Jusletter IT

«They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety.»¹

 

Benjamin Franklin

For the first time in history a democratic society is facing inevitable tension in finding a perfect compromise between the individual’s rights online and national security purposes. Widely affirmed principles applicable to the web assume a well-established balance between the conflicting claims, such as the individual’s rights and national security. The continuous escalation of new emerging threats to national security has forced states to re-consider the balance of civil liberties and national security established in international human rights treaties and implement number of new rules in order to legalise the increasing volume of security measures online. In international debates between politicians and lawyers a number of questions arise about how these measures adjust to the interpretation of the existing universal human rights treaties. Even though the United Nations (hereinafter UN) Human Rights Council² in 2012 affirmed that the human rights are applicable to the Internet as much as offline, the limits of the human rights constraints that favour national security interests were not clarified. As a result, different interpretations of international treaties and, therefore, implementations of legislation and security measures among states emerged with substantially divergent balances for the privacy, freedom of information and national security.

This article follows the balanced approach rather than the one-sided advocacy of libertarians and authoritarians focusing mainly on the interrelationship of privacy, freedom of information and national security concepts as a complex issue, suggesting that a balanced model for implementing rights and freedoms online is to be found in a systematic analysis of state practice, along with an examination of attitudes among the international community as well as the contingent conceptual integration of all three fields. The reader will be guided to current disputes in order to illustrate the difficulties in striking a fair balance between the conflicting claims related to the collection, storing, and analyzing the records of the private electronic communications from the following perspectives: the right to privacy, in particular, as a protection from extraction of information on individuals and contexts; the freedom of information, as in the right to receive and impart information; and national security, as in the security of nation states against man-made threats.

The dynamics of the balance point is affected by the volatile contextual framework of fundamental interests. The terminology of national cyber security entails non-definable nominators which are rapidly changing. The condition of a nation’s security is changing in accordance with a government’s current role and place, its national and contingent political values,³ interests and goals, ⁴ as well as the means and methods preventing and reflecting internal and external threats. The basic organisation and principles of the systems that function to grant national security have additional mutual impact on the changes.⁵ The nature of national security as well as nature of security in whole, is never measured, never certain and, always contains contradicting interests between individuals, society and state against external and internal threats.⁶ Thus, national security does not have any static character,⁷ especially in the cyber sphere. In a similar way, the concept of privacy⁸ does not have an overarching definition but and is contained in plurality⁹ of different things without a singular essence.¹⁰ Therefore, position of scales favouring security and favouring liberty, that have variable characters, depends on the times¹¹ and the perception of threats.¹² These instances seem to coincide with times of war or conflict, when a direct threat to the state’s political and social order can be readily identified.¹³

Majority of discussions which are usually tilted towards either the state or the individual,¹⁴ create a contest of weights on the scales of democratic society. Even if it seems that the interests of individuals and states are contradictory, both civil liberties and national security can co-exist when on both sides sacrifices of one value (either privacy, freedom of information, or national security) are made in order to create a satisfactory balance. The public must be willing to allow some intrusion by government in order to protect national security’s interests when there is a threat present.¹⁵ On the government side, individuals expect an effective model of data management that keeps agencies accountable and the establishment of structural technological changes to Internet architecture with a reducing number of anti-privacy laws. When social agreement on these interests is achieved, mutual beneficial results start to appear: security measures enhance the protection of user’s interests, including protection of privacy, in cyberspace, strengthen defences in cyberspace, improve resilience and diminish the impact of cyber attacks.

The balance point between privacy, freedom of information and restrictive interests of national security in the light of new emerging cyber threats, determines who has a hold over political, military, and economic power.¹⁶ In 2013 Snowden wrote to Brazilian government that the National Security Agency’s (hereinafter NSA) programs were never about terrorism: they were about economic spying, social control and diplomatic manipulation.¹⁷ From an economic point of view, surveillance practices provide insight into other countries' economic policy or behaviour which could affect global markets. A complex and often relatively complete «digital dossier»¹⁸ of individuals can be assembled by private companies as was evidenced in the Apple case when it was caught sharing a year’s worth of location data on every user’s iPhone with state officials.¹⁹ From a military perspective, the possession of surveillance assets provides the confidence to adequately assess the capabilities of a potential partner over time.²⁰ And finally, spying on the UN, European Union (hereinafter EU), the European Parliament, the G20 summit, the Vatican, and world leaders is aimed at gaining advantage in diplomatic negotiations.²¹ These considerations lead progressive states (United States (hereinafter US), United Kingdom (hereinafter UK), Canada) to admit that there are no better alternatives in the current digitized world to effectively protect country’s sovereignty than by advancing defence capacities of information technology and corresponding national legislation.

