1. Introduction
Future-proofing is an ‘interdisciplinary perspective that offers a systematic framework to deal with future requirements and uncertainties while accommodating innovation’.Footnote 1 Accordingly, although not uniformly defined,Footnote 2 the design of future-proof legislation aims to be adaptive,Footnote 3 and remain ‘true to its original objective’.Footnote 4 The question of whether legislation can also be designed to sustain unforeseen contingencies and developments raises theoretical questions pertaining to the temporality of law, to the nature of legal language, and to the distribution of political power between the three democratic branches.
This article focuses on the various future-proofing strategies in the statutory framework under which the Israel Security Agency (ISA, also known as Shin Bet or Shabak) is authorised to engage in online surveillance. In the context of national security law and the regulation of emerging technology, the article treats resilience to legislative amendments as a measure of future-proofing. If the language of the law withstands the test of time, it will not require further legislative attention, which may impede the adoption of beneficial technologies or, in the case of national security, trigger public debate about security agencies’ measures, which they seek to avoid.
The ISA is the domestic security agency of Israel, responsible for counterterrorism and counterintelligence.Footnote 5 Given the ethnonational character of the conflict in the region, the ISA directs the majority of its operational focus towards countering potential terrorist threats from Palestinians, whether from the Occupied Territories or from the Palestinian citizens of Israel residing within its borders (Arab-Israelis).Footnote 6 ISA measures have also been directed against Jewish extremists (from both ends of the political spectrum).Footnote 7 While the ISA Law generally regulates the activities and functions of the Agency, this article focuses on its provisions concerning online surveillance. It examines future-proofing design features in both the ISA Law and the proposed 2023 Amendment Memorandum.Footnote 8
Pursuant to the account in Section 2 of this article, future-proofing legislation is drafting the law so as to minimise potential future amendments, thereby minimising parliamentary scrutiny, conserving legislative resources, and ascertaining certainty in a particular legal domain.Footnote 9 Beyond the ISA Law, this article advances a general argument that future-proofing is hedging legislative design against uncertainties, which requires the legislator to delegate rulemaking authority to the executive, either directly or tacitly, enabling the latter to adapt to uncertain future circumstances. There are stronger incentives to future-proof surveillance laws, as they operate in two contexts of uncertainty: emerging technologies and national security.Footnote 10 When combined, much like Deeks’s ‘double black box’,Footnote 11 both components of this double uncertainty – the purposive one and the technological one – drive legislators towards future-proof language that affords intelligence and security agencies flexibility and adaptability to new threats and new technologies.
Section 3 of the article maps various future-proofing techniques, and assesses their applicability for surveillance law. Following a short overview of Israeli surveillance law in Section 4, the article proceeds to critically analyse various future-proofing techniques in the ISA Law in Section 5. The article concludes in Section 6, in which it is suggested that while effective governance of emerging technologies for national security cannot entirely dispense with future-proofing, the secrecy and uncertainties involved in such delegation of decision-making power to the executive require the reinforcement of oversight and transparency mechanisms.
2. Future-proofing and uncertainties
Lawmaking is both past- and future-oriented. It is influenced by the past, restrained by it, and draws from it.Footnote 12 However, Wistrich observes that lawmaking is increasingly future-oriented, affording a substantial role for future-oriented rulemaking methods.
Hart observes that law is persistent, and its lifespan exceeds that of its maker.Footnote 13 Law is a system that aims to maintain temporal inertia, to preserve its efficacy over time without changes.Footnote 14 Legal devices the amendment or repeal of which entails complex proceedings possess substantial inertia, which allows prolonged stabilisation of normative expectations.Footnote 15 This applies to legal doctrine as well as to statute.
Unlike common law judicial rulemaking, which (subject to jurisdiction) is constrained by past precedents and traditions, and focuses on the particular past circumstances of the case at hand to derive a general rule, legislation and administrative rulemaking are less constrained.Footnote 16 They are more future-oriented, geared towards governing the future conduct of legal subjects. This requires legal practitioners, particularly rulemakers, to engage in the prediction of future social realities. They must also assess the degree of interpretative flexibility that the rule’s language will afford future legal actors. The rulemaking process aims to control temporal inertia – at times by setting temporal limits to legislation by way of sunset provisions that ensure fewer revisions during a predetermined lifespan of the law, but primarily through language that anticipates predicted and unforeseen future changes.
Accelerated technological development increasingly erodes temporal inertia, as new socio-technical circumstances tend to render existing law obsolete or difficult to apply.Footnote 17 The legislative process is slow, and owing to a lack of resources and incentives, legislative issues go unreviewed for prolonged periods of time.Footnote 18 Indeed, the legal system reacts slowly to rapidly evolving technologies, creating a pacing problem that pervades attempts to regulate emerging technologies.
Although legislators who wish to implement future-oriented policies are faced with uncertainties with respect to most issues, the uncertainties presented by emerging technologies are of a different magnitude. First, the technologies themselves continue to evolve while the relevant policies and legislation are still taking shape. The generative boom in artificial intelligence (AI) following OpenAI’s release of ChatGPT preceded the publication of the first draft of the EU Artificial Intelligence Act,Footnote 19 which did not address generative AI. Subsequent drafts responded by introducing provisions governing ‘foundation models’Footnote 20 or ‘general purpose AI models’.Footnote 21 At times, attempts to regulate immature technologies amount to a waste of legislative attention and resources on unrealised speculations.Footnote 22
Societal impacts of emerging technologies are also difficult to predict.Footnote 23 Accounts of the anticipated social implications of emerging technologies tend to be unbalanced, leaning towards either techno-optimism or techno-pessimism, which in turn may distort the regulatory response. In the context of AI regulation, for example, this presents decision-makers with a regulatory dilemma: whether to adopt an overly precautionary approach driven by AI doomsday scenarios, or to embrace an overly permissive framework that anticipates an era of subservient intelligent machines. Both extreme techno-social imaginaries risk obscuring the AI regulation debate, diverting attention from actual harm and benefits.Footnote 24
Given these uncertainties, and in the light of the costs of legislative proceedings in terms of resources and time, the regulation of emerging technologies may benefit from a more flexible legislative design that extends its temporal inertia. Tying legal language to specific technology risks rendering it obsolete.Footnote 25 As a legislative strategy, technological neutrality aims to regulate activities and the use of technology rather than the technology itself, ‘to regulate behaviour, not technology; to worry about what occurs, not how it occurs’.Footnote 26
Technologically neutral law, therefore, requires a degree of abstraction anchored in the general architecture of function. It refers, for instance, to ‘communication’ but not to ‘transmission’; to ‘equipment’ or ‘devices’ rather than to a ‘computer’, a ‘teleprinter’ or a ‘smartphone’. The classification of legal instruments as technologically neutral or technologically specific is not binary but rather a matter of degree along a continuum of abstraction.Footnote 27
Technological neutrality achieved through abstraction may nonetheless rest on underlying assumptions about the abstract architecture of use that become dated with new techno-social developments. The Dutch online surveillance law, prior to its recent reform, differentiated between cable-bound and non-cable-bound communications (i.e., electromagnetic transmissions via antenna).Footnote 28 While the law avoided referring to particular communication protocols or devices, its level of abstraction was fixed on the signal’s propagation medium, on the assumption that cable-bound communications are harder to intercept and tend to be private in content, and that government surveillance of them should therefore be subject to more stringent rules than non-cable-bound communications (such as military radio communications at the time) that are easier to intercept and tend to be used for less personal or private purposes. These underlying assumptions may have been appropriate for an era predating cellular phones, where most non-cable-bound communications were indeed for military purposes and the distinction accordingly merited different rules. Today, that distinction is obsolete.Footnote 29
Technology-neutral law may also suffer from excess abstraction. Statutory language that relies on open-textured and broad terms may ultimately amount to little more than a hollow outline of general principles. Such laws may indeed be formally stable, but risk generating normative and application uncertainties.Footnote 30
However, future-proof legislative design is not directed solely at producing a language that is adaptive to emerging technologies. National security legislation – and, in particular, those provisions that regulate the clandestine activities of intelligence, counterterrorism or law-enforcement agencies – has its own future-proofing objectives.
