a. The US Position

In the opinion of the US, persons who are not both within the respective territory and subject to the state’s jurisdiction do not benefit from the treaty’s protection.³⁶ In an attempt to substantiate its position and to present it as a long-established understanding and practice of the Covenant’s applicability, the US argues using the travaux préparatoires and refers to its earlier statements before the HRC.³⁷ The US further relies on the ordinary meaning of the two conditions in Art. 2 (1) ICCPR connected by the conjunctive ‘and’. This position, however, has been contested from the very moment of its articulation³⁸ and raises substantial problems. These shall be explored in the following sub-sections.

b. Rules of Treaty Interpretation in the VCLT

The Vienna Convention rules on treaty interpretation are considered declarations of pre-existing customary international law.³⁹ Arts. 31 to 33 VCLT covers the interpretation doctrines in international law. The first approach centers on the actual text of the provision in question, emphasizing the analysis of the words used.⁴⁰ The second approach considers the intention of the parties adopting the agreement, while the third approach looks at the object and purpose of the treaty as the most important tool in resolving ambiguities.⁴¹ Thus, Art. 31 (1) VCLT requires in the first place a reading of the Covenant in good faith and consistent with the ordinary meaning of the terms used.⁴²

Following this rule of interpretation, the US position seems to be the most natural one, considering the literal meaning of the ‘and’ as a conjunction between ‘within its territory’ and ‘subject to its jurisdiction’.

However, what appears superficially to be the right answer leads to unsustainable results when considering some of the further norms in the ICCPR. The provision regarding the right to return to one’s state⁴³ and the right not to be tried in absentia⁴⁴ presume exactly that individuals can be outside the territory of their state when exercising the rights in question. As Margulies⁴⁵ rightfully points out, these provisions would become a nullity if they would not protect persons at least temporarily outside a state’s territory. Additionally, it would exclude from its reach individuals who are outside the state’s jurisdiction but within its territory, such as foreign diplomats or members of foreign armed forces stationed on the territory pursuant to international agreements between the receiving and the sending state.⁴⁶ Thus, it makes more sense that Art. 2 (1) has to be read interpreted within the context of all of the substantive rights in Art. 6–27 ICCPR.⁴⁷ Otherwise, one would reach an interpretation that is inconsistent with the object and purpose of the treaty in the sense of Art. 31 (1) VCLT or to a result which, as Art. 32 (b) VCLT puts it, is manifestly absurd or unreasonable. It seems more logical to deem that Art. 2 (1) permits and requires a different construction.⁴⁸ This conclusion allows turning to the preparatory work and drafting history of the Covenant as a further means of interpretation, Art. 32 VCLT.

While the provision might have been drafted in a different manner that would have avoided the ambiguity, interestingly, the travaux préparatoires indicate that attempts to delete ‘within its territory’ and to replace ‘or’ for ‘and’ failed for different reasons.⁴⁹ One finds in the official records of the drafting process statements of the chief US delegate⁵⁰ that clearly show that including a reference to ‘territory’ in Art. 2 (1) ICCPR aimed at avoiding obligations to ‘ensure’ the rights of individuals in the territories occupied by the Allies after the Second World War. The obligation to respect, on the other hand, was not considered problematic. The US eschewed the responsibility to guarantee rights within the states with only recently recovered democratic institutions.⁵¹ Potential inconsistencies with the international law of occupation had to be considered as well.⁵²

The facts illustrated above show a very different position by the US Government and a diverse meaning of the terms. Thus, the reading of the US cannot be considered a long-established practice.

In addition it should be also noted that the International Court of Justice has endorsed the extraterritorial applicability of human rights obligations in its ‘Wall’ Advisory Opinion.⁵³

c. Why the Narrow View is not Persuasive in the Surveillance Context

Although the stance of the US was reviewed and conceived as inconsistent with effective international law in general, in order to strengthen this finding it is important to see how the US position would perform in the surveillance context.

As the HRC has stressed in its General Comment (‘GC’) on the nature of legal obligations imposed by the Covenant,⁵⁴ every State party has a legal interest in the performance by every other State party of its obligations. Bearing this in mind, the US reading of the territorial scope of the ICCPR brings a couple of interesting consequences along.

