducted by the authorities of Saudi Arabia against Saudi dissidents abroad, one of which ultimately led to the plot to assassinate the journalist Jamal Khashoggi, or against the CEO of Amazon, Jeff Bezos, apparently in a rather crude attempt to blackmail him. (2) Mass surveillance or bulk collection programmes, such as those run by the US and UK signals intelligence agencies, that syphon the content of electronic communications of millions of people outside the state’s territory, or the metadata about these communications, in order to create searchable datasets in which persons of particular interest, e.g. suspected terrorists, can then be found. (3) Cyber operations that exfiltrate data on Covid-19 vaccine research, potentially affecting the development of vaccines that could save many thousands of lives. (4) Cyber operations that destroy or manipulate such data. (5) Cyber operations against hospitals or against critical infrastructure, which directly endanger many lives. (6) Cyber operations against media outlets, which disrupt their activities and inhibit their freedom of expression. (7) Online misinformation operations for various purposes, for example to manipulate the outcome of an election or to destroy public trust in state institutions during the pandemic. Common to all of these scenarios is that through entirely digital means states can violate a host of different human rights, from the rights to privacy and the freedom of expression, to the right to life and the right to health, of persons located outside their territories.The chapter will first proceed to briefly outline how the traditional models of extraterritorial application, the spatial and the personal, would apply to surveillance and cyber operations, examining a few old cases in which the issue was raised, if never properly resolved. It will then look at recent developments that are particularly important in the surveillance and cyber context, even if some of them are not directly apposite: a judgment of the UK Investigatory Powers Tribunal, the advisory opinion of the Inter-American Court of Human Rights on the environment and human rights, the Human Rights Committee’s General Comment No. 36 on the right to life, and the judgment of the Federal Constitutional Court of Germany on the applicability of the German Basic Law to surveillance operations abroad. The chapter will then finally offer some concluding thoughts on the direction towards which the legal position is likely to evolve, and should evolve, regarding the applicability of human rights law to extraterritorial surveillance and cyber operations.

Shining a Light on Policing of the Dark Web: An Analysis of UK Investigatory Powers

The dark web and the proliferation of criminals who have exploited its cryptographic protocols to commit crimes anonymously has created major challenges for law enforcement around the world. Traditional policing techniques have required amendment and new techniques have been developed to break the dark web’s use of encryption. As with all new technology, the law has been slow to catch up and police have historically needed to use legislation which was not designed with the available technology in mind. This paper discusses the tools and techniques police use to investigate and prosecute criminals operating on the dark web in the UK and the legal framework in which they are deployed. There are two specific areas which are examined in depth: the use of covert policing and hacking tools, known in the UK as equipment interference. The operation of these investigatory methods within the context of dark web investigations has not previously been considered in UK literature, although this has received greater analysis in the United States and Australia. The effectiveness of UK investigatory powers in the investigation of crimes committed on the dark web are analysed and recommendations are made in relation to both the law and the relevant Codes of Practice. The article concludes that while the UK has recently introduced legislation which adequately sets out the powers police can use during online covert operations and when hacking, the Codes of Practice need to specifically address the role these investigative tools play in dark web investigations. Highlighted as areas of particular concern are the risks of jurisdiction forum shopping and hacking overseas. Recommendations are made for reform of the Investigatory Powers Act 2016 to ensure clarity as to when equipment interference can be used to search equipment when the location of that equipment is unknown.

Anti-terrorism laws and data retention: war is over?

The Anti-terrorism, Crime and Security Act 2001 signals a determined response to the attacks of September 11th. One aspect involves the facilitation of the use of electronic surveillance in order to prevent, detect or prosecute the perpetrators of terrorism. The role of Part XI of the 2001 Act is to augment existing surveillance powers in the Regulation of Investigatory Powers Act 2000. This paper plots the relationships between those two statutes and also their relationship to data protection laws. Delays and difficulties in enforcement are noted and are related to a process of return to greater normality after an initial period of panic.

The Ouster of Parliamentary Sovereignty?

In R (on the application of Privacy International) v Investigatory Powers Tribunal [2019] UKSC 22; [2019] 2 WLR 1219, the claimant sought judicial review of a decision of the Investigatory Powers Tribunal (IPT) on the ground that the IPT had committed an error of law. But there was a preliminary stumbling block in the form of s 67(8) of the Regulation of Investigatory Powers Act 2000. By a majority, the Supreme Court held that this provision did not oust the power of judicial review of the IPT’s decisions on the ground of error of law. This note makes two points. First, the majority’s conclusion was right and the minority’s was not. Secondly, the decision of one of the majority judges, Lord Carnwath (with whom Lady Hale and Lord Kerr agreed), made several revolutionary remarks about ouster clauses generally that have attenuated the principle of parliamentary sovereignty.

Resisting Digital Surveillance Reform: The Arguments and Tactics of Communications Service Providers

Communications surveillance in the UK has been an increasingly contentious issue since the early 2000s. The Investigatory Powers Act 2016 is the result of a long series of attempts by the UK government to reform communications surveillance legislation. The consultations on this legislation—and on its precursor, the Draft Communications Data Bill 2012—offer unique insight into how such efforts generate resistance to surveillance. This article draws attention to the role of communications service providers (CSPs)—who are increasingly being responsibilised to collect and retain communications data—within a multi-actor network of resistance. It also identifies the reasons CSPs gave for resisting these proposed reforms. Content analysis of the consultation documents reveals three themes that were central to the CSPs’ arguments: technology, territory, and trust. The article concludes by considering the implications for understanding resistance to contemporary digital surveillance.

Digital Privacy and Article 12 of the Universal Declaration of Human Rights

AbstractThis article considers the impact of digital technologies on privacy and, specifically, the issues arising from metadata. It takes the 2016 Investigatory Powers Act as an exemplar and argues, by reference to European case law, that while data arising from new technologies undoubtedly fall within the scope of privacy protections, there are questions as to the level of protection awarded. Questions arise from how the nature and intensity of intrusion is understood against a backdrop of ‘dataveillance’, as well as the underlying issue of whether ex post controls—through oversight mechanisms—are sufficient to safeguard privacy.

Briefly Noted

On May 15, 2019, the U.K. Supreme Court ruled in R (Privacy International) v. Investigatory Powers Tribunal and others that that the extent of the U.K. government's power to hack into internet services is subject to judicial review. The case concerned whether the British Parliament was sufficiently clear in drafting an “ouster” clause in an attempt to keep the decisions of the Investigatory Powers Tribunal (IPT), which oversees challenges to the U.K. intelligence services, from review by other courts. It was instigated in the aftermath of Edward Snowden's disclosures of the U.K. government's bulk hacking techniques when Privacy International challenged them in the IPT. After the IPT sided with the government, Privacy International sought judicial review, and ultimately the Supreme Court determined that the language of the ouster clause was insufficiently clear, and consequently, the IPT is now subject to oversight by U.K. courts.

UK: Judicial Review of Decisions of the Investigatory Powers Tribunal

UK: Judicial Review of Decisions of the Investigatory Powers Tribunal