The legislative framework surrounding surveillance law is significantly influenced by national security agencies, which function not merely as stakeholders but as active participants in the regulatory process. These agencies contribute substantively to the legislative process by providing comprehensive intelligence briefings to legislators that illuminate operational requirements and prevailing threat assessments,Footnote 31 and by frequently participating in the initial governmental drafting of legislative proposals prior to parliamentary deliberation,Footnote 32 or in subsequent parliamentary committee hearings at which the bill is prepared for a vote.Footnote 33
As with the regulation of emerging technologies, national security law must contend with technological uncertainty. The future development and use of emerging technologies – including, for example, new communications methods and platforms, neuro-sensor applications, smart home devices, AI and large language model agents, and autonomous vehicles – by the potential targets of national security and law-enforcement agencies is unpredictable, as are the surveillance technologies that intelligence agencies will deploy to monitor those targets.
The task of national security agencies is to prevent threats from actualising. Accordingly, the realm in which they operate is one of uncertainty, characterised by ‘known unknowns’ and ‘unknown unknowns’. The latter category of threats – of which national security and law-enforcement agencies are unaware – invites a precautionary response requiring a more permissive, flexible and adaptive legal framework.Footnote 34 Intelligence legislation also tends towards future-proofing on account of operational constraints. While some scholars do not find secrecy to be integral to the concept of intelligenceFootnote 35 and others hold that it is,Footnote 36 the need for operational secrecy is less contentious.Footnote 37 This necessitates keeping surveillance measures, techniques and technologies classified, so as to prevent their circumvention by potential targets.Footnote 38 Accordingly, intelligence agencies will seek to promote legislative language that does not disclose operational capabilities.
Beyond their general risk-averse disposition, national security and intelligence agencies also tend to be wary of external scrutiny. Intelligence agencies tend to cultivate a culture of secrecy,Footnote 39 within which external oversight may be perceived as a leaky threat to operational confidentiality.Footnote 40 Accordingly, intelligence agencies may favour future-proof legislation, with sufficient temporal inertia to forestall frequent parliamentary revisions.
In conclusion, future-proofing legislation consists of hedging it against uncertainty so as to ensure its durability in the face of dynamic socio-technical developments. While general technology regulation faces significant challenges from the pace of innovation and unpredictable societal impacts, these challenges are compounded in the national security domain. National security legislation confronts additional future-proofing arising from its preventative mandate operating under inherent uncertainty, operational secrecy requirements, and institutional resistance to external oversight – factors that collectively demand more flexible and enduring legal frameworks than conventional regulatory contexts.
3. Future-proofing emerging technologies
The previous section provided a brief overview of uncertainties concerning national security and emerging technologies, and identified the motivations for future-proofing legislation in both domains. This section outlines the principal methods of future-proofing and assesses their applicability to the regulation of emerging technologies within the national security context.
From the outset it should be noted that future-proofing transfers uncertainty from the applicability of a rule to the manner of its application. In other words, future-proof legislation may have more temporal inertia, but is less foreseeable, potentially lacking sufficient clarity to afford citizens an adequate indication of the circumstances in which it operates.Footnote 41 In jurisdictions where legal foreseeability is a condition for allowing rules to interfere with fundamental rights, unduly future-proof rules may not withstand judicial review.Footnote 42 However, under recent European jurisprudence, the foreseeability deficit of broadly drafted mass surveillance statutes may be remedied by detailed secondary codes, settled case law and robust oversight architecture.Footnote 43
Legal scholarship on future-proofing focuses primarily on linguistic choices.Footnote 44 Technologically neutral legislative language refrains from explicitly invoking specific technologies, and addresses in the abstract the purposive use of a technology rather than the technology itself. For example, the language of the Israeli Wiretapping Law refers to ‘conversations’ as the target of ‘listening’.Footnote 45 From its inception, this enabled the Wiretapping Law to capture both the placing of listening devices in spaces where conversations take place and the interception of landline telephony. However, this language also provides a flexible legal basis facilitating the interception of electronic communications between computerised devices.Footnote 46
The use of technical terms of art that may appear intelligible to laypeople, but which carry non-intuitive and often classified interpretations, extends the temporal inertia of legislation.Footnote 47 Similarly, future-proof language may employ familiar terms of legal art that are invested with exceptional meaning within their particular context, departing from both lay and professional understanding of those terms.Footnote 48 In the context of national security law, which regularly relies on classified executive interpretation, the departure from the legal text could be substantial to the extent that, as Senator Wyden observed nearly two decades ago, ‘there are two PATRIOT Acts in America. The first is the text of the law itself, and the second is the government’s secret interpretation of what they believe the law means’.Footnote 49 At times, surveillance law reforms include a ‘semantic face-lifting’, the concern of which is less with technologically neutral language than with obscuring common understanding of surveillance practices through the use of euphemisms.Footnote 50 For example, a government ‘golden key’ for legally accessing encrypted communication resonates better than a ‘back door’,Footnote 51 and both may be obscured in legislative language referring to ‘lawful access’ or ‘technical capability notices’.Footnote 52
However, future-proofing is not just about language. Examining future-proofing methods often reveals rulemaking power delegated from the legislature to the executive. For example, future-proofing legislation may be achieved through the adoption of principles rather than rules.Footnote 53 A standards-oriented legal framework may require technologically neutral language in which it is easier to articulate in broad strokes the general principles governing a certain domain. On the other hand, granularity ensures certainty, and legislative abstraction that favours standards over rules generates normative uncertainty that defers decision-making to administrative bodies.Footnote 54
Future-proofing through the delegation of rulemaking powers also manifests when relying on executive legal interpretation of ambiguous language. This tendency is exacerbated in the context of surveillance law, where such interpretation is not only classified but is rarely challenged in adversarial settings,Footnote 55 with its application further shrouded in operational secrecy.Footnote 56
An indirect form of future-proofing may arise when an agency is vested with a general power which, under the agency’s internal interpretation, permits the use of new technologies. This technique of authorising the use and acquisition of emerging technologies tends to arise in the context of surveillance; operational secrecy is required to curtail any adversarial opportunities. Recently, it appears that Israeli police have resorted to this line of argument following revelations about its use of emerging technologies, such as licence plate recognition (LPR) systems and AI-based profiling systems used to identify drug couriers, claiming that these measures were acquired and operated under its general authority to prevent and investigate crimes.Footnote 57
Delegation of rulemaking powers to the executive may also occur through second-order future-proofing methods. Statutory provisions that defer certain matters to executive regulations, internal agency rules or regulatory guidelines provide a general, broad framework within which the executive rulemaker may adapt to evolving technological circumstances. Procedures that allow the executive to expand statutory classifications or powers by adding items to a statutory annex list without full parliamentary proceedingsFootnote 58 represent a prominent example of this approach.