The first one is that it allows states to perform illegal or arbitrary surveillance on anyone outside of their own territory or outside of their jurisdiction.⁵⁵ This automatically means that the Covenant secures the privacy of i.e. Americans only against arbitrary and illegal interferences by their own state, but would leave them unprotected against intrusions by every other state agency in the world.⁵⁶ However, this result most certainly conflicts with the very nature of human rights, to which every human being is entitled by the simple fact of being human and a bearer of human dignity.⁵⁷ Human Rights cannot be assimilated to social compacts, nor depend for their applicability on ‘morally arbitrary criteria’ such as the mere accident of birth.⁵⁸ In the words of Ronald Dworkin, ‘[t]he domain of human rights has no place for passports’.⁵⁹

The second consequence to consider is that with this reading, the task of each state to protect its own subjects from the spying activities conducted by all other states would be impossible to accomplish. This is true to the extent that privacy intrusions would become something ordinary, potentially defeating the object and purpose of the treaty with regards to the right to privacy. Such an understanding of Art. 2 (1) ICCPR would not only offer very little protection with regards to privacy, but most the protection offered for most of the other ICCPR rights would be undermined. And here is where the line must be drawn – where even a small part of the Covenant’s guarantees cannot be fulfilled in any reasonable way as a result of a particular understanding of the treaty, then this understanding is most certainly inadequate.⁶⁰

The illustrated points make it clear that the advocated understanding of the Covenant’s territorial scope by the US is unsustainable under international law. The reference to a state’s territory in Art. 2 (1) ICCPR is not to be read as excluding extraterritorial application per se.

Now that this has been established, the rather similar jurisdictional clauses of the two provisions can be further examined.

a. First Extraterritorial Steps

For the simple reason that ‘jurisdiction’ has emerged as the basis of sovereignty and state’s sovereign powers, the original notion of jurisdiction is necessarily linked with the idea of territorial powers.⁶¹ That is why jurisdiction is closely related to the national territory.⁶² However in the interventionist age⁶³ we live, with the growth of operations conducted abroad and the ever-increasing number of individuals brought under some form of foreign de facto control, the question of human rights treaties’ applicability although vague in terms of the exact guarantees’ scope is quite significant. Taking this in account, the ECtHR has only accepted in exceptional cases that acts carried out by the Member States outside their territories can be an exercise of jurisdiction in the sense of Art. 1 ECHR.⁶⁴

The territorial scope of the ECHR has been a point of contention for quite some time. Although Art. 1 ECHR has received some fair attention in the Court’s case law; the ECtHR’s position is far from uniform. It had a promising start with the Loizidou case,⁶⁵ where the Court accepted that the treaty has a certain degree of extraterritorial effect, coupling the Convention’s application with the requirement of effective control employed by a State Party in a certain area. What mattered was the question of effective control, regardless of whether it was based on an unlawful act, i.e. violation of the territorial state’s sovereignty.⁶⁶ In the later judgement of Cyprus v Turkey, the justices of the Grand Chamber reaffirmed their position, adding to the previous argumentation the need to reject the otherwise resulting ‘regrettable vacuum in the system of human-rights protection’.⁶⁷

In a similar cautious manner, the early HRC only ruled in favour of extraterritorial application in ‘exceptional circumstances’, such as when states acted against their own citizens living abroad.⁶⁸ However, it must be also acknowledged that in comparison to the ECtHR, the Committee’s degree of practice in the matter of extraterritoriality is more limited by the simple fact that it receives fewer complaints than its European counterpart. As will be illustrated below, the consequence is that the Committee often turns to the judgements delivered by the ECtHR for interpretation help.

In the so called Passport cases,⁶⁹ the HRC found that States parties are responsible for infringements of the Covenant committed by their foreign diplomatic representatives. Further, considering the cases of individuals kidnapped by Uruguayan agents in neighbouring countries, the Committee held that States parties are liable for the actions of their agents on foreign territory.⁷⁰ The HRC thus accepted the extraterritorial application of the ICCPR in cases where state agents exercised authority and control over individuals, rather than over areas. This same approach used by the ECtHR in one of its early Cyprus cases,⁷¹ where it had found that States parties are ‘bound to secure the rights and freedoms to all persons under their actual authority’. In other words, what mattered was the relationship between the individual and the state and not where the alleged violation occurred.⁷²

b. Jurisdictional Approaches after Bankovic

What looked like an auspicious (although not entirely uniform) beginning that kept pace with recent developments in the international community, took a step back with the Bankovic admissibility decision.⁷³ In this case, the ECtHR found that the victims of an air strike on a TV station in Belgrade had never been ‘within the jurisdiction’ of the NATO Member States. The Court observed that only effective control – an exercise of all or some public power – over a territory and its inhabitants due to a military occupation or an explicit agreement could bring the situation within the jurisdiction of the ‘occupying’ state. The mere repercussions of States parties’ actions, i.e. dropping bombs over Belgrade, would not trigger control over the territory or individuals in question.⁷⁴ This approach, clearly leaning towards the pronouncement of the Convention’s extraterritorial application as an exception, has casted quite some doubt on the Court’s reasoning, which has been a point of critique and discussion ever since.

