CEDH · CASELAW;JUDGMENTS;CHAMBER;ENG — 12 septembre 2023

.s800EAC49 { font-size:12pt } .sFE10DC93 { margin-top:0pt; margin-bottom:0pt; text-align:center } .sBB9EE52A { font-family:Arial } .s5E1364CA { margin-top:0pt; margin-bottom:12pt; text-align:center; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s87371512 { margin-top:46pt; margin-bottom:14pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s29100277 { font-family:Arial; font-weight:bold } .s34DFC730 { margin-top:0pt; margin-bottom:0pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .sA36B60A1 { font-family:Arial; font-style:italic } .s339D85E6 { margin-top:0pt; margin-bottom:14pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s2D726B78 { margin-top:0pt; margin-bottom:12pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s780F5245 { border:0.75pt solid #000000; clear:both } .sE77B86B8 { margin-top:0pt; margin-bottom:0pt; text-align:justify; padding-top:1pt; padding-right:4pt; padding-left:4pt } .sD423F84E { margin-top:0pt; margin-bottom:0pt; text-align:justify; padding-right:4pt; padding-left:4pt; padding-bottom:1pt } .s8FE8E970 { margin-top:0pt; margin-bottom:10pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s2E932ED2 { margin-top:0pt; margin-bottom:0pt; font-size:11pt } .s598389FB { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:14pt } .sF5E1C6CF { font-family:Arial; font-weight:bold; text-decoration:underline; color:#ff0000 } .sE208486F { font-family:Arial; color:#ff0000 } .s598389F8 { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:11pt } .s4ACA9207 { page-break-before:always; clear:both; mso-break-type:section-break } .s10950C61 { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt; text-align:justify } .s32563E28 { margin-top:0pt; margin-bottom:0pt } .sB9D5CABB { width:28.35pt; display:inline-block } .s3AAE10DF { margin-top:14pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s3CA22BA { font-family:Arial; text-transform:uppercase } .sECF8538A { margin-top:14pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s6B505E72 { margin:0pt; padding-left:0pt } .sE485344B { margin-top:14pt; margin-left:28.6pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:0.6pt; font-family:Arial; font-weight:bold } .sFBC99493 { font-style:italic } .sAB51C47C { margin-top:14pt; margin-left:27.94pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:1.26pt; font-family:Arial; font-weight:bold } .s3E19E58F { margin-top:14pt; margin-left:27.26pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:1.94pt; font-family:Arial; font-weight:bold } .s9D48DD53 { margin-top:6pt; margin-left:21.25pt; margin-bottom:6pt; text-indent:7.1pt; text-align:justify; font-size:10pt } .sB706BD6C { margin-left:11.67pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:6.18pt; font-family:Arial; text-transform:uppercase } .s8B983D37 { text-transform:none } .sF43EBB0E { margin-top:14pt; margin-left:15pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:2.85pt; font-family:Arial; text-transform:uppercase } .sAA38361A { margin-top:14pt; margin-left:17.85pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-family:Arial; text-transform:uppercase } .sFCC17DF1 { margin-top:14pt; margin-left:17.85pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s715E7C6D { margin-top:14pt; margin-left:25.5pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s4836203C { font-style:italic; text-transform:none } .s743F3A55 { margin-right:0pt; margin-left:0pt; padding-left:0pt } .sC03030BA { margin-left:10.75pt; margin-bottom:12pt; page-break-inside:avoid; page-break-after:avoid; padding-left:0.6pt; font-weight:bold; text-transform:none } .s7ED160F0 { text-decoration:none } .s33165EBA { font-family:Arial; font-size:8pt; vertical-align:super; color:#0069d6 } .s7A9D86BD { margin-top:14pt; margin-left:28.6pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:0.6pt; font-family:Arial; font-weight:bold; font-style:italic } .sDD998142 { margin-top:14pt; margin-left:17pt; margin-bottom:12pt; text-indent:-17pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s6C2746C6 { margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-family:Arial; text-transform:uppercase; list-style-position:inside } .s6047437D { width:11.03pt; font:7pt 'Times New Roman'; display:inline-block } .s947C7B1B { margin-top:14pt; margin-left:15pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:6.3pt; font-family:Arial; text-transform:uppercase } .sC47DA4E2 { margin-top:14pt; margin-left:18.34pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:1.51pt; font-family:Arial; text-transform:uppercase } .s174EF198 { margin-left:8.75pt; margin-bottom:12pt; page-break-inside:avoid; page-break-after:avoid; padding-left:0.6pt; font-weight:bold; text-transform:none } .sF7610474 { margin-top:14pt; margin-left:36.55pt; margin-bottom:6pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-family:Arial; font-style:italic } .sD0682254 { margin-top:0pt; margin-left:48.75pt; margin-bottom:6pt; text-indent:-17pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s30C8A987 { width:4.78pt; font:7pt 'Times New Roman'; display:inline-block } .s38A1A3E1 { margin-top:0pt; margin-left:59.55pt; margin-bottom:6pt; text-indent:-17.9pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; line-height:113%; font-size:10pt } .sDE1AC5D1 { width:3.32pt; font:7pt 'Times New Roman'; display:inline-block } .sAEC88898 { margin-top:0pt; margin-left:68.6pt; margin-bottom:6pt; text-indent:-16.7pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s8C5C962F { width:4.25pt; font:7pt 'Times New Roman'; display:inline-block } .s7483BB9D { margin-top:14pt; margin-left:68.6pt; margin-bottom:6pt; text-indent:-16.7pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .sA32501C8 { width:4.4pt; font:7pt 'Times New Roman'; display:inline-block } .s3FA6240E { margin-top:14pt; margin-left:59.55pt; margin-bottom:6pt; text-indent:-17.9pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; line-height:113%; font-size:10pt } .s6F295A2 { width:1.1pt; font:7pt 'Times New Roman'; display:inline-block } .sB2ED4664 { margin-top:14pt; margin-left:48.75pt; margin-bottom:6pt; text-indent:-17pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s4E0353E8 { width:4.23pt; font:7pt 'Times New Roman'; display:inline-block } .sF4DD38B3 { width:1.72pt; font:7pt 'Times New Roman'; display:inline-block } .sE03C66E7 { margin-top:14pt; margin-left:31.4pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:4.6pt; font-family:Arial; font-weight:bold } .s7CAC83C { margin-top:14pt; margin-left:19.67pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:0.18pt; font-family:Arial; text-transform:uppercase } .s448F0C15 { margin-top:14pt; margin-left:18pt; margin-bottom:12pt; text-indent:-18pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s74818F78 { margin-top:14pt; margin-bottom:3pt; text-align:justify; font-family:Arial; list-style-position:inside } .sE7B3A78A { width:1.99pt; font:7pt 'Times New Roman'; display:inline-block } .sD11CFAB7 { margin-top:14pt; margin-left:15.01pt; margin-bottom:3pt; text-align:justify; padding-left:1.99pt; font-family:Arial } .s51DFF5CF { margin-top:0pt; margin-left:34pt; margin-bottom:0pt; text-indent:-17pt; text-align:justify } .sE5BF05B1 { width:2.33pt; font:7pt 'Times New Roman'; display:inline-block } .s7F175FE6 { margin-top:0pt; margin-left:51.05pt; margin-bottom:0pt; text-indent:-17.05pt; text-align:justify } .sE5C1F6E3 { width:3.33pt; font:7pt 'Times New Roman'; display:inline-block } .s2D9C6089 { margin-top:12pt; margin-bottom:12pt; text-indent:14.2pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s69DCC830 { margin-top:36pt; margin-bottom:0pt } .s4598CDF { width:70.9pt; display:inline-block } .sD8AE9261 { width:36.9pt; display:inline-block } .sB1A859A2 { width:116.43pt; display:inline-block } .s5D826FD4 { width:25.88pt; display:inline-block } .s1B61D60 { width:156.43pt; display:inline-block } .sD00444C6 { margin-top:0pt; margin-bottom:14pt } .s6DB91820 { text-align:center } .s85E2A1C4 { margin-right:auto; margin-left:auto; border:0.75pt solid #949494; border-collapse:collapse } .sC5C14500 { height:34.7pt } .s83DA3E24 { border-right:0.75pt solid #949494; border-bottom:0.75pt solid #949494; padding:0.62pt 4.68pt; vertical-align:top; background-color:#dfdfdf } .sDF237D91 { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:8pt } .sEECE831 { font-family:Arial; font-weight:bold; color:#474747 } .s1CFDA2EB { border-right:0.75pt solid #949494; border-left:0.75pt solid #949494; border-bottom:0.75pt solid #949494; padding:0.62pt 4.68pt; vertical-align:top; background-color:#dfdfdf } .sBFEA9C45 { border-left:0.75pt solid #949494; border-bottom:0.75pt solid #949494; padding:0.62pt 4.68pt; vertical-align:top; background-color:#dfdfdf } .s31926575 { height:32.45pt } .s6BBB6FB3 { border-top:0.75pt solid #949494; border-right:0.75pt solid #949494; border-bottom:0.75pt solid #949494; padding:0.62pt 4.68pt; vertical-align:top } .s598389F9 { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:12pt } .s3DC36BA9 { font-family:Arial; text-decoration:underline; color:#0069d6 } .s254FFF8A { border:0.75pt solid #949494; padding:0.62pt 4.68pt; vertical-align:top } .s51F18A94 { border-top:0.75pt solid #949494; border-left:0.75pt solid #949494; border-bottom:0.75pt solid #949494; padding:0.62pt 4.68pt; vertical-align:top } .s59163FCB { border-top:0.75pt solid #949494; border-right:0.75pt solid #949494; padding:0.62pt 4.68pt; vertical-align:top } .s4916C411 { border-top:0.75pt solid #949494; border-right:0.75pt solid #949494; border-left:0.75pt solid #949494; padding:0.62pt 4.68pt; vertical-align:top } .s9CE9A140 { border-top:0.75pt solid #949494; border-left:0.75pt solid #949494; padding:0.62pt 4.68pt; vertical-align:top } .sF6A12959 { width:33%; height:1px; text-align:left } .s85226119 { margin-top:0pt; margin-bottom:0pt; text-align:justify; font-size:10pt } .s653E6C45 { font-family:Arial; font-size:6.67pt; vertical-align:super; color:#0069d6 }   FOURTH SECTION CASE OF WIEDER AND GUARNIERI v. THE UNITED KINGDOM (Applications nos. 64371/16 and 64407/16)   JUDGMENT   Art 1 • Jurisdiction of States • Alleged bulk interception of communications of applicants, living outside the respondent State, fell within respondent State’s territorial jurisdiction • Interference with privacy of communications occurs where they are intercepted, searched, examined and used and the resulting injury to privacy rights of sender and/or recipient also takes place there Art 8 • Private life • Finding of a violation based on reasons identified in Big Brother Watch and Others v. the United Kingdom [GC] • Fundamental deficiencies present in bulk interception regime, through absence of independent authorisation, failure to include categories of selectors in the application for a warrant, and failure to subject selectors linked to an individual to prior internal authorisation   STRASBOURG 12 September 2023   FINAL   12/12/2023   This judgment has become final under Article 44 § 2 of the Convention. It may be subject to editorial revision. In the case of Wieder and Guarnieriv. the United Kingdom, The European Court of Human Rights (Fourth Section), sitting as a Chamber composed of:   Gabriele Kucsko-Stadlmayer , President ,   Tim Eicke,   Faris Vehabović,   Branko Lubarda,   Anja Seibert-Fohr,   Ana Maria Guerra Martins,   Anne Louise Bormann , judges , and Ilse Freiwirth, Deputy Section Registrar , Having regard to: the applications (nos.   64371/16 and 64407/16) against the United Kingdom of Great Britain and Northern Ireland lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by an American national, Mr   Joshua Wieder, and an Italian national, Mr Claudio Guarnieri, on the various dates indicated in the appended table; the decision to give notice to the United Kingdom Government (“the Government”) of the complaints concerning Articles 8, 10 and 13 of the Convention; the observations submitted by the respondent Government and the observations in reply submitted by the applicants; the comments submitted by Media Defence, which was granted leave to intervene by the President of the Section; Having deliberated in private on 11 July 2023, Delivers the following judgment, which was adopted on that date: INTRODUCTION 1.     The principal issue to be addressed in the present case is whether, for the purposes of a complaint under Article 8 of the Convention, persons outside a Contracting State fall within its territorial jurisdiction if their electronic communications were (or were at risk of being) intercepted, searched and examined by that State’s intelligence agencies operating within its borders. THE FACTS 2.     The applicant in application no. 64371/16 (“the first applicant”), Mr   Joshua Wieder, is a national of the United States of America who was born in 1984 and lives in Cloud Lake, Florida. The applicant in application no. 64407/16 (“the second applicant”), Mr Claudio Guarnieri, is an Italian national, who was born in 1987 and lives in Berlin, Germany. Both applicants are represented before the Court by Mr M. Scott of Bhatt Murphy Solicitors, a lawyer practising in London. 3.     The United Kingdom Government were represented by their Agent, Mr   J. Gaughan of the Foreign, Commonwealth and Development Office. 4.     The Italian Government did not seek to exercise their right to intervene (Article 36 § 1 of the Convention and Rule 44 of the Rules of Court). THE CIRCUMSTANCES OF THE CASE 5.     The facts of the case may be summarised as follows. The applicants 6 .     The first applicant is an IT professional and independent researcher. He has worked for commercial data centres and news organisations. 7 .     The second applicant is a privacy and security researcher and the creator of an open source malware analysis system. He has researched and published extensively on privacy and surveillance with Der Spiegel and The   Intercept. The Liberty proceedings 8 .     On 5 December 2014, 6 February 2015 and 22 June 2015 the Investigatory Powers Tribunal (“the IPT”) handed down three rulings on an application lodged by ten human rights organisations (“the Liberty proceedings”: see Big Brother Watch and Others v. the United Kingdom   [GC], nos. 58170/13 and 2 others, §§ 28-60, 25 May 2021). That case concerned the bulk interception of communications by the United Kingdom intelligence agencies pursuant to section 8(4) of the Regulation of Investigatory Powers Act 2000 (“RIPA”) and the receipt by the United Kingdom intelligence agencies of material intercepted by their foreign counterparts. The IPT upheld the lawfulness of those regimes, finding neither to be in breach of Articles 8, 10 or 14 of the Convention. However, it accepted that prior to disclosures made in the course of the proceedings, “the regime governing the soliciting, receiving, storing and transmitting by UK authorities of private communications of individuals located in the UK, which have been obtained by US authorities pursuant to Prism and/or ... Upstream, contravened Articles 8 or 10 ECHR”. The IPT was of the view that without the disclosures made, there would not have been adequate signposting of the existing arrangements, as was required under Articles 8 and 10 of the Convention. 9.     It further held that the communications of one of the applicant organisations had been lawfully and proportionately intercepted and accessed pursuant to section   8(4) of RIPA but that the material had been retained for longer than permitted in breach of Article 8 of the Convention. In respect of another applicant organisation, the IPT found that communications from an email address associated with it had been intercepted and selected for examination under a section 8(4) warrant. Although it was satisfied the interception was lawful and proportionate and that selection for examination was proportionate, the IPT found that the internal procedure for selection had not been followed and consequently there had been a breach of the complainant’s Article 8 rights. 10 .     The IPT made no finding that the communications of any of the complainants in the Liberty proceedings had been obtained by US authorities pursuant to Prism and/or Upstream, and unlawfully shared with the United Kingdom. The Privacy International campaign 11.     There followed a worldwide campaign by Privacy International, one of the applicants in the Liberty proceedings, through which it sought to encourage individuals to lodge complaints with the IPT. 12 .     The applicants in the present case lodged applications with the IPT with the aid of a standard application form made available on Privacy International’s website. They alleged that the respondent Government and/or the security services had breached Articles 8 and 10 of the Convention because they had and/or continued to intercept, solicit, obtain, process, use, store and/or retain their information and/or communications; and because their information and/or communications were accessible to the respondent Government as part of datasets maintained wholly or in part by other Governments’ intelligence agencies; and that the Government and/or security services might have acted unlawfully under domestic law by intercepting, soliciting, accessing, obtaining, processing, storing or retaining their information and/or communications in breach of their own internal policies and procedures. 