The delegation of rulemaking authority to executive actors raises democratic concerns beyond procedural oversight alone. Where legislatures transfer to executive officials the power to define the scope of legal obligations – particularly obligations conferring intrusive powers over individuals in the name of national security – and through those officials to the operational agencies that ultimately exercise them, they simultaneously transfer the political accountability that democratic governance requires.Footnote 59 Ely argues that broad delegations allow legislators to ‘shrewdly prefer not to have to stand up and be counted’, offloading contentious decisions to ‘faceless bureaucrats’ who are neither elected nor subject to electoral removal.Footnote 60 Additionally, the more that this deferred discretionary power takes the form of effectively a rulemaking power, questions of non-delegation become more acute.Footnote 61
In the national security and surveillance context, this accountability deficit is particularly acute. Not only does the legislature abdicate the policy choice but the exercise of those delegated powers occurs in secret, such that neither the public nor parliament can assess whether the executive has acted within (or beyond) the spirit of the statutory grant. The combination of broad delegative language and operational secrecy thus produces a dual democratic deficit: obscured legislative responsibility at the point of enactment and obscured executive conduct at the point of implementation.Footnote 62
Despite their inherent democratic deficit, these future-proofing techniques are prevalent in surveillance law, for the reasons outlined in Section 2. These methods of transferring rulemaking authority to executive actors – whether tacitly or explicitly – require close attention to statutory safeguards and robust oversight to ensure that the agencies entrusted with this rulemaking authority (which operate under a veil of secrecy) have exercised it in conformity with constitutional standards and democratic values.Footnote 63
However, certain future-proofing techniques bolster oversight procedures or enshrine statutory safeguards against uncertainty. Sunset provisions are a strategy for addressing the uncertainty of national security threats,Footnote 64 or those involving emerging technologies. Limiting the effective period of the legal framework governing these subject areas allows for a degree of regulatory experimentation with techno-social uncertainties in the case of emerging technologies, or to mitigate policymakers’ tendencies to overreact when in the face of emerging security threats.Footnote 65 Sunset provisions tend to affect proportionality analysis, in so far as their ephemeral nature may mitigate potential harm to human rights.Footnote 66 Although sunset provisions are not future-proof in the sense of ensuring their own indefinite existence, the temporal inertia within their effective period is more likely to be fully utilised, functioning as a form of temporal insurance. Furthermore, when challenged in courts, certain litigation strategies may seek to delay proceedings until the law expires of its own accord, obviating the need for a substantive ruling.Footnote 67 It should be noted, however, that sustained reliance on sunset provisions may render sensitive national security programmes vulnerable to partisan gridlock and the contingencies of shifting legislative majorities, potentially jeopardising programme continuity even where operational utility has been repeatedly demonstrated across administrations.Footnote 68
Another technique employed by regulators of emerging technologies is red-lining. Based on a risk-management approach, certain applications of emerging technologies, and at times the technologies themselves, are placed under a moratorium until decision-makers can develop a better understanding of their societal impactsFootnote 69 and potential harm.Footnote 70 This approach is most recently notable in the EU AI Act, which, although lacking a general definition of a prohibited intelligence practice,Footnote 71 identifies certain artificial intelligence practices as categorically prohibited.Footnote 72 Prohibitions and temporary moratoria may be viewed as time-management techniques that afford decision-makers deliberative space. However, red-lining itself faces the future-proofing challenges of correctly identifying the risks posed by emerging technologies in a manner that captures the ‘unknown unknowns’.
An increasingly employed time-management technique in the regulation of emerging technologies is the regulatory sandbox.Footnote 73 Sandboxes allow regulators to explore different regulatory approaches to emerging technologies in a controlled environment, while maintaining dialogue with industry. In future-proofing terms, legislative frameworks for regulatory sandboxes preserve the general temporal inertia of a given field of law, while permitting the regulator to carve out a space of exception – the sandbox – within which rulemaking authority is delegated.
In sum, future-proof surveillance law hedges against uncertainty by establishing safeguards in the form of red-lining and sunset provisions that preserve space for future legislative deliberation and by deferring rulemaking power to executive actors. The latter requires legislative attention and mitigation mechanisms, particularly in the context of national security and surveillance laws. Since national security law frequently shrouds future-proofing mechanisms in a veil of secrecy, these delegation or deferral mechanisms require robust oversight and safeguards to future-proof adherence to civil liberties and human rights standards.
4. Israeli national security surveillance law: An overview
This section provides an overview of Israel’s legal framework pertaining to national security surveillance – from its constitutional foundations to the statutory framework governing the ISA – as background to the following section, which examines future-proofing mechanisms in the ISA Law.
The right to privacy enjoys constitutional status in Israel pursuant to Basic Law: Human Dignity and Liberty, which came into force in 1992.Footnote 74 Privacy is a right that is subject to a general limitation clause, pursuant to which rights protected by the Basic Law may not be infringed ‘save by means of a law that corresponds to the values of the State of Israel, which serves an appropriate purpose, and to an extent that does not exceed what is required, or on the basis of a law, as aforementioned, by force of an explicit authorisation therein’.Footnote 75 The Israeli Supreme Court has held on several occasions that privacy-infringing practices by public authorities require ‘clear, detailed and explicit’ authorisation.Footnote 76 The granular detail that an explicit authorisation may mandate is in tension with the abstraction that future-proofing may require. The Israeli police’s reliance on general law-enforcement powers as the legal basis for adopting new surveillance technologies,Footnote 77 or on an expansive interpretation of more specific powers, serves as an illustration of this tension.Footnote 78
During Israel’s formative years, ISA activities were not subject to statutory regulation. Furthermore, at the time, the ISA was also deployed as a political instrument by the ruling party, Workers of Eretz-Israel Party (Mapai), to monitor leaders of opposition parties across the political spectrum.Footnote 79 The first statutory instrument governing ISA surveillance practices was the Wiretapping Law, the origins of which may be traced to that earlier era when ISA agents planted listening devices in headquarters of rival parties.Footnote 80
In addition to the Wiretapping Law, one of the first laws to mention the ISA explicitly was the Privacy Protection Law,Footnote 81 which contains a provision exempting certain ‘security authorities’ (including the ISA) and their employees from liability for reasonable privacy infringements committed within the scope of their functions.Footnote 82
The Wiretapping Law governs the targeted interception of content for national security and law-enforcement purposes.Footnote 83 The language of the Wiretapping Law is fairly technologically neutral, as the law regulates the interception of ‘a conversation’, defined as ‘aurally or electronically, including but not limited to phones, wireless phones, mobile radio phones, two-way radios, facsimile machines, telex, teleprinters or by electronic communication between computers’. This technologically neutral catch-all definition effectively future-proofed the Wiretapping Law across successive transformations in telecommunications infrastructure, capturing wire-based telephony, digital telephony, mobile communications, email, and – pursuant to a contested interpretation by the Ministry of Justice – the interception of communications via spyware.Footnote 84
Under the Wiretapping Law, upon a written request by the ISA Director, the Prime Minister may authorise the ISA to ‘eavesdrop’ on ‘a conversation’ if the Prime Minister considers it necessary for national security purposes, having also taken into account the privacy infringements involved.Footnote 85 Wiretapping of privileged conversations requires a judicial warrant.Footnote 86 The ISA Director solely may authorise an emergency wiretap under exigent circumstances for a period not exceeding 48 hours, and subject to immediate notification of the Prime Minister and, where the wiretap targets a privileged conversation, also the Attorney-General.Footnote 87
By 2002, following several scandals (the ‘Bus Line 300’ and the Nafso affairs),Footnote 88 the Knesset enacted the ISA Law.Footnote 89 These scandals – one involving extrajudicial killing, the other torture – relied both on systematic cover-up and forgery by senior ISA officials. The ISA Law emerged from the institutional trauma of the 1980s, focusing on the ISA’s stateliness,Footnote 90 its internal security duties (counterterrorism, counterespionage and securing other national security interests),Footnote 91 and executive oversight.