The decision in the Issa case⁷⁵ led to further confusion with its observation that ‘Art. 1 of the Convention cannot be interpreted so as to allow a State party to perpetrate violations of the Convention on the territory of another State, which it could not perpetrate on its own territory’. The Court stipulated that even short-term military operations in a territory brought the individuals there under the jurisdiction of the acting state. In the Ilascu case,⁷⁶ the Court affirmed the triggering effect of military control in an area, but this time it reduced the requirement to ‘overall control’.

This so-called ‘more generous approach’⁷⁷ was later followed in the Al-Skeini⁷⁸ judgement as well, where the Court explained that the test of jurisdiction could be met either through control over an individual or over a certain area. In addition, a state can exercise effective control either directly, through its own armed forces, or by means of a ‘subordinate local administration’.⁷⁹ Thus, it would seem that the ECtHR was moving away from the view that jurisdiction is an all-or-nothing matter,⁸⁰ trying to correct to some extent the Bankovic findings by reducing the degree of control required over a territory. A further development in the Court’s approach was brought by the case of Öcalan v Turkey,⁸¹ a case involving the handing-over of a suspect of terrorist-related crimes to Turkish officials in Kenya. The ECtHR noted that the suspect was ‘effectively under Turkish authority and therefore within the jurisdiction of Turkey’ after the handing-over was completed.⁸² Simplifying this statement means that the State party in question does not need to exercise all public powers, for even some exercise of public powers is sufficient to trigger jurisdiction, although not in an exclusive manner with regard to all other states and their rights.

In the meantime, the HRC, which from its very inception has sought a way to provide a reading of Art. 2 (1) ICCPR that renders appropriate legal protection and had therefore followed the disjunctive interpretation, extended the application of the Covenant to actions of state authorities in occupied territories as well.⁸³ For example, as the Committee has stated in its recent comments on Israel, the latter bears responsibility for implementation of the ICCPR within Israel, as well as the Occupied Palestinian Territories in the West Bank and Gaza⁸⁴ where Israel exercised effective jurisdiction and effective control. The HRC’s line of arguments appears to follow Bankovic, that is, it is based on an ‘effective control’ approach.⁸⁵ The Committee has applied this approach in a number of different contexts where the state acts or takes measures on the territory of another state and these have an effect on persons within that other state’s territory.⁸⁶ In GC 31 the Committee reaffirmed its position, asserting that a State Party must provide for the Covenant’s rights to anyone within its power or effective control, even if not situated within its respective national borders and without concern for the circumstances in which such power or effective control was obtained.⁸⁷ In other words, in the view of the Committee, states are always bound to both respect and ensure that individuals receive maximum protection of their human rights.⁸⁸ Through this position the HRC has officially developed a case law that some scholars have criticized for being purposive⁸⁹ and rather goal-oriented. While this presumption may or may not be true and could be the topic of an entirely different investigation, it demonstrates one of the core problems of extraterritoriality – namely that human rights protections are necessarily extraterritorial. This issue will be addressed in a moment under 2. d).

c. The Test of ‘Subject to its Effective Control’ in the Surveillance Context

As it was illustrated above, the effective control over territory or over individuals test represents the best synthesis of the ECtHR’s current extraterritorial jurisprudence, supported by the HRC as well. However, this approach was put into place long before one could even consider the issue of foreign surveillance and its impact on the discussion.

The ‘effective control’ notion is adequate to analyse the actions in real time taken abroad by state agents,⁹⁰ but in the cyber domain, the physical control over persons or territory is not very useful.⁹¹ The NSA has the capacity to remotely control and filter much of the communications of a foreign national abroad and, as indicated in the press, the agency can break different forms of encryptions thanks to so-called ‘back-doors’ it has engineered in many software systems.⁹² In addition, the implantation of tiny radio transmitters in most of the computers produced in the US grants the NSA the capacity to gain control over computers not connected to the Internet.⁹³ Considering also that much of the Internet traffic is routed through the US, makes the picture complete – physical control does not play a role at all. That is why in order to answer the question how surveilling a foreign national’s communications renders that person subject to the surveilling state’s jurisdiction,⁹⁴ the concept needs to be adapted to the cyber context. A narrow standard does not do justice to the rapidly evolving technology, but an official solution has not been established yet, although one of the first cases concerning external communications’ interception is already being dealt with in Strasbourg.⁹⁵

In this regard, Margulies suggests the virtual control test as an approach that at least for now can meet this challenge.⁹⁶ Applying this standard has two advantages: first, it works closely with the notion of control developed and required in the jurisprudence discussed above; second, it considers and bridges the changing technological circumstances that any practitioner would face when dealing with questions of jurisdiction triggering human rights obligations in surveillance cases. The intelligence agencies under scrutiny are perfectly capable of controlling lives and private information with the press of a button. Without a proper assimilation of the effective control test in cyberspace these intrusions would remain unaddressed and would run counter to substantial human rights principles. Privacy rights should be protected even when interferences have been initiated in a place different than the affected individuals’ abode. The virtual control test is thus preferable when assessing the extraterritorial application of privacy interests in cases of foreign surveillance.

d. Type of State Obligations in the Extraterritorial Application

What has become clear from the above sub-sections is that both the ECtHR and the HRC, certainly not uninfluenced from each other’s findings and interpretations, apply the treaties in question outside of the national borders of the States parties. The current stance of both bodies is to answer in affirmative the question of jurisdiction where some kind of public power has a controlling effect over an area or an individual abroad. What needs a point of clarification, however, is what exactly states are obliged to do when their jurisdiction is triggered.

