United Kingdom Investigatory Powers Tribunal

IN THE INVESTIGATORY POWERS TRIBUNAL

		P.O. Box 33220 London SW1H 9ZQ
		06/02/2015

See Order at bottom of this judgment.

Mr Justice Burton (President):

1. This is the judgment of the Tribunal.
2. The Tribunal delivered a judgment, [2014] UKIPTrib 13_77-H, (to which we refer) on 5 December 2014 ("the December Judgment"), by which we concluded, in paragraph 156, that:

"Save in one possible (and to date hypothetical) respect, . . . the current regime, both in relation to Prism and Upstream and to s.8(4), [of the Regulation of Investigatory Powers Act 2000 (RIPA)], when conducted in accordance with the requirements which we have considered, is lawful and human rights compliant."

Prism and Upstream are US programmes, publicly admitted in the United States by the NSA, referred to in paragraph 4(i) of the December Judgment.

3. The possible exception to which we referred is that described in paragraph 53 of the December Judgment, which arises in the following way.
4. By the Respondents' Disclosure set out in paragraph 47 of the December Judgment, they gave the following confirmation (subject to the caveat there referred to) relating to Prism and/or (on the Claimants' case) Upstream ("the Prism/Upstream arrangements"):

"1. A request may only be made by the Intelligence Services to the government of a country or territory outside the United Kingdom for unanalysed intercepted communications (and associated communications data), otherwise than in accordance with an international mutual legal assistance agreement, if either:

a. a relevant interception warrant under the Regulation of Investigatory Powers Act 2000 ("RIPA") has already been issued by the Secretary of State, the assistance of the foreign government is necessary to obtain the communications at issue because they cannot be obtained under the relevant RIPA interception warrant and it is necessary and proportionate for the Intelligence Services to obtain those communications; or

b. making the request for the communications at issue in the absence of a relevant RIPA interception warrant does not amount to a deliberate circumvention of RIPA or otherwise contravene the principle established in Padfield v. Minister of Agriculture, Fisheries and Food [1968] AC 997 (for example, because it is not technically feasible to obtain the communications via RIPA interception), and it is necessary and proportionate for the Intelligence Services to obtain those communications. In these circumstances, the question whether the request should be made would be considered and decided upon by the Secretary of State personally.

For these purposes a "relevant RIPA interception warrant" means either (i) a s8(1) warrant in relation to the target at issue; (ii) a s8(4) warrant and an accompanying certificate which includes one or more "descriptions of intercepted material" (within the meaning of s8(4)(b) of RIPA) covering the target's communications, together with an appropriate s16(3) modification (for individuals known to be within the British Islands); or (iii) a s8(4) warrant and accompanying certificate which includes one or more "descriptions of intercepted material" covering the target's communications (for other individuals). The reference to a "warrant for interception, signed by a Minister" being "already in place" in the ISC's Statement of 17 July 2013 should be understood in these terms. (Given sub-paragraph (b), and as previously submitted in open, a RIPA interception warrant is not as a matter of law required in all cases in which unanalysed intercepted communications might be sought from a foreign government.)

2. Where the Intelligence Services receive intercepted communications content or communications data from the government of a country or territory outside the United Kingdom, irrespective whether it is / they are solicited or unsolicited, whether the content is analysed or unanalysed, or whether or not the communications data are associated with the content of communications, the communications content and data are, pursuant to internal "arrangements", subject to the same internal rules and safeguards as the same categories of content or data, when they are obtained directly by the Intelligence Services as a result of interception under RIPA."

5. The Respondents made the following further disclosure set out in paragraph 48 of the December Judgment:

"(1) The US Government has publicly acknowledged that the Prism system and Upstream programme, undertaken in accordance with Section 702 of the Foreign Intelligence Surveillance Act, permit the acquisition of communications to, from, or about specific tasked selectors associated with non-US persons who are reasonably believed to be located outside the United States in order to acquire foreign intelligence information. To the extent that the Intelligence Services are permitted by the US Government to make requests for material obtained under the Prism system (and/or on the Claimants' case, pursuant to the Upstream programme), those requests may only be made for unanalysed intercepted communications (and associated communications data) acquired in this way."