13.     Over 600 applications of a similar nature were received by the IPT. Of these complainants, 294 were resident in the United Kingdom. 14 .     The IPT listed the first ten applications (which included those lodged by the present applicants) for hearing to enable issues to be addressed as to whether the claims should be investigated. The applicants, together with four other complainants, were represented in the proceedings; the other four complainants were neither represented nor identified, except to the extent that it could be said that three were resident in the United States of America and one was resident in the United Kingdom. The Government’s preliminary submissions to the IPT 15.     The Government made preliminary submissions to the IPT in which they sought a “principled basis on which the claims generated by the Privacy campaign can be addressed”. In the Government’s view, these complaints raised no new issues of law but were instead designed for the purpose of finding out whether the intelligence agencies in fact held information about persons or organisations, or whether they had access to that material from the United States’ National Security Agency (”NSA”). The operation of the regime had been examined in detail in the Liberty proceedings and nothing would be achieved by requiring individual examination of a potentially very large number of cases. 16 .     Of the first ten claims before the IPT, five of the complainants were resident abroad. The Government argued that these complainants were outside the scope of Article 1 of the Convention and, as such, it would be appropriate for the IPT to dispose of their Convention complaints at a preliminary stage on that basis. While it was accepted, more generally, that individuals of any nationality could bring complaints to the IPT, the Government argued that the IPT was entitled to proceed on the basis that unless an individual was present in the United Kingdom, there was no jurisdiction to consider a complaint under the Convention concerning the interception, obtaining or handling of communications by the Government and/or intelligence agencies. 17.     The Government further argued, inter alia , that the ten complainants could not claim to be victims of a violation of the Convention because they could not show that due to their personal situation they were potentially at risk of being subject to secret interception measures. 18.     The complainants contended that their claims required individual consideration. They further contended that the IPT had jurisdiction over those among them who were resident abroad; and that they all enjoyed “victim” status under the Convention. The IPT judgment 19.     Prior to the hearing, the parties agreed that the NSA had a lawful basis for targeted interception pursuant to section 702 of the Foreign Intelligence Surveillance Act 1978 (as amended) (“FISA”), and to Executive Order   12333, pursuant to which PRISM and “Upstream” were lawfully sanctioned for “the targeting of persons reasonably believed to be located outside the United States to acquire foreign intelligence information”. They also agreed that in order to pursue their statutory objectives, the intelligence agencies needed to share intelligence with foreign Governments. Moreover, for the purpose of the hearing, any information supplied to the United Kingdom Government by the NSA was assumed to have been lawfully obtained. 20.     The IPT handed down its judgment on 16 May 2016. At the outset, it noted that, encouraged by the jurisprudence of the Court, it had approached the question of locus standi on a very open-minded basis and without requiring from its complainants the kind of arguable case they would need to present a case in the High Court. It therefore concluded that the judgments in the Liberty proceedings were not the finishing point but rather the starting point for the potential investigation of any proper individual claims. Just as the complainants in the Liberty proceedings, who had established sufficient locus to bring the claim, were entitled, after the legal issues had been decided, to have investigations of their own individual circumstances, so should be the case of any other such complainant who could satisfy the locus requirement. To not look at the individual cases of other complainants who could establish the relevant locus would be contrary to Roman Zakharov v.   Russia ([GC], no.   47143/06, ECHR 2015) and Weber and Saravia v.   Germany ((dec.), no.   54934/00, ECHR 2006‑XI), and to its own duty under RIPA. Moreover, it would undermine the position adopted in Kennedy v. the United Kingdom (no. 26839/05, 18 May 2010), in which the Court approved the role of the IPT to such an extent that in Roman Zakharov it was prepared to recognise that in consequence there could be a different approach to locus in claims before it. Therefore, whatever the purpose of Privacy International’s campaign, the IPT was satisfied that each subsequent application had to be considered on its merits. 21 .     