In this regard it is important to turn again to the original treaty provisions. While the ICCPR text requires states to ‘respect and ensure’⁹⁷ the rights in the Covenant and, as it was illustrated above, the Committee has gladly taken up this wording in its demands for effective rights protection, Art. 1 ECHR speaks of ‘securing’ the respective rights and freedoms. However, despite the differences in the wording of these treaty provisions, it has become customary to apply the tripartite typology of respect – protect – fulfil when assessing state’s obligations under a human right treaty.⁹⁸ One can also categorize the duty to respect as closely corresponding to negative obligations,⁹⁹s and the other two dimensions (protect and fulfil) to positive obligations.¹⁰⁰ Since ‘to secure’ in Art. 1 ECHR and ‘to respect and to ensure’ in Art. 2 (1) ICCPR encompass both negative and positive obligations, it can be acted on the assumption that both treaties mean the same.

Now, the problem with the extraterritorial application is constituted by the fact that interventions abroad take place in forms other than extensive and long-term military operations and occupations. In many cases, there are actions that can and are accomplished in a matter of days or even hours. Under these circumstances, the foreign state acting abroad cannot be expected to also positively ensure or protect human rights, for it does not have the respective powers to adopt any legislative, judicial or administrative or other appropriate measures in order to fulfil its positive legal obligations. It can only make sure to respect and not to interfere with the rights of the individuals. A further difficulty arises out of the fact that the bodies entrusted with the application and interpretation of the provisions have either left the question of the exact nature of the obligation unaddressed or have opted for an ‘all-or nothing’ approach. In other words, the approach is everything but conclusive.

Some voices in the literature suggest a completely different solution and advocate a relational or contextual assessment in light of the particular right in the respective situation.¹⁰¹ It seems, however, like a rather pedestrian method to leave the determination of extraterritoriality and the state obligations it triggers to the interpretation of what constitutes a human right and what constitutes a human right violation.¹⁰² Bearing this in mind, the present contribution follows the positions of Milanovic¹⁰³ and Margulies,¹⁰⁴ who make a plausible argument suggesting that the duty to ensure a right should be limited to the cases where the individual is both within a state’s territory and subject to its jurisdiction. Since states always remain in full control of their organs and agents,¹⁰⁵ they are also perfectly capable of complying with their negative obligations. The ‘moral logic of universality’¹⁰⁶ is thus also brought into balance, while jurisdiction still serves as a limiting factor for the normally far more tedious positive obligations.

Now that the type of state obligations in the extraterritorial application of human rights has been established and the test of ‘effective control’ has been adapted to the cyber context, the discourse can be further brought to the actual privacy provisions and their details in the ECHR and the ICCPR.

a. Accessibility

The criterion of accessibility aims at transparency¹⁵⁹ and mandates that exceptions to Art. 17 ICCPR or Art. 8 (1) ECHR cannot be secret.¹⁶⁰ Individuals must be given the opportunity to familiarize themselves with the relevant rules. Against security concerns that more detailed public information about surveillance activities would jeopardize the efficiency of such operations,¹⁶¹ the Strasbourg Court applies as a reference the case of Weber where the German government had incorporated guidelines and limitations in the primary legislation itself.¹⁶² The accessibility of the information had clearly not had any adverse effect on the surveillance activities, ‘strategic monitoring’ or the subsequent uses and sharing of the gathered telecommunications information with other security agencies. It should also be noted that the Court’s approach does not imply full data disclosure or exposure of internal regulations applicable in the respective surveillance agencies. It simply establishes a certain level of accessibility that should be maintained.¹⁶³

The authority for the PRISM program appears to derive from the FISA Amendments Act of 2008 (‘FAA’), which includes a regulation for the premeditated targeting of communications from ‘foreign nationals believed to be not on U.S. soil.’¹⁶⁴ The Act explicitly amended FISA¹⁶⁵ allowing the government an easier and a less strict surveillance conduct under the FISA framework. Section 702 allows the Attorney General together with the Director of National Intelligence to authorize targeting of ‘persons reasonably believed to be located outside the United States’, but does not allow to ‘target’ U.S. citizens. Once authorized, the information gathering may continue up to one year and permits different intelligence agencies to share the obtained information among them.¹⁶⁶ As for Boundless Informant, as of this writing, the legal grounds are not clear and appear to follow a praxis of warrantless monitoring.