(2) As to the request referred to in paragraph 1(b) of the Disclosure above (a "1(b) Request"),

"Any such request would only be made in exceptional circumstances, and has not occurred as at the date of this statement.""

6. We concluded in our Judgment as follows:

"51. In relation to paragraph 1 of the Disclosure, this subjects any requests pursuant to Prism and/or Upstream in respect of intercept or communications data to the RIPA regime, save only for the wholly exceptional scenario referred to as a 1(b) request. A 1(b) request has in fact never occurred, as the [Intelligence and Security Committee of Parliament ("ISC")] has recognised, as set out at paragraph 5 of its Statement, (cited in paragraph 23 [of the December Judgment]), and as now confirmed by the Respondents, as set out in paragraph 48(2) above.

52. In relation to paragraph 2 of the Disclosure, by which the same obligations and safeguards are applied to the receipt of any intercept or communications data pursuant to Prism and/or Upstream as apply when they are obtained directly by the Intelligence Services as a result of interception under RIPA . . . (ii) As Mr Squires accepted, the clarification given within paragraph 1 of the Disclosure, that there will only be a request under Prism and/or Upstream, by reference to the existence of a s.8(4) warrant, which relates to an individual known to be within the British Islands, if a s.16(3) [of RIPA] modification is in place, means that the RIPA safeguards under ss.15 and 16 (dealt with in detail below) in fact apply: except as he pointed out, in respect of a 1(b) Request so far as s.16 safeguards are concerned."

7. We then continued:

"53. The one matter of concern is this. Although it is the case that any request for, or receipt of, intercept or communications data pursuant to Prism and/or Upstream is ordinarily subject to the same safeguards as in a case where intercept or communication data are obtained directly by the Respondents, if there were a 1(b) request, albeit that such request must go to the Secretary of State, and that any material so obtained must be dealt with pursuant to RIPA, there is the possibility that the s.16 protection might not apply. As already indicated, no 1(b) request has in fact ever occurred, and there has thus been no problem hitherto. We are however satisfied that there ought to be introduced a procedure whereby any such request, if it be made, when referred to the Secretary of State, must address the issue of s.16(3)."

8. With that exception we were satisfied as to the lawfulness of the Respondents' arrangements, as so disclosed.
9. We considered further, after reaching our conclusions:

"153. . . However . . . our answers are given with the benefit of the Disclosures by the Respondents given in paragraphs 47-48 . . .

154 It is apparent that the Disclosures are in each case such that their effect is to reveal the existence of a safeguard rendering it less, rather than more, likely that there will be objectionable interference with privacy or arbitrary conduct by the Respondents. . . . But it is obvious that the disclosure as to the procedures relating to the obtaining and treatment of intercept pursuant to Prism is of significance. We shall invite submissions from the parties as to the consequence in respect of whether there has been breach of Article 8 prior hereto, only by virtue of the Disclosures.

155 The Tribunal is satisfied that no further disclosure is required to be made as to the detail of the Respondents' practices and procedures in order to render them sufficiently accessible."

10. By our Order of 5 December 2014 we made declarations that the Prism and/or Upstream arrangements (subject to the exception referred to in paragraphs 7 and 8 above) did not contravene Articles 8 or 10 ECHR, and further that the RIPA regime in respect of ss. 8(4), 15 and 16 of RIPA similarly did not contravene Articles 8 or 10 ECHR.
11. By paragraph 4 of the Order, we directed that the parties serve written submissions according to an agreed timetable, and with a view to the two outstanding issues being resolved by the Tribunal, by agreement of the parties, without a further hearing:

"4. i) Whether by virtue of the fact that any of the matters now disclosed in the judgment of 5 December 2014 were not previously disclosed, there had prior thereto been a contravention of Articles 8 or 10 ECHR. ("The First Issue").

ii) Whether by virtue of the facts and matters set out in paragraph 53 of the judgment of 5 December 2014, there is a contravention of Articles 8 or 10 ECHR." ("The Second Issue").

