Written Evidence Submitted by Dr Matthew White (COV0247)
1. I am a Doctor of Law who primarily focusses on State surveillance, particularly the Investigatory Powers Act 2016 (IPA). I have written on many aspects of the IPA for well-respected journals and blogs. Thus, my understanding in this particular field leaves me well equipped to raise a few points in this call for evidence.
2. This evidence will focus on the changes brought about by the Coronavirus Act 2020 (CvA) to the IPA. For background, it must be noted that the Government sought to allow temporary Judicial Commissioners (JCs) to be appointed at the request of the Investigatory Power Commissioner (IPC) (the judicial element of surveillance authorisations). Additionally, the Government sought to permit the Home Secretary, at the request of the IPC to vary the time allowed for urgent warrants to be reviewed by JCs for up to 12 days. This was said to be necessary by the Government to maintain national security capabilities for example, if there are fewer JCs than available. By 23rd March 2020, serious crime was added to the capabilities that was needed to be maintained. With no opposition to the investigatory powers element of the CvBill from either the Lords or the Commons, on 25th March 2020, the CvA attained Royal Assent.
The investigatory powers element of the Coronavirus Act 2020
3. Sections 22/23 of the CvA governs the appointment of temporary JCs and the extensions of urgent warrants respectively.
4. Section 22(1) allows the IPC to notify the Secretary of State that if due to the Coronavirus, there is a shortage of JCs to carry out functions conferred by the Police Act 1997 (PA), the Regulation of Investigatory Powers Act 2000 (RIPA) and the IPA (the relevant legislations), in the IPCs opinion, that power needs to be exercised to deal with that shortage. Section 22(2) and (3) gives the Secretary of State the discretion to create regulations for the IPC to appoint temporary JCs to carry out functions related to the relevant legislation for either a maximum of six or twelve months.
5. Subsection 4 allows the regulations to specify omissions or other modifications with regards to temporary commissioners in relation to the relevant legislations.
6. Subsection 5 does not produce the effect of the requirements and recommendations of the IPA e.g. requirements of high judicial office (High Court judge or higher), recommendations from the IPC, senior judges etc, but does require the IPC to notify the Prime Minister and senior judges amongst others when appointing a temporary JC. Additionally, these regulations last for twelve months and the role of the temporary JCs expires when the regulations cease to have effect. They can also be annulled by either House of Parliament.
7. On notification by the IPC, sections 23(1) and (2) allows the Secretary of State to alter the relevant period of urgent warrants. Subsection 3 details this further as ‘the relevant period’ could be altered in terms of period in which a JC must decide whether to approve a decision to issue an urgent warrant, the period at which an urgent warrant ceases to have effect, periods in which urgent warrants can be renewed and whether to approve the decision to make urgent modification to warrants.
8. Subjection 4 denotes that these urgent warrants cannot extend beyond the twelfth working day. Similarly, to section 22, the duration of these regulations and the ability of both Houses the annul it remain the same. These urgent warrants permit interception, communications data access/retention and hacking en masse and creating bulk personal datasets (information en masse from a variety of sources).
A threat to national security and fighting serious crime? And why was there no mention of economic well-being in relation to national security?
9. These provisions were based on the need to maintain national security capabilities but neither sections 22 or 23 mention national security. It must first be asked if this pandemic is indeed a national security issue, but this becomes difficult when national security has no definition in UK law (HL Deb 12 September 2016, vol 774, col 1315). Judge Pettiti noted that terms such as national security were abused by European states by distorting the meaning and its nature (Kopp v Switzerland  ECHR 18). This has led to abuses whether it be with regards to appointing someone to the IPC or refraining from investigating possible attempts at interfering in democracy. This lack of definition has led to intense criticisms by the European Court of Human Rights (ECtHR) because it is imprecise, gives significant discretion and thus creates greater possibilities for abuse (Roman Zakharov v Russia  ECHR 1065, para ; Iordachi and Others v Moldova  ECHR 256, para ). Dunt notes the Government’s approach is an error as approaching pandemics with secrecy decreases control due to lack of public awareness and debate.
10. Unlike national security, serious crime is defined in section 263 of the IPA, and though a similar definition has, in the past been accepted by the ECtHR (Kennedy v UK  ECHR 682, paras -), this current definition remains unclear (White, 25-26). The Government had rejected calls for defining the exact crimes (a position which Judge Pinto de Albuquerque agrees with (Szabo and Vissy v Hungary  ECHR 579, at para ) and is also a minimum requirement as established in Weber and Saravia v Germany  ECHR 1173, at para ) that would fall under the definition of serious crimes and this current definition would not even satisfy the requirements of Kennedy as it would not provide sufficient detail on the nature of offences and would thus be unlawful
11. Similarly, to national security, economic well-being in so far as it relates to national security is another justification (although not mentioned by the Government) that can be utilised when issuing urgent warrants. This definition is so vague that the Intelligence and Security Committee advocated for its entire removal from the IPA because the Home Office could not justify its inclusion.