In the UK, surveillance of communications comes under two separate law regimes. Interception of content is authorised for three or six months (depending on the purpose) by a warrant specifying an individual or premises from the Secretary of State under Part I Chapter 1 of the Regulation of Investigatory Powers Act 2000 (‘RIPA’). Access to metadata is regulated under Part I Chapter 2 of RIPA, with a large number of government agencies able to self-authorise access to some of this data.¹⁶⁷

As an act of Congress and a statutory law, the FAA has been published in the United States Code.¹⁶⁸ RIPA on its turn is an act of the UK parliament, which has been implemented by the responsible administrative department.¹⁶⁹ It appears that the requirement of publicity is adhered to and the pieces of legislation in question are not kept secret. A certain level of accessibility can be thus affirmed. This appears from the Guardian reports and statements of the Chair of the ISC.¹⁷⁰

b. Foreseeability

The person concerned should be able to foresee the consequences following from the applicable piece of legislation for him. Thus, one important function of this requirement is to make the intrusion ‘predictable’.¹⁷¹ As Nardell puts it, when the citizen with whose rights the State interferes asks ‘Why me?’, he should be able to find an answer in the available legal arrangements that allowed the surveillance in the first place.¹⁷²

To achieve this aim, national law must be ‘sufficiently clear as to the circumstances in which and the conditions on which public authorities are empowered to resort to this secret and potentially dangerous interference with the right to respect for private life and correspondence’.¹⁷³ Also the procedures applicable in the ‘examining, using and storing of intercepted material should be set out in a form which is open to public scrutiny and knowledge’.¹⁷⁴ This should enable every individual to determine which public authorities, mechanisms, or private individuals oversee or control their files.¹⁷⁵ However, the requirement of foreseeability does not provide that individuals should be able to anticipate when authorities are likely to adopt surveillance measures targeting them so that they can adapt their behaviour accordingly.¹⁷⁶

Applying these criteria to the RIPA and to the US Act in question means that both acts should be particularly precise in derogating from Art. 8 (1) ECHR or Art. 17 ICCPR. Section 8 (4) RIPA stipulates that interception warrants do not have to specify a person or premises if it refers to the wiretapping of communications outside of the UK and if an authorizing certificate has been issued by a Secretary of State that also describes the classes of material to be examined. This appears to be the approach by which the UK Government authorises the GCHQ to undertake automated Tempora-searches of communications that originate or terminate outside the British Isles. Consequently, RIPA’s individual scope becomes rather deliberately unpredictable and indiscriminate. It does not concern a specific interference in a particular case, but rather constant and continued private life interferences, ignoring the case-by-case approach developed by the HR bodies.

The NSA framework on its turn does not require an individualized court order in order to collect information on a suspected overseas target.¹⁷⁷ Any foreign national outside the US can be a surveillance target under Section 702 of the FAA as long as the government’s purpose is to obtain foreign intelligence.¹⁷⁸ An individual cannot, however, consult either the RIPA or the FAA for further criteria or clarification of the terms – a reasonable belief of being outside the US is already enough to trigger a one-year spying authorization.¹⁷⁹ In addition, the provisions in question do not indicate which authorities may access and control the targets’ files – i.e. RIPA plainly provides a long list of public bodies permitted to use the information without defining on what ground and under what circumstances. They are thus not making the surveillance process more foreseeable, for the only foreseeable case is that no one can be sure of being exempted.

c. Compatible with the rule of law

Lastly, the law at stake itself must be compatible with the rule of law. This implies that domestic law must be able to provide effective means of legal redress against arbitrary or incongruous interference by public authorities. In this regard both the HRC and the ECtHR endorse the crucial need for independent, especially judicial supervision of approved surveillance measures.¹⁸⁰ In Ekimdziev the Court found that the Bulgarian law did not provide any independent means of review of the intelligence agency’s activities after the initial authorization stage.¹⁸¹ It thus failed to provide adequate guarantees against the risk of abuse.¹⁸² The Court has come to a similar conclusion in the case of Liberty, where the executive enjoyed unconstrained discretion while processing surveillance data.¹⁸³ The Committee has confirmed this approach especially in the cases of telephone tapping and postal interception.¹⁸⁴ Volio also sees the need for an order from competent judicial authorities, in accordance with the law and procedures in force, mandated by the constitutional organs empowered to do so, and in accordance with constitutional and statutory norms.¹⁸⁵

The illustrated case-law raises the bar at a reasonable level and requires the existence of a defence option for the targeted individuals. Thus the crucial question is whether foreigners enjoy some kind of rights in the monitoring process under the provision that authorized the surveillance. With regard to the GCHQ’s activities, its actions outside the UK are exempt from civil and criminal liability under UK law if done pursuant to an authorization of the Secretary of State under section 7 of the Intelligence Services Act of 1994. Similarly, the protections envisioned in section 16 of RIPA which refer to material obtained under a warrant of general section 8 (4) RIPA apply only to individuals located in the British Isles at the time of the interception. It would therefore offer no protection in the present case of foreign surveillance concerns, other than to limit the period of surveillance to a maximum of six months.