As for victim status, it considered that the appropriate test was whether the applicants could show that due to their personal situation they were potentially at risk of being subjected to the measures complained of (see Roman Zakharov , cited above, § 171). Applying this test, it was persuaded that all six of the represented complainants satisfied it in respect of the section   8(4) regime; and – albeit with a significant element of doubt  that all save for Mr   Wieder, who was a US citizen, satisfied it in respect of the receipt of intelligence from the NSA. It did so on the basis that, in addition to the mere assertion – taken from the standard application form on Privacy International’s website – that they believed that the authorities “may have unlawfully intercepted, solicited, accessed, obtained, processed, used, stored and/or retained my information and/or communications, whatever the source of that information or communications may be”, all six complainants had provided supplemental information, including in relation to these two applicants that Mr Wieder was “an IT professional and independent researcher, again substantially involved in intelligence and security matters” and Mr Guarneri was “an independent privacy and security researcher, materially involved in intelligence matters, living in a Council of Europe state”. However, as it did not consider there to be sufficient information on Privacy International’s standard application form to demonstrate victim status, it did not consider that the four unrepresented complainants (see paragraph 14 above) had established locus. 22 .     As to the matter of jurisdiction, the complainants accepted that the issue could be determined under Article 8 and that Article 10 added nothing to their argument. The IPT noted that a State’s competence under Article 1 of the Convention was primarily territorial and the exceptions so far recognised by the Court concerned acts of diplomatic and consular agents present on foreign territory, the exercise of control and authority over an individual outside a Contracting State’s territory, and the exercise of effective control of an area outside a Contracting State’s territory (see Al-Skeini and Others v.   the   United Kingdom [GC], no. 55721/07, §§ 133-142, ECHR 2011). Therefore, in the IPT’s view, a Contracting State owed no obligation under Article 8 of the Convention to persons both of whom were situated outside its territory in respect of electronic communications between them which passed through that State. Furthermore, it was not persuaded that a privacy right was a right of action present in the jurisdiction and to find otherwise would be to extend the bounds of the domestic courts’ jurisdiction under Article 8 of the Convention. 23 .     Consequently, the IPT dismissed the claims of Mr Guarnieri and Mr   Wieder by reference to the Human Rights Act 1998 (“HRA”) on the ground that it had no jurisdiction to examine them. It also dismissed the claims of the three unrepresented complainants who were resident in the United States of America. It accepted, however, that the Government had itself acknowledged that any claims made otherwise than by reference to the HRA could not be resisted on this basis. 24 .     In light of its findings, the IPT directed inquiries in respect of the six represented applicants, with the exception of the HRA claims by Mr   Guarnieri and Mr Wieder, and in respect of any claim by Mr Wieder relating to the receipt of intelligence from the NSA. It also directed that a copy of its judgment be sent to all other complainants, notifying those who were not resident in the United Kingdom that their HRA claims were dismissed for lack of jurisdiction. Finally, it indicated that the complainants resident in the United Kingdom, and the complainants not resident in the United Kingdom in respect of their non-HRA claims, would be notified that their claims would be dismissed as unsustainable pursuant to section 68(4) of RIPA if it did not receive further submissions within twenty-eight days of the date of dispatch of the judgment. Subsequent events 25 .     On 12 September 2016 the IPT notified the representatives of Mr   Guarnieri that it had carefully considered his domestic law complaints and made no determination in his favour. According to the letter: “Under section 68(4) of [RIPA], when not making a determination in favour of an applicant, the Tribunal is only permitted to inform such a complainant that no determination has been made in his favour. If no determination is made in favour of the complainant that may mean that there has been no conduct in relation to the complainant by any relevant body which falls within the jurisdiction of the Tribunal, or that there has been some official activity which is not in contravention of [RIPA]. The provisions of [RIPA] do not allow the Tribunal to disclose whether or not your client is, or has been, of interest to the security, intelligence or law enforcement agencies. Nor is the Tribunal permitted to disclose what evidence it has taken into account in considering your client’s complaint.” 26 .     The IPT wrote a similar letter to Mr Wieder on 12 September 2016, informing him that his complaint had been considered in light of all relevant evidence and no determination had been made in his favour. RELEVANT LEGAL FRAMEWORK AND PRACTICE SECRET SURVEILLANCE REGIMES 27.     The relevant domestic law and practice is set out in Big Brother Watch and Others , cited above, §§ 61-201. THE IPT: JURISDICTION, JUDICIAL REVIEW AND APPEALS 28 .     Pursuant to section 64(4) of RIPA, the IPT was the appropriate forum for any complaint by a person aggrieved by, inter alia , conduct by or on behalf of any of the intelligence agencies which he believed to have taken place in relation to him, his property, communications sent by or to him, or intended for him, or to his use of any postal service, telecommunications service or telecommunication system. Pursuant to section 67(1) and (4)-(5) it was the duty of the IPT to hear and consider any complaint made to it, save where the complaint was frivolous or vexatious, or had been made out of time. 29 .     