Skip to main content Accessibility help
×
Home

Bulk Surveillance in the Digital Age: Rethinking the Human Rights Law Approach to Bulk Monitoring of Communications Data

  • Daragh Murray (a1) and Pete Fussey (a2)

Abstract

The digital age has brought new possibilities and potency to state surveillance activities. Of significance has been the advent of bulk communications data monitoring, which involves the large-scale collection, retention and subsequent analysis of communications data. The scale and invasiveness of these techniques generate key questions regarding their ‘necessity’ from a human rights law perspective and they are the subject of ongoing human rights-based litigation. This article examines bulk communications data surveillance through the lens of human rights law, undertaking critical examination of both the potential utility of bulk communications surveillance and – drawing on social science analysis – the potential human rights-related harm. It argues that utility and harm calculations can conceal the complex nature of contemporary digital surveillance practices, rendering current approaches to the ‘necessity’ test problematic. The article argues that (i) the distinction between content and communications data be removed; (ii) analysis of surveillance-related harm must extend beyond privacy implications and incorporate society-wide effects; and (iii) a more nuanced approach to bulk communications data be developed. Suggestions are provided as to how the ‘necessity’ of bulk surveillance measures may be evaluated, with an emphasis on understanding the type of activity that may qualify as ‘serious crime’.

  • View HTML
    • Send article to Kindle

      To send this article to your Kindle, first ensure no-reply@cambridge.org is added to your Approved Personal Document E-mail List under your Personal Document Settings on the Manage Your Content and Devices page of your Amazon account. Then enter the ‘name’ part of your Kindle email address below. Find out more about sending to your Kindle. Find out more about sending to your Kindle.

      Note you can select to send to either the @free.kindle.com or @kindle.com variations. ‘@free.kindle.com’ emails are free but can only be sent to your device when it is connected to wi-fi. ‘@kindle.com’ emails can be delivered even when you are not connected to wi-fi, but note that service fees apply.

      Find out more about the Kindle Personal Document Service.

      Bulk Surveillance in the Digital Age: Rethinking the Human Rights Law Approach to Bulk Monitoring of Communications Data
      Available formats
      ×

      Send article to Dropbox

      To send this article to your Dropbox account, please select one or more formats and confirm that you agree to abide by our usage policies. If this is the first time you use this feature, you will be asked to authorise Cambridge Core to connect with your <service> account. Find out more about sending content to Dropbox.

      Bulk Surveillance in the Digital Age: Rethinking the Human Rights Law Approach to Bulk Monitoring of Communications Data
      Available formats
      ×

      Send article to Google Drive

      To send this article to your Google Drive account, please select one or more formats and confirm that you agree to abide by our usage policies. If this is the first time you use this feature, you will be asked to authorise Cambridge Core to connect with your <service> account. Find out more about sending content to Google Drive.

      Bulk Surveillance in the Digital Age: Rethinking the Human Rights Law Approach to Bulk Monitoring of Communications Data
      Available formats
      ×

Copyright

This is an Open Access article, distributed under the terms of the Creative Commons Attribution licence (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted re-use, distribution, and reproduction in any medium, provided the original work is properly cited.

Footnotes

Hide All

This work was supported by the Economic Social and Research Council, grant number ES/M010236/1. The authors would like to thank the anonymous peer reviewers for their helpful comments. The authors are available for contact at pfussey@essex.ac.uk and d.murray@essex.ac.uk, respectively.

Footnotes

References

Hide All

1 Also referred to as ‘metadata’: for further discussion see Section 2 below.

2 See, eg, the Investigatory Powers Act 2016 (UK), Parts 4, 6 and 7.

3 Government of the United Kingdom, ‘Operational Case for Bulk Powers’, 2016, para 1.7.

4 In the digital age, individuals produce a significant quantity of communications data. This can be used to make revealing inferences about specific individuals, providing insights into, inter alia, their health, sexual orientation and political affiliations: see further below Sections 2 and 5.1.

5 See, in this regard, ECtHR, Szabo and Vissy v Hungary, App no 37138/14, 12 January 2016, para 57; Council of Europe Commissioner for Human Rights, ‘Democratic and Effective Oversight of National Security Services’, May 2015, 19–27.

