B e f o r e :
MR ROBERT SEABROOK QC
MRS JUSTICE CARR
THE HON CHRISTOPHER GARDNER QC
HIS HONOUR GEOFFREY RIVLIN QC
| Liberty (The National Council of Civil Liberties)
|- and -
|The Government Communications Headquarters & Others
|- and -
|- and -
|The Secretary of State for the Foreign and Commonwealth Office & Others
|- and -
American Civil Liberties Union & Others
|- and -
|The Government Communications Headquarters & Others
|- and -
Amnesty International Limited
|- and -
|The Security Service & Others
|- and -
|Bytes For All
|- and -
|The Secretary of State for Foreign and Commonwealth Affairs & Others
Mr Dan Squires and Mr Ben Jaffey (instructed by Bhatt Murphy Solicitors) for the Second and Fifth Claimants
Ms Kirsty Brimelow QC and Mr Jude Bunting (instructed by Amnesty International Ltd) for the Fourth Claimant
Mr James Eadie QC, Mr Ben Hooper and Mr Julian Milford (instructed by the Treasury Solicitor ) for All Respondents
Mr Martin Chamberlain QC and Mr David Manknell (instructed by the Treasury Solicitor) as Counsel to the Tribunal
Hearing dates: 14, 15, 16, 17 & 18 July, 31 October and 5 December 2014
Crown Copyright ©
Mr Justice Burton (President) :
i) The alleged conduct itself is not admitted by the Respondents. It falls to be considered as a result of allegations made by Mr Edward Snowden, a former contractor for the National Security Agency ("NSA") of the United States, by whom a very substantial quantity of documentation has been leaked and much put into the public domain. This has resulted in the Claimants asserting their belief that investigation of the Respondents would show that the Claimants' privacy has been unlawfully invaded. Hence the Tribunal's detailed scrutiny is at this stage carried out upon the basis of assuming the relevant allegations to be derived from Mr Snowden's leaks to be true. The set of assumed facts is set out below, and the arguments of law have proceeded on the basis of those assumed facts, which have enabled the main hearing to take place entirely in public without putting at risk any national security interest. Save for the existence of two programmes in the United States called Prism and Upstream, which have been publicly admitted in the United States by the NSA, and for confirmation that GCHQ has obtained information from the United States Government that the United States Government obtained via Prism, none of the matters the subject of the assumed facts are admitted by the Respondents (i.e. they fall within the Neither Confirm Nor Deny ("NCND") policy to which we shall refer below), and are only assumed for the purposes of this hearing. Some further evidence has been put in by both Claimants and Respondents by way of background, which has not been subject to cross-examination, and which did not detract from the NCND policy nor the manner in which the hearing has been conducted.
ii) As for the Claimants, they have not needed to prove any of the activities, which are assumed to have occurred, and by virtue of which interference with their privacy has been assumed. This is consistent with the normal practice of this Tribunal, which enables claimants to bring claims without having the kind of arguable case which they would need to pursue a case in the High Court, and also with the jurisprudence of the European Court of Human Rights ("ECtHR"), which permits and encourages such hypothetical cases on the basis that if there has been an unlawful interference a claimant may have been a victim. Thus locus is established so as to permit "general challenges to the relevant legislative regime" (Kennedy v United Kingdom (2011) 52 EHRR 4 at paragraph 119) by those who are "unable to demonstrate that the impugned measures had actually been applied to them" (Weber and Saravia v Germany (2008) 46 EHRR SE5 at paragraph 78): see also Liberty v United Kingdom (2009) 48 EHRR 1 at paragraph 57.
"15.1 A Special Advocate is appointed (normally, but not necessarily, pursuant to statute) to represent the interests of a party at hearings from which that party is excluded. A Special Advocate is required to be partisan. He or she makes such submissions (if any) as he considers will advance the interests of the excluded party. If the Special Advocate reaches the view that it would not advance the interests of the excluded party to make submissions at all (as has happened in a few cases), then the proper course is to decline to make submissions at all, even though this leaves the tribunal without assistance.
15.2 Counsel to the Tribunal performs a different function, akin to that of amicus curiae. His or her function is to assist the tribunal in whatever way the tribunal directs. Sometimes (eg in relation to issues on which all parties are represented), the Tribunal will not specify from what perspective submissions are to be made. In these circumstances, counsel will make submissions according to his or her own analysis of the relevant legal or factual issues, seeking to give particular emphasis to points not fully developed by the parties. At other times (in particular where one or more interests are not represented), the Tribunal may invite its counsel to make submissions from a particular perspective (normally the perspective of the party or parties whose interests are not otherwise represented)."
"19.1 The role of counsel to the Tribunal is in principle distinct from that of Special Advocate. The function of the former is to assist the Tribunal by performing such functions as he or she is directed by the Tribunal to perform. The precise roles played by counsel to the Tribunal may therefore vary depending on the circumstances.
19.2 However. in the present circumstances, there is a broad measure of agreement between the Claimants and the Respondents that counsel to the Tribunal can best assist the Tribunal by performing the following roles: (i) identifying documents, parts of documents or gists that ought properly to be disclosed;. (ii) making such submissions to the Tribunal in favour of disclosure as are in the interests of the Claimants and open justice; and (iii) ensuring that all the relevant arguments on the facts and the law are put before the Tribunal. In relation to (iii), the Tribunal will expect its counsel to make submissions from the perspective of the Claimants' interests (since the Respondents will be able to make their own submissions). If the Tribunal decides to receive closed oral evidence from one or more of the Respondent's witnesses, it may also direct its counsel to cross-examine them. In practice, the roles performed by counsel to the Tribunal at this stage of the current proceedings will be similar to those performed by a Special Advocate in closed material proceedings.
19.3 If, at the closed hearing, the Tribunal concludes that the closed material relied upon by the Respondents could not be properly be made open, there will be no need for any more than one closed hearing: counsel to the Tribunal will be able to make submissions on the closed material. If, on the other hand, it concludes that the closed material relied upon by the Respondents could be disclosed to the parties. it will invite the Respondents to consent to such disclosure. If the Respondents agree, it will afford the parties an opportunity to make open submissions on the disclosed material. If the Respondents decline, it will give directions for [a further] open hearing . . . "
The Tribunal considered and conclude that this was the correct analysis and approach. As will be seen, in the context of a closed hearing there were matters derived from the evidence in the closed hearing which the Respondents were prepared to consent to disclose, and there were no matters which the Tribunal considered should be disclosed which the Respondents declined to disclose. Written submissions by the parties and a further closed and open hearing then followed, and some further matters were disclosed voluntarily by the Respondents. Such open disclosures appear in paragraphs 46 and 47 and 126 below ("the Disclosures").
"1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."
Liberty, Privacy and Amnesty International also rely upon Article 10 "Freedom of Expression", on the basis that, as campaigning organisations, they are also entitled to the protection of that Article which primarily relates to the freedom of the press. It is common ground that, subject to one possible exception to which we shall return later, no different questions fall to be decided by reference to Article 10 than are raised by Article 8, and we shall therefore leave aside the matter of Article 10, which underlies Agreed Issues (ii), (iii), (vi) and (vii).
"5. Secrecy is essential to the necessarily covert work and operational effectiveness of the Intelligence Services, whose primary function is to protect national security. See e.g. Attorney General v. Guardian Newspapers Ltd (No.2)  1 AC 109, per Lord Griffiths at 269F.
6. As a result, the mere fact that the Intelligence Services are carrying out an investigation or operation in relation to, say, a terrorist group, or hold information on a suspected terrorist, will itself be sensitive. If, for example, a hostile individual or group were to become aware that they were the subject of interest by the Intelligence Services, they could not only take steps to thwart any (covert) investigation or operation but also attempt to discover, and perhaps publicly reveal, the methods used by the Intelligence Services or the identities of the officers or agents involved. Conversely, if a hostile individual or group were to become aware that they were not the subject of Intelligence Service interest, they would then know that they could engage or continue to engage in their undesirable activities with increased vigour and increased confidence that they will not be detected.
7. In addition, an appropriate degree of secrecy must be maintained as regards the intelligence-gathering capabilities and techniques of the Intelligence Services (and any gaps in or limits to those capabilities and techniques). If hostile individuals or groups acquire detailed information on such matters then they will be able to adapt their conduct to avoid, or at least minimise, the risk that the Intelligence Services will be able successfully to deploy those capabilities and techniques against them.
8. It has thus been the policy of successive UK Governments to neither confirm nor deny whether they are monitoring the activities of a particular group or individual, or hold information on a particular group or individual, or have had contact with a particular individual. Similarly, the long-standing policy of the UK Government is to neither confirm nor deny the truth of claims about the operational activities of the Intelligence Services, including their intelligence-gathering capabilities and techniques.
9. Further, the "neither confirm nor deny" principle would be rendered nugatory, and national security thereby seriously damaged, if every time that sensitive information were disclosed without authority (i.e. "leaked"), or it was alleged that there had been such unauthorised disclosure of such information, the UK Government were then obliged to confirm or deny the veracity of the information in question.
10. It has thus been the policy of successive Governments to adopt a neither confirm nor deny stance in relation to any information derived from any alleged leak regarding the activities or operations of the Intelligence Services insofar as that information has not been separately confirmed by an official statement by the UK Government. That long-standing policy is applied in this Open Response."
Because this hearing has been held on the basis of agreed assumed facts, it has not been necessary to address this policy or its consequences.
THE PRISM ISSUE
"1. The US Government's "Prism" system collects foreign intelligence information from electronic communication service providers under US court supervision. The US Government's "upstream collection" programme obtains internet communications under US court supervision as they transit the internet.
2. The Claimants' communications and/or communications data (i) might in principle have been obtained by the US Government via Prism (and/or, on the Claimants' case, pursuant to the "upstream collection" programme) and (ii) might in principle have thereafter been obtained by the Intelligence Services from the US Government. Thereafter, the Claimants' communications and/or communications data might in principle have been retained, used or disclosed by the Intelligence Services (a) pursuant to a specific request from the intelligence services and/or (b) not pursuant to a specific request from the intelligence services."
The issue itself is formulated as follows:
"In the light of factual premises (1) and (2) above, does the statutory regime as set out in paragraphs 36-76 of the Respondents' Open Response to the Claims brought by Liberty and Privacy satisfy the Art. 8(2) "in accordance with the law" requirement?"
i) The NSA has a lawful basis for targeted interception pursuant to s.702 of the Foreign Intelligence Surveillance Act 1978 (as amended) ("FISA"), and to Executive Order 12333, pursuant to which Prism and "Upstream" are lawfully sanctioned for "the targeting of persons reasonably believed to be located outside the United States to acquire foreign intelligence information". According to the NSA's 'Mission Statement' of 9 August 2013 "the collection under . . . s.702 is the most significant tool in the NSA collection arsenal for the detection, identification and disruption of terrorist threats to the U.S. and round the world": and according to the NSA's Director of Civil Liberties and Privacy Office Report of April 18, 2014 "NSA is subject to rigorous internal compliance and external oversight". For the purpose of this hearing the information assumed to be supplied to the Respondents by the NSA is assumed to have been lawfully obtained.
ii) The United States is the principal hub of the world's telecommunications system, and a very substantial quantity of the world's communications pass through the United States: thus for example an email sent by a sender in the UK to another email address in the UK may be routed via the United States.
iii) As set out in paragraph 11 of the Respondents' open Response:
"11. In order to pursue their statutory objectives, the Intelligence Services need to share intelligence with foreign Governments, including the US Government (with which the Intelligence Services have particularly close ties). Intelligence that foreign governments share with the Intelligence Services (on a strictly confidential basis) represents a significant proportion of the Intelligence Services' total store of intelligence on terrorists, organised criminals and others seeking to harm national security."
A British-US Communication Intelligence Agreement of 5 March 1946 which was marked "Top Secret", and remained so until its transfer to the National Archive in 2010, governs the arrangements between the British and United States authorities in relation to the exchange of intelligence information relating to "foreign" communications, defined by reference to countries other than the United States, the United Kingdom and the Commonwealth. In his witness statement Mr Charles Farr, the Director-General of the Office for Security and Counter Terrorism ("OSCT") at the Home Office since June 2007, says, after describing the threat from international terrorism, and quoting from the National Crime Agency's recent Strategic Assessment, that "all of the most serious crime threats are transnational":
"20. . . It is highly unlikely that any government will be able to obtain all the intelligence it needs through its own activities. It is therefore vital for the UK Government to be able to obtain intelligence from foreign governments both to improve its understanding of the threats that the UK faces, and to gain the knowledge needed to counter those threats. . . . [He refers to what is said in paragraph 11 of the open Response quoted above, and continues]. This store of intelligence forms a critical resource for the Government in seeking to take preventative action to counter threats, and save lives."