At the time the applicants brought their domestic proceedings, section   67(8) of RIPA provided that “[e]xcept to such an extent as the Secretary of State may by order otherwise provide, determinations, awards, orders and other decisions of the [Investigatory Powers] Tribunal (including decisions as to whether they have jurisdiction) shall not be subject to appeal or be liable to be questioned in any court”.   However, in R (on the application of Privacy International) v Investigatory Powers Tribunal and others ([2019] UKSC 22), which was handed down on 15 May 2019, the Supreme Court, by a majority of four votes to three, held that section 67(8) of RIPA did not preclude judicial review of a decision of the IPT. In so doing, it disagreed with the first instance court and the Court of Appeal, both of which had held that section 67(8) did preclude judicial review of a decision of the IPT. 30 .     In addition, a new section 67A was inserted into RIPA with effect from 31 December 2018 to provide a right of appeal from the IPT to the Court of Appeal of England and Wales, or the Court of Session in Scotland. “A QUESTION OF TRUST”: REPORT OF THE INVESTIGATORY POWERS REVIEW BY THE INDEPENDENT REVIEWER OF TERRORISM LEGISLATION (“THE ANDERSON REPORT”) 31.     The Independent Reviewer of Terrorism Legislation is a person wholly independent of Government, appointed by the Home Secretary and by the Treasury for a renewable three-year term. He is tasked with reporting to the Home Secretary and to Parliament on the operation of counter‑terrorism law in the United Kingdom. These reports are laid before Parliament to inform the public and political debate. The purpose of the Anderson Report, which was both laid before Parliament and published on 11 June 2015, and which was named after David Anderson K.C., the then Independent Reviewer of Terrorism Legislation, was to inform the public and political debate on the threats to the United Kingdom, the capabilities required to combat those threats, the safeguards in place to protect privacy, the challenges of changing technology, issues relating to transparency and oversight, and the case for new or amended legislation (see Big Brother Watch and Others , cited above, §§   150-55). 32 .     Under the heading “The Global Nature of the Internet”, the Anderson Report stated the following: “The trends outlined above [towards an increasing variety of communication methods, an increasing number of devices and an increasing pace of adoption of new technologies] have resulted in a vast increase in data volumes. One exabyte of data is 500 billion pages of text: by 2015, 76 exabytes of data will travel across the internet every year. However, the infrastructure of the internet means data are not territorially bound. A network is a group of devices which are linked and so able to communicate with one another. The internet is often described as a ‘network of networks’, all of which are interconnected. Communications over the internet take place through the adoption of protocols which are standardised worldwide. A single communication is divided into packets (units of data), which are transmitted separately across multiple networks. They may be routed via different countries as the path of travel followed will be a mix of the quickest or cheapest paths; not necessarily the shortest path. The quickest path will depend upon bandwidth capacity and latency (the amount of data which can be sent through an internet connection and the delay). The result of this method of transmission is increased data flows across borders. For example, an email sent between two persons in the UK may be routed via another country if that is the optimum path for the CSPs [Communications Service Providers] involved. The route taken will also depend on the location of servers. The servers of major email services like Gmail, Yahoo and Hotmail are based outside the UK. It is estimated that somewhere between 10% and 25% of the world’s international telephone and internet traffic transits the UK via underwater fibre optic cables and much of the remaining traffic transits cabling in the US. Whilst the cables are not a recent technological development, having been in use since the 1970s, the amount of data that can be carried has steadily risen. Cables carrying data at a rate of 10 gigabits per second were the norm for most of the 1990s. Data rates of 100 gigabits per second have been available since 2010. By 2014 Google had already invested $300million in 60 terabit (60,000 gigabit) per second fibre optic cables. In 2014, it was reported that researchers in the Netherlands and the USA demonstrated data rates of 225 terabits per second.” 33 .     