6 See, in this regard, Lubin, Asaf, ‘“We Only Spy on Foreigners”: The Myth of a Universal Right to Privacy and the Practice of Foreign Mass Surveillance’ (2018) 18 Chicago Journal of International Law 502; Deeks, Ashley, ‘An International Legal Framework for Surveillance’ (2015) 55 Virginia Journal of International Law 291.

7 This article does not intend to analyse the Investigatory Powers Act or its compliance with the requirements of human rights law. Rather, it is presented as an example of modern domestic legislation that regulates advanced surveillance practices. For further information on the Act itself, see McKay, Simon, Blackstone's Guide to the Investigatory Powers Act 2016 (Oxford University Press 2017).

8 Other European surveillance regimes are discussed in European Union Fundamental Rights Agency, ‘Surveillance by Intelligence Services: Fundamental Rights, Safeguards and Remedies in the EU’, Vol I: Member States’ Legal Frameworks (2017).

9 See ECtHR, S and Marper v United Kingdom, App nos 30562/04 and 30566/04, 4 December 2008, para 101.

10 This is broadly similar to the test established in relation to the International Convention on Civil and Political Rights (ICCPR) ((entered into force 23 March 1976) 999 UNTS 171) and the American Convention on Human Rights (Pact of San José, Costa Rica (entered into force 18 July 1978) 1144 UNTS 123). In these treaties reference is made to necessity and proportionality, but not always to the test of necessity ‘in a democratic society’. See, for instance, the discussion of necessity in UN Human Rights Committee, General Comment No 34, Article 19: Freedoms of Opinion and Expression (12 September 2011), UN Doc CCPR/C/GC/34.

11 See, eg, ECtHR, Weber and Saravia v Germany, App no 54934/00, 29 June 2006, paras 103–104.

12 ie, how ‘useful’ bulk surveillance techniques are, in light of the legitimate aims pursued.

13 The UK High Court classified communications data into three broad categories: subscriber data, service data, and traffic data: see Davis and Others v Secretary of State for the Home Department [2015] EWHC 2092, [13].

14 For instance, normal use of a smartphone will indicate the user's location history, the identity of everyone with whom he or she communicates (over email, phone or messaging), the time and duration of this communication, and the user's internet search history.

15 See, eg, Investigatory Powers Act (n 2) s 61; UN Human Rights Council, Report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression – Frank La Rue (17 April 2013), UN Doc A/HRC/23/40, para 15.

16 The utility of bulk communications surveillance is discussed in greater detail in Section 3 below.

17 David Anderson, Independent Reviewer of Terrorism Legislation, ‘A Question of Trust: Report of the Investigatory Powers Review’, June 2015, 129.

18 For example, computational science research has consistently demonstrated how only a few partial scraps of data can be merged to reveal a comprehensive picture of someone's identity. This includes the sufficiency of only four spatio-temporal points to identify 95% of both an individual's identity and their unique travel patterns: see de Montjoye, Yves-Alexandre and others, ‘Unique in the Crowd: The Privacy Bounds of Human Mobility’ (2013) 3 Nature Scientific Reports 1.

19 Joined Cases C-203/15 and C-698/15 Tele2 Sverige AB v Post-och telestyrelsen and Secretary of State for the Home Department v Watson and Others, Opinion of Advocate General Saugmandsgaard Øe, 19 July 2016, ECLI:EU:C:2016:572, [253] (Tele2 Sverige AB, AG Opinion).

20 Report of the Special Rapporteur (n 15) para 42.

21 This is partially because of the complexity associated with understanding and accurately analysing speech, and the difficulty in effectively automating this practice.

22 Tele2 Sverige AB, AG Opinion (n 19) [257]–[259].

23 See, generally, Mayer-Schönberger, Viktor and Cukier, Kenneth, Big Data: A Revolution that Will Transform How We Live, Work, and Think (John Murray 2013).

24 ie, the collection of communications data relating to a specific individual, initiated on the basis of a reasonable suspicion that that individual is engaged in criminal activity.