"(i) A declaration that the Secretary of State for the Foreign Office and/or the Secretary of State for the Home Office have unlawfully failed to ensure that there is in place a regime which complied with Article 8 and 10 ECHR governing the soliciting, receiving, storing and transmitting by UK authorities of private communications of individuals located in the UK which have been obtained by US authorities.
(ii) A declaration that the soliciting, receipt, storage and transmission of such information by the Security Service, the Secret Intelligence Service and/or GCHQ is unlawful.
(iii) An order that the Security Service, the Secret Intelligence Service and/or GCHQ will not solicit, receive, store or transmit such information unless and until such activities are governed by a legal regime which satisfies ECHR Art 8 and 10 and will destroy any material unlawfully obtained."
i) S.1 of the Security Service Act 1989 ("SSA") provides in relevant part:
"(2) The function of [MI5] shall be the protection of national security and, in particular, its protection against threats from espionage, terrorism and sabotage, from the activities of agents of foreign powers and from actions intended to overthrow or undermine parliamentary democracy by political, industrial or violent means.
(3) It shall also be the function of [MI5] to safeguard the economic well-being of the United Kingdom against threats posed by the actions or intentions of persons outside the British Islands.
(4) It shall also be the function of [MI5] to act in support of the activities of police forces, the National Crime Agency and other law enforcement agencies in the prevention and detection of serious crime."
ii) The operations of MI5 are under the control of the Director-General, who is appointed by the Secretary of State (s. 2(1) of SSA). By s. 2(2)(a), it is the duty of the Director-General to ensure:
". . . that there are arrangements for securing that no information is obtained by the Service except so far as necessary for the proper discharge of its functions or disclosed by it except so far as necessary for that purpose or for the purpose of the prevention or detection of serious crime or for the purpose of any criminal proceedings. . ."
iii) Subject to s. 1(2) of the Intelligence Services Act 1994 ("ISA"), the functions of MI6 are, by s. 1(1):
"(a) to obtain and provide information relating to the actions or intentions of persons outside the British Islands; and
(b) to perform other tasks relating to the actions or intentions of such persons."
iv) By s. 1(2) of ISA:
"The functions of [MI6] shall be exercisable only—
(a) in the interests of national security, with particular reference to the defence and foreign policies of Her Majesty's Government in the United Kingdom; or
(b) in the interests of the economic well-being of the United Kingdom; or
(c) in support of the prevention or detection of serious crime."
v) The operations of MI6 are under the control of the Chief of the Intelligence Service, who is appointed by the Secretary of State (s. 2(1) of ISA). By s. 2(2)(a), it is the duty of the Chief of the Intelligence Service to ensure:
". . . that there are arrangements for securing that no information is obtained by [MI6] except so far as necessary for the proper discharge of its functions and that no information is disclosed by it except so far as necessary—
(i) for that purpose;
(ii) in the interests of national security;
(iii) for the purpose of the prevention or detection of serious crime; or
(iv) for the purpose of any criminal proceedings. . ."
vi) By s. 3(1)(a) of ISA, the functions of GCHQ include the following:
". . . to monitor or interfere with electromagnetic, acoustic and other emissions and any equipment producing such emissions and to obtain and provide information derived from or related to such emissions or equipment and from encrypted material . . ."
vii) By s. 3(2) of ISA, these functions are only exercisable:
"(a) in the interests of national security, with particular reference to the defence and foreign policies of Her Majesty's Government in the United Kingdom; or
(b) in the interests of the economic well-being of the United Kingdom in relation to the actions or intentions of persons outside the British Islands; or
(c) in support of the prevention or detection of serious crime."
viii) GCHQ's operations are under the control of a Director, who is appointed by the Secretary of State (s. 4(1)). By s. 4(2)(a), it is the duty of the Director to ensure:
". . . that there are arrangements for securing that no information is obtained by GCHQ except so far as necessary for the proper discharge of its functions and that no information is disclosed by it except so far as necessary for that purpose or for the purpose of any criminal proceedings . . ."
ix) Thus, specific statutory limits are imposed on the information that each of the Intelligence Services can obtain, and on the information that each can disclose. Further, these statutory limits do not simply apply to the obtaining of information from other persons in the United Kingdom or to the disclosing of information to such persons: they apply equally to obtaining information from or disclosing information to persons abroad, including foreign intelligence agencies. In addition, the term "information" is a very broad one, and is capable of covering e.g. communications and communications data (otherwise referred to as 'metadata' or 'traffic data', to which we refer in paragraph 64(i) below) that a foreign intelligence agency may have obtained and passed to the Intelligence Services.
x) By s. 19(2) of the Counter-Terrorism Act 2008 ("CTA"):
"Information obtained by any of the intelligence services in connection with the exercise of any of its functions may be used by that service in connection with the exercise of any of its other functions."
xi) By s.19(3) and (4) of CTA it is provided that information obtained by, respectively, MI5 and MI6 for the purposes of any of its functions "may be disclosed by it – (a) for the purpose of the proper discharge of its functions (b) in the interests of national security (c) for the purpose of the prevention or detection of serious crime, or (d) for the purpose of any criminal proceedings": and there is a similar provision, but limited to (a) and (d), relating to GCHQ in s.19(5).
i) The Data Protection Act 1998 ("DPA"). Each of the Intelligence Services is a "data controller", and is required by s.4(4) of the DPA to comply with the data protection principles in Part 1 of Schedule 1 to the DPA, subject to exemption by ministerial certificate, and are in any event not exempted from the obligation to comply with the fifth and seventh data protection principles, which provide:
"(5) Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes . . .
(7) Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."
ii) A member of the Intelligence Services commits an offence under s.1(1) of the Official Secrets Act 1989 ("OSA") if "without lawful authority he discloses any information, document or other article relating to security or intelligence which is, or has been, in his possession by virtue of his position as a member of any of those services". This disclosure can only be made with lawful authority if it is made in accordance with his official duty by virtue of s.7(1) of the OSA. Thus, Mr Eadie points out that disclosure of information by a member of the Intelligence Services in material breach of the relevant "arrangements" made under s.2(2)(a) of SSA or ISA or s.4(2)(a) of ISA would be a criminal offence, and there are other criminal obligations in relation to disclosure under the OSA.
iii) The Respondents are also bound by their obligations under s.6(1) of the Human Rights Act 1998, which, in relation to breach of Articles 8 and 10 of the Convention, is another positive obligation which can be enforced in a court, or in this case, in this Tribunal.
"5. Our investigation has included scrutiny of GCHQ's access to the content of communications, the legal framework which governs that access, and the arrangements GCHQ has with its overseas counterparts for sharing such information. We have received substantive reports from GCHQ, including:
- a list of counter-terrorist operations for which GCHQ was able to obtain intelligence from the US in any relevant area;
- a list of all the individuals who were subject to monitoring via such arrangements who were either believed to be in the UK or were identified as UK nationals;
- a list of every 'selector' (such as an email address) for these individuals on which the intelligence was requested;
- a list of the warrants and internal authorisations that were in place for each of these individuals being targeted;
- a number (as selected by us) of the intelligence reports that were produced as a result of this activity; and
- the formal agreements that regulated access to this material.
We discussed the programme with the NSA and our Congressional counterparts during our recent visit to the United States. We have also taken oral evidence from the Director of GCHQ and questioned him in detail.
- It has been alleged that GCHQ circumvented UK law by using the NSA's PRISM programme to access the content of private communications. From the evidence we have seen, we have concluded that this is unfounded.
- We have reviewed the reports that GCHQ produced on the basis of intelligence sought from the US, and we are satisfied that they conformed with GCHQ's statutory duties. The legal authority for this is contained in the Intelligence Services Act 1994.
- Further, in each case where GCHQ sought information from the US, a warrant for interception, signed by a Minister, was already in place, in accordance with the legal safeguards contained in the Regulation of Investigatory Powers Act 2000.
6. Although we have concluded that GCHQ has not circumvented or attempted to circumvent UK law, it is proper to consider further whether the current statutory framework governing access to private communications remains adequate.
7. In some areas the legislation is expressed in general terms and more detailed policies and procedures have, rightly, been put in place around this work by GCHQ in order to ensure compliance with their statutory obligations under the Human Rights Act 1998. We are therefore examining the complex interaction between the Intelligence Services Act, the Human Rights Act and the Regulation of Investigatory Powers Act, and the policies and procedures that underpin them, further. We note that the Interception of Communications Commissioner is also considering this issue."
"8. Do British intelligence agencies receive from US agencies intercept material about British citizens which could not lawfully be acquired by intercept in the UK and vice versa and thereby circumvent domestic oversight regimes?"
He set out his views (at paragraph 6.8.1-5) by reference to the assumption, which has also been made for the purposes of the case before us (paragraph 15(i) above) that the intercept material in question has been lawfully acquired by the United States Agencies. In the light of his own investigations, as there referred to, he answered his question in the negative. He concluded as follows:
"6.8.6 . . . information lawfully obtained by interception abroad is not necessarily available by interception to an interception agency here. In many cases it will not be available. If it is to be lawfully provided from abroad, it is sometimes appropriate for the interception agencies to apply explicitly by analogy the RIPA 2000 Part I principles of necessity and proportionality to its receipt here even though RIPA 2000 Part I does not strictly apply, because the interception did not take place in the UK by an UK agency. This is responsibly done in a number of appropriate circumstances by various of the agencies, and I am asked to review the consequent arrangements, although this may not be within my statutory remit."
"27. [The descriptions he gives of sharing of intelligence with foreign states] do not just apply to intelligence obtained through interception. These paragraphs apply to all forms of intelligence, including intelligence (i) derived from covert human intelligence sources (as they would be termed under RIPA), (ii) derived from or constituting records of audio and/or visual surveillance and (iii) obtained or derived from covert property searches.
28. I am advised that a potential issue in these proceedings is whether the sharing of intelligence in the form of (or that is derived from) communications and communications data between the UK and foreign governments should in some sense be separately regulated.
29. From the point of view of the privacy interests of those individuals who are subject to investigative measures, I do not consider that a workable distinction can be drawn between such intelligence and the other three forms of intelligence referred to in paragraph 27 above. In particular, I do not consider that intelligence in the form of (or that is derived from) communications and communications data is in some general sense more personal or private than those other forms of intelligence. For instance, if an eavesdropping device is covertly installed in a target's home it may record conversations between family members that are more intimate and personal than those that might be recorded if the target's telephone were to be intercepted (and this example becomes even clearer if, for instance, the telephone in question is only used by the target to contact his criminal associates). To give a further example, a covert human intelligence source may be able to provide information about a target as a result of his or her friendship (or more intimate relationship) with the target that is more private than information that could be obtained from, for instance, intercepting the target's emails.
30. Nor can some general distinction be drawn between intelligence from interception and the other forms of covert intelligence identified in paragraph 27 above in terms of how likely it is that the individual targets in question will in practice be able to predict or foresee the possibility of the relevant investigative measures being taken against them. All forms of covert intelligence-gathering necessarily seek to benefit from a lack of awareness on the part of the target in order to maximise the chance of obtaining valuable intelligence. Interception is, in this regard, no different from, for instance, covert surveillance or the use of covert human intelligence sources."
i) material which on its face derives from intercept, provided unsolicited;
ii) communications which the Respondents have requested the NSA to intercept, or to make available to them as intercept, because they are themselves unable to do so ('solicited intercept');
iii) all other information or communications obtained from the NSA by way of shared information, as discussed by Mr Farr.
"In this section "copy", in relation to intercepted material or related communications data, means any of the following (whether or not in documentary form) –
(a) any copy, extract or summary of the material or data which identifies itself as the product of an interception."
The Claimants are not addressing any information which does not 'identify itself as the product of an interception', and he refers to this subsection as indicating that this is a feasible differentiation, recognised as such (for other purposes) in RIPA.