The ISA Law was designed as a relatively short statute, primarily out of concern that detailed legislation would hinder the ISA’s operational capabilities.Footnote 92 This may itself indicate a future-proofing approach favouring flexible standards over exhaustive statutory language, affording the ISA sufficient interpretive latitude to adapt to new threat typologies.
Statutory oversight of ISA activities is exercised primarily through the executive branch – through the Office of the Attorney General at the Ministry of Justice, alongside the external parliamentary oversight exercised by the Knesset’s Foreign Affairs and Security Committee’s Intelligence and Secret Services Subcommittee (the Intelligence Subcommittee).Footnote 93
Section 7 of the ISA Law sets out the Agency’s mission and duties. The ISA’s mission is defined as:Footnote 94
The protection of state security and the order and institutions of the democratic regime against threats of terrorism, sabotage, subversion, espionage and disclosure of state secrets, and the Agency shall also act to safeguard and promote other state interests vital for national state security, all as prescribed by the Government and subject to every law.
The ISA’s statutory duties, accordingly, are (i) the prevention of activities aimed at harming state security, the democratic order or the institutions of the democratic regime; (ii) protection of certain individuals, information and places, as determined by the government; (iii) security vetting for positions and offices in the public service and other bodies; (iv) establishing protection procedures for certain bodies, as determined by the government; (v) intelligence analysis and assessment; and (vi) the collection and receipt of information necessary to fulfil these duties.Footnote 95
Both subsections 7(a) and 7(b) of the ISA Law allow for a certain degree of domain expansion in so far as the government can add other essential state interests to the ISA’s protective mandate. Furthermore, pursuant to subsection 7(b)(6), the government may decide, with the approval of the Intelligence Subcommittee, to deploy the ISA in activities falling outside the areas prescribed in section 7, provided that such activities are designed to safeguard and promote state interests essential for national security.Footnote 96
Under section 11 of the ISA Law, the Prime Minister is empowered to promulgate rules defining certain categories of information as categories required by the ISA to fulfil its statutory duties and that licensed telecommunication service providers are obliged to transfer to the ISA.Footnote 97 ‘Information’ is broadly defined as ‘excluding the content of a conversation as defined in the Wiretapping Law 1979’. Accordingly, all types of metadata (rather than the exhaustive list that governs the Israeli police’s acquisition of metadata under the Communications Data Law)Footnote 98 are capturable under the ISA Law. Similar to the provisions governing ISA wiretapping, the ISA Law does not require any ex ante judicial oversight of the Agency’s metadata collection and use practices. The use of information obtained under the ISA Law is subject only to the authorisation of the ISA Director. Such authorisation may be granted for periods not exceeding six months and renewed indefinitely.Footnote 99 The rules governing the use, retention, security and processing of such information are promulgated by the Prime MinisterFootnote 100 and, like all rules promulgated under the provisions of the ISA Law, remain classified.Footnote 101
Section 11 provides the legal framework under which the ISA is authorised to operate the ‘Tool’, its metadata collection programme, which has been operational since before the enactment of the ISA Law.Footnote 102 The availability of this mass surveillance capability during the emergence of the COVID-19 pandemic may have prompted the Israeli government to employ it for contact-tracing purposes, before any civilian alternative was developed.Footnote 103
Among its operational powers under the ISA Law, the ISA engages in covert searches. The Prime Minister may authorise ISA employees in writing to enter vehicles or premises, conduct a search and obtain information therein, without the permission or knowledge of their respective owners or holders.Footnote 104 The ISA Director may authorise a covert search in exigent circumstances, when written authorisation by the Prime Minister cannot be obtained in time.Footnote 105 Under an expansive reading of the term ‘premises’, the ISA has relied on section 10 as a source of authority to perform remote searches of computers and electronic devices.Footnote 106
Executive rules promulgated under the ISA Law by the Prime Minister, with the approval of the Ministerial Committee for ISA Affairs,Footnote 107 are classified, and unauthorised disclosure thereof constitutes a criminal offence punishable by up to five years’ imprisonment, depending on the circumstances.Footnote 108
The secrecy surrounding the executive rules promulgated under the ISA Law, the parliamentary and ministerial oversight functions, and the executive and internal oversight activities all afford ISA officials a margin of discretion when applying the broadly defined powers to search and conduct surveillance. Furthermore, as the covert activities of the ISA are rarely subject to judicial scrutiny,Footnote 109 the effective limits on ISA activities are those of interpretative imagination and the Agency’s institutional ethos of self-restraint.Footnote 110 In practice, it appears, at least from the outside, that the ISA Law has not constrained the operational effectiveness of the service, as the ISA has not actively sought its amendment.Footnote 111
5. Future-proofing Israeli surveillance law?
The rules governing the ISA’s online surveillance practices were enacted in a markedly different socio-technological era. The latest of these, the ISA Law, was enacted prior to the emergence of the contemporary electronic communications ecosystem, which encompasses smartphones, social media and online platforms, the cloud and, from the mid-2010s, also end-to-end encryption available to ordinary users.Footnote 112 These developments have had a profound effect on the corresponding surveillance technologies employed to target them.Footnote 113
Past and current attempts to amend the ISA Law have addressed some of these developments.Footnote 114 However, these proposed amendments have yet to be enacted, and the ISA appears to remain actively engaged in advanced online surveillance despite the rapidly changing technological environment. The ISA’s legal position is that these amendments do not significantly expand its authority but rather ‘clarify’ its existing powers.Footnote 115
These ex post clarifications indicate unsuccessful future-proofing, where executive interpretation of broadly drafted statutory language proved, in retrospect, insufficiently obvious to preclude the need for amendment. Masking this in the rhetoric of ‘clarification’ seeks to solidify the amendment as the only reasonable meaning of the prior statutory language, thereby ‘past-proofing’ it from retrospective interpretive challenges.Footnote 116
The following section provides an overview of future-proofing mechanisms in the ISA Law, surveying its present form, a past instance of delegation of rulemaking authority to the executive, and its possible future as set out in the Amendment Memorandum.