25 See, inter alia, Lyon, David, Surveillance after Snowden (Polity Press 2015).

26 Investigatory Powers Act (n 2) s 87. If this retained data is accessed by the intelligence and security services and therefore becomes ‘operationally relevant’, it is possible that it may be retained by these agencies for significant periods of time, and also potentially reassembled into new forms in the future, thus ensuring a more enduring legacy. This may be a loophole in existing legislation, such as the UK Investigatory Powers Act, which has the effect of facilitating the retention of communications data for significantly longer than envisaged in the legislation.

27 Investigatory Powers Act (n 2) s 61(7)(a), (b) and (f), respectively.

28 See ECtHR, Barbulescu v Romania, App no 61496/08, Judgment, 12 January 2016, para 36.

29 The ECtHR examined the right to private life and freedom of expression together in Telegraaf Media Nederland Landelijke Media BV and Others v The Netherlands, App no 39315/06, 22 November 2012, para 88. The CJEU similarly discussed both privacy and expression in Joined Cases C-203/15 and C-698/15 Tele2 Sverige AB v Post-och telestyrelsen and Secretary of State for the Home Department v Watson and Others, Judgment, 21 December 2016, ECLI:EU:C:2016:970, [92], [93]. For further discussion on the content of the right to freedom of expression, see UN Human Rights Committee (n 10).

30 A similar test is applied when evaluating compliance with the ICCPR (n 10): UN Human Rights Committee (n 10) para 22.

31 See, eg, Operational Case for Bulk Powers (n 3); Anderson (n 17); David Anderson, Independent Reviewer of Terrorism Legislation, ‘Report of the Bulk Powers Review’, August 2016; Privacy and Civil Liberties Oversight Board, ‘Report on the Telephone Records Program Conducted under Section 215 of the USA Patriot Act and on the Operations of the Foreign Intelligence Surveillance Court’, 23 January 2014.

32 Anderson (2016), ibid para 4.12.

33 Operational Case for Bulk Powers (n 3) para 1.7.

34 Anderson (n 17) para 9.28.

35 Operational Case for Bulk Powers (n 3) para 5.6.

36 ibid 28.

37 ibid para 5.2.

38 ibid paras 5.2–5.3.

39 ibid para 3.13.

40 For instance, a specific individual, or a suspect's device.

41 Operational Case for Bulk Powers (n 3) para 3.17.

42 Anderson (n 17) 337.

43 See, eg, Carpenter v United States, 585 US _ (2018), 12.

44 In the US context, see Privacy and Civil Liberties Oversight Board (n 31) 146.

45 Operational Case for Bulk Powers (n 3) para 9.6.

46 ibid para 9.5.

47 National Research Council of the National Academies, Bulk Collection of Signals Intelligence: Technical Options (National Academy of Sciences 2015) 57.

48 ie, through smartphone location data.

49 National Research Council of the National Academies (n 47) 52.

50 This is particularly useful in the cyber defence context.

51 Operational Case for Bulk Powers (n 3) para 9.18.

52 For example, the UK police and Crown Prosecution Service are reported to have highlighted three benefits of retained data (Anderson (n 17) para 9.45):

  1. (a)

    (a) Conspirators become more guarded in their use of communications as the moment of a crime approaches. Older data may therefore be the best evidence against them.

  2. (b)

    (b) It may be relatively easy to arrest the minor players in a drugs importation or smuggling ring. But by going through their historic communications data, it may become possible to trace the bigger players who have taken care to remain in the background.

  3. (c)

    (c) A time lapse between the incident and the identification of a suspect will mean that old data is needed.

53 For further examples highlighting the utility of retained data provided by the French government, see Tele2 Sverige AB, AG Opinion (n 19) [183].

54 Operational Case for Bulk Powers (n 3) paras 1.8 and 4.5.

55 ibid para 1.8.

56 ibid.

57 Government of the United Kingdom, ‘Operational Case for the Use of Communications Data by Public Authorities’ (undated) 5.