"In particular, not least given the safeguards and oversight mechanisms that Parliament saw fit to impose in the case of interception pursuant to a RIPA interception warrant . . . and in the light of the well established Padfield principle, it is accepted that it would as a matter of domestic public law be unlawful for any of the Intelligence Services to deliberately circumvent those safeguards and mechanisms (and attempt to avoid the need to apply for an interception warrant under RIPA) by asking a foreign intelligence agency to intercept certain specified communications and disclose them. That is not to say that there will not be circumstances where there are legitimate reasons to ask a foreign intelligence agency to intercept particular communications, for example, where it is not technically feasible for the Intelligence Services themselves to undertake the interception in question."
The Claimants do not suggest that such a request to the NSA for solicited intercept would fall foul of the Padfield principle, or (in answer to the point raised by the Tribunal) would render the NSA an agent for the Respondents. However they submit that, if that occurs, then the Respondents will know that what is subsequently produced is the product of intercept.
"Whether it is solicited, or whether it is not solicited, dealing with the product of intercept is, at some level or other, an interference with Article 8 which needs some legal backing, and there ought to be, at however high a level, a published procedure in relation to it."
"The Court reiterates that the expression "in accordance with the law" within the meaning of Article 8(2) requires, firstly, that the impugned measure should have some basis in domestic law; it also refers to the quality of the law in question, requiring that it should be accessible to the person concerned, who must, moreover be able to foresee its consequences for him, and compatible with the rule of law."
The Court then proceeded to set out in relation to an interception case the following propositions, which have become known as the Weber requirements: we have numbered these from 1-6 for convenience.
"95. In its case-law on secret measures of surveillance, the Court has developed the following minimum safeguards that should be set out in statute law in order to avoid abuses of power: (1) the nature of the offences which may give rise to an interception order; (2) a definition of the categories of people liable to have their telephones tapped; (3) a limit on the duration of telephone tapping; (4) the procedure to be followed for examining, using and storing the data obtained; (5) the precautions to be taken when communicating the data to other parties; and (6) the circumstances in which recordings may or must be erased or the tapes destroyed."
"While the Court is not barred from gaining inspiration from these principles, it finds that these rather strict standards, set up and applied in the specific context of surveillance of telecommunications . . . are not applicable as such to cases such as the present one, concerning surveillance via GPS of movements in public places, and thus a measure which must be considered to interfere less with the private life of the person concerned than the interception of his or her telephone conversations . . . It will therefore apply the more general principles on adequate protection against arbitrary interference with Article 8 rights as summarised above."
Mr Eadie submitted (as referred to in paragraph 25 above) that this is simply a species of intelligence gathering, not to be equated with the position where the UK itself intercepts. Mr Ryder contended that this ignored the fact that the product of the intercept would then be stored, used and analysed in the same way as intercepted material obtained by the Respondent's themselves – although of course that would also apply to the information within the Claimants' third category referred to in paragraph 28(iii) above.
i) there must not be an unfettered discretion for executive action. There must be controls on the arbitrariness of that action.
ii) the nature of the rules must be clear and the ambit of them must be in the public domain so far as possible, an "adequate indication" given (Malone v UK (1985) 7 EHRR 14 at paragraph 67), so that the existence of interference with privacy may in general terms be foreseeable.
A clear reiteration of these principles is contained in the judgment of the Court in Bykov v Russia 4378/02,  ECHR 441, 21 January 2009:
"76. The Court reiterates that the phrase "in accordance with the law" not only requires compliance with domestic law but also relates to the quality of that law, requiring it to be compatible with the rule of law. In the context of covert surveillance by public authorities, in this instance the police, domestic law must provide protection against arbitrary interference with an individual's right under Article 8. Moreover, the law must be sufficiently clear in its terms to give individuals an adequate indication as to the circumstances in which and the conditions on which public authorities are entitled to resort to such covert measures . . .
78. . . . In particular, in order to comply with the requirement of the "quality of the law", a law which confers discretion must indicate the scope of that discretion, although the detailed procedures and conditions to be observed do not necessarily have to be incorporated in rules of substantive law. The degree of precision required of the "law" in this connection will depend upon the particular subject-matter. Since the implementation in practice of measures of secret surveillance of communications is not open to scrutiny by the individuals concerned or the public at large, it would be contrary to the rule of law for the legal discretion granted to the executive – or to a judge – to be expressed in terms of an unfettered power. Consequently, the law must indicate the scope of any such discretion conferred on the competent authorities and the manner of its exercise with sufficient clarity to give the individual adequate protection against arbitrary interference."
"However, the requirement of foreseeability in the special context of secret controls of staff in sectors affecting national security cannot be the same as in many other fields. Thus, it cannot mean that an individual should be enabled to foresee precisely what checks will be made in his regard by the Swedish special police service in its efforts to protect national security. Nevertheless, in a system applicable to citizens generally, as under the Personnel Control Ordinance, the law has to be sufficiently clear in its terms to give them an adequate indication as to the circumstances in which and the conditions on which the public authorities are empowered to resort to this kind of secret and potentially dangerous interference with private life.
In assessing whether the criterion of foreseeability is satisfied, account may be taken also of instructions or administrative practices which do not have the status of substantive law, in so far as those concerned are made sufficiently aware of their contents.
In addition, where the implementation of the law consists of secret measures, not open to scrutiny by the individuals concerned or by the public at large, the law itself, as opposed to the accompanying administrative practice, must indicate the scope of any discretion conferred on the competent authority with sufficient clarity, having regard to the legitimate aim of the measure in question, to give the individual adequate protection against arbitrary interference."
"The Commission notes that the exercise of the Security Service's functions [is] subject to express limitations and to the supervision of a tribunal and commissioner appointed pursuant to the 1989 Act. The guidelines referred to in section 2(3) of the Act relate only to the administrative implementation of preceding provisions, which expressly limit the use of information by the Service to that necessary to fulfil its functions.
. . .
In light of the above, the Commission considers that in the present case the law is formulated with sufficient precision to enable the applicant to anticipate the application of vetting procedures and to the likely nature of the involvement of the Security Service and police Special Branches with regard to the collection, recording and release of information relating to himself."
i) Appropriate rules or arrangements exist and are publicly known and confirmed to exist, with their content sufficiently signposted, such as to give an adequate indication of it (as per Malone: see paragraph 37(ii) above).
ii) They are subject to proper oversight.
"51. The Intelligence Services take their legal duties under the regime very seriously. The statutory framework is underpinned by detailed internal guidance (including the "arrangements" to which reference is made in section 2 of the Security Service Act 1989 and sections 2 and 4 of the Intelligence Services Act 1994), and by a culture of compliance.
52. This culture of compliance is reinforced by the provision of mandatory training to staff within the Intelligence Services regarding the legal and policy framework within which they operate. The training includes clear instructions on the need for strict adherence to the law and to internal guidance.
. . .
55. The full details of the arrangements between the Intelligence Services and the UK's foreign intelligence partners for the sharing of intelligence, and the internal guidance of the Intelligence Services for the handling and use of intelligence obtained as a result, are (and have always been) kept confidential. I am satisfied that they cannot safely be published without undermining the interests of national security and the prevention and detection of serious crime. There are four main reasons for this."
Mr Eadie on instructions stated in open hearing that such arrangements also included provision for destruction. Mr Farr also referred in paragraph 74 of his witness statement to what the ISC had said in paragraph 7 of its Statement, set out in paragraph 23 above, as to GCHQ having put in place policies and procedures to underpin the statutory provisions.
"(a) the need to secure that matters which are the subject of proceedings, complaints or references brought before or made to the Tribunal are properly heard and considered; and
(b) the need to secure that information is not disclosed to an extent, or in a manner, that is contrary to the public interest or prejudicial to national security, the prevention or detection of serious crime, the economic well-being of the United Kingdom or the continued discharge of the functions of any of the intelligence services."
Rules 6 and 9 permitted and facilitated the following of the procedure set out in paragraph 10 above (particularly as set out in paragraph 19.3 there cited).
i) It can hold this hearing and have the benefit of inter partes argument at which forceful legal submissions can be made on behalf of Claimants who seek to criticise the system. This is and was not available to the ISC or to the Commissioner. Ms Brimelow for Amnesty highlighted a number of matters which she submits were either missed or not dealt with by the ISC: all of those matters have now been addressed before us in depth.
ii) It can hold a public hearing on assumed facts, as it has done in this case, i.e. facts which are asserted by the Claimants, and would otherwise be the subject of NCND, without the Claimants needing to present an arguable case that they are the subject of interference (see paragraph 4(ii) above).
iii) It has access to all secret information, and can adjourn into closed hearing in order to assess whether the arrangements (a) do indeed exist as asserted by Mr Farr, (b) are adequate to do the job of giving the individual "adequate protection against arbitrary interference".
iv) It has, and takes, the opportunity, with the benefit of full argument, to probe fully whether matters disclosed to it in closed hearing, pursuant to the Respondents' obligation to do so pursuant to s.68(6) of RIPA, can and should be disclosed in open and thereby publicised.
"1. A request may only be made by the Intelligence Services to the government of a country or territory outside the United Kingdom for unanalysed intercepted communications (and associated communications data), otherwise than in accordance with an international mutual legal assistance agreement, if either:
a. a relevant interception warrant under the Regulation of Investigatory Powers Act 2000 ("RIPA") has already been issued by the Secretary of State, the assistance of the foreign government is necessary to obtain the communications at issue because they cannot be obtained under the relevant RIPA interception warrant and it is necessary and proportionate for the Intelligence Services to obtain those communications; or
b. making the request for the communications at issue in the absence of a relevant RIPA interception warrant does not amount to a deliberate circumvention of RIPA or otherwise contravene the principle established in Padfield v. Minister of Agriculture, Fisheries and Food  AC 997 (for example, because it is not technically feasible to obtain the communications via RIPA interception), and it is necessary and proportionate for the Intelligence Services to obtain those communications. In these circumstances, the question whether the request should be made would be considered and decided upon by the Secretary of State personally.
For these purposes a "relevant RIPA interception warrant" means either (i) a s8(1) warrant in relation to the target at issue; (ii) a s8(4) warrant and an accompanying certificate which includes one or more "descriptions of intercepted material" (within the meaning of s8(4)(b) of RIPA) covering the target's communications, together with an appropriate s16(3) modification (for individuals known to be within the British Islands); or (iii) a s8(4) warrant and accompanying certificate which includes one or more "descriptions of intercepted material" covering the target's communications (for other individuals). The reference to a "warrant for interception, signed by a Minister" being "already in place" in the ISC's Statement of 17 July 2013 should be understood in these terms. (Given sub-paragraph (b), and as previously submitted in open, a RIPA interception warrant is not as a matter of law required in all cases in which unanalysed intercepted communications might be sought from a foreign government.)
2. Where the Intelligence Services receive intercepted communications content or communications data from the government of a country or territory outside the United Kingdom, irrespective whether it is / they are solicited or unsolicited, whether the content is analysed or unanalysed, or whether or not the communications data are associated with the content of communications, the communications content and data are, pursuant to internal "arrangements", subject to the same internal rules and safeguards as the same categories of content or data, when they are obtained directly by the Intelligence Services as a result of interception under RIPA."
We considered that this Disclosure could be made open, and it was so made with the consent of the Respondents.
(1) "The US Government has publicly acknowledged that the Prism system and Upstream programme, undertaken in accordance with Section 702 of the Foreign Intelligence Surveillance Act, permit the acquisition of communications to, from, or about specific tasked selectors associated with non-US persons who are reasonably believed to be located outside the United States in order to acquire foreign intelligence information. To the extent that the Intelligence Services are permitted by the US Government to make requests for material obtained under the Prism system (and/or on the Claimants' case, pursuant to the Upstream programme), those requests may only be made for unanalysed intercepted communications (and associated communications data) acquired in this way."
(2) As to the request referred to in paragraph 1(b) of the Disclosure above (a "1(b) Request"),
"Any such request would only be made in exceptional circumstances, and has not occurred as at the date of this statement."
(i) They relied upon and repeated their arguments that the Tribunal is not entitled to look below the waterline to examine the arrangements and safeguards, even if the Tribunal is satisfied that there is adequate indication of them above the waterline and even for the purpose of assessing their adequacy.
(ii) They submitted that the Disclosure which was produced after the first closed hearing and then amended in the light of the Claimants' written submissions and the further closed and open hearings, was unsatisfactory in that it did not disclose its sources nor of what it was a gist or summary.