With regard to the NSA, although the early adoption of FISA has brought in motion also a special court – the Foreign Intelligence Surveillance Court (‘FISC’) – FISA’s protection and thus abuse prevention under the FAA is quite loose.¹⁸⁶ FISC’s role is limited to reviewing the selection process and extenuation procedures that the Attorney General and the Director of National Intelligence employ to determine intelligence targets.¹⁸⁷ An actual supervision during the implementation of the warrants is not officially provided for. The NSA is also overseen by Congress. But the gaps in this oversight frame have become clearer over the past few months, with many members of Congress directly objecting to Obama’s persistent claim that they have signed off surveillance mandates, and insisting they had been totally unaware of the surveillance activities’ extent.¹⁸⁸

Finally, a curious addition to the debate is the report on the blog of the Wall Street Journal, which revealed that on several occasions NSA officers employed the agency’s technical capacities to spy on their love interests.¹⁸⁹ The report did not present an exact number of the incidents – now known in the media as ‘LOVEINT’, but they all seem to have concerned overseas communications.¹⁹⁰ The occurrence of the mentioned incidents is a further sign of the lack of independent overview and of the urgent necessity to create such oversight.

It is important to note that these considerations relate only to the information available to the public at the moment. Accordingly, the analysis above does not claim to be exclusive, nor complete. It aims rather at showing that the already known but vague and broad statutory basis for surveillance is not sufficient, and based on what is exposed so far, incompatible with the rule of law.¹⁹¹ However, although these findings are not at all unproblematic, since the present contribution does not aim at providing an in-depth analysis of the provisions’ constitutionality under the respective national regimes, the remaining requirements ‘legitimate aim’ and ‘necessity’/’non-arbitrariness’ shall be considered for the sake of the argument as well.

a. Proportionality

When assessing the necessity of a state’s conduct, the notion of proportionality is to be considered first. Even though proportionality is not explicitly mentioned in Art. 8 (2) ECHR, it is one of the main requirements that the Court considers when assessing private life intrusions.²⁰³ In certain cases it even constitutes the final test in the Court’s reasoning and its decisive point.²⁰⁴ From a more empirical perspective, the very core of proportionality requires a balance of the compelling rights and interests.²⁰⁵ States implementing foreign surveillance have thus the difficult task to balance between the protections of their citizens against terrorist threats while preserving also the fundamental rights of those persons suspected of terrorist activities.²⁰⁶ In this regard the Court has granted state parties a margin of appreciation with regard to the actual implementation of security measures.²⁰⁷ However, the implementation of the same margin of appreciation has often been scrutinized by the Court and is applied in the context of Art. 8 ECHR like a squeezebox device to which the proportionality principle adapts accordingly.²⁰⁸ I.e. in Peck the Court stipulated that the margin of appreciation enjoyed by national authorities in the exercise of surveillance powers depends on the nature and seriousness of the interest at stake and the gravity of the interference.²⁰⁹ In Leander v Sweden the ECtHR also emphasized that the scope of a state’s margin of appreciation is related also to the particular nature of the interference involved.²¹⁰

Now, let us apply this approach to the present scenario of foreign surveillance activities. The interference in question is the bulk data collection by the NSA programs and the respective GCHQ’s practices. As was described earlier, their particular nature is quite broad, gathering indiscriminately all the communications, metadata and other raw material available in the intercepted fibre-optic cables, computers and servers. Such surveillance practices aim at collecting ‘all the signals all the time’²¹¹ and threaten the very core of the HR to privacy as stipulated in Art. 8 ECHR and Art. 17 ICCPR. The state’s justification for conducting programs like PRISM, Boundless Informant or Tempora is combating sophisticated forms of terrorism and other serious national security treats, which already in the case Klass v Germany were affirmed as a sufficient reason for the resort to ‘secret surveillance of subversive elements’.²¹²

Thus, it would appear that presently states enjoy a rather broad margin of appreciation, which should be considered when assessing the proportionality between the grave interference with the fundamental human right of privacy and the measures states adopt to antagonize serious national threats.