5.1. Present: Future-proofing in the ISA Law
As the overview in Section 4 demonstrates, the legal framework governing the ISA’s surveillance powers employs a broad range of future-proofing techniques. Section 11 was introduced to the draft ISA Law between its first and subsequent readings, attracting little attention.Footnote 117 The ISA Director at the time, Avi Dichter, later said that ‘we tried to pass it under the radar screen, because it was potentially a very problematic section, even though in 2002 not everybody fully understood the implications of communications metadata’.Footnote 118 Indeed, an uninformed reading of section 11 prior to the declassification of the existence of the ‘Tool’ could easily have missed that this section authorises a mass surveillance metadata collection programme.
The language of section 11 of the ISA Law, which authorises the ISA to run its metadata collection programme, ‘the Tool’, is technologically neutral. The ‘categories of information’ that the Prime Minister may authorise the ISA to acquire from licensed telecommunication service providers are defined without reference to any particular technological architecture. The definition of ‘information’ as ‘[information] … excluding the content of a conversation’ adopts another technologically neutral term from the Wiretapping Law, rendering it applicable to metadata pertaining to any category of communication.
The ISA internally interpreted the term ‘premises’ as extending to computers and electronic devices, thereby authorising ISA employees to conduct remote searches of such devices through hacking or spyware. As ISA searches are not subject to ex ante judicial oversight, until recently this expansive interpretation went unchallenged in court.Footnote 119
A further instance of vague language in section 11 is the term ‘use’ as applied to acquired information. Section 11 provides that while the rules governing information acquisition are promulgated by the Prime Minister, the ISA Director alone is authorised to permit its ‘use’. Although the provision distinguishes between the acquisition and processing of information, the word ‘use’ may be interpreted broadly, in comparison, for example, with the British term of art ‘examine’ (which applies to reviewing intercepted content data),Footnote 120 or even with the European term of art ‘data processing’.Footnote 121
A further future-proofing technique found in the ISA Law is the delegation of rulemaking authority to the executive. The data retention rules applying to licensed telecommunication service providers are to be promulgated by the Prime Minister in classified executive rules. Similarly, rules governing the retention, deletion or purging of information, as well as information security, are to be prescribed in classified executive rules.Footnote 122
5.2. A thing of the past? Subsection 7(b)(6)
Finally, the procedure pursuant to which the government (with the approval of the Intelligence Subcommittee) may confer on the ISA duties additional to those enumerated in the ISA Law permits potential purpose creep, and affords the government considerable latitude to expand the Agency’s operational domain without revising core statutory provisions.Footnote 123
Since the enactment of the ISA Law, section 7(b)(6) has been invoked to confer six additional functions on the ISA, four of which remain classified to date.Footnote 124 The unclassified functions conferred in addition to statutory ones are intelligence sharing and cooperation with foreign intelligence and security agencies,Footnote 125 and assistance in the national effort to thwart the COVID-19 pandemic.Footnote 126 In recent years it has been frequently proposed that the ISA should assist law-enforcement agencies in criminal investigations,Footnote 127 primarily in the context of crime within the Arab–Israeli community,Footnote 128 a function in respect of which ISA directors have repeatedly expressed grave reservations.Footnote 129
As noted above, subsection 7(b)(6) permits the government to authorise the ISA to engage in activities in ‘other areas [apart from the ISA’s statutory duties] whose purpose is to protect and promote state interests essential to national security’. The government resolution, promulgated under subsection 7(b)(6), authorising the ISA to engage in contact-tracing of COVID-19 carriers and of persons with whom they have been in close contact, was challenged before the Supreme Court of IsraelFootnote 130 in Ben Meir v Prime Minister. Footnote 131 The petitioners argued that authorising the ISA to address a civilian public health issue was contrary to subsection 7(b)(6) and that, accordingly, Resolution 4916 was ultra vires.Footnote 132 They contended that the term ‘national security’ should be construed narrowly, so as to encompass only security threats in the strict sense.
In reviewing the legislative history of the ISA Law – particularly the minutes of the Joint ISA Law Committee of the Knesset Security and Foreign Affairs Committee and the Constitution, Law and Justice Committee, which were declassified for the purpose of the proceedings – the Court concluded that the legislator did not intend to confine ISA authorisation under subsection 7(b)(6) to matters of national security in the narrow sense. Rather, the legislative intent was to encompass matters extending beyond the narrow meaning of ‘national security’.Footnote 133 Chief Justice Hayut held that subsection 7(b)(6), therefore, may be interpreted as permitting the government to authorise the ISA to act in matters that do not concern national security in the narrow sense. However, the term ‘national security’ in that context should be construed as referring to a ‘severe, imminent danger to the citizens and residents of the State or its regime’.Footnote 134
Subsection 7(b)(6) affords the government and the ISA a degree of future-proofing in so far as the statutory arrangements need not be revisited by the legislature in every circumstance requiring an expansion of the Agency’s scope of activities. However, the Court in Ben Meir limited the interpretive scope of the provision: when the government seeks to authorise the ISA to act in areas not directly related to national security, the further the new function is from the national security core, the more stringent is the onus to demonstrate that the circumstances represent a severe and imminent threat.Footnote 135 The Court concluded that during the initial period of the COVID-19 outbreak, the exceptional circumstances warranting such a threat assessment existed, thereby enabling the authorisation of the ISA to assist in contact-tracing.Footnote 136
Following a freedom of information request, the Association of Civil Rights in Israel (ACRI) learned that since the enactment of the ISA Law, four permanent functions had been conferred on the ISA pursuant to subsection 7(b)(6).Footnote 137 ACRI petitioned the Supreme Court, contending that subsection 7(b)(6) should not be used to permanently expand the statutory functions of the ISA, and accordingly any government resolutions purporting to make permanent functions conferred under subsection 7(b)(6) were ultra vires.Footnote 138 ACRI further argued that this use of subsection 7(b)(6) operates contrary to the principle of separation of powers, in so far as the executive branch is effectively promulgating permanent rules that ought to have been enacted by the legislature.Footnote 139
The Supreme Court ruled that subsection 7(b)(6) should be limited to exigent circumstances or circumstances in which secrecy is required, and that any functions authorised thereunder should be subject to periodic review.Footnote 140 While this ruling confined future uses of subsection 7(b)(6) to a narrower set of circumstances, the government may still have some flexibility to task the ISA with additional statutory duties by way of emergency regulations.Footnote 141
5.3. Future of future-proofing? Draft bill to amend the ISA Law (2023)
In December 2023, the Israeli Ministry of Justice published a draft Amendment Memorandum to the ISA Law.Footnote 142 The Amendment Memorandum, which focuses primarily on the Agency’s surveillance powers, also authorises the ISA to employ malware measures, among other changes.
