As we covered in yesterday’s Early Edition, Sir Anthony May, the UK’s Interception of Communications Commissioner (the UK’s surveillance watchdog), has concluded in his 2013 Annual Report (full text) to the Prime Minister that the UK’s spy agencies do not carry out “random mass intrusion into the private affairs of law abiding UK citizens.”  In the 87-page annual report released yesterday, Sir Anthony states that the UK government “does not misuse [its] powers under the Regulation of Investigatory Powers Act (RIPA).”  This is undoubtedly an important and compelling report, and in this post, we aim to outline some of its highlights, analyze a few of its important findings, and discuss shortcomings in the report.

A full examination of the grant of powers under the (admittedly complex) RIPA statute is well beyond the scope of our post (although if you are looking for more background on RIPA, may we recommend this brief overview from The Guardian).  Nevertheless, a brief introduction to RIPA and the UK surveillance regime is helpful, particularly to our largely U.S.-based audience, to lay the appropriate foundation to understand the Commissioner’s report.

So, in the most general terms, what is RIPA and what does it do?  In the U.S., there is quite a hodgepodge of legislative and regulatory authority governing surveillance programs, including but not limited to Title III warrants“traditional” FISA ordersSection 215 of the PATRIOT Act, Section 702 of the FAA, EO 12333, and the various regulations and laws that govern human intelligence at home and abroad.  However, in the United Kingdom, almost all covert surveillance by the government, whether electronic surveillance or human surveillance or whether for the purpose of criminal investigations or for intelligence gathering, is governed by a single, comprehensive statute: RIPA.  Originally passed in 2000, RIPA has been revised on numerous occasions over the last decade and half.

Interception of communications, which includes both the electronic interception of the content of communications (e.g., wiretaps) and acquisition of communications data (e.g. call record metadata), is governed by Part I of RIPA.  Regarding content interceptions, RIPA provides for two types of warrants: Section 8(1) and Section 8(4) warrants.  Section 8(1) warrants authorize interception of the content of communications on a single person or a single premises. Whereas, Section 8(4) warrants are not required to name or describe a specific name or target nor a single premises.  However, Section 8(4) warrants are limited to “external communications sent or received outside of the British Islands” (see Section 20). Therefore, they allow for wholesale bulk collection of the contents of communications, provided the communications are not sent and received inside the UK.  In this regard, Section 8(4) warrants can be functionally thought of as the rough equivalent to the authority granted under Section 702 of the FISA Amendments Act.  On the other hand, Sections 21-25 of RIPA govern the acquisition and disclosure of “communications data” (or what in the U.S. has been referred to as “metadata”).  And therefore, we can functionally think of Sections 21-25 as granting similar investigative authorities to that of the Section 215 program in the U.S.

It should be noted that RIPA is far from uncontroversial.  Human rights and civil liberties groups have long called for wholesale reform of RIPA, which many argue has entirely failed to prevent excessive government surveillance (see here, here, and here).  Most recently, a coalition of influential organizations that defend privacy and free expression–Don’t Spy On Usis campaigning for, among other things, an independent inquiry to recommend legislative reform.  At the political level, parliament’s Intelligence and Security Committee is currently conducting an inquiry into whether the current legal framework governing access to the content of private communications, including RIPA, is “‘fit for its purpose, given the developments in information technology.”  Last month, Deputy Prime Minister Nick Clegg (of the Liberal Democrats) asked the Royal United Services Institute to conduct an overarching surveillance review, including considering new legislation, which is scheduled to report after the 2015 general election.  And Shadow Home Secretary Yvette Cooper (Labour Party) also announced last month that it is time for “a full review of RIPA.”

With this background information, we can turn to the important findings of the Commissioner’s report.  In our minds, the most interesting and important section of the report is Section 6, where Sir Anthony raises and addresses several areas of concern within the RIPA authorities.  In particular (and in direct response to the concerns from some members of parliament discussed above), he considers whether technology and the way citizens communicate have developed so rapidly that the law creates loop holes that allow the government to intercept communication content and data that unduly invade individuals’ privacy.  The Commissioners’ answer, however, is an emphatic “no,” concluding that the RIPA statute is “fit for its required purpose”:

“Public authorities do not misuse their powers under RIPA Part I to engage in random mass intrusion into the private affairs of law abiding UK citizens. It would be comprehensively unlawful if they did. I have considered whether there is a material risk that unlawful intrusion might occur in the operation of Section 8(4). Subject to some further investigation, I conclude there is no material risk.