With regard to the difficulties in attributing online communications, the report stated: “The infrastructure of the internet can make it difficult to attribute communications to their sender and so offers a ‘cloak of anonymity’ for communications. An Internet Protocol [IP] address [IP address] is the identifier for a device on a network. The address may be static or dynamic and is usually written and displayed in the following format: 172.16.254.1 (IPv4 – 32 bits), and 2001:db8:0:1234:0:567:8:1 (IPv6 – 128 bits). IPv6 is the latest version of the Internet Protocol. (a)     Dynamic Host Configuration Protocol is used to allocate IP addresses dynamically to devices connected to a network. For example, CSPs assign an IP address to a router and all devices connected to the router use it to form a private IP network. All the connections from the devices on the private network appear to come from the single IP address assigned to the router by using Network Address Translation. CSPs have a pool of IP addresses which are allocated dynamically in sequence, so that a customer’s external IP address will change and different customers will use the same external IP address, but not at the same time. (b)     Network Address Translation is a technique used by CSPs to allow a single IP address to be shared by multiple customers simultaneously, sometimes numbered in the thousands. It became necessary due to a shortage of IPv4 addresses, though things will change as IPv6 is increasingly adopted. DRIPA 2014 mandated the retention of subscriber data for some categories of IP addresses, namely, those which are static and those which are dynamically allocated in sequence. The Counter Terrorism and Security Act 2015 [CTSA 2015] seeks to address the difficulty which arises when IP addresses are shared by a number of users simultaneously, by requiring the retention of ‘relevant internet data’ in addition to the shared IP address. However those data are not sufficient to resolve IP addresses in all cases (see 9.51 below); and in any event, a CSP can usually only provide details of the person who pays the internet subscription. This is not necessarily the person who was using a device at a particular time. One problem created by the variety of devices now commonly used was highlighted by submissions to the Review. Smart phones and tablets are often shared by a number of users, such as family members. Each of these users may be accessing different applications. This pattern of usage differs from the traditional use of a mobile phone by one person. In light of this, one service provider suggested that in the future investigations will need to be much more user-specific. IP matching can only help with this to a certain degree. A further problem for the attribution of communications is that an IP address can be changed by the use of a proxy server so that a communication appears to come from somewhere it does not. A proxy server acts as an intermediary between a device and the internet, changing the IP address from that of the actual sender to that of the proxy server. Many use proxy servers for perfectly legitimate reasons, such as to maintain privacy online. However, some use proxy servers in order to carry out cyber attacks so that the origin of the attack remains hidden. Often such attacks involve numerous proxies. Virtual Private Networks [VPN] act in a similar way to proxy servers by changing the IP address from that of the actual sender to one provided by the VPN. In the past, VPNs were primarily used by companies to allow their employees to access resources on the company’s network remotely. Increasingly, VPNs are used by individuals to protect their privacy and security online. Unlike proxy servers, VPNs also provide secure communications through encryption. Multi-hop VPNs offer significantly higher degrees of privacy and anonymity online as they route traffic through two or more VPNs. Multipath TCP is an example of an emerging technology likely to have implications for IP matching. Most mobile devices can access the internet through both WiFi and a mobile phone data connection, utilising one or the other at one time. Technologies such as Multipath TCP will enable the splitting of traffic between these two methods of access, increasing the number of requests that will have to be made for communications data and making the IP matching process more complex. Mobile Edge Computing is also likely to diminish the quantity of data entering the central network. It brings content closer to the user by moving it from the central network to the edge of networks. The benefits are faster delivery and better quality for the user, for example, less buffering. However, this is likely to mean fewer communications entering the core network and so lesser volumes of data available for collection. Nomadic wireless technology provides devices with access to an internet connection within a limited area: for example, the localised WiFi Access Points offered by coffee shops in order to encourage custom. Users are transient and access to the internet by a device can only be traced to a timeslot in the specified premises. If the device connects to the internet elsewhere an identifier called a MAC address will recur, however it is possible to change MAC addresses. The internet provides opportunities for undetected communications: (a)     Anyone can set up an email address or social networking profile using a pseudonym. (b)     Criminal gangs can use gaming consoles to communicate. (c)     Opportunities for covert communications via the internet include the use of internet cafes and hidden web pages (...). (d)     Encryption software, discussed in more detail below, can be used to hide the content of communications. (e)     An instant messaging service called Wickr allows users to send encrypted and self ‑ destructing messages.” RELEVANT INTERNATIONAL LAW AND PRACTICE THE COUNCIL OF EUROPE The 2015 Report of the European Commission for Democracy through Law (“the Venice Commission”) on the Democratic Oversight of Signals Intelligence Agencies 34 .     