58 Anderson (n 17) para 9.22.

59 Szabo and Vissy v Hungary (n 5) para 73.

60 ‘Case Study: Protecting Northern Ireland’ in Operational Case for Bulk Powers (n 3) 39.

61 ibid.

62 ‘Case Study: Preventing A Kidnap’ in Operational Case for Bulk Powers (n 3) 40.

63 Anderson (n 17) para 9.45.

64 ibid.

65 Of course, evidence of a vital role may be present but restricted on national security grounds.

66 Anderson (n 31) para 4.12.

67 For wide ranging reviews of such impacts see Fussey, Pete, ‘Beyond Liberty, Beyond Security: The Politics of Public Surveillance’ (2008) 3 British Politics 120; Lyon, David, Surveillance Society: Monitoring Everyday Life (Open University Press 2001); Gilliom, John and Monahan, Torin, SuperVision: An Introduction to the Surveillance Society (University of Chicago Press 2013).

68 This may include, for instance, accessing particular information, communicating with particular individuals or organisations, and attending certain events.

69 See Human Rights Committee, Aduayom and Others v Togo, Communication Nos 422/1990, 423/1990 and 424/1990, UN Doc CCPR/C/51/D/422/1990, 423/1990, 424/1990 (30 June 1994), art 7.4; Abrams v United States, 250 US 616 (1919), dissenting opinion of Justice Oliver Wendell Holmes.

70 Gregory L White and Phillip G Zimbardo, ‘The Chilling Effects of Surveillance: Deindividuation and Reactance’, Stanford University Technical Report prepared for the Office of Naval Research, May 1975, http://www.dtic.mil/get-tr-doc/pdf?AD=ADA013230.

71 ibid 14.

72 ibid 5.

73 See Martin Scheinin, ‘Report of the Special Rapporteur on the Promotion and Protection of Human Rights and Fundamental Freedoms while Countering Terrorism (28 December 2009), UN Doc A/HRCD/13/37, para 33; Joined Cases C-293/12 and C-594/12 Digital Rights Ireland v Minister for Communications and Others, Judgment, 8 April 2014, ECLI:EU:C:2014:238, [28]; Tele2 Sverige AB, judgment (n 29) [92]. Also, although a chilling effect is not directly discussed, see Szabo and Vissy v Hungary (n 5) para 68.

74 See, generally, Greenwald, Glenn, No Place to Hide: Edward Snowden, the NSA, and the U.S. Surveillance State (Hamish Hamilton 2014); Brown, IanSocial Media Surveillance’ in Mansell, Robin and others (eds), The International Encyclopedia of Digital Communication and Society (Wiley 2015) 1.

75 Pew Research Center, ‘Americans’ Privacy Strategies Post-Snowden’, 16 March 2015, http://www.pewinternet.org/2015/03/16/Americans-Privacy-Strategies-Post-Snowden.

76 PEN America, ‘Chilling Effects: NSA Surveillance Drives U.S. Writers to Self-Censor’, 12 November 2013, https://pen.org/sites/default/files/2014-08-01_Full%20Report_Chilling%20Effects%20w%20Color%20cover-UPDATED.pdf.

77 ibid 6.

78 Stoycheff, Elizabeth, ‘Under Surveillance: Examining Facebook's Spiral of Silence Effects in the Wake of NSA Internet Monitoring’ (2016) 93 Journalism and Mass Communication Quarterly 296.

79 See generally, inter alia, Sidhu, Dawinder S, ‘The Chilling Effect of Government Surveillance Programs on the Use of the Internet by Muslim-Americans’ (2007) 7 University of Maryland Law Journal of Race, Religion, Gender and Class 375; Starr, Amory and others, ‘The Impacts of State Surveillance on Political Assembly and Association: A Socio-Legal Analysis’ (2008) 31(3) Qualitative Sociology 251; Bloss, William, ‘Escalating US Police Surveillance after 9/11: An Examination of Causes and Effects’ (2007) 4(3) Surveillance and Society 208.