The Amendment Memorandum was published during the Gaza war, which may call to mind the expansion of national security legislation following 9/11. The Amendment Memorandum does not, however, necessarily represent such expansion. The ISA powers which the Gaza war necessitated had already been extended through specific emergency regulations.Footnote 143 The Amendment Memorandum appears to be a response to an ongoing legal challenge against the ISA Law in ACRI v ISA Director.Footnote 144 However, it also addresses powers beyond those examined in ACRI v ISA Director, some of which the ISA had previously sought to advance.Footnote 145 There might be a degree of opportunism in the timing of the publication of the Amendment Memorandum.
This section provides an overview of the principal amendments to the ISA Law proposed in the Amendment Memorandum, with particular focus on their future-proofing dimensions.
5.3.1. Database acquisition and processing powers
The Amendment Memorandum proposes a framework for handling databases,Footnote 146 which bears resemblance to the concept of bulk personal datasets (BPDs) under the IPA 2016.Footnote 147 Under the proposed legal arrangement, the ISA would be authorised to receive or collect a database required for its core statutory function,Footnote 148 although, once acquired, a database may be used for any statutory purpose, subject to classified internal rules.Footnote 149
Authorisation to acquire a database may be granted by the Prime Minister, upon written application from the ISA Director,Footnote 150 for a period not exceeding two years. The Prime Minister is required to take into account privacy considerations, and be satisfied that the benefits of obtaining the requested database outweigh the extent of the privacy infringement involved.Footnote 151 ISA employees may use databases obtained under section 8A, subject to specific authorisation by the ISA Director.Footnote 152 The Amendment Memorandum provides for an emergency procedure under which the ISA Director may authorise the exigent acquisition of a database. Any use of a database so acquired, however, is subject to the Prime Minister’s approval.Footnote 153
The Amendment Memorandum neither defines nor elucidates the terms ‘receive’ and ‘collect’, which may refer to one-time acquisition as opposed to the continuous online extraction of a database, or to the degree of consent by the database owner to the ISA’s acquisition thereof. Databases consisting solely of highly sensitive dataFootnote 154 are excluded from acquisition by the ISA. However, databases containing highly sensitive data alongside non-sensitive data may be acquired, provided that it is only the non-sensitive data that is acquired.Footnote 155 A separate provision would authorise the ISA to derive biometric data from databases containing biometric identification means subject to a specific necessityFootnote 156 and subject to the relevant privacy protection rules.Footnote 157
Under proposed section 8B, the Amendment Memorandum would authorise the ISA Director to permit the transfer of any database acquired under section 8A to another party that would be authorised to hold such data under classified rules.Footnote 158 A database so transferred may not include data concerning Israeli residents.Footnote 159
The purpose of the proposed section 8A is to clarify and codify the ISA’s existing general powers. Under section 8(a)(1) of the ISA Law, the Agency is broadly authorised to ‘obtain and collect information’.Footnote 160 The Amendment Memorandum further proposes an addition to this provision that, in respect of databases the acquisition of which is not regulated under any other law,Footnote 161 the ISA’s information-gathering powers would be governed by proposed section 8A.Footnote 162 Similarly, the Amendment Memorandum proposes specifying explicitly that the ISA’s general authority to share information with third parties under the ISA LawFootnote 163 would be subject to the proposed section 8B.Footnote 164
The deployment of the technologically neutral, vague and broad terms ‘use’, ‘obtain’ and ‘collect’ affords further flexibility in the ISA’s processing and acquisition of databases. However, the UK government is considering amending the overly broad language of the provisions governing the intelligence community’s acquisition of BPDs, which apply the same rules to publicly available databases and sensitive data alike.Footnote 165
The provisions of section 8B, which regulate the sharing of databases acquired under section 8A with third parties, are silent as to the nature of those parties. It is unclear whether third-party recipients of ISA databases are Israeli public authorities, foreign intelligence agencies or private entities. The broad language of section 8B may necessitate resort to classified internal rulemaking by the ISA,Footnote 166 in a domain where a greater degree of transparency would be warranted.Footnote 167
A further future-proofing mechanism in proposed section 8A is the delegation of rulemaking powers to the executive. Data protection rules governing the use of databases acquired under the section would be promulgated by the Prime Minister, with the approval of the Ministerial Committee for ISA Affairs.Footnote 168 The Memorandum also proposes empowering the Minister of Justice, in consultation with the Prime Minister, to add further categories of data to the definition of ‘highly sensitive data’.Footnote 169
5.3.2. Searches in computer media and the use of malware
A further set of surveillance powers proposed by the Amendment Memorandum concerns searches of computer media. Certain surgical amendments aim to clarify and codify existing powers explicitly, while others introduce new measures.Footnote 170
Section 9 of the ISA Law authorises ISA employees to conduct searches, at Israeli border crossing points, of any person’s body, luggage, vehicle or ‘other goods in his possession, seize any object, or gather information’. Such searches may be conducted either covertly or in the presence of the individuals whose property is being searched.Footnote 171 The Amendment Memorandum proposes that the terms ‘goods’ and ‘objects’ be defined to include computers and computer materials.Footnote 172 Similarly, the Amendment Memorandum proposes adding explicit language to section 10 of the ISA Law, which sets out the Agency’s covert search powers, to encompass remote computer searches.Footnote 173 With reference to the earlier Antiterrorism Bill,Footnote 174 Bahar characterises these amendments as clarifications of existing powers.Footnote 175 If the current secret executive interpretation, shoehorning remote computer searches into the language of section 10, requires statutory clarification, this illustrates the limits of overly technologically neutral language (in this case, language so neutral that technology is not mentioned at all) as a future-proofing mechanism.
The Amendment Memorandum proposes further amendments to section 10, which include refinements to statutory safeguardsFootnote 176 and enhanced oversight.Footnote 177
While most of the amendments proposed in the Amendment Memorandum concern surveillance powers, the introduction of remote interference powers constitutes its most significant novelty.Footnote 178 Unlike the IPA 2016, for example, which permits equipment interference for the purposes of communications interception,Footnote 179 the Amendment Memorandum goes further by proposing to empower the Prime Minister to authorise ISA employees to conduct offensive cyber operations.Footnote 180
Proposed section 10A would permit the Prime Minister to authorise ISA employees to ‘perform an operation on a thing that constitutes computer material’ provided that such a cyber operation constitutes a vital counterterrorism or counterespionage measure directed against a threat to human life or to national security.Footnote 181 An ‘operation on computer material’ is defined as penetration of computer materialsFootnote 182 and interference or disruption of the operations of computers, or the deletion, alteration or disruption of computer materials. The Amendment Memorandum refers to the Computers Law meaning of ‘a thing that constitutes computer material’, yet this term is not defined therein. Authorisations under proposed section 10A would be granted only if no less intrusive alternative measures that could reasonably be employed are available. The ISA Director’s applications for authorisation to target legally protected professionals would be subject to the Attorney General’s approval.Footnote 183 The section further sets out emergency procedures and reporting obligations to the Intelligence Subcommittee, the Attorney General and the Prime Minister.Footnote 184
Section 10A is not unique in its use of broad terminology when compared with foreign legislation governing offensiveFootnote 185 cyber powers conferred on intelligence agencies and law-enforcement agencies, the UK IPA 2016 and the German BKA being prominent examples. Legislation conferring such powers tends to employ broad language (‘equipment interference’, ‘intervene using technical means’)Footnote 186 that obscures the actual scope of cyber acquisition powers and affords sufficiently neutral provisions for future technological developments. The Amendment Memorandum’s reference to the Computers Law facilitates future-proofing by linking it to the existing and continuously evolving jurisprudence concerning computer offences, but also bears the risk of future judicial limitations on the ambit afforded by this language through interpretative narrowing.