It cannot be denied that, as a response to sophisticated terrorist threats, states need to adopt sophisticated and innovative strategies to combat these threats. This is especially so with regard to the fact that dealing with terrorists means developing capacities to prevent attacks before they even happen. Although some voices in academia argue that terrorists can be dealt with by the existing bodies and procedures like other criminals²¹³ their approach does not seem convincing in the counter-terrorism context. Law enforcement understands the penalisation for an offence as a deterrent against future crimes. However this traditional concept would hardly have the expected effect on terrorists - there is little ground for the assumption that those willing to commit suicide during their attack can be influenced at all; such people have nothing to lose. In other words, there appear to be some solid arguments as to why combating terrorism justifies additional and, above all, different security means than those used in dealing with ‘regular’ criminals on the domestic and international level.²¹⁴ These arguments do not justify any particular security means or foreign surveillance systems per se but, rather, support the view that public safety measures adapted or specially created to meet this threat are needed.

Now, let us apply this insight in the present surveillance context and in consideration of the available jurisprudence on the topic. The collected personal data is a powerful instrument in the hands of the security agencies, allowing them to look for evidence of serious threats. According to the leaked sources, the gathered intelligence has helped more than once to detect new techniques employed by terrorists to avoid security checks and to identify terrorists planning atrocities.²¹⁵ The data has also been employed to combat child exploitation networks and in matters of cyber defence.²¹⁶ And up until now even broad pieces of surveillance legislation have been understood as compatible and proportionate with the state’s HR obligations. This approach is clearly stipulated in the case of Weber in which the Strasbourg judges concluded that a German law in question did not violate Art. 8 ECHR for the law was limited to cases in which there were factual indicators for suspecting persons of planning, committing or having committed certain serious criminal acts. However, in Weber just a small percent of telecommunications were potentially intercepted and the surveillance was restrained to a precise number of specified countries.²¹⁷ The Court was thus perfectly clear in stating that ‘exploratory’ or ‘general’ surveillance practices are not permitted by the contested legislation.²¹⁸ In other words, ‘personal data collected for one specific purpose (i.e. countering terror threats) can only be used for another specific purpose (i.e. investigating actual offences) if the data could have been independently collected for that second purpose’.²¹⁹ No law enforcement agency should ever collect personal data ‘just in case’.²²⁰

These points are clearly problematic in the vast (and until Snowden’s revelations unimagined) scale of the NSA/GCHQ operations. So far, there are no precise criteria (i.e. for activities or offences that require specific attention by the authorities) on the basis of which surveillance may be conducted. The same applies for the duration of the surveillance, which under the Tempora, Boundless Informant and PRISM programme effectively collects data on an on-going basis. Also important in terms of the ICCPR and the ECHR is the fact that the NSA and GCHQ reportedly have direct access to the programme data of each other, for purposes going far beyond those that have been accepted by the ECtHR to justify the intrusiveness of ‘strategic’ surveillance systems.²²¹

In light of the above-mentioned situation, limitless surveillance as in the present case is clearly out of proportion. The mere statement provided by the authorities that ‘those of us who pose no threat of terrorism and do not inadvertently consort with possible terrorists should not worry that the government will track our phone or internet exchanges or that our privacy will be otherwise infringed’,²²² appears out of place and neglects the core of the present issue. Where data collection takes place, individuals around the globe have to worry on an on-going basis that their communications or communications data may at some point lead to false incrimination, or (as it has already been the case) to public or private misuse of the data. Those who have reasons to be apprehensive of the data collected on them would aspire to behave as unsuspiciously as possible or even refrain from communicating altogether.²²³ Further, foreign surveillance activities and data retention can have an adverse effect on political activities, which would seriously impact the operation of our democratic states and thus our society.²²⁴ It is thus clear that a balance between the conflicting rights and interests must be kept, rather than presuming that one always overtrumps the other.²²⁵ The common good cannot be always legitimately emphasized over considerations of individual rights and personal autonomy.

Presently, there is a significant imbalance between the likely benefit of the surveillance activities and the data obtained through it, and their negative impacts, both on individuals and on society as a whole. Foreign surveillance as presently implemented by the NSA and the GCHQ is a disproportionate restriction of the privacy rights under Art. 8 ECHR and Art. 17 ICCPR.

b. Existing Safeguards

However, before making general conclusions on the NSA/GCHQ surveillance activities the available safeguards should be taken into consideration as well. This is presently of importance, for only in the cases where the ECtHR has contented itself with the existing legal safeguards, has it ruled out a violation of Art. 8(1) ECHR. Thus, following its lead, after examining the proportionality of foreign surveillance measures, a holistic overall assessment of the existing safeguards against abuse must be made. Such adequate and effective safeguards are required regardless of the monitoring system’s structure²²⁶ and should be set out in statutory law.²²⁷ Further, following the notion of proportionality, the required remedy must be tailored to the legitimacy of the state’s power to interfere with the right rather than the right of the individual.²²⁸ The same remedy must be available to anyone with an arguable claim.