12. We have subsequently received submissions from all three sets of Claimants, with a response from the Respondents and replies from the Claimants. With regard to the First Issue, no point was raised by any of the Claimants with regard to the s.8(4) regime, and indeed in helpfully enclosing a draft order for our consideration, Matthew Ryder QC for Liberty expressly limited the declaration that he seeks in respect of the First Issue to one relating to the Prism/Upstream arrangements. As requested by the Respondents, therefore, the Tribunal can make it clear, for the avoidance of doubt, that the declaration it made on 5 December 2014 in relation to the RIPA regime was that it is in accordance with the law/prescribed by law and was so prior to the Tribunal's Judgment of 5 December 2014. The First Issue therefore only relates to whether the same applies to the Prism/Upstream arrangements.
13. We shall refer, as we did in the December Judgment, to Article 8 ECHR, but, as set out in paragraphs 12 and 152 of that Judgment, the same reasoning and conclusions apply in respect of both Articles 8 and 10.

The First Issue

14. We deal first with the question as to whether prior to the December Judgment the Respondents' Prism/Upstream arrangements contravened Article 8 and/or 10 ECHR, leaving aside the exception, to which we will return below as the Second Issue.
15. We set out the requirements of Article 8 in paragraph 37 of the December Judgment:

"37. The relevant principles appear to us to be that in order for interference with Article 8 to be in accordance with the law:

(i) there must not be an unfettered discretion for executive action. There must be controls on the arbitrariness of that action.

(ii) the nature of the rules must be clear and the ambit of them must be in the public domain so far as possible, an "adequate indication" given (Malone v UK [1985] 7 EHRR 14 at paragraph 67), so that the existence of interference with privacy may in general terms be foreseeable.

A clear reiteration of these principles is contained in the judgment of the Court in Bykov v Russia 4378/02 21 January 2009."

We cited from paragraphs 76 and 78 of Bykov, ending:

"Consequently, the law must indicate the scope of any such discretion conferred on the competent authorities and the manner of its exercise with sufficient clarity to give the individual adequate protection against arbitrary interference."

16. We continued:

"41. We consider that what is required is a sufficient signposting of the rules or arrangements insofar as they are not disclosed. . . It is in our judgment sufficient that:

(i) Appropriate rules or arrangements exist and are publicly known and confirmed to exist, with their content sufficiently signposted, such as to give an adequate indication of it (as per Malone: see paragraph 37(ii) above).

(ii) They are subject to proper oversight."

17. We set out our conclusions, so far as relevant to this question, in paragraph 55:

"55. After careful consideration, the Tribunal reaches the following conclusions:

(i) Having considered the arrangements below the waterline, as described in this judgment, we are satisfied that there are adequate arrangements in place for the purpose of ensuring compliance with the statutory framework and with Articles 8 and 10 of the Convention, so far as the receipt of intercept from Prism and/or Upstream is concerned.

(ii)This is of course of itself not sufficient, because the arrangements must be sufficiently accessible to the public. We are satisfied that they are sufficiently signposted by virtue of the statutory framework to which we have referred and the Statements of the ISC and the [Interception of Communications] Commissioner quoted above, and as now, after the two closed hearings that we have held, publicly disclosed by the Respondents and recorded in this judgment."

18. The Claimants rely in their submissions upon Liberty v United Kingdom [2009] 48 EHRR 1, to which we referred substantially in the December Judgment, and in particular upon paragraphs 68 and 69, in which, after noting that by the time of their judgment there was a Code in place, the Court did "not consider that the domestic law at the relevant time [our underlining] indicated with sufficient clarity . . . the scope or manner of exercise" of the discretion.
19. Mr Ryder submitted that it is apparent from our December Judgment that:

"It is only by reference to the Disclosures that [we were] satisfied that there was a sufficiently accessible indication to the public of the legal framework and any safeguards. In the absence of the Disclosures any such indications would have been insufficient and the intelligence sharing regime would not have been in 'accordance with the law/prescribed by law'."

We agree.

20. The Respondents made submissions in response, which were summarised and addressed by Mr Squires and Mr Jaffey on behalf of Privacy at paragraph 3 of their submissions in reply:

"(1) Paragraph 1 of the Disclosure "essentially reflects the application of Padfield" [§17(l)]: This is incorrect. Paragraph 1(a) of the Disclosure and the accompanying explanation about what is meant by a "relevant RIPA warrant" is novel, was unknown to the public prior to the Disclosure being published and does not rest on a simple application of Padfield (which is authority for no more than the very general proposition that a public body must not act to frustrate the purpose of a statutory scheme). . .