(iii) The description of circumstances in which such a request could be made where a s.8(4) warrant was in existence was unclear.
(iv) They complain of the limitation of the Disclosure by reference to paragraph 48(1) to Prism and Upstream, but it is plain that this case, and this Issue, only relate to Prism and Upstream.
(i) We shall return further to this later in the judgment, but we conclude that the Tribunal is entitled to look below the waterline in order to be satisfied (a) that there are adequate safeguards (b) that what is described above the waterline is accurate and gives a sufficiently clear signpost to what is below the waterline without disclosing detail of it.
(ii) We do not accept that the holding of a closed hearing, as we have carried it out, is unfair. It accords with the statutory procedure, and facilitates the process referred to in paragraphs 45 and 46 above. This enables a combination of open and closed hearings which both gives the fullest and most transparent opportunity for hearing full arguments inter partes on hypothetical or actual facts, with as much as possible heard in public, and preserves the public interest and national security.
(iii) The Disclosure has been a running document, being amended by additions or clarifications on 2 occasions (ignoring one which was necessitated by an unfortunate typographical error which was entirely the fault of the Tribunal Secretariat) and again as set out in paragraph 47 above, taking account of the submissions and criticisms of the Claimants and the observations of the Tribunal in closed hearing. We are satisfied that the Disclosures cast a clear and accurate summary or résumé of that part of the evidence given in the closed hearing which ought to be disclosed: and that the balance of the evidence and submissions given in closed hearing was too sensitive for disclosure without risk to national security or to the NCND principle.
(iv) We are satisfied that the description of the circumstances in which, when a request is made, there is an existing warrant is clear. Although the reader of this judgment will be enabled to understand the position better when, in relation to the s.8(4) issue, fuller exposition is given below, it is clear that the preconditions are either the existence of a s.8(1) warrant or the existence of a s.8(4) warrant within whose ambit the proposed target's communications fall, together, if the individual is known to be within the British Islands, with a s.16(3) modification.
(i) We must address below, with regard to the s.8(4) Issue, the nature and adequacy of those obligations and safeguards resulting from and relating to interception under RIPA, and, subject to (ii) below, the same considerations will apply.
(ii) As Mr Squires accepted, the clarification given within paragraph 1 of the Disclosure, that there will only be a request under Prism and/or Upstream, by reference to the existence of a s.8(4) warrant, which relates to an individual known to be within the British Islands, if a s.16(3) modification is in place, means that the RIPA safeguards under ss.15 and 16 (dealt with in detail below) in fact apply: except as he pointed out, in respect of a 1(b) Request so far as s.16 safeguards are concerned.
(i) Having considered the arrangements below the waterline, as described in this judgment, we are satisfied that there are adequate arrangements in place for the purpose of ensuring compliance with the statutory framework and with Articles 8 and 10 of the Convention, so far as the receipt of intercept from Prism and/or Upstream is concerned.
(ii) This is of course of itself not sufficient, because the arrangements must be sufficiently accessible to the public. We are satisfied that they are sufficiently signposted by virtue of the statutory framework to which we have referred and the Statements of the ISC and the Commissioner quoted above, and as now, after the two closed hearings that we have held, publicly disclosed by the Respondents and recorded in this judgment.
(iii) These arrangements are subject to oversight.
(iv) The scope of the discretion conferred on the Respondents to receive and handle intercepted material and communications data and (subject to the s.8(4) issues referred to below) the manner of its exercise, are accordingly (and consistent with Bykov - see paragraph 37 above) accessible with sufficient clarity to give the individual adequate protection against arbitrary interference.
We refer in paragraphs 153-155 below to the consequences of these conclusions.
"No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence."
"Everyone has the right to the protection of the law against such interference."
"127 . . . the Convention organs have repeatedly stated that the Convention does not contain a right which requires a High Contracting Party to exercise diplomatic protection, or espouse an applicant's complaints under international law, or otherwise to intervene with the authorities of another state on his or her behalf."
THE S.8(4) ISSUE
"5 Interception with a warrant.
(1) Subject to the following provisions of this Chapter, the Secretary of State may issue a warrant authorising or requiring the person to whom it is addressed, by any such conduct as may be described in the warrant, to secure any one or more of the following—
(a) the interception in the course of their transmission by means of a postal service or telecommunication system of the communications described in the warrant;
. . .
. . .
(d) the disclosure, in such manner as may be so described, of intercepted material obtained by any interception authorised or required by the warrant, and of related communications data.
(2) The Secretary of State shall not issue an interception warrant unless he believes—
(a) that the warrant is necessary on grounds falling within subsection (3); and
(b) that the conduct authorised by the warrant is proportionate to what is sought to be achieved by that conduct.
(3) Subject to the following provisions of this section, a warrant is necessary on grounds falling within this subsection if it is necessary—
(a) in the interests of national security;
(b) for the purpose of preventing or detecting serious crime; [or]
(c) for the purpose of safeguarding the economic well-being of the United Kingdom;
. . .
(4) The matters to be taken into account in considering whether the requirements of subsection (2) are satisfied in the case of any warrant shall include whether the information which it is thought necessary to obtain under the warrant could reasonably be obtained by other means.
(5) A warrant shall not be considered necessary on the ground falling within subsection (3)(c) unless the information which it is thought necessary to obtain is information relating to the acts or intentions of persons outside the British Islands.
(6) The conduct authorised by an interception warrant shall be taken to include—
(a) all such conduct (including the interception of communications not identified by the warrant) as it is necessary to undertake in order to do what is expressly authorised or required by the warrant;
(b) conduct for obtaining related communications data; and
(c) conduct by any person which is conduct in pursuance of a requirement imposed by or on behalf of the person to whom the warrant is addressed to be provided with assistance with giving effect to the warrant."
"8 Contents of warrants.
(1) An interception warrant must name or describe either—
(a) one person as the interception subject; or
(b) a single set of premises as the premises in relation to which the interception to which the warrant relates is to take place.
(2) The provisions of an interception warrant describing communications the interception of which is authorised or required by the warrant must comprise one or more schedules setting out the addresses, numbers, apparatus or other factors, or combination of factors, that are to be used for identifying the communications that may be or are to be intercepted.
(3) Any factor or combination of factors set out in accordance with subsection (2) must be one that identifies communications which are likely to be or to include—
(a) communications from, or intended for, the person named or described in the warrant in accordance with subsection (1); or
(b) communications originating on, or intended for transmission to, the premises so named or described.
(4) Subsections (1) and (2) shall not apply to an interception warrant if—
(a) the description of communications to which the warrant relates confines the conduct authorised or required by the warrant to conduct falling within subsection (5); and
(b) at the time of the issue of the warrant, a certificate applicable to the warrant has been issued by the Secretary of State certifying—
(i) the descriptions of intercepted material the examination of which he considers necessary; and
(ii) that he considers the examination of material of those descriptions necessary as mentioned in section 5(3)(a), (b) or (c).
(5) Conduct falls within this subsection if it consists in—
(a) the interception of external communications in the course of their transmission by means of a telecommunication system; and
(b) any conduct authorised in relation to any such interception by section 5(6).
(6) A certificate for the purposes of subsection (4) shall not be issued except under the hand of the Secretary of State."
i) For the meaning of communications data cross-reference is made to s.21(4), which gives the following definition:
"(a) any traffic data comprised in or attached to a communication (whether by the sender or otherwise) for the purposes of any postal service or telecommunication system by means of which it is being or may be transmitted;
(b) any information which includes none of the contents of a communication (apart from any information falling within paragraph (a)) and is about the use made by any person—
(i) of any postal service or telecommunications service; or
(ii) in connection with the provision to or use by any person of any telecommunications service, of any part of a telecommunication system."
As set out in Paragraph 18(ix) above, such communications data are colloquially called 'metadata'.
ii) It is related communications data if it:
"a) is obtained by, or in connection with, the interception; and
(b) relates to the communication or to the sender or recipient, or intended recipient, of the communication;"
iii) "Intercepted material", "in relation to an interception warrant means the contents of any communications intercepted by an interception to which the warrant relates". It is common ground that this definition does not include "related communications data", separately defined as set out above.
iv) "External communication" means a communication sent or received outside the British Islands.
"It is just not possible to ensure that only external communications are intercepted. That is because modern communications are often routed in ways that are not all intuitively obvious. Noble Lords who have contributed to the debate understand that. An internal communication say, a message from London to Birmingham—may be handled on its journey by Internet service providers in, perhaps, two different countries outside the United Kingdom. We understand that. The communication might therefore be found on a link between those two foreign countries. Such a link should clearly be treated as external, yet it would contain at least this one internal communication. There is no way of filtering that out without intercepting the whole link, including the internal communication.
Even after interception, it may not be practicably possible to guarantee to filter out all internal messages. Messages may well be split into separate parts which are sent by different routes. Only some of these will contain the originator and the intended final recipient. Without this information it will not be possible to distinguish internal messages from external. In some cases it may not be possible even if this information is available. For example, a message between two foreign registered mobile phones, if both happened to be roaming in the UK, would be an internal communication, but there would be nothing in the message to indicate that.
It is still the intention that Clause 8(4) warrants should be aimed at external communications. Clause 8(5) limits such a warrant to authorising the interception of external communications together with whatever other conduct is necessary to achieve that external interception. Whenever such a warrant is signed, the Secretary of State must be convinced that the conduct it will authorise as a whole is proportionate—my favourite word—to the objects to be achieved. His decision to sign will be overseen by the Interception of Communications Commissioner."
"5.1 This section applies to the interception of external communications by means of a warrant complying with section 8(4) of the Act. External communications are defined by the Act to be those which are sent or received outside the British Islands. They include those which are both sent and received outside the British Islands, whether or not they pass through the British Islands in course of their transit. They do not include communications both sent and received in the British Islands, even if they pass outside the British Islands en route. Responsibility for the issuing of such interception warrants rests with the Secretary of State."
"The section 8(4) structure does not permit random trawling of communications. This would be unlawful. It only permits a search for communications referable to individuals the examination of whose communications are certified as necessary for a statutory purpose."
"70 . . . intercept a substantially greater volume of communications (including, potentially, a volume of internal communications), and then apply a selection stage to identify the communications in question. In other words, it is common ground that the only practical way to find and reconstruct most external communication "needles" is to look through the communications "haystack".
71. . . Unless the Claimants wish to submit that the Intelligence Services should not be able to obtain the external communications that are needed for the purposes of national security, etc., they must accept some form of interception regime that permits substantially more communications to be intercepted (including, potentially, internal communications) than are actually being sought."
"15 (1) Subject to subsection (6), it shall be the duty of the Secretary of State to ensure, in relation to all interception warrants, that such arrangements are in force as he considers necessary for securing—
(a) that the requirements of subsections (2) and (3) are satisfied in relation to the intercepted material and any related communications data; and
(b) in the case of warrants in relation to which there are section 8(4) certificates, that the requirements of section 16 are also satisfied.
(2) The requirements of this subsection are satisfied in relation to the intercepted material and any related communications data if each of the following—
(a) the number of persons to whom any of the material or data is disclosed or otherwise made available,
(b) the extent to which any of the material or data is disclosed or otherwise made available,
(c) the extent to which any of the material or data is copied, and
(d) the number of copies that are made,
is limited to the minimum that is necessary for the authorised purposes.
(3) The requirements of this subsection are satisfied in relation to the intercepted material and any related communications data if each copy made of any of the material or data (if not destroyed earlier) is destroyed as soon as there are no longer any grounds for retaining it as necessary for any of the authorised purposes.
(4) For the purposes of this section something is necessary for the authorised purposes if, and only if—
(a) it continues to be, or is likely to become, necessary as mentioned in section 5(3);
. . .
(5) The arrangements for the time being in force under this section for securing that the requirements of subsection (2) are satisfied in relation to the intercepted material or any related communications data must include such arrangements as the Secretary of State considers necessary for securing that every copy of the material or data that is made is stored, for so long as it is retained, in a secure manner.