80 Clapper v Amnesty International USA, 568 US 398 (2013) III(B). This case focused on s 702 of FISA. A 2008 amendment allowed the Attorney General and the Director of National Intelligence (Clapper, in this instance) to collect intelligence on individuals reasonably believed to be outside the US. Several US-located civil society groups argued that because they may be in contact with individuals subject to these surveillance measures, they might themselves become objects of scrutiny, with their communications and other interactions monitored. Among other arguments, the plaintiffs argued that such surveillance activities exerted a chilling effect on their First Amendment rights.

81 Penney, Jon, ‘Chilling Effects: Online Surveillance and Wikipedia Use’ (2016) 31 Berkeley Technology Law Journal 117. This study offers empirical evidence of chilling effects on online searches relating to Wikipedia articles following Edward Snowden's revelations of June 2013 and the publicity that followed. The study identifies a reduction of 995,085 (over 30%) visits to Wikipedia sites that could be deemed subject to government surveillance (such as those discussing terrorism, suicide attack and Al-Qaeda, among others).

82 ibid 147.

83 inter alia, Clapper v Amnesty International USA (n 80) III(B).

84 Nunn, Samuel, ‘Seeking Tools for the War on Terror: A Critical Assessment of Emerging Technologies in Law Enforcement’ (2003) 26 Policing: An International Journal of Police Strategies and Management 454.

85 ibid.

86 Fussey, Pete, ‘Protecting Britain's Crowded Spaces from Terrorist Attacks: Key Criminological Reflections’ in Silke, Andrew (ed), Psychology, Terrorism and Counter-Terrorism (Routledge 2010) 164.

87 Wall, Tyler and Monahan, Torin, ‘Surveillance and Violence from Afar: The Politics of Drones and Liminal Security-scapes’ (2011) 15 Theoretical Criminology 239.

88 TEMPORA was a secret GCHQ initiative that infiltrated over 200 fibre optic cables carrying internet traffic. This allowed detailed access to both the content and metadata of enormous quantities of global internet information.

89 See, further, Merton, Robert K, ‘Social Structure and Anomie’ (1938) 3 American Sociological Review 672; Lemert, Edwin M, Social Pathology: A Systematic Approach to the Theory of Sociopathic Behavior (McGraw-Hill 1951).

90 See, further, Becker, Howard S, Outsiders: Studies in the Sociology of Deviance (Free Press 1963).

91 See, further, Norris, Clive and Armstrong, Gary, The Maximum Surveillance Society (Berg 1999).

92 Sewell, Abigail A and Jefferson, Kevin A, ‘Collateral Damage: The Health Effects of Invasive Police Encounters in New York City’ (2016) 93 Journal of Urban Health: Bulletin of the New York Academy of Medicine 42.

93 Sewell, Abigail A, Jefferson, Kevin A and Lee, Hedwig, ‘Living under Surveillance: Gender, Psychological Distress, and Stop-Question-and-Frisk Policing in New York City’ (2015) 156 Social Science & Medicine 1.

94 For authoritative critique on the eroding boundaries between the corrections estate and heavily policed urban spaces see, inter alia, Wacquant, Loic, ‘The New “Peculiar Institution”: On the Prison as Surrogate Ghetto’ (2000) 4 Theoretical Criminology 377.

95 Spalek, Basia, ‘Community Policing, Trust and Muslim Communities in relation to “New Terrorism”’ (2010) 38 Politics and Policy 789.

96 Szabo and Vissy v Hungary (n 5) para 73.

97 ie, ensuring both the protection of the right to life, and the right to freedom of expression or the right to privacy.

98 Mayer, Jonathan, Mutchler, Patrick and Mitchell, John C, ‘Evaluating the Privacy Properties of Telephone Metadata’, (2016) 113(20) PNAS 5536, 5540; doi 10.1073/pnas.1508081113.

99 Tele2 Sverige AB, AG Opinion (n 19) [257].

100 ibid [258].

101 Ian Sample, ‘Even Basic Phone Logs Can Reveal Deeply Personal Information, Researchers Find’, The Guardian, 16 May 2016, https://www.theguardian.com/science/2016/may/16/even-basic-phone-logs-can-reveal-deeply-personal-information-researchers-find.