I am quite clear that any member of the public who does not associate with potential terrorists or serious criminals or individuals who are potentially involved in actions which could raise national security issues for the UK can be assured that none of the interception agencies which I inspect has the slightest interest in examining their emails, their phone or postal communications or their use of the internet, and they do not do so to any extent which could reasonably be regarded as significant.” (pg. 63)

Central to the Commissioner’s conclusion that RIPA’s Section 8(4) warrants and its “communications data” acquisition authorities pose no material risk to privacy are the safeguards built into the RIPA statute to prevent abuse.  For example, Section 8(4) warrants are limited by Section 15 of RIPA, which, Sir Anthony concludes, results in a more limited regime than what public disclosures and media reports imply:

“What this all boils down to is that:

  • a section 8(4) warrant permits the interception of generally described (but not indiscriminate) external communications.
  • this may only be lawfully examined if it is within a description certified by the Secretary of State as necessary for a statutory purpose.
  • the selection for examination may not be referable to the communications of an individual who is known to be for the time being in the British Islands unless he or she is the subject of an individual authorisation under section 16(3) or (5)13.
  • the section 8(4) structure does not permit random trawling of communications. This would be unlawful. It only permits a search for communications referable to individuals the examination of whose communications are certified as necessary for a statutory purpose.” (pg. 51)

The acquisition of communications data (meaning, again, the UK’s equivalent of the Section 215 metadata program) similarly has built in safeguards for abuse, which lead Sir Anthony to conclude that there is “no material risk” that innocent persons’ privacy will be violated.

Another important conclusion in the report is with respect to whether British intelligence agencies circumvent domestic oversight regimes by receiving intercepted information from the U.S. that Britain would otherwise be prohibited from acquiring on its own.  Sir Anthony concludes after having received “appropriate assurances” that:

“British intelligence agencies do not circumvent domestic oversight regimes by receiving from US agencies intercept material about British citizens which could not lawfully be acquired by intercept in the UK.” (pg. 63).

Our purpose here isn’t to dissect the legal framework and argue against the report’s conclusions. As we discussed earlier, civil liberty groups and human rights organizations have, for several years, been calling for reform of the RIPA surveillance framework, arguing that it provides too broad surveillance powers with too little oversight — these organizations have done a much better job critiquing the RIPA statute than we could do in the limited space on this blog.  Nevertheless, in closing we want to highlight two aspects inherent in the report that may call into question, or at least temper, some of the Commissioner’s conclusions.

First, it appears that there are still ongoing investigations by the Commissioner into both the use of Section 8(4) warrant and the Sections 21-25 communication data acquisition authorities.  For example, the Commissioner continues to review the “error reports” of two interception agencies regarding the use of Section 8(4) warrants.  Unfortunately, from the report, we do not know which of the two agencies this includes.  From the tenor and tone of the report, the fact that there is an ongoing review of the two agencies does not “materially detract” from the conclusions that the Section 8(4) warrant authorities are conducted “lawfully, conscientiously, effectively and in the national interest.”  However, depending on which agencies continue to be reviewed, this could have an effect on the overall conclusions regarding Section 8(4) authorities.  Likewise, regarding, metadata acquisition, the report states, somewhat casually on page 38, that there may be systematic overuse of acquisition of communication data authorities:

“My office is in the process of undertaking an inquiry into whether there might be an institutional overuse of authorisations to acquire communications data under RIPA Part I Chapter 2. I will report on this inquiry when my investigation is complete, but in any event in my report for 2014.”

Perhaps more fundamentally, its not clear to us that the Commissioner has made a strong enough case that his review of Section 8(4) authorities has been thorough enough to warrant such a definitive conclusion.  Turning to page 18 of the report, we learn that there were 2760 interception warrants issued in 2013, and that to complete the review, the Commissioner inspected 600 of those warrants (less than a third of the total).  However, we learn very little about the quality and type of either the warrants reviewed or the total set of warrants.  For example, we don’t know how many of the total number of warrants were issued under the authorities of Section 8(1) versus the total number of bulk collection warrants under Section 8(4).  Similarly, we cannot tell from the report whether the 600 interception warrants reviewed were a representative sample of the total number.

Perhaps unsurprisingly, some UK human rights organizations have expressed dissatisfaction with Sir Anthony’s findings.  For instance, Liberty, a civil liberties campaigning organization, told The Guardian that the report’s failure to find programs such as Tempora anything less than intrusive was “baffling.” However, these groups do acknowledge that Sir Anthony’s office was “necessarily limited” in this regard, due to the fact that these programs were outside the scope of the Commissioner’s review.

These closing critiques do not doom the report or its conclusions. As Sir Anthony reminds us, the Commissioner is independent of and from the agencies executing the RIPA authorities, and the report does appear to be thorough both in its investigatory reach and reporting.  Indeed, the report is written with such candor and openness, that one can hardly question the sincerity of its belief. Big Brother Watch, a member of the aforementioned Don’t Spy On Us coalition, notes that the report is “a marked improvement on the quality and quantity of information that has been presented in the past.”  Nevertheless, these highlighted concerns should be raised to fully appreciate the value and impact of the report.