5.3.3. Revising the tool?
One of the catalysts for the reform proposed in the Amendment Memorandum is the pending case of ACRI v ISA Director, in which the constitutionality of the legal framework authorising the ISA to operate the Tool is under challenge.Footnote 187 The Amendment Memorandum accordingly seeks to address the constitutional claims raised in the petition, revising section 11 in detail.
First, the maximalist definition of ‘Information’ is replaced with the following: ‘Communications data as defined in the Rules,Footnote 188 including the internet, as well as data pertaining to the operation of communication systems, and including internet usage data which is not the contents of a conversation between people’.Footnote 189
The backbone of section 11 remains unchanged. The Prime Minister is authorised to determine, in the classified internal ISA rules, that certain categories of information are required by the Agency in its performance of its duties. However, newly added language requires the Prime Minister to take into account privacy considerations, and limits the purposes for which internet usage data may be acquired for counterterrorism, counterespionage and security of personnel.Footnote 190 The Amendment Memorandum proposes the addition of a provision explicitly setting out the ISA Director’s authority to order service providers to transfer information to the Agency,Footnote 191 the ex post controls over its use,Footnote 192 and the temporal limits on such an order.Footnote 193
The Amendment Memorandum further proposes authorising the ISA to make data acquired under section 11 that was received in an unusable form accessible for use,Footnote 194 provided that no excess data is retained.Footnote 195 Use of the data so acquired is subject to authorisation by the ISA Director for a specified purpose and a period not exceeding 12 months.Footnote 196
Classified internal ISA rules would be promulgated to ensure that use of such data minimises privacy infringements, having regard to data processing and retention methods, access controls, whether or not the data concerns legally protected professionals and, in respect of internet usage data, the circumstances permitting non-automated processing.Footnote 197
Further amendments to section 11 include a more detailed framework for periodic reports by the ISA to the Prime Minister, Attorney General and the Intelligence Subcommittee concerning the exercise of the authority thereunder,Footnote 198 and two ‘clarifying’ provisions of a declaratory nature. The first of these provides that data acquired under section 11 would be used only to fulfil the ISA’s statutory functions; the second provides that nothing in the subsection is to preclude the ISA from obtaining or collecting communication metadata under any other law.Footnote 199
While the Amendment Memorandum elaborates upon the existing skeletal statutory framework authorising the operation of the Tool, thus providing greater detail on authorisation procedures, it continues to rely on the delegation of rulemaking authority to the classified internal ISA rules to govern privacy-preserving safeguards applicable to the use of the information obtained thereunder,Footnote 200 to specify the particular categories of information required by the Agency,Footnote 201 and to define elements within its very definition of ‘information’.Footnote 202
The drafters of the Amendment Memorandum elaborated upon the definition of ‘information’, providing explicitly that the definition also encompasses internet usage history, although the delegation of the definition of ‘communications metadata’ to classified internal rules provides a malleable foundation for future adjustments – which, given the still broad definition of ‘information’, may not be required at all.
Finally, proposed section 11(b2) appears to represent an attempt to future-proof data pre-processing techniques, while preserving technological neutrality. However, its structure suggests that content data may be obtained incidentally, provided that pre-processing can separately extract metadata that the ISA is authorised to use.Footnote 203 The proposed proviso of this subsection, which authorises the ISA ‘to render accessible’ certain categories of data, achieves technological neutrality by leaving open the question of whether the inaccessible data to which it refers is technically or legally inaccessible.
5.3.4. Second-order future-proofing: Expanding measures, not purpose
The authorisation of the ISA to conduct contact-tracing during the COVID-19 pandemic may be characterised as purpose creep, in so far as surveillance measures and their governing legal framework, designed for counterterrorism and counterespionage purposes, were repurposed for epidemiological and civilian ends. Subsection 7(b)(6), discussed in Section 5.2, constitutes one of the authorisation routes that potentially enable such purpose creep.
Proposed section 11A of the Amendment Memorandum permits a form of functional creep whereby the ISA may be authorised to collect new categories of information falling outside the surveillance powers proposed in the Amendment Memorandum. The provision stipulates that if data is strictly necessary for the prevention of offences that fall within the ISA’s core national security functions or any other function conferred under section 7(b)(6), and its collection is not provided for under existing statutory surveillance powers, then the Ministerial Committee for ISA Affairs, with the approval of the Intelligence Subcommittee, may grant the ISA the requisite authorisation for a period not exceeding one year, renewable for a further year.Footnote 204
This second-order future-proofing mechanism permits the executive (with the approval of a parliamentary subcommittee controlled by the governing coalition) to adapt the ISA’s surveillance powers to evolving technological and operational circumstances, with minimal parliamentary deliberation, under the guise of necessity. The legislative intention to enact this new vector of creep – not of purpose, but of means – warrants serious concern as it compounds the democratic deficit identified above by extending executive discretion beyond purpose to the very means of surveillance, without commensurate legislative scrutiny.
5.3.5. Future-proofing techniques in the Amendment Memorandum
The Amendment Memorandum’s repeated ‘clarifications’ of the ISA’s internal interpretation of existing law indicate the erosion of past future-proofing. From an external perspective, this erosion is juridical in character. With past and ongoing litigation challenging various provisions of the ISA Law, and with a particular case the resolution of which may depend on the advancement of legislative proceedings,Footnote 205 the Agency may be seeking to enshrine its interpretation of the once flexible and future-proof law in statute. However, attempts to codify ‘clarifications’ of formerly classified interpretations of statutory law may present their own challenges. First, seeking the legislature’s approval for such interpretations may prove futile, in direct proportion to their unreasonableness. Secondly, mission-oriented intelligence professionalsFootnote 206 may interpret explicit statutory permission to employ a particular measure as imposing a corresponding duty to do so when seeking to prevent the next terrorist attack.Footnote 207
Accordingly, exceptional measures that were cautiously authorised beneath the radar of public scrutiny and dependent on an expansive interpretation of the law are likely to be deployed more frequently once grounded in ‘clarified’ and explicit statutory language.