102 Tele2 Sverige AB, judgment (n 29) [101]. See also Digital Rights Ireland (n 73) [28].

103 See, further, Sidhu (n 79).

104 This is particularly true in relation to the significantly reduced resource implications associated with digital surveillance, compared with other techniques.

105 Carpenter v United States (n 43) 12.

106 ibid 13.

107 Intelligence and Security Committee of Parliament (UK), ‘Privacy and Security: A Modern and Transparent Legal Framework’, HC 1075, 12 March 2015, para 80.

108 ECtHR, Tagayeva and Others v Russia, Judgment, App nos 26562/07, 49380/08, 21294/11, 37096/11, 14755/08, 49339/08 and 51313/08, Judgment, 13 April 2017, para 482.

109 ibid.

110 Case C-362/14 Maximillian Schrems v Data Protection Commissioner, Judgment, 6 October 2015, ECLI:EU:C:2015:650, [94].

111 Digital Rights Ireland (n 73) [39].

112 Davis and Others v Secretary of State for the Home Department (n 13).

113 See Milanovic, Marko, ‘Human Rights Treaties and Foreign Surveillance: Privacy in the Digital Age’ (2015) 56 Harvard International Law Journal 81, 141.

114 Tele2 Sverige AB, AG Opinion (n 19) [259].

115 See Intelligence and Security Committee of Parliament (UK) (n 107) para 80.

116 Szabo and Vissy v Hungary (n 5) para 70.

117 ECtHR, Big Brother Watch and Others v United Kingdom, App nos 58170/13, 62322/14 and 24960/15, 13 September 2018, para 356.

118 Carpenter v United States (n 43).

119 Maximillian Schrems v Data Protection Commissioner (n 110) [94].

120 Digital Rights Ireland (n 73) [93].

121 Maximillian Schrems v Data Protection Commissioner (n 110) [93].

122 Big Brother Watch and Others v United Kingdom (n 117) paras 328–47.

123 Szabo and Vissy v Hungary (n 5) para 73.

124 Tele2 Sverige AB, judgment (n 29) [102].

125 See Joined Cases C-465/00, C-138/01 and C-139/01 Rechnungshof v Osterreichischer Rundfunk and Others, Judgment, 20 May 2003, ECLI:EU:C:2003:294, [71].

126 Investigatory Powers Act 2016 (n 2) s 263.

127 It is noted that the CJEU effectively invalidated elements of the UK Investigatory Powers Act where access to retained communications data was for purposes deemed to fall short of ‘serious crime’. The UK government must now present changes, and put amendments to the legislation before Parliament: Tele2 Sverige AB, judgment (n 29) [125]; Consultation Outcome: Investigatory Powers Act 2016, GOV.UK, 30 November 2017, https://www.gov.uk/government/consultations/investigatory-powers-act-2016.

128 ECtHR, Centrum för Rättvisa v Sweden, App no 35252/08, 19 June 2018, para 112.

129 Big Brother Watch and Others v United Kingdom (n 117) para 314.

130 Szabo and Vissy v Hungary (n 5) para 77; ECtHR, Zakharov v Russia, App no 47173/06, 4 December 2015, para 233.

131 This was discussed in Big Brother Watch and Others (n 117): see conclusions reached at para 387.

132 The role of the Investigatory Powers Commission in this regard is interesting, and although it is too early to reach a conclusion, this body may provide insight into how effective oversight in a national security context may be conducted.

This work was supported by the Economic Social and Research Council, grant number ES/M010236/1. The authors would like to thank the anonymous peer reviewers for their helpful comments. The authors are available for contact at and , respectively.

Keywords

Bulk Surveillance in the Digital Age: Rethinking the Human Rights Law Approach to Bulk Monitoring of Communications Data

  • Daragh Murray (a1) and Pete Fussey (a2)

Metrics

Altmetric attention score

Full text views

Total number of HTML views: 0
Total number of PDF views: 0 *
Loading metrics...

Abstract views

Total abstract views: 0 *
Loading metrics...

* Views captured on Cambridge Core between <date>. This data will be updated every 24 hours.

Usage data cannot currently be displayed