(6) Arrangements in relation to interception warrants which are made for the purposes of subsection (1)—
(a) shall not be required to secure that the requirements of subsections (2) and (3) are satisfied in so far as they relate to any of the intercepted material or related communications data, or any copy of any such material or data, possession of which has been surrendered to any authorities of a country or territory outside the United Kingdom; but
(b) shall be required to secure, in the case of every such warrant, that possession of the intercepted material and data and of copies of the material or data is surrendered to authorities of a country or territory outside the United Kingdom only if the requirements of subsection (7) are satisfied.
(7) The requirements of this subsection are satisfied in the case of a warrant if it appears to the Secretary of State—
(a) that requirements corresponding to those of subsections (2) and (3) will apply, to such extent (if any) as the Secretary of State thinks fit, in relation to any of the intercepted material or related communications data possession of which, or of any copy of which, is surrendered to the authorities in question; and
(b) that restrictions are in force which would prevent, to such extent (if any) as the Secretary of State thinks fit, the doing of anything in, for the purposes of or in connection with any proceedings outside the United Kingdom which would result in such a disclosure as, by virtue of section 17, could not be made in the United Kingdom."
We have already referred to s.15(8) in paragraph 29 above.
"16. (1) For the purposes of section 15 the requirements of this section, in the case of a warrant in relation to which there is a section 8(4) certificate, are that the intercepted material is read, looked at or listened to by the persons to whom it becomes available by virtue of the warrant to the extent only that it—
(a) has been certified as material the examination of which is necessary as mentioned in section 5(3)(a), (b) or (c); and
(b) falls within subsection (2).
(2) Subject to subsections (3) and (4), intercepted material falls within this subsection so far only as it is selected to be read, looked at or listened to otherwise than according to a factor which—
(a) is referable to an individual who is known to be for the time being in the British Islands; and
(b) has as its purpose, or one of its purposes, the identification of material contained in communications sent by him, or intended for him.
(3) Intercepted material falls within subsection (2), notwithstanding that it is selected by reference to any such factor as is mentioned in paragraph (a) and (b) of that subsection, if—
(a) it is certified by the Secretary of State for the purposes of section 8(4) that the examination of material selected according to factors referable to the individual in question is necessary as mentioned in subsection 5(3)(a), (b) or (c); and
(b) the material relates only to communications sent during a period specified in the certificate that is no longer than the permitted maximum .
. . ."
"5.2 An application for a warrant is made to the Secretary of State. Interception warrants, when issued, are addressed to the person who submitted the application. This person may then serve a copy upon any person who may be able to provide assistance in giving effect to that warrant. Each application, a copy of which must be retained by the applicant, should contain the following information:
- Background to the operation in question.
- Description of the communications to be intercepted, details of the communications service provider(s) and an assessment of the feasibility of the operation where this is relevant.
- Description of the conduct to be authorised, which must be restricted to the interception of external communications, or to conduct necessary in order to intercept those external communications, where appropriate.
- The certificate that will regulate examination of intercepted material.
- An explanation of why the interception is considered to be necessary for one or more of the section 5(3) purposes.
- A consideration of why the conduct to be authorised by the warrant is proportionate to what is sought to be achieved by that conduct.
- A consideration of any unusual degree of collateral intrusion, and why that intrusion is justified in the circumstances. In particular, where the communications in question might affect religious, medical or journalistic confidentiality or legal privilege, this must be specified in the application.
- Where an application is urgent, supporting justification should be provided.
- An assurance that intercepted material will be read, looked at or listened to only so far as it is certified, and it meets the conditions of sections 16(2)-16(6) of the Act.
- An assurance that all material intercepted will be handled in accordance with the safeguards required by sections 15 and 16 of the Act."
There are then provisions placing obligations on the Secretary of State in relation to the authorisation of such a warrant, and giving further guidance as to its necessity and proportionality (paragraphs 5.3 to 5.6). Paragraph 5.12 provides, in respect of renewal of such a warrant, that:
"The Secretary of State may renew a warrant at any point before its expiry date. Applications for renewals are made to the Secretary of State and contain an update of the matters outlined in paragraph 5.2 above. In particular, the applicant must give an assessment of the value of interception to the operation to date and explain why he considers that interception continues to be necessary for one or more of the purposes in section 5(3)."
Detailed records are required to be kept by paragraph 5.17.
"6.8 Intercepted material, and all copies, extracts and summaries which can be identified as the product of an interception, must be securely destroyed as soon as it is no longer needed for any of the authorised purposes. If such material is retained, it should be reviewed at appropriate intervals to confirm that the justification for its retention is still valid under section 15(3) of the Act."
Paragraph 6.9 deals with personnel security.
"100. Section 15 of RIPA imposes a duty on the Secretary of State to ensure, in relation to section 8(4) warrants, that such arrangements are in force as he considers necessary for securing that the requirements of sections 15(2)-(3) and 16 are satisfied. Chapter 6 of the current Code expands on the nature of the required safeguards, as does the revised draft Code to which I refer in paragraph 161 below (which was published for consultation and remains in the public domain). Beyond these public statements, the full details of the sections 15 and 16 arrangements are (and have always been) kept confidential. I have reviewed the safeguards that have been put in place for the purposes of sections 15 and 16 and I am satisfied that they cannot safely be put into the public domain without undermining the effectiveness of interception methods. This would be contrary to the interests of national security and prejudicial to the prevention and detection of serious crime. Interception techniques form a critical resource for the Government in countering terrorism and serious crime. To maintain the effectiveness of the techniques of interception that are adopted, the Government must take steps to ensure appropriate levels of secrecy not only as regards the fact of interception but also as regards the detailed manner in which it is performed. This applies to what I am able to say about the nature of the s. 8(4) regime and the safeguards that attach to it.
101. Although the full details of the sections 15 and 16 arrangements cannot be made public, they are not simply an internal Government matter. Rather, they are made available to the Commissioner (see paragraph 6.1 of the Code) who is required (by section 57(2)(d)(i) of RIPA) to keep them under review. Further, to facilitate oversight by the Commissioner (i) each intercepting agency is required to keep a record of the arrangements in question (see paragraph 5.17 of the Code) and (ii) any breach of the arrangements must be reported to the Commissioner (paragraph 6.1 of the Code)."
"3. The Claimants' communications might in principle have been intercepted in the United Kingdom under the s. 8(4) regime (as defined in the Original Open Response) and at least some of those intercepted communications might in principle have been "read, looked at or listened to" by a person or persons under that regime.
4. The Claimants allege:
(a) the Intelligence Services operate a programme, described as Tempora, under which fibre optic cables are intercepted. This involves making available the contents of all the communications and communications data being transmitted through the fibre optic cables;
(b) the intercepted communications and communications data may be retained for an indefinite period and automatically searched through the use of a large number of search terms, including search terms supplied by the United States National Security Agency.
(c) The intercepted communications and communications data may then be further retained, analysed and shared with other public authorities."
In light of the factual premises at paragraphs (3) and (4) above, does the statutory regime as set out in paragraphs 102-178 of the Respondents' Open Response to the Claims brought by Liberty and Privacy satisfy the Art. 8(2) "in accordance with the law" requirement?
Given the Claimants' allegations at factual premise (4), is the definition of "external communications" within s.20 Regulation of Investigatory Powers Act 2000 sufficiently precise to be "in accordance with the law" for the purposes of Art.8(2)?
Does the absence of a requirement that any s. 8(4) warrants issued in respect of the alleged Tempora programme target specific individuals or premises give rise to a breach of the "necessity" and "in accordance with the law" requirements in Art. 8(2) and/or (if the answer to Issue (vi) is "yes") Art. 10(2)?
Are the "necessity" and "in accordance with the law" requirements in Art. 8(2) . . . breached because interception under the s. 8(4) regime issued in respect of the alleged Tempora programme may in principle involve (i) the interception (and subsequent recording) of communications and communications data without there being any reason to suspect that the communications of the individuals in question are relevant to national security, serious crime and/or the economic well-being of the United Kingdom, and (ii) the intercepted communications and communications data so obtained being processed to determine whether (pursuant to s. 16 and the certificate in question) it may be read, looked at or listened to by one or more persons?
Does the alleged Tempora programme and/or the s. 8(4) regime give rise to unlawful discrimination contrary to (i) Art. 14 of the ECHR (as read with Art. 8 and/or Art. 10), . . ."
We have foreshortened the wording of this Issue, because it became common ground that there was only need to consider the Convention in this regard.
(1) Is the difficulty of determining the difference between external and internal communications, whether as a theoretical or practical matter, such as to cause the s.8(4) regime not to be in accordance with law contrary to Article 8(2)?
(2) Insofar as s.16 of RIPA is required as a safeguard in order to render the interference with Article 8 in accordance with law, is it a sufficient one?
(3) Is the regime, whether with or without s.16, sufficiently compliant with the Weber requirements, insofar as such is necessary in order to be in accordance with law?
(4) Is s.16(2) indirectly discriminatory contrary to Article 14 of the Convention, and, if so, can it be justified? It should be explained that, led by Mr Jaffey, the Claimants developed this more limited argument in the course of the hearing, effectively not pursuing the original pleaded claim by all Claimants that s.8(4) and (5) were so discriminatory.
The relief sought is effectively for a declaration that the Respondents acted unlawfully in violation of the Claimants' rights under Articles 8 and 14 ECtHR.
"9. The s8(4) warrant is accordingly also described as a "certificated warrant". It can and may result, provided that the requirements of s8(4) and (5) are satisfied, in the interception of all communications between the United Kingdom and an identified city or country.
. . .
11. It is apparent that the interference with the privacy of communications is likely to be greater by virtue of a s8(4) warrant than as a result of what Counsel called a "targeted" s8(1) warrant; although there may still be a mass of material obtained pursuant to a s8(1) warrant, dependent upon the activities of the individual, or at the premises, the subject of the warrant, and the number of calls made. In relation to both regimes, there are restrictions upon the use of intercepted material. S15 in particular applies to both a s8(1) and a s8(4) warrant. By s15(1) the Secretary of State must ensure in relation to all interception warrants that such arrangements are in force as he considers necessary for securing, by reference to s15(2), that there is the minimum necessary disclosure and copying of such material, and by reference to s15(3) the soonest possible destruction. No challenge is any longer made by the Complainants to the processes relating to disclosure retention or destruction of material obtained under a s8(1) or a s8(4) warrant. There are extra safeguards provided by s16 of RIPA in the case of s.8(4), or certificated, warrants.
. . .
14. As to the safeguards in ss15 and 16 of RIPA, in his witness statement served on behalf of the Respondents, the Director General of the Organised Crime, Drugs and International Group of the Home Office explains as follows:
'26. The internal agency manuals that set out the section 15 and section 16 safeguards, contain comprehensive instructions and refer in detail to specific techniques and processes. This level of detail is required precisely in order to ensure that the section 15 and section 16 safeguards, and the section 8(4) requirements, are properly understood by staff and are fully effective in practice. For the reasons given in the above paragraph [his description of the growing threat of terrorism, and the use by terrorist groups of modern technology, requiring to be countered by interception techniques and appropriate levels of secrecy to protect those techniques] the Government is unable to disclose the full detail of the arrangements for s8(4) warrants that are in place under sections 15 and 16 of [RIPA]. Disclosure of the specific arrangements, the Government assesses, and I believe, would be contrary to the interests of national security. In particular, it would enable individuals to adapt their conduct so as to undermine the operational effectiveness of any interception efforts which it might be thought necessary to apply to them. It is axiomatic that such instructions would be a very great utility to, for instance, members of the intelligence agencies of countries that are hostile to British interests.
27. In the light of the above, what I set out in this statement is the fullest account of the safeguards and operating procedures that the Government is able to provide without undermining national security. The Government has experience of the loss of intelligence available to it and the loss of effectiveness of its intelligence gathering machinery, consequent upon revealing details of the methodologies available to it'"
"30. The Respondents' Counsel placed considerable reliance upon the decision of the Commission in Christie v United Kingdom 78A DR 119,  ECHR 59. This decision took express account of, and referred to, Kruslin and Huvig (at 132). It was considering the very legislation now before us (save that it related to the predecessor statute, the Interception of Communications Act 1985, the terms of s2(2) of which were materially identical to s5(3) of RIPA). It was not a question of a judicial order for evidence leading to its admissibility in court. The issue related to authorised interception of telexes received from trade unions in Eastern Europe, which had been considered necessary under s2(2) (now s5(3)). Accessibility and foreseeability were addressed, and there was express reference not only to the Sunday Times judgment but also to paragraph 67 of the Malone judgment. The Commission concluded at 133ff as follows:"
"The Government contend that the terms of the relevant legislative provisions sufficiently indicate the type of activity likely to be susceptible to interception of communications, and that safeguards are imposed that regulate the retention and use of information obtained from interceptions.