(2) The application of RIPA "by analogy. . . was known prior to the Judgment through the Commissioner's report" [§17(2)]. The Commissioner's report was published on 8 April 2014, almost a year after the claim was issued. . .

(3) ISC had confirmed that RIPA warrants were in place for Prism [§17(3)]: That too does not assist the Respondents. The ISC report was published on 17 July 2013. Proceedings were issued on 8 July 2013. Furthermore, the ISC did not disclose whether the fact that there were warrants in place resulted from happenstance or reflected the requirements of an internal policy. The ISC's statement left this crucial matter obscure. A person reading the ISC statement would not have been able to deduce the content of the Respondents' internal arrangements . . .

(4) The fact of the existence of the arrangements was known [§17(3)] . . . It is not in dispute that some arrangements existed. The problem was that none of their contents was made public."

We agree with Privacy's submissions.

21. The Respondents further submitted that:

"It is a non sequitur to argue, as the Claimants do, that because the Disclosure shows that it was possible to make further information . . . public, the regime was previously not "in accordance with the law" simply because that further information had not been disclosed."

We are however satisfied, as Mr Ryder submitted, that, without the disclosures made, there would not have been adequate signposting, as we have found was required and has now, as a result of our Judgment, been given.

22. Although the first requirement of Article 8, set out in paragraph 37(i) of the December Judgment and in paragraph 15 above, is satisfied, the second requirement, as set out in paragraph 37(ii) of the December Judgment, was only satisfied by the Disclosures being made public in our Judgment.
23. We would accordingly make a declaration that prior to the disclosures made and referred to in the Tribunal's Judgment of 5 December 2014, the regime governing the soliciting, receiving, storing and transmitting by UK authorities of private communications of individuals located in the UK, which have been obtained by US authorities pursuant to Prism and/or (on the Claimants' case) Upstream, contravened Articles 8 or 10 ECHR, but now complies. This is, with some rewording, the declaration sought by Mr Ryder in his draft.

The Second Issue

24. Mr Ryder included submissions with regard to s.5(3) and 16(1) of RIPA, but, as the Respondents pointed out in response, these submissions were apparently inconsistent with those made by the Claimants at the July hearing, and in particular with the basis of the point made by Mr Squires set out in paragraph 52(ii) of the December Judgment quoted in paragraph 6 above. But in any event they do not fall within the ambit of the only issue before us, set out in paragraph 4(ii) of the 5 December Order and directed to be resolved in the light of paragraphs 53 and 156 of the December Judgment set out in paragraphs 2 and 7 above.
25. The safeguards of ss.15 and 16 of RIPA are set out in paragraph 74 of the December Judgment, including s.16(3). We were satisfied (as set out in paragraph 53 of the December Judgment) that there remained the possibility that in the event of a hypothetical 1(b) request there would not be the safeguard of s.16(3), or at any rate that there was no requirement for it to be applied.
26. Such a safeguard is implicit or explicit in paragraphs 77, 83(14), 86(36), 103 (including the reference to the Commissioner) and 112 to 114 of the December Judgment. In any event by s.15(1) there is a duty upon the Secretary of State to "ensure, in relation to all interception warrants, that such arrangements are in force as he considers necessary for securing . . . in the case of warrants in relation to which there are section 8(4) certificates, that the requirements of section 16 are also satisfied". If the requirements appropriate to a section 8(4) warrant are to be cross-applied in the circumstances of a 1(b) request, then the same safeguards should apply.
27. The Respondents point out, as is the case, that there has been no such 1(b) request. They also point out, by reference to the Disclosure set out in paragraph 48 of the December Judgment, that any request for material obtained under the Prism and/or Upstream programmes could only ever be a request for communications to, from or about tasked selectors. Nevertheless, in our Judgment, this is irrelevant, because it is the system which is being addressed by the agreed Prism issue recorded at paragraph 14 of the December Judgment by reference to the alleged factual premises there set out:

"14. The alleged factual premises agreed for the purposes of the Prism issue (Issue (i)) are as follows:

"1. The US Government's "Prism" system collects foreign intelligence information from electronic communication service providers under US court supervision. The US Government's "upstream collection" programme obtains internet communications under US court supervision as they transit the internet.