In the present case, the available safeguards raise some serious doubts. Some of the problems are already briefly introduced above;²²⁹ some will be addressed for the first time.

To begin with, a large part of the applicable terms is hidden from public view, making it impossible to ascertain whether the existing safeguards achieve their aim. Also, it is difficult to see how this situation is compatible with the UK’s or the US’ obligations to protect the privacy of those under their jurisdiction.

The available procedures, although considered an improvement²³⁰ especially with regard to some of the points defeated by the ECtHR in the UK-related cases, do not bear up the necessary protective threshold required in extraterritorial surveillance procedures. In view of the collected data, there are no known clear rules limiting its use and disclosure or its sharing with other intelligence agencies, including the agencies of the other ‘Five Eyes’ states. So far, there are also no known provisions that ensure that collected data is not unduly retained when it is no longer needed or relevant. In this regard, both intelligence agencies have been reluctant to provide the public with more details on the matter. Whether the data is actually deleted after the period of two or five years cannot be ascertained and the agencies’ argument they would not have the technical capacities to keep it after this time frame is simply not plausible anymore.

Further, because the online services of the private companies cooperating with the NSA are popular globally, and are covered by US law, their users worldwide can expect their personal data to be open to inspection by the NSA with no expectation of legal protection, if the person is outside the US.²³¹ More controversially, the FAA of 2008 conferred retroactive immunity to telecom companies that had been forwarding data to the NSA without the involvement of the FISC.²³² The law requires annual reports from the Attorney General and the Director of the National Intelligence to the FISC, which has the last word on approving the government’s surveillance provisions and its targeting of foreigners outside the US.²³³ However, the same regulation gives the Director of National Intelligence and the Attorney General joint power to issue extensive, yearlong warrants for targeting foreign individuals or groups,²³⁴ obviating the FISC’s warrant approval.

Walton wrote that the ‘government has compounded its noncompliance with the court’s orders by repeatedly submitting inaccurate descriptions of the alert list process’, and that ‘It has finally come to light that the FISC’s authorizations of this vast collection program have been premised on a flawed depiction of how the NSA uses’ the phone call data.²³⁵

Further, there are no real safeguards against abuse, with the current oversight regimes having been shown to be unable to check the growth of NSA or GCHQ employees and contractors who use the monitoring systems to spy on and control their own personal affairs. Frequent over-collection of data by government officials is also a common phenomenon.²³⁶

Stone particularly points out the vagueness of the grounds for some of the surveillance procedures and the lack of independent supervision²³⁷ - these policies and procedures are not published and not subjected to Parliamentary or public democratic scrutiny. For some of the specific targeted surveillance measures conducted by the GCHQ there is no involvement of the Surveillance Commissioners.²³⁸ GCHQ’s compliance with the certificates is subjected to the agency’s own oversight and the results of those audits are confidential as well. Also, although an individual (at least one being on UK soil) willing to file a complaint can turn to the Tribunal established under RIPA 2000, another route for remedy is not foreseen and the work of the RIPA Tribunal itself is not under scrutiny by any other institution. However, the complaint before the Tribunal concerns only search operations or targeted surveillance activities. The generalised warranting process that authorizes the Tempora programme does not qualify as such.

At the very least, more information about how the governments execute the programs is needed.

These technologies have the potential to enable small groups of people to restrict the freedom and to control the perception of a great numbers of individuals.²³⁹ The first signals that during the last presidential campaign Barak Obama has used surveillance technology to reconstruct the behaviour of potential voters in order to comprehend and address their values in his designations are already public. While catching up on the political program of a candidate running for office is the fair choice of the electorate and a democratic right, this is certainly not the case when the same candidate manipulates you by monitoring your activities and tracking your interests. The storage and use of large amounts of intelligence (including communications’ metadata) can and already greatly impacts the relationships between governments and their citizens.²⁴⁰ Information can (and does) provide and facilitate power.²⁴¹

The findings illustrated above bring some serious doubts with regards to the legality of the NSA/GCHQ surveillance programs. The present analysis has highlighted a number of ways in which the foreign surveillance programs seem both unlawful and arbitrary and accordingly out of proportion to the privacy rights they interfere with. Although additional and more concrete information is further needed to present this complicated argument in bullet-proved manner, at a minimum we face the frightening prospects that the US-UK surveillance ensemble is systematically and massively violating the human right to privacy under Art. 8 ECHR and Art. 17 ICCPR. These interferences further suggest that the surveillance legal framework both in Europe and across the Atlantic needs urgent and substantial revision in order to be brought in line with the demands of the ECHR and the ICCPR. Whilst the tensions described above cannot be simply eradicated, they can be managed sufficiently through oversight mechanisms that do permit public scrutiny.