A number of technologically advanced countries have already adopted regulations to establish legal base for state practices in order to guarantee national security in a digital society. These laws have raised intense concerns among human rights watchers²², journalists and academic representatives²³ that highlight internal state conflicts between civil and political individuals. One of the main concerns is about the power that public authorities gain through new technological means as well as their control of an individual’s data. In 2001 the US signed the Patriot Act that bypasses the Foreign Intelligence Surveillance Court (hereinafter FISA Court)²⁴ and allows direct spying through a new NSA electronic surveillance program.²⁵ In 2014, Russia passed several amendments to its counterterrorism legislation that increased the penalties for, and broadened the definition of terrorist-related crimes.²⁶ In 2015 the UK adopted the Counter-Terrorism and Security Act with security measures through targeted and effective surveillance, criminal investigations and prosecution.²⁷ At the same time, the UK²⁸, like Australia,²⁹ lacks an impartial safeguards system to ensure against the abuse of such powers.³⁰ Thus, states have adopted number of counterterrorism legislative measures that focus on the protection of national security and allow states to take over control over personal data of every individual both inside and outside of a state’s territory.

Much the same state practice can be seen in other cyber-territorially ambitious countries. In November 2014 France adopted the new counterterrorism law which legalised electronic surveillance by public bodies and increased the sentence to seven years if either offence is committed online. In January 2015 France doubled-down on an existing law that allows the shutdown of websites deemed to be «sympathizing with terror».³¹ Many other countries, like Spain, Turkey, Nigeria, and Russia³² continue to develop surveillance practices in spite of intensive social opposition by journalists³³ and other stakeholders.³⁴ And, for the complete picture must be mentioned, there are some exceptions in social attitude: 85percent of Chinese citizens support government control and restrictions of internet content. ³⁵ These examples of recently adopted regulations show that counterterrorist laws already cover the European, American, Russian, Asian and Australian territories with the power of control tilted towards public authorities. Therefore, while the legislative and executive state powers of these countries acknowledge the balance of privacy, freedom of information, and national security at the point of enhanced securitization needs, where individual’s liberties and rights are forced to give priority to national security interests, they mainly serve the interests of states. The worldwide tendency of adopting surveillance laws is evident in the rapidly growing number of the state practices.³⁶ Consider these statistics,³⁷ during the year from May 2013 to May 2014, 41 countries worldwide passed or proposed legislation to penalize legitimate forms of speech online, increase government powers to control content, or expand government surveillance capabilities.³⁸ Therefore, in the light of the current technological arms race³⁹ and the growing number of countries,⁴⁰ such as Russia, Turkey, Uzbekistan,⁴¹ Nigeria and Vietnam, that implement surveillance practices and adopt respective legislation, there is no reason to believe that states will refuse to employ new surveillance capabilities and practices in the near future.

It is important to mention that the balance between privacy, flow of information, and national security cannot be measured without the operation of secret intelligence agencies, such as M15, GCHQ, CIA, FSB etc., been hidden from public as much as possible and now exposed again to improvements. The fact, that democracies do not have the luxury of focusing all their attention on maximizing internal accountability, instead of safeguard their national security, where intelligence has provided critical support,⁴² should be accepted. To assure balanced approach, it is generally accepted among liberal democracies that intelligence services should in theory be subject to law and officials should be accountable for their actions.⁴³ The relationship between secret intelligence services and democracy that has been addressed by assigning distinct agencies with the responsibility for intelligence collection, should be balanced especially in terms of the degree of public transparency that is appropriate in a world which demands scrutiny, assurances and accountability for organisations.⁴⁴ In the current absence of intelligence network agreements,⁴⁵ detailed regulation and potential meaningful democratic accountability in oversight within the individual nations’ needs,⁴⁶ the model of intelligence services performance remains a prerogative of certain state. But one is for certain: the accountability and transparency of secret agencies shall be limited to degree inevitably necessary due to the interests of national security of a specific state.

While states are striving toward securitizing,⁴⁷ courts have pointed, in several decisions, to balanced solutions for states to follow.⁴⁸ The regions of case-law examination will be the EU, the US, the UK, and Australia, as territories which are upheld as democracies and are generally lauded for maintaining a commitment to the protection of human rights.⁴⁹ They are also countries that have each experienced challenges to their national security as a result of both foreign and domestic terrorism.