2. The Claimants' communications and/or communications data (i) might in principle have been obtained by the US Government via Prism (and/or, on the Claimants' case, pursuant to the "upstream collection" programme) and (ii) might in principle have thereafter been obtained by the Intelligence Services from the US Government. Thereafter, the Claimants' communications and/or communications data might in principle have been retained, used or disclosed by the Intelligence Services (a) pursuant to a specific request from the intelligence services and/or (b) not pursuant to a specific request from the intelligence services."

The issue itself was formulated as follows:

"In the light of factual premises (1) and (2) above, does the statutory regime as set out in paragraphs 36-76 of the Respondents' Open Response to the Claims brought by Liberty and Privacy satisfy the Art. 8(2) "in accordance with the law" requirement?"

28. This issue was addressed at the July hearing by reference to hypothetical and assumed facts, and in accordance with the approach permitted and encouraged by (inter alia) Weber and Saravia v Germany [2008] 46 EHRR SE5 at paragraph 78, whereby, as we pointed out in paragraph 4(ii) of the December Judgment, the jurisprudence permits "general challenges to the relevant legislative regime . . . by those who are unable to demonstrate that the impugned measures had actually been applied to them".
29. It is understandable why the Respondents did not make the matter clear in their previous Disclosure, given the case, which they explained at paragraph 29 of their submissions, that "requiring a statement about the application of a safeguard equivalent to section 16(3) of RIPA as a pre-condition of lawfulness would be requiring a statement relating to a type of request that has not happened, may never happen and could not happen against the factual premises of the claims". Nevertheless it is an important part of the arrangements not previously disclosed.
30. The Respondents have now given the further Disclosure, as contained in paragraphs 19 and 20 of their submissions:

"19. For the avoidance of doubt, the concern identified by the Tribunal would not arise in the first place if a request were made pursuant to paragraph 1(b) of the Disclosure for material to, from or about specific selectors (relating therefore to a specific individual or individuals). In such a situation, the request would be a "targeted" one and the Secretary of State would therefore have approved it for the specific individual(s) in question. In that case, the proper parallel would be with a warrant under s.8(1) of RIPA, not s.8(4). Thus, the safeguards under s.16 of RIPA would not be at issue even by analogy because s.16 of RIPA only applies to the examination stage following interception under s.8(4) warrants (i.e. "untargeted" interception).

20. In those circumstances, the remaining concern is in relation to such untargeted interception. The Respondents can confirm that, in the event that a request falling within paragraph 1(b) of the Disclosure were to be made and approved by the Secretary of State other than in relation to specific selectors (i.e. "untargeted"), the Intelligence Services would not examine any communications so obtained according to any factors as are mentioned in section 16(2)(a) and (b) of RIPA unless the Secretary of State personally considered and approved the examination of those communications by reference to such factors."

31. Privacy in their reply submissions, with which Amnesty agrees, accept that "that safeguard is now in place, but was not in place before December 2014". Liberty does not expressly so accept, but made no submissions to the contrary in their reply. In any event we agree, and the disclosure which resolves the lacuna is now made public in this judgment.
32. In our judgment the appropriate course is to alter the declaration we were otherwise minded to make as set out in paragraph 23 above in respect of the First Issue, so that the declaration we propose to make would recite that "prior to the disclosures made and referred to in the Tribunal's Judgment of 5 December 2014 and this judgment" the Prism and/or Upstream arrangements contravened Articles 8 or 10 ECHR, but now comply.

ORDER

UPON CONSIDERING WRITTEN SUBMISSIONS FROM THE CLAIMANTS AND THE RESPONDENTS

FOR THE REASONS SET OUT IN THE TRIBUNAL'S JUDGMENT OF 5 DECEMBER 2014 ("THE FIRST JUDGMENT") AND THEIR JUDGMENT OF THIS DATE ("THE SECOND JUDGMENT")

IT IS DECLARED

(i) THAT prior to the disclosures made and referred to in the First Judgment and the Second Judgment, the regime governing the soliciting, receiving, storing and transmitting by UK authorities of private communications of individuals located in the UK, which have been obtained by US authorities pursuant to Prism and/or (on the Claimants' case) Upstream, contravened Articles 8 or 10 ECHR, but

(ii) THAT it now complies with the said Articles.

6 February 2015