12. When States have relied solely on a stated exemption for surveillance, under the requirement of ‘foreseeability,’ the ECtHR has regarded this as lacking sufficient precision to be lawful (Doerga v Netherlands  ECHR 175, at paras , , ,  and ). This demonstrates reliance on a specified qualified ground in and of itself will fall foul of the ECtHR’s standard of legality. This becomes more prudent when it was acknowledged by the ECtHR in Szabo and Vissy that since the technological advances since the 70s, the ECHR needs to protect Article 8 (privacy) more acutely (at para ).
13. This highlights a defect in the IPA that has been carried into the CvA. Due to the lack of definitions or sufficiently precise definitions, the ECtHR has held that prior judicial authorisation of surveillance measures may be a sufficient safeguard when details are lacking (Roman Zakharov, at para ).
The Independence and effectiveness of temporary Judicial Commissioners
14. Dunt noted that we ‘need more details about the process for appointing temporary judicial commissioners and evidence for how independent they are.’ However, before we even consider that, it is important to consider the independence and impartiality of full time JCs and the IPC. It has been strongly suggested, that from an ECHR perspective:
[T]hat the cumulative effects of appointments, tenure, dismissal, directions/instructions, staffing/resources and the possibility function alteration posed a serious threat to the independence of the IPC/JC system…the strongest argument on the independence of the IPC/JC system is that it lacks (and lacks the appearance of) independence due to the…unnecessary executive and legislature involvement and the lack of institutional separation between the IPC and JC. This lack of institutional separation also raises doubts as to the impartially (and appearance of) of the system, which could also subject the JCs to undue pressures…[and]… not only could the IPC be marking its own homework by way of audit, inspection and investigation, but also by way of being a sitting judge in the Court of Appeal.
15. Thus, from the outset, even without the CvA, the independence and impartiality of the judicial element of surveillance authorisations is already highly suspect. There has been no reason or justification as to why appointments are now unilateral or why there is a water down of an already imperfect procedure. The lack of institutional separation between the IPC and the JC further dilutes the independence of appointments whilst also lowering the bar for e.g. holding high judicial office is no longer a requirement, whereas the ECtHR has strong requirements of independence and of ‘judicial character.’ This is also problematic as Mi5 has already demonstrated its tendency to mislead JCs into authorising knowingly illegal surveillance (which was (predicted White, (30, 31))). Lowering the requirements to qualify as a temporary JC increases the risk of abuse.
16. The CvA actually grants the Home Secretary even more power over IPC and JC because it is at their discretion as to whether regulations would even be created to appoint temporary JCs, and the fact that their functions can be modified, cementing their subordinate (33) position further by effectively controlling their staffing (and has already inappropriately done so in the case of Eric Kind). Shortness of judicial tenure also threatens judicial independence, not least even with the full-time JCs which tenures are relatively short but this would be exasperated for the temporary JCs as their tenues are even shorter.
Necessity and urgent warrants?
17. For measures to be ECHR compliant, they must be necessary in a democratic society. Liberty have queried why the CvA even exists when there are alternatives, such as the Civil Contingencies Act 2004 (CCA) (which a much shorter sunset clause). When the Government was quizzed on this, Jacob Rees-Mogg MP replied that it was not possible to use the CCA, however, the drafter of the of the legislation pointed out the Government were quite clearly capable of utilising it (5). Not only does the necessity of the CvA needs to be challenged but also in relation to sections 22 and 23. Not only are law enforcement and the security services capable of utilising the urgent warrants procedures, but so are immigration officers, HMRC, the Chair of the Competition Markets Authority, the Director General of the Independent Office for Police Conduct, the Police Investigations and Review Commissioner. Every public authority should require a convincing case to be able to utilise powers of mass surveillance (Joint Committee on the Draft Communications Data Bill, Draft Communications Data Bill, (2012-2013 HL 79 HC 479, 137), and fresh justifications should be made for circumstances such as these. Especially considering not all of these public authorities are the police or secret services.
18. The current urgent warrant procedure of three working days (which could essentially lead to five days of surveillance) is already too long (the Draft Investigatory Powers Bill Joint Committee recommended 24 hours at most, 87, 457) and is unacceptable. The ECtHR deemed 24-48 hours acceptable (see European Integration and Human Rights and Ekimdzhiev v Bulgaria  ECHR 533, at paras  and  Roman Zakharov, para  respectively) in the national security context i.e. meaning even less discretion for other grounds such as serious crime). Section 23 would extend the length of urgent warrants for up to 18 days, which is way too long. Big Brother Watch could see no justification in such an extension at a time when scrutiny had become weaker. Liberty took a similar view, deeming it inappropriate especially when there is no guarantee this data would be subsequently deleted. It demonstrates the Government’s hunger for surveillance outweighs effective oversight.