The Commission notes that the case law of the Commission and Court establishes that the requirement of foreseeability in the special context of sectors affecting national security cannot be the same as in many other fields. In the Leander case (1987) 9 EHRR 433] the Court stated:
"Thus, it cannot mean that an individual should be enabled to foresee precisely what checks will be made in his regard by the Swedish special police service in its efforts to protect national security. Nevertheless, in a system applicable to citizens generally ... the law has to be sufficiently clear in its terms to give them an adequate indication as to the circumstances in which and the conditions on which the public authorities are empowered to resort to this kind of secret and potentially dangerous interference with private life ... "
The Commission recalls that it has considered the compatibility with the requirements of foreseeability of the partial definition of "interests of national security" ... in two previous cases, Esbester v United Kingdom [18 EHRR CD 72] ... and Hewitt and Harman v United Kingdom [Commission decision 1.9.93] ... It considered that the principles referred to above did not necessarily require a comprehensive definition of the notion of "the interests of national security", noting that many laws, which by their subject matter require to be flexible, are inevitably couched in terms which are to a greater or lesser extent vague and whose interpretation and application are questions of practice. It held that, given the express limitations on the exercise of the Security Service's functions and the supervision of a Tribunal and Commissioner, the law was formulated with sufficient precision ...
While, as the applicant points out, the provisions of the 1985 ... [Act] are not subject to the influence of the adversarial input which forms part of the judicial process of interpretation, the Commission does not consider that the concept of foreseeability requires that questions of interpretation and practice must be decided in a judicial forum. It is compatible with the requirements of foreseeability that terms which are on their face general and unlimited are explained by administrative or executive statements and instructions, since it is the provision of sufficiently precise guidance to enable individuals to regulate their conduct, rather than the source of that guidance, which is of relevance (cf ... Silver v UK (1983) 5 EHRR 347). ...
In light of the above, the Commission considers that the scope and manner of exercise of the powers to intercept communications and make use of the information obtained are indicated with a requisite degree of certainty to satisfy the minimum requirements referred to above.
The Commission thus concludes that any interference in the present case was "in accordance with the law".
31. The Complainants' Counsel submits that Christie and the two previous decisions referred to can be distinguished, since, although the issue addressed related to the identical statutory provision, the precise point now being taken was not addressed, namely one directed towards the absence of selection criteria. As will be seen however, it is the Respondents' submission that s5(3) supplies the answer to the Complainants' new submission also, such that, if that be right, the submission is both not new and answered by Christie.
32. The nub of the Complainants' contention is that this is a case which falls within Silver, because there is no answer provided by the statute, and no other guidelines, published or available, which supply an answer to the requirement of accessibility or foreseeability:
32.1 Although the Complainants' expert referred to a case presented to the Constitutional Court in the Federal Republic of Germany, [this must be a reference to Weber, which was not yet before the ECtHR] in which there was reference made to a list of search terms which could or might be used as a filtering system prior to accessing material (although, as the Respondents' Counsel points out, he does not himself appear actually to say that the German search terms were ever published, as opposed to an account being given to the German Constitutional Court), the Complainants' Counsel does not suggest that, in order to comply with the in accordance with law doctrine there would have to be publication in the United Kingdom of a list of search terms. Such a course would in our judgment be both risky and pointless; risky because it would or might, contrary to the principle enunciated in paragraph 67 of Malone, enable those intending to participate in secret communications to avoid the use of words which would be known to appear in the search list; and pointless both for that reason and because any accessing of information intercepted pursuant to a s8( 4) warrant would be bound to be fact specific, and what was being looked for would depend upon the subject matter of the warrant.
32.2 At the end of the day the Complainants' Counsel's submission is a simple one. He is in no position, he submits, to guess at what should be said, but he simply submits that something more should be said, by way of indication as to selection criteria than is presently stated, and that the selection should not be left simply to the discretion of officials.
33. The Respondents' response is unequivocal. They refer to paragraph 22 of the statement mentioned above in paragraph 14:
" ... This process under section 8(4) permits selection and examination of the selected material only to the extent that to do so would be necessary in the interests of national security, to prevent or detect serious crime or to safeguard the economic well-being of the United Kingdom. In this regard and generally, section 8(4) is to be read in conjunction with section 15 of RIPA, which in subsection (1)(b) specifically makes section 8(4) warrants subject to arrangements for ensuring that the requirements of section 16 of RIPA are satisfied (namely "that intercepted material is read, looked at or listened to by the persons to whom it becomes available by virtue of the warrant to the extent only that it has been certified as material the examination of which is necessary as mentioned in section 5(3)(a), (b) or (c))". It is the duty of the Secretary of State to ensure that such arrangements are in force that he considers necessary for securing that the requirements of s16 are satisfied."
34. The selection criteria in relation to accessing a large quantity of as yet unexamined material obtained pursuant to a s8(4) warrant (as indeed in relation to material obtained in relation to a s8(1) warrant) are those set out in s5(3). The Complainants' Counsel complains that there is no "publicly stated material indicating that a relevant person is satisfied that the [accessing] of a particular individual's telephone call is proportionate". But the Respondents submit that there is indeed such publicly stated material, namely the provisions of s6(l) of the Human Rights Act which requires a public authority to act compatibly with Convention rights, and thus, it is submitted, imposes a duty to act proportionately in applying to the material the s5(3) criteria.
35. To that duty there is added the existence of seven safeguards listed by the Respondents' Counsel, namely (I) the criminal prohibition on unlawful interception (2) the involvement of the Secretary of State (3) the guiding role of the Joint Intelligence Committee ("JIC") (4) the Code of Practice (5) the oversight by the Interception of Communication Commissioner (whose powers are set out in Part IV of the Act) (6) the availability of proceedings before this Tribunal and (7) the oversight by the Intelligence and Security Committee, an all-party body of nine Parliamentarians created by the Intelligence Services Act 1994, whose operation is described in the Respondents' evidence. The existence of the Commissioner and the Tribunal alone expressly weighed with the Commission in its decision in Christie.
36. It is plain that, although in fact the existence of all these safeguards is publicly known, it is not part of the requirements for accessibility or foreseeability that the precise details of those safeguards should be published. The Complainants' Counsel has pointed out that it appears from the Respondents' evidence that there are in existence additional operating procedures, as would be expected given the requirements that there be the extra safeguards required by s 16 of the Act, and the obligation of the Secretary of State to ensure their existence under sI5(1)(b). It is not suggested by the Complainants that the nature of those operating procedures be disclosed, but that their existence, i.e. something along the lines of what is in the Respondents' evidence, should itself be disclosed in the Code of Practice.
37. We are unpersuaded by this. First, such a statement in the Code of Practice, namely as to the existence of such procedures, would in fact take the matter no further than it already stands by virtue of the words of the statute. But in any event, the existence of such procedures is only one of the substantial number of safeguards which are known to exist. Accessibility and foreseeability are satisfied by the knowledge of the criteria and the knowledge of the existence of those multiple safeguards.
38. It is in those circumstances that the Respondents submit, by reference to the criteria in s5(3), as exercised with proportionality and the existence of the multiple safeguards, that both the question and the answer are the same as in Christie. We agree. It is clear from the Sunday Times case at para 49 that foreseeability is only expected to a degree that is reasonable in the circumstances, and the circumstances here are those of national security, as discussed in Klass and Leander. This is not a Silver case where the legislation itself was inadequate and the guidelines were unpublished. In this case the legislation is adequate and the guidelines are clear. Foreseeability does not require that a person who telephones abroad knows that his conversation is going to be intercepted because of the existence of a valid s8(4) warrant. The "why me?" test is as inapt in this case as it would have been found to be by the Court of Appeal in its recent decision in R ex parte Gillan and Another v Commissioner of Police for the Metropolis  3 WLR 1144, at paragraph 50 of the judgment of the Court given by Lord Woolf LCJ, in relation to the subject of a valid stop and search order."
i) The Claimants point out that the decision in Gillan, to which the Tribunal referred in paragraph 38 of its judgment, has been subsequently effectively overruled by the ECtHR decision in Gillan v United Kingdom (2010) 50 EHRR 45. However, apart from the inappropriateness of the question "why me?", which does not appear to us to have been essential to the Tribunal's conclusions, the conclusory passage in paragraphs 77 to 79 of the ECtHR's judgment in that case does not appear to us to flaw the Tribunal's conclusion, nor to lead to a conclusion different from that reached by the Tribunal, namely the Court's requirement in paragraph 77 that:
"For domestic law to meet these requirements it must afford a measure of legal protection against arbitrary interferences by public authorities with the rights safeguarded by the Convention . . . it would be contrary to the rule of law . . .for a legal discretion granted to the executive to be expressed in terms of an unfettered power",
such as the Court found there to be in Gillan, and the Tribunal did not find in the British Irish Rights Watch case.
ii) The Claimants also point out that in Liberty v UK, at paragraph 63, the ECtHR stated that its "approach to the foreseeability requirement in this field has . . . evolved since the Commission considered the United Kingdom's surveillance scheme in its decision in . . . Christie". But Christie and Esbester (see paragraph 40 above), to which the Tribunal also referred, were both cited without disapproval in Kennedy. We see no reason, particularly as the Tribunal expressly referred to and relied upon Malone and Leander, to differ from its conclusion, by reference to foreseeability. Further we see no reason, bearing in mind the Tribunal's findings in that case, to conclude that, in whatever respect the ECtHR was of the view in Liberty v UK that the Court's jurisprudence had evolved since Christie, the Tribunal's conclusions as to accessibility and foreseeability in that case should be regarded as in any way flawed.
"68 . . . In the United Kingdom, extensive extracts from the Code of Practice issued under s.71 of the 2000 Act are now in the public domain, which suggests that it is possible for the state to make public certain details about the operation of a scheme of external surveillance without compromising national security."
"In the circumstances, the Court considers that the domestic law on interception of internal communications together with the clarifications brought by the publication of the Code indicate with sufficient clarity the procedures for the authorisation and processing of interception warrants as well as the processing, communicating and destruction of intercept material collected. The Court further observes that there is no evidence of any significant shortcomings in the application and operation of the surveillance regime. On the contrary, the various reports of the Commissioner have highlighted the diligence with which the authorities implement RIPA and correct any technical or human errors which accidentally occur. Having regard to the safeguards against abuse in the procedures as well as the more general safeguards offered by the supervision of the Commissioner and the review of the IPT, the impugned surveillance measures, insofar as they may have been applied to the applicant in the circumstances outlined in the present case, are justified under Article 8(2)."