For the European region, the European Court of Human Rights (hereinafter ECtHR) case-law emphasizes: both the collection of communications data and the interception of content interfere with art 8 of the European Convention of Human Rights (hereinafter ECHR).⁵⁰ In some cases, there are hints in the ECtHR jurisprudence that they may legitimately be treated differently. This way the case-law of the ECtHR suggests that bulk data collection and analysis, in the absence of suspicion, is not in itself a disproportionate interference with the right to respect for private life, but is assessed against a higher standard than individual interferences with the right to privacy.⁵¹ The decisions of the ECtHR illustrate that the EU courts have given priority to national security interests only in those cases where interference with human rights was justified by passing a control «triple» test of necessity, legitimacy and proportionality by means of lawful limitations.⁵² The research from 2012 on examination of the data privacy laws revealed, that the «European standard» has exerted an influence in a majority of the world’s countries⁵³, although, it originated from the universal legal standards established in the Universal Declaration of Human Rights (hereinafter UDHR) and in the International Covenant on Civil and Political Rights (hereinafter ICCPR) which follows the same logic of subordination for rights and restrictions, legally binding on all UN Member States. In European case-law, we see that an unlimited mass communication interception is strictly prohibited. Where the judicial balance gives an advantage to human rights with proportional, legitimate and necessary restrictions, the balance established in national counterterrorism laws tends to hold in favour of state interests. Thus, the gap between balances for the legislative, executive and judicial powers emerges, as the political and judicial concepts for the balance of the privacy, freedom of information and national security in Europe differ substantially.

Compared with the European contradictions, the United States current case-law achieved cohesion in its state practice, regulations and judicial overview after the 9/11 accidents⁵⁴. Before that in 1971 the US courts concluded that the threat level did not justify an infringement of the core values of society, such as privacy or freedom of speech⁵⁵. For example, in the New York Times Co. v. United States⁵⁶ the court ruled that, in attempting to suppress the Pentagon Papers, the government failed to meet the «heavy burden of showing justification for the imposition of prior judicial restraint». However, the 9/11 terrorist attacks caused a crucial shift in the balance of privacy, freedom of information, and national security in the US finding, for the first time, full agreement about that balance between the courts, the US Congress and the President. The US judicial concept made a radical shift both in state practice and judicial decisions after terrorist incidents in 2001.⁵⁷ These incidents brought the longstanding tension between civil liberties and national security into sharp focus which resulted in the provisions of the USA Patriot Act on 24 October 2001,⁵⁸ which was previously turned down by Congress because it eroded civil liberties.⁵⁹ The record search provision made it possible for the FBI to secure client records without judicial oversight, and without notification of the person under surveillance. Each of these provisions removes important layers of oversight and accountability for government law enforcement activities.⁶⁰ Thus, the US judicial concept of balance moved to the completely opposite side from the previous position and now contradicted the judicial balance set in the EU.

Going even deeper in the analysis, the fact should be mentioned that an apparently coherent US model does not mean that there is an internal consensus between judicial and legislative powers: after a federal appellate court’ decision in May 2015 that declared illegal the collection of metadata from every call in and out of the United States, and despite Congress voting to terminate the NSA’ bulk telephone metadata surveillance program due to its illegality, the FISA Court, being urged by the government, ruled in June 2015 that the NSA was free to continue with the program.⁶¹

A similar paradigm shift in the conceptualisation of privacy and national security after 9/11 in 2001 in the US may have resulted for the UK after 7/7 in 2005. Before the terror incidents the case-law of the UK courts (for example, 2001 R v. Khan⁶² and Rehman⁶³) was designed to ensure that practices in surveillance were brought into line with the ECHR requirement that the different kinds of surveillance be authorised in advance, the authorisation in some cases requiring judicial approval. The adoption of the new Counter-Terrorism and Security Act 2015 intended to give Britain some of the «toughest powers in the world»⁶⁴ against terrorism. Thus, the principle allowing the interception of connection only when it is properly justified within the law, are intensely challenged in the UK. In November 2014 this premise was affirmed by the UK home secretary who addressed her strong view to the courts that the provisions of the Counter-Terrorism and Security Bill were compatible with the ECHR and should be implemented.⁶⁵ On 5^th December 2014 the Investigatory Powers Tribunal (hereinafter IPT) in Liberty & Others v. the Security Service, SIS, GCHQ⁶⁶ has ruled that Britain’s legal regime governing mass surveillance of the internet by intelligence agencies does not violate human rights.⁶⁷ The case was appealed to the ECtHR and is awaiting judgment.⁶⁸ Another pending case before the ECtHR is the case of Big Brother Watch v. UK⁶⁹ that concerns bulk data collection and data sharing. The ECtHR will be called upon to determine the issue that collection is of itself an intrusion into privacy which requires careful justification and, in law, a proportionality analysis and provide the final word on the matter.⁷⁰ These recent applications represent the view that the balance of privacy, freedom of information and national security that is, present in US, has already taken place in UK case-law. Therefore, the upcoming decisions of the ECtHR will show the results of the cross-continental battle between legislative and executive powers with judicial ones.