19. Liberty also noted that if there are pre-existing issues with capacity, the CvA should not be used to address this, and should be done elsewhere. The IPC has noted that the staff were already (2.17-2.18) under strain, and thus begs the question, why was national security and serious crime not enough of a reason to address this before the pandemic?
20. Measures are not sufficient just because they fall within a class of exceptions i.e. national security (Sunday Times v UK  ECHR 1, at para ). The Government has failed to demonstrate the need for extending urgent warrants and watering down the requirements for temporary JCs, this would violate the ECHR (Sunday Times, at paras  and ).
21. Not only are the Government’s measures unnecessary, opportunistic and authoritarian, but relies solely on Article 8 compliance when privacy is not the only fundamental right that is affected by surveillance. Whether or not the Coronavirus is indeed a threat to national security (and the economic well-being in relation to it) and serious crime, the Government’s response to it, is not necessary in a democratic society.
22. The views the JCHR seek in relation to human rights compliance, the impact on human rights and the groups disproportionality affected is not straight forward. This is simply because this measure is not necessary at all. The measures introduced by sections 22 and 23 do not comply with the ECHR. The measures also significantly impact human rights (such as privacy, freedom of expression/association/religion, freedom from discrimination, the right to a fair trial and freedom of movement) due to the severity of the interference of the measures in question as they range from interception, communications data/bulk personal dataset access/retention and hacking on unprecedented scales. This severity intensifies because the lax in safeguards that will be introduced in relation to the extension of urgent warrants and the fact that temporary JCs do not meet the standards required by the ECHR.
23. In terms of discrimination, because these measures are increasingly indiscriminate, these would fall foul of Article 14 in conjunction with all the relevant rights engaged for failing to distinguish between groups that fall within a category liable to subject to surveillance (Thlimmenos v Greece  ECHR 162, at para ). Additionally, because Big Data (which can be obtained via bulk personal datasets) can be swept up in these measures, which comes with its own biases on race, can intensify ethnic profiling. This in turn can create chilling effects on the exercise of key fundamental rights.
 e.g. Matthew White, ‘Protection by Judicial Oversight, or an Oversight in Protection?’ (2017) Journal of Information Rights, Policy and Practice 2:1 1; Matthew White, ‘Data retention: serious crime or a serious problem? (2019) Public Law 633.
 e.g. Matthew White, ‘Data Retention incompatible with EU law: Victory? Victory you say?’ (24 May 2018) <https://eulawanalysis.blogspot.com/2018/05/data-retention-incompatible-with-eu-law.html
 Matthew White, “The Threat to the UK’s Independent and Impartial Surveillance Oversight Comes Not Just from the Outside, but from Within” (2019) European Human Rights Law Review 5 512, 524-525.
 Matthew White, ‘Data retention: serious crime or a serious problem? (2019) Public Law, 638.
 Intelligence and Security Committee, Report on the draft Investigatory Powers Bill, (2016, HC 795), para J(i).
 Matthew White, “The Threat to the UK’s Independent and Impartial Surveillance Oversight Comes Not Just from the Outside, but from Within” (2019) European Human Rights Law Review, 533.
 Matthew White, “The Threat to the UK’s Independent and Impartial Surveillance Oversight Comes Not Just from the Outside, but from Within” (2019) European Human Rights Law Review, 517, 519.
 Matthew White, “The Threat to the UK’s Independent and Impartial Surveillance Oversight Comes Not Just from the Outside, but from Within” (2019) European Human Rights Law Review, 524-525
 Matthew White, “The Threat to the UK’s Independent and Impartial Surveillance Oversight Comes Not Just from the Outside, but from Within” (2019) European Human Rights Law Review, 522.
 Kate Crawford and Ryan Calo, “There is a Blind Spot in AI Research” (2016) Nature 538 311, 312; Julia Angwin, Jeff Larson, Surya Mattu and Lauren Kirchner, “Machine Bias” (23 May 2016) https://www.propublica.org/article/machine-bias-risk-assessments-in-criminal-sentencing.
 Bart van der Sloot, Dennis Broeders and Erik Schrijvers, Exploring the Boundaries of Big Data (Amsterdam University Press, Amsterdam 2016), 125; Joanne P. van der Leun and Maartje A.H. van der Woude, “Ethnic profiling in the Netherlands? A reflection on expanding preventive powers, ethnic profiling and a changing social and political context” (2011) Poicing and Society 21:4 444; Open Society Initiative, “Equality under Pressure: The Impact of Ethnic Profiling” (2013) https://www.opensocietyfoundations.org/sites/default/files/equality-under-pressure-the-impact-of-ethnic-profiling-netherlands-20131128_1.pdf.