Again, of the Four Questions before us, the first, second and fourth were not asked of the Court: the third plainly was, albeit in the context of a s.8(1) warrant.
i) It is impossible to differentiate at the 'interception' stage between external and internal communications, which will all be carried within the same 'bearer'.
ii) It is impossible to know at the time of interception, i.e. in the course of transmission, what is external and what is internal, and such has always been the case:
a) The definition of interception in s.2(2) of RIPA refers (as set out above) to transmission "to a person other than the sender or intended [our underlining] recipient of the communication" i.e. it is (or may be) intercepted before receipt.
b) Again as set out above, s.2(7) provides that transmission of a communication is to include the time when the communication has arrived but is being stored pending collection by the intended recipient – e.g. stored on an email server.
iii) It is inevitable that, when a telephone call is made from a mobile phone or IPhone, or an email is sent to an email address, it will not necessarily be known whether it will be received in the United Kingdom or in the course of travel or at a foreign destination. It is accepted that once and if received abroad by the intended recipient it will be an external communication, even if the sender did not know, when he or she made the call or sent the email, that that was to be the case.
i) There is no dispute that emails sent to an email address will still be likely to be in transmission when intercepted (see above). There is also no dispute that if an email is sent to more than one addressee, and one of the addressees is abroad, then there is an external communication to that addressee, even if not to the others. It is also not disputed, in accordance with Lord Bassam's statement and the Code, that if an email is sent via a server which is abroad, such as Hotmail, that that is not an external communication if the addressee receives it in the UK, irrespective of the fact that it has been transmitted to, and stored, until called down, on a US server.
ii) It is also not disputed that if Google is used as a search engine to navigate the internet in order to find a web page or addressee abroad, for example such as Wikipedia, then, if e.g. Wikipedia is abroad, that is external.
iii) It is also not in dispute that a Facebook message which is posted to a US server and picked up by a recipient abroad is an external communication.
iv) The disputes between Mr Farr (paragraphs 132 to 141) and Mr King (paragraphs 32 to 55) revolve primarily around (i) other uses of Google, where Mr Farr considers that a message is sent to Google or a Google entity/platform in the United States, and a message is then sent back (ii) other uses of Facebook – e.g. placing a message on the US Facebook page or (iii) Twitter. In each of these cases Mr King considers that (absent the common ground referred to above) the communications are or remain internal. It was apparent that much of the dispute related to the difference between what is interpreted as a "communication" within s.81 of RIPA, which includes the definition, at (c), that communication includes "signals serving either for the impartation of anything between persons, between a person and a thing or between things or for the actuation or control of any apparatus."
i) Of the respects in which it is common ground that external and internal communications are either intermingled or impossible to differentiate at the interception stage (set out in paragraphs 94 to 95 above), all were present, foreseeable and foreseen at the time of the passage of RIPA by Parliament in 2000.
ii) There is in any event no dispute about the communications which will be contained on the same bearers, namely incoming communications into the United Kingdom from abroad. They are likely to be substantial, and will qualify as external communications, thus diminishing yet further the proportionality of consideration of the intermingling of the outgoing communications.
iii) Although the changes in technology are substantial, they do not seem to us, given the common ground to which we have referred, to constitute any material addition to the quantity (or proportion) of communications which either could or could not be differentiated as being internal or external at the time of interception.
i) All communications, whether they be external or internal, intercepted by s.8(4) warrant come to be considered for examination by reference to s.16 of RIPA, to which we turn below. It is that section which does what Mr Ryder called in argument the "heavy lifting".
ii) The only impact, in our judgment, that could arise would be if Mr Farr's interpretation were incorrect, and it were the case that a warrant under s.8(4) had been granted by express reference to it, and thus on an arguably false basis. However, given that such warrants and such interception would be likely to be applied for on a "generic basis", and a bearer sought to be intercepted would be bound to include, for the reasons that we have given, a substantial quantity of communications which would be on any basis either external or at any rate inchoate external communications in the sense discussed above, it would seem to us not to follow that any such warrant would be so flawed. Plainly if a warrant, for example a warrant issued impacting upon these Claimants (if in due course it later becomes apparent, in subsequent closed consideration or otherwise, that there has been such a warrant) were applied for or granted on the basis of express reliance upon such an arguably flawed basis, then it would be at that stage that the question would arise, and would need to be resolved.
"Data associated with emails:
- Sender's name, email, and IP address
- Recipient's name and email address
- Date, time, and time zone in which email is sent and received
Data associated with mobile phones:
- Phone number of every caller
- Serial numbers of phones involved
- Time of call
- Duration of call
- Cell site location
Data associated with web browsers:
- Activity including pages the user visits and when visited
- User IP address, internet service provider, device hardware details, operating system, and browser version. "
i) S.16(2) is clearly in accordance with law. He set out the reasons for the exemption of communications data, namely that the metadata enabled compliance with the difficult task imposed by s.16(2) with regards to contents. He submitted as follows in paragraph 121.5 of his skeleton argument:
"(a) In order for s. 16 to work as a safeguard in relation to individuals who are within the British Islands, but whose communications might be intercepted as part of the s8(4) Regime, the Intelligence Services need information to be able to assess whether any potential target is "for the time being in the British Islands" (for the purposes of s. 16(2)(a)). Communications data is a significant resource in this regard.
(b) In other words, an important reason why the Intelligence Services need access to related communications data under the s.8(4) Regime is precisely so as to ensure that the s. 16 safeguard works properly and, insofar as possible, factors are not used at the selection that are - albeit not to the knowledge of the Intelligence Services - "referable to an individual who is ... for the time being in the British Islands"."
This was, he submitted, plainly the express, and sensible, purpose of Parliament.
ii) The structure of s.16 is quite clear, and amounts to the safeguard intended in respect of the operation of the s.8(4) warrant discussed above. The existence of the exemption for communications data is nothing new, and had been intended.
iii) Communications data are fully protected by the safeguards of s.15(2) handling and (3) destruction, etc. The protection for communications data is thereby established, and such protection is only less than for contents, by virtue of s.16(2), in relation to some communications. If this could be said to be something less than full Weber requirements, then, if, contrary to his submissions, Weber applies to communications data at all, a lesser protection is permitted, so far as communications data is concerned, and in any event the exemption was fully justified, as above.
i) The reference to "national security" is a sufficient description: see Esbester at CD 74 and Kennedy at paragraph 159, where the ECtHR stated:
". . .The applicant criticises the terms "national security" and "serious crime" as being insufficiently clear. The Court disagrees. It observes that the term "national security" is frequently employed in both national and international legislation and constitutes one of the legitimate aims to which Article 8(2) itself refers. The Court has previously emphasised that the requirement of "foreseeability" of the law does not go so far as to compel States to enact legal provisions listing in detail all conduct that may prompt a decision to deport an individual on "national security" grounds. By the nature of things, threats to national security may vary in character and may be unanticipated or difficult to define in advance."
ii) The absence of targeting at 'Stage one' is acceptable and inevitable. This was so in the Weber case itself (by reference to the 'strategic monitoring' being there addressed). In Liberty v UK the Court criticised the "virtually unfettered" nature of the legal discretion granted to the executive for the physical capture of external communications (paragraph 64), but would appear, rather as in Weber itself, to have concluded that the defect was the failure to set out with sufficient clarity the scope or manner of such exercise (paragraph 69), and in particular the absence of the Code, which by then had been published (paragraph 68).
iii) The Code was plainly acceptable so far as the s.8(1) warrant is concerned, when it was fully considered by the Court in Kennedy. Insofar as the Code was referred to in Liberty v UK (at paragraph 68), no specific complaints were made or problems identified.
iv) We heard considerable argument by Mr Ryder as to the appropriateness of paragraph 5.2 of the Code. Of course it may be that in a given case the particulars supplied in an application for a warrant would be found to have been insufficient, although we note the Commissioner's duties as to the supervision and inspection of such warrants. We find that on its face paragraph 5.2 is impressive, and that the provisions of paragraph 5.2, particularly together with those of paragraphs 2.4 and 2.5 and 5.3, 5.4, 5.5 and 5.6 referred to in paragraph 56 above, dealing with necessity and proportionality, are satisfactory.
v) There is in our judgment no call for search words to be included in an application for a warrant or in the warrant itself. It seems to us that this would unnecessarily undermine and limit the operation of the warrant and be in any event entirely unrealistic. It does not appear to us to be in any way demanded by the Weber requirements. So far as the facts of Weber are concerned, it appears that some form of notification of search words was required under the German domestic law. But the facts of Weber are of course not prescriptive, and, particularly as the outcome was that the Court found that the application in Weber was "manifestly unfounded", it does not impose on any other legislature the requirement either to have some system of search words, (or indeed to adopt another matter which formed part of the facts of Weber, namely a provision for some form of notification to the target(s) that there is or has been a warrant – a proposition that was not argued before us, and in our judgment rightly so). We agree with the conclusion of this Tribunal in British Irish Rights Watch that such a course would be both risky and pointless.
vi) There is also in our judgment no basis for objection by virtue of the absence for judicial pre-authorisation of a warrant. The United Kingdom system is for the approval by the highest level of government, namely by the Secretary of State. The absence of such judicial authorisation in Liberty v UK was not a matter of criticism, and the Court in Kennedy concluded (at paragraph 167) that, whereas "it has previously indicated that in a field where abuse is potentially so easy in individual cases and could have such harmful consequences for democratic society as a whole, it is in principle desirable to entrust supervisory control to a judge", it was satisfied, not only by virtue of the existence of the Commissioner (then, as now, a distinguished retired Judge), which it had examined at length (as referred to in paragraph 92 above), but also by virtue of the fact that "the Court highlights the extensive jurisdiction of the IPT to examine any complaint of unlawful interception". This approval of the absence of judicial pre-authorisation was further addressed by the Court in Telegraaf Media at paragraph 98.
vii) We have seen nothing to cause us to take a different view from that of the Tribunal in British Irish Rights Watch, particularly as to the matters set out in (ii), (v) and (vi) above, which the Tribunal then specifically addressed.
i) The Code. The Code (save for its earlier absence) was not a subject of specific criticism in Liberty v UK, and, relevantly, because s.15 applies to both s.8(1) and s.8(4) warrants, was approved in Kennedy.
ii) The arrangements. These are provided for in sub-sections 15(1), (5) and (6). There are also the arrangements referred to in paragraph 42 above by reference to ISA, SSA and CTA, and DPA; and the Code itself makes reference to the arrangements in force with relation to s.15(2) and s.15(3) and specifically with regard to s.16, all of which must be recorded in the records referred to in paragraph 5.17 of the Code.
(a) The ECtHR in paragraph 68 of Malone stated that "the detailed procedures and conditions to be observed do not necessarily have to be incorporated in rules of substantive law", which must "indicate the scope of [the] discretion conferred upon the competent authorities and the manner of its exercise with sufficient clarity, having regard to the legitimate aim of the measure in question, to give the individual adequate protection against arbitrary interference". This is repeated in Bykov, in the passage cited at paragraph 37 above.
(b) It is clear that actual statute is not required – hence the approval of the Code in Kennedy (and its anticipated approval in Liberty v UK). The Code itself, as set out above, refers to the underlying arrangements. Whether or not the Court in Liberty v UK considered the Code in detail, and thus noticed the reference in it to the arrangements, the way the Court dealt with the Code was by noting (in paragraph 68) that "it is possible for a state to make public certain details about the operation of the scheme of external surveillance without compromising national security". The Court in Kennedy, in specifically approving the availability of reference to the Code, approved (at paragraph 156) its earlier judgment in Silver, reference to which had formed part of the conclusion of this Tribunal in British Irish Rights Watch.
"The Court reiterates that when balancing the interest of the respondent State in protecting its national security through secret surveillance measures against the seriousness of the interference with an applicant's right to respect for his or her private life, it has consistently recognised that the national authorities enjoy a fairly wide margin of appreciation in choosing the means for achieving the legitimate aim of protecting national security (see, inter alia, Klass and Others, cited above, p. 23, § 49; Leander, cited above, p. 25, § 59; and Malone, cited above, pp. 36-37, § 81). Nevertheless, in view of the risk that a system of secret surveillance for the protection of national security may undermine or even destroy democracy under the cloak of defending it, the Court must be satisfied that there exist adequate and effective guarantees against abuse (see Klass and Others, cited above, pp. 23-24, §§ 49-50; Leander, cited above, p. 25, § 60; Camenzind v. Switzerland, judgment of 16 December 1997, Reports 1997-VIII, pp. 2893-94, § 45; and Lambert, cited above, p. 2240, § 31). This assessment depends on all the circumstances of the case, such as the nature, scope and duration of the possible measures, the grounds required for ordering them, the authorities competent to authorise, carry out and supervise them, and the kind of remedy provided by the national law (see Klass and Others, cited above, pp. 23-24, § 50)."
This is reiterated in paragraph 77 of the Court's judgment in Association for European Integration and Human Rights v Bulgaria App No. 62540/00 28 June 2007.
"161. In respect of the duration of any telephone tapping, the Act clearly stipulates, first, the period after which an interception warrant will expire and, second, the conditions under which a warrant can be renewed. Although a warrant can be renewed indefinitely, the Secretary of State himself must authorise any renewal and, upon such authorisation, must again satisfy himself that the warrant remains necessary on the grounds stipulated in section 5(3). In the context of national security and serious crime, the Court observes that the scale of the criminal activities involved is such that their planning often takes some time. Subsequent investigations may also be of some duration, in light of the general complexity of such cases and the numbers of individuals involved. The Court is therefore of the view that the overall duration of any interception measures will depend on the complexity and duration of the investigation in question and, provided that adequate safeguards exist, it is not unreasonable to leave this matter for the discretion of the relevant domestic authorities. The Code explains that the person seeking the renewal must make an application to the Secretary of State providing an update and assessing the value of the interception operation to date. He must specifically address why he considers that the warrant remains necessary on section 5(3) grounds. Further, under section 9(3) RIPA, the Secretary of State is obliged to cancel a warrant where he is satisfied that the warrant is no longer necessary on section 5(3) grounds. There is also provision in the Act for specific factors in the schedule to the warrant to be deleted where the Secretary of State considers that they are no longer relevant for identifying communications from or to the interception subject. The Code advises that the duty on the Secretary of State to cancel warrants which are no longer necessary means, in practice, that intercepting agencies must keep their warrants under continuous review (see paragraph 55 above). The Court concludes that the provisions on duration, renewal and cancellation are sufficiently clear.