Clarification also erodes future-proofing by necessitating compliance with constitutional requirements such as specificity and proportionality. Specificity requires detailed provisions that narrow the margin of discretionary latitude afforded to the executive by future-proof language and, similarly, proportionality requires limitations on surveillance powers, as well as safeguards and proper oversight. The proposed amended section 11, for example, provides greater detail on authorisation periods, which under the existing ISA Law are prescribed by the classified internal ISA rules. However, the rules governing data handling and retention periods of acquired data remain classified.
The deferral of the substantive design of safeguards and controls over surveillance measures is also evident in the legal arrangements proposed in the Amendment Memorandum for database acquisition. The specific data protection rules governing database acquisition would be promulgated by the Prime Minister in classified internal ISA rules.Footnote 208 This, together with the provision empowering the Minister of Justice to expand the definition of highly sensitive data,Footnote 209 may future-proof legal safeguards and potentially allow for greater protection; yet the classified nature of the ISA’s internal rules raises doubts in this regard.
On balance, the ISA Law has proved a remarkably durable legislative instrument. Its technologically neutral language and broad delegation of rulemaking authority to the executive have accommodated significant socio-technical change without formal amendment for over two decades. Yet the foregoing analysis reveals that even well-calibrated future-proofing has its limits. The repeated ‘clarifying’ provisions in the Amendment Memorandum attest to the fact that the original statutory language could not be stretched indefinitely without incurring constitutional vulnerability, and the Supreme Court’s narrowing of section 7(b)(6) in Ben Meir and ACRI v Government demonstrates that judicial review can and does provide an effective check on executive overreach in expanding the ISA’s functional domain.
These episodes of course correction are reassuring, but the more pressing concern lies ahead. The Amendment Memorandum introduces mechanisms the reach of which has yet to be tested – most notably proposed section 11A, which would permit the executive to authorise entirely new categories of surveillance data collection outside existing statutory powers, with minimal parliamentary deliberation. Unlike the overreaching future-proofing narrowed in ACRI v Government, this cannot be ruled out as an incidental by-product of ambiguous drafting but is a deliberate legislative design. The pertinent question is whether it is prudent to wait for such mechanisms to be exposed, as was the metadata collection programme under section 11 only through press disclosure years after its covert operation, before demanding accountability. Rather than relying on future whistleblowers or retrospective litigation, the present moment calls for proactive installation of stronger constraints and transparency mechanisms, ensuring that the substantive design of safeguards is not surrendered to classified internal rulemaking and that civil society and the judiciary retain meaningful capacity for ex post review.
6. Concluding remarks: Future-proofing the ISA Law
Future-proofing is often invoked as a panacea for resolving the tensions between regulation and innovation, and may equally serve as a tool for circumventing cumbersome legislative proceedings in responding to emerging national security threats. It is an approach that mitigates uncertainties through deferral.
However, future-proof legislation also bears the risk of over-proofing. Laws designed as general standards rather than detailed rules afford flexibility in their application, but also generate a potential democratic deficit by deferring substantive rulemaking authority to executive actors. Although technology-related legislative proceedings may be protracted,Footnote 210 legislators are capable of responding promptly to pressing needs, even those of a technological nature, as demonstrated in the relatively prompt enactment of the Authorisation Law, or the law to replace the Omicron Regulations (which did not come to be).
Future-proof legislative design is a matter of choice and as it constitutes, in essence, a transfer of rulemaking power, such power should not be left unchecked. Future-proofing that manages uncertainty through ambiguous or vague language subsequently interpreted by the executive, or through the direct delegation of decision-making authority to the executive, must be accompanied by robust oversight and transparency mechanisms to ensure that the executive does not exceed its boundaries.
One can envisage an institutional design in which the oversight of future-proof regulation of emerging technologies is entrusted to accountable regulators subject to judicial review. The General Data Protection Regulation’s system of independent national data protection authorities, the decisions of which are subject to judicial review, provides one such example.
Designing effective intelligence oversight and transparency mechanisms for both law-enforcement agencies and counterintelligence agencies like the ISA is more challenging, given the constraints of operational secrecy as well as the mission-oriented institutional culture of these organisations, which renders them less responsive to external scrutiny. Ensuring that these agencies’ reading of future-proof laws remains within lawful bounds requires an independentFootnote 211 external oversight body possessing the requisite expertiseFootnote 212 and powers to declare certain practices unlawful.Footnote 213
Robust oversight, however, requires a commensurate degree of transparency.Footnote 214 The inherent absence of adversarial judicial proceedings in national security surveillance case law, where intelligence gathered through surveillance measures is not challenged ex post in court as evidence, and where any ex ante authorisation is granted ex parte, narrows the range of cases susceptible to judicial review. Effective ex post judicial oversight of surveillance technologies, including the manner in which future-proof legislation is applied by the executive in practice, requires a threshold of transparency sufficient to enable civil society to become informed to litigate. Indeed, section 11 of the ISA Law, which authorises the Agency to operate a mass metadata collection programme, was challenged before the court by the Association for Civil Rights in Israel only following its disclosure by the press.
Certain matters cannot be delegated to the executive or to a parliamentary subcommittee. This is especially true for Israel, where the dominant actors in the Intelligence Subcommittee are frequently drawn from the governing coalition and tend to act in concert with the government. The Supreme Court signalled as much in ACRI v Government, limiting the effective rulemaking authority of subsection 7(b)(6), and observing that full legislative proceedings in which all Knesset members participate are preferable to the classified hearings and resolutions by ministerial committees.Footnote 215 This reasoning may prove instructive for the legal analysis of proposed section 11A of the Amendment Memorandum, which proposes permitting government authorisations of new surveillance powers, with the approval of the Intelligence Subcommittee, without recourse to full legislative deliberation.
Moreover, many emerging technologies with national security applications are not directly addressed in the Amendment Memorandum, and it is difficult to determine whether, and if so how, they fall within its permissive language. Post-collection processing of data, for example, is barely touched upon either in the ISA Law or in the Amendment Memorandum – leaving open questions regarding the regulation of facial recognition technologies (which could be embedded in post-collection intelligence analysis of data), AI-driven predictive intelligence, and the use and harvesting of open-source intelligence (OSINT) from social media platforms.
Future-proofing techniques distribute the burden of managing future uncertainties between the executive and the legislature through the direct transfer of rulemaking powers to the executive or by affording it interpretive latitude. The degree of uncertainty generated by the coupling of emerging technologies and national security purposes may render resources dedicated to drafting detailed legislation disproportionate. The legal framework governing emerging technologies in the national security domain should therefore incorporate a degree of future-proofing, particularly in volatile political circumstances in which the future availability of legislative attention to revisit these issues cannot be assured.
However, in the absence of any adversarial actor capable of challenging the executive’s legal interpretation of abstract, technologically neutral statutory language, intrusive surveillance may easily creep through. Future-proof legislation requires democratic control over post-legislative rulemaking, with strong oversight and transparency mechanisms in place,Footnote 216 which will proof surveillance law against excessive future-proofing.
Acknowledgements
Not applicable.
Funding statement
The research for this article was supported by ERC Grant No. 101054745 (DigitalHRGeneration3), https://bit.ly/3rDGTT6.
Competing interests
The author declares none.
Open access