Thus, the present dichotomy of concepts for the balance between executive and judicial powers in Europe cracks the existing framework of the European democracy. The justification by states for receding from the universal treaty requirements is the idea that, apart from its questionable ability to adjust to modern-day threats to national security, the UDHR is not legally binding and that the signatories of the ICCPR who had an «unprecedented number of reservations, understanding, and declarations» rendered the treaty powerless under domestic law.⁷¹ Another reason is, that for states as rational egoists, the «costs of strict adherence to the UN Charter in a world of new security threats» has just become too great.⁷² This way, the grave differences between state practices and the international human rights treaties, which sustained at least surface peace, reflect the enormous imbalance between national executive, legislative and judicial powers, and jeopardize the present rule of law.

The way the technologies and data flows are shaped will have far-reaching effects for the social structures of the digital societies of the future. It is noticeable that the limits of obligations taken by states with international human rights instruments in the context of the new massive technological developments are undetermined. In 2013 the UN General Assembly filled the gap by issuing a resolution⁷³ that called upon states to end privacy violations and prevent further privacy incursions. Still, in the absence of formal guidelines, the British report «A Question of Trust» on interception of communications⁷⁴ by David Anderson is aimed at convincing that the UK practice does not appear to contravene to the ECHR. To promote his argument he expressed that balance must be found between retaining the secrecy of operational tools and methods on the one hand, and, on the other, having a law that is «sufficiently clear in its terms to give citizens an adequate indication as to the circumstances in which and the conditions under which public authorities will access their communications».⁷⁵However, the onus is on governments to demonstrate a practical and effective standard for the future.

It appears more probable that the one and only global model of balance cannot be achieved and constructed due to conceptual contradictions for states that fragment parts of the world, such as, for example, US, China, Iraq, and Germany, who’s political aims and technical capabilities are not coherent. In 2011 between contradicting approaches of the US and Russia, Germany took a mediating role on the idea of a universal cyber convention, that codifies reasonable standards of state behaviour, and expressed support for formulating a codex that would guide government actions in cyberspace.⁷⁶ On the other hand, in 2013 as a response to the NSA spying revelations, Brazil adopted the marco civil with provisions for net neutrality, privacy protection, open government, data storage guidelines and guarantees that platform providers should not be held liable for user content.⁷⁷ So far, Brazil has been an example of state who was willing to save its political autonomy and protect human rights according to the human rights treaties in digital sphere as well. Therefore, states group into territorial collective unities with homogeneous solutions to handle new threats.

The balance point between privacy, freedom of information and national security is under reconsideration by international society which is reviewing the legal grounds for protecting national security and human rights agreed globally after the World War II. Partners of international agreements stand at the cross-road of decision whether it is possible to continue with the balance model according to the existing universal treaties or the «new normal» standard is to be introduced.

After an inclusive and multi-pronged analysis of the matter, it is revealed that terrorist attacks during last decade have intensified implementation of security measures online and escalated adopting surveillance laws by states in order to guarantee national security in a digital society. The absence of a shared vision on the future of legitimate limitations of the human rights produced polar dichotomy between judicial, legislative and executive powers among states. The balance for privacy, freedom of information and national security in US has shifted after changes of state’s practice and judicial concepts. Similar tendencies are followed for the rest digitally advanced states in Europe, Asia, Canada, Russia and Australia. cracked existing understanding of democracy and the rule of law. Intensified implementation of security measures online and laws crack existing understanding of democracy and the rule of law.

Applications has been put before international courts to give interpretation of the existing universal human rights treaties for countries to implement international treaties and provided with balanced guidance on security measures. Deep continental controversy on fundamental concepts of legitimate justifications on limitation of human rights and national security protection demands prevent states agree on one global working model for balance, instead they would rather continue to cooperate through international fragmented unities to be able to handle new threats in even more efficient manner.

This research was granted by ICT4Peace Norms Project. The author is grateful to the International Institute for Strategic Studies in London for interviews and remarks on the draft text. The author deeply appreciates the substantive and financial support provided by Dr. iur. Eneken Tikk-Ringas and Dr. Mika Kerttunen. The model for approach of the article originates from research papers⁷⁸ issued by ICT4Peace Norms Project for Hague Global Conference on Cyberspace.