. . .
163. As to the general safeguards which apply to the processing and communication of intercept material, the Court observes that section 15 RIPA imposes a duty on the Secretary of State to ensure that arrangements are in place to secure any data obtained from interception and contains specific provisions on communication of intercept material. Further details of the arrangements are provided by the Code. In particular, the Code strictly limits the number of persons to whom intercept material can be disclosed, imposing a requirement for the appropriate level of security clearance as well as a requirement to communicate data only where there is a "need to know". It further clarifies that only so much of the intercept material as the individual needs to know is to be disclosed and that where a summary of the material would suffice, then only a summary should be disclosed. The Code requires intercept material, as well as copies and summaries of such material, to be handled and stored securely to minimise the risk of threat or loss. In particular, it must be inaccessible to those without the necessary security clearance. A strict procedure for security vetting is in place. In the circumstances, the Court is satisfied that the provisions on processing and communication of intercept material provide adequate safeguards for the protection of data obtained.
164. As far as the destruction of intercept material is concerned, section 15(3) RIPA requires that the intercept material and any related communications data, as well as any copies made of the material or data, must be destroyed as soon as there are no longer any grounds for retaining them as necessary on section 5(3) grounds. The Code stipulates that intercept material must be reviewed at appropriate intervals to confirm that the justification for its retention remains valid.
165. The Code also requires intercepting agencies to keep detailed records of interception warrants for which they have applied an obligation which the Court considers is particularly important in the context of the powers and duties of the Commissioner and the IPT."
We have not cited paragraph 162, because that did not relate to the conclusions of the Court which are common to both s.8(1) and s.8(4) warrants.
"161. In March 2010, the Home Office published on its website a revised draft of the Code . . . the draft was subject to a targeted consultation, lasting 3 months. The aim, in response to the Liberty v UK judgment was to make public, to the extent possible, further information as to how material gathered under s.8(4) warrant comes to be examined following interception. The proposed changes were mainly to chapters 5 and 6. Some minor corrections and updates were also made."
In the event, the amended Code was never brought into force. The Claimants, while recognising that there were thus some proposed changes, do not assert that those changes would resolve their complaints against the existing Code. We have considered the amendments, and although they may constitute improvements in methodology and supervision, which we encourage, we do not consider that the additions call into question the adequacy of the existing Code.
126. The Respondents have agreed at and after the closed hearings, in the circumstances described in paragraph 10 above, also to make the following further Disclosures, by way of a summary of the evidence in Closed (the numbering continues from that in paragraph 47):
3. Those of the Intelligence Services that receive unanalysed intercepted material and related communications data from interception under a s.8(4) warrant have internal "arrangements" that require a record to be created, explaining why access to the unanalysed intercepted material is required, before an authorised person is able to access such material pursuant to s.16 of RIPA.
4. The internal "arrangements" of those of the Intelligence Services that receive unanalysed intercepted material and related communications data from interception under a s.8(4) warrant specify (or require to be determined, on a system-by-system basis) maximum retention periods for different categories of such data which reflect the nature and intrusiveness of the particular data at issue. The periods so specified (or determined) are normally no longer than 2 years, and in certain cases are significantly shorter (intelligence reports that draw on such data are treated as a separate category, and are retained for longer). Data may only be retained for longer than the applicable maximum retention period where prior authorisation has been obtained from a senior official within the particular Intelligence Service at issue on the basis that continued retention of the particular data at issue has been assessed to be necessary and proportionate (if the continued retention of any such data is thereafter assessed no longer to meet the tests of necessity and proportionality, such data are deleted). As far as possible, all retention periods are implemented by a process of automated deletion which is triggered once the applicable maximum retention period has been reached for the data at issue. The maximum retention periods are overseen by, and agreed with the Commissioner. As regards related communications data in particular, Sir Anthony May made a recommendation to those of the Intelligence Services that receive unanalysed intercepted material and related communications data from interception under a s8(4) warrant, and the interim Commissioner (Sir Paul Kennedy) has recently expressed himself to be content with the implementation of that recommendation.
(i) The Code, which was the subject of consideration by the ECtHR, latterly in Kennedy, itself refers to a number of arrangements not contained in the Code, and even in Liberty (at paragraph 68) the ECtHR required the disclosure of only "certain details".
(ii) There is the system of oversight, which the ECtHR has approved, which ensures that such arrangements are kept under constant review.
(i) Whereas in paragraph 3.56 of the Commissioner's Report, one of the paragraphs referred to in paragraph 92 above, the Commissioner stated that he had yet to satisfy himself fully that some of the retention periods were justified, paragraph 4 of the Disclosure states that he has now made a recommendation (said to have been implemented). This is not evidence which could have been given in any detail in open, and is sufficiently summarised by that paragraph in the Disclosure.
(ii) Privacy relies on paragraph 5 of the Disclosure as indicating that there is more that could be disclosed. It states that there may be yet further review, resulting in additional disclosure of matters which may in the future be concluded not to be prejudicial to national security. Plainly, with the assistance of the Commissioner, the position as to what can and cannot safely be disclosed without prejudicing national security will be kept under review. That is a welcome approach. It does not mean that there are any more details which can at present be disclosed without such risk.
(i) Mr Ryder made an argument that the Belhadj documents should not have been produced (in part) by way of gisting, but by way of service of the full document redacted, showing the deletions. Quite apart from the fact that the Tribunal could not see how this arose for consideration in the present case, the Tribunal (differently constituted) has given a reasoned judgment on this very point in Belhadj on 18 November 2014 ( UKIPTrib 13_132-9H_2), to which reference can be made, and which this Tribunal sees no purpose in reconsidering.
(ii) A request for disclosure, at this very late stage, of further documents from the Respondents is now made, by reference to the fact that the Respondents disclosed (in redacted or gisted form) some extracts of the GCHQ compliance procedures in the Belhadj case, relating specifically to legal professional privilege ("LPP"), and it is suggested that similar documents could now be disclosed by the Respondents in this case (although of course, as set out in paragraph 130 above, on a basis far wider than a scope which is limited to LPP). In this case there has been disclosure to the Tribunal by the Respondents pursuant to s.68(6) of RIPA, as referred to in paragraph 46(iv) above, and there has been a closed hearing at which the documents in respect of which the Respondents claim protection on national security grounds have been considered by the Tribunal. The Tribunal in this case is tasked to judge the adequacy of the arrangements, both above and below the waterline, and to judge accessibility, by reference to the extent to which the scope of the discretion of the Respondents is revealed or the nature of the arrangements is adequately signposted. Particularly at this late stage of the proceedings, after the close of the hearings, further disclosure to the Claimants is unnecessary. If there is inadequate signposting above the waterline of the arrangements below the waterline, then the Respondents will fail. This is not a case which depends, particularly at this late stage, upon the need for any further disclosure to the Claimants.
(i) It is right that the Claimants pleaded from the outset that Article 10 applied to investigatory NGOs as to journalists, and that in the Respondents' pleadings this was denied.
(ii) Amnesty in its claim specifically alleged in relation to LPP, but not in relation to NGO confidence, a case (in particular at paragraph 58(g) of its grounds) that there was likely to be no or no adequate (or in any event no accessible) legal framework for the protection of LPP in relation to intercepted documents.
(iii) That case was, by an agreed direction of 14 February 2014, hived off to be dealt with in the Belhadj case, to which Amnesty was joined as an additional claimant.
(iv) There was no similar case made in respect of NGO confidence. The issues in relation to Article 10, as agreed in the 14 February direction were, as discussed in paragraph 12 above, simply mirror images of the same issues under Article 8 and raised (save as set out in paragraphs 149 to 151 below) no further or separate issue.
(v) The arguments raised on Article 10 were led at the hearing by Liberty, according to the skeleton arguments served by the Claimants, and Liberty's skeleton addressed Article 10 succinctly:
(a) In relation to the Prism Issue (iii):
"54. For the same reasons the Claimants submitted that the statutory regime does not satisfy the Article 8(2) "in accordance with the law" requirement, it does not satisfy the Article 10(2) "prescribed by law" requirement".
(b) Similarly (mutatis mutandis) in relation to the s.8(4) issues (vi) and (vii), at paragraphs 102-103 of the skeleton.
(vi) This is exactly how Article 10 was addressed by the Claimants at the hearing, as set out in paragraphs 149-152 below, save for the addition of the argument there addressed, in relation to prior judicial authorisation.
"The enjoyment of the rights and freedoms set forth in this Convention shall be secured without discrimination on any ground such as sex, race, colour, language, religion, political or other opinion, national or social origin, association with a national minority, property, birth or other status."
The claim is made by reference to differential treatment on the grounds of national origin.
i) Protection is needed for those against whom otherwise a s.8(4) warrant could be used to avoid the need for other 'domestic' remedies of surveillance, not available against those abroad. Hence the exceptional nature of a s.16(3) certificate.
ii) Given that the purpose of accessing external communications is primarily to obtain information relating to those abroad, the consequence of eliminating the distinction would be the need to obtain a s.16(3) certificate in almost every case rather than by way of an exception, and normally without the information available in respect of those in the UK. The Respondents rely on what they submit to be obvious, namely that it is harder to investigate terrorism and crime abroad, and difficult if not impossible to provide a case for a certificate under s.16(3) in every case, rather than the exceptional. The numbers of those involved if s.16(3) certificates were extended to those abroad would inevitably be very substantial (we were provided with figures in closed hearing) and this would radically undermine the efficacy of the s.8(4) regime. In any event in relation to a potential target abroad there might not be any or any sufficient information for a s.16(3) certificate.
"(1) Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises.
(2) The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or the rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary."
It was accepted at the hearing that there is no separate argument in relation to Article 10(2), over and above that arising out of Article 8(2), save that there may be a special argument relating to Article 10 with respect to the need for judicial pre-authorisation of a warrant if such were not necessary, as indeed we have found, in respect of Article 8. Reference was made by Mr Ryder to Sanoma Uitgevers BV v The Netherlands  EMLR 4, in which the ECtHR concluded that prior judicial authorisation was required before the state may seize and retain journalistic material. Since it is common ground for the purposes of this case (see paragraph 12 above) that the Claimants may be entitled to the benefit of any protection under Article 10 otherwise available to journalists, it was submitted that the consequences of Sanoma should follow.
(i) In relation to any material intercepted abroad it would always be unlawful for the Intelligence Services to use the absence of a warrant as a device deliberately to circumvent the requirements of UK law by procuring another State to do what they could not lawfully do themselves.
(ii) The indiscriminate trawling for information by interception, whether mass or bulk or otherwise, would be unlawful, as would be the seeking, obtaining or retention of material which is unnecessary or disproportionate. In this context, even if, pursuant to a s.8(4) warrant enabling the interception of substantial quantities of communications, large quantities are lawfully intercepted, material can only be then accessed lawfully if it is necessary in the interests of national security, for the purpose of preventing or detecting serious crime or for the purpose of safeguarding the economic well being of the United Kingdom ("the statutory purposes"); and it is only proportionate if it is proportionate to what is sought to be achieved by lawful conduct.
(iii) Once it has been accessed by the Intelligence Services, either by specific targeting or selection, intercepted material, including communications data, may only be retained for as long as is necessary for the statutory purposes; thereafter it must be destroyed.
(iv) In respect of all intercepted information which they receive and retain by any of these means the Intelligence Services are accountable. The receipt, handling and destruction of material must be carefully managed, monitored and recorded, and all this information must be freely available for inspection by the relevant authorised oversight bodies, who must be given full and ongoing cooperation in their work.
Mr Justice Burton (President)
Mr Robert Seabrook QC
Mrs Justice Carr
The Hon Christopher Gardner QC
His Honour Geoffrey Rivlin QC