In this report the Venice Commission made the following observations on the subject of jurisdiction: “Strategic surveillance is conducted both within the territory of a state and outside it, by units operating from military bases in allied states, embassies or in ships and aircraft on or, respectively, over the high seas. The collection of intelligence on or over the high seas, or in the territory of another state, with that state’s permission, will not be in violation of the customary international law norm of non-intervention. However, the case law of the European Court of Human Rights, and the UN Human Rights Committee clarifies that human rights obligations under these treaties can extend to activities conducted wholly extraterritorially. Collection facilities in military bases, or vessels situated outside national territory can thus also be within ‘jurisdiction’ for states parties to these treaties. In any event, the processing, analysis and communication of this material is clearly within national jurisdiction and is governed both by national law and states’ applicable human rights obligations. ... It may be technically possible for an agency in one state (A) remotely to gain access to computers physically situated within the territory of another state (B), and use this access to plant malware on the computer, allowing it to be monitored. This technical capability does not alter the fact that the computer is within the territory of B, and clearly within its criminal and administrative law jurisdiction. Thus, if A plants malware for security/law-enforcement purposes in computers in B, then this risks violating the norm of non-intervention if it is not done in compliance with B’s law (if this is possible under the law of B at all).” RELEVANT COMPARATIVE LAW AND PRACTICE JUDGMENT OF 19 MAY 2020 OF THE FEDERAL CONSTUTIONAL COURT ( BUNDESVERFASSUNGSGERICHT ) (1 BVR 2835/17) 35.     The complainants in this case were mostly journalists who reported on human rights violations in conflict zones and in authoritarian States. They challenged the amended version of the Federal Intelligence Service Act ( Gesetz über den Bundesnachrichtendienst ) of 2016 as well as the surveillance measures to which they could be subjected pursuant to this legislation. The amendment of the Act created – for the first time – a statutory basis for the Federal Intelligence Service’s practice of strategic surveillance of foreign telecommunications. It granted the Federal Intelligence Service powers to access telecommunications transmission routes and networks to collect telecommunications data in order to identify telecommunications that were of interest to the intelligence services by the use of search terms (selectors), other tools of analysis and by a subsequent manual analysis. According to the challenged provisions, data regarding telecommunications involving German nationals or persons within Germany had to be separated from the other data and deleted prior to any further analysis. Although such data could be collected incidentally, it was excluded from examination or use by the Federal Intelligence Service. 36.     On the question of territorial jurisdiction, the Constitutional Court held that the fundamental rights of the Basic Law were binding upon the Federal Intelligence Service and the legislator that set out its powers, irrespective of whether the Federal Intelligence Service was operating within Germany or abroad. The protection afforded by Article 10(1) (the fundamental right to the privacy of telecommunications) and the second sentence of Article 5(1) (freedom of the press) also applied to the telecommunications surveillance of foreigners in other countries. According to the Constitutional Court: “ Art. 1(3) [of the Basic Law] provides that German state authority is comprehensively bound by the fundamental rights of the Basic Law. No restrictive requirements that make the binding effect of fundamental rights dependent on a territorial connection with Germany or on the exercise of specific sovereign powers can be inferred from the provision. In any event, this holds true for the fundamental rights at issue in the present case, which, in their dimension as rights against state interference, afford protection against surveillance measures. According to Art. 1(3) [of the Basic Law], the fundamental rights of the Basic Law bind the legislature, the executive and the judiciary as directly applicable law. The provision does not contain an explicit restriction to German territory. ... Rather, the Basic Law’s aim to provide comprehensive fundamental rights protection and to place the individual at its centre suggests that fundamental rights ought to provide protection whenever the German state acts and might thereby create a need for protection – irrespective of where and towards whom it does so. ... German state authority is bound by fundamental rights even in relation to actions taken vis-à-vis foreigners in other countries; this is also in line with Germany’s participation in the international community. ... This link between fundamental rights and human rights guarantees is incompatible with the notion that the applicability of the fundamental rights of the Basic Law ends at the national border, which would exempt German authorities from having to adhere to fundamental rights and human rights when they act abroad vis-à-vis foreigners. Such a notion would run counter to the Basic Law’s aim of ensuring that every person is afforded inalienable rights on the basis of international conventions and beyond national borders – including protection from surveillance (cf. Art. 12 of the Universal Declaration of Human Rights, Art. 17(1) of the International Covenant on Civil and Political Rights). Given the realities of internationalised political action and the ever increasing involvement of states beyond their own borders, this would result in a situation where the fundamental rights protection of the Basic Law could not keep up with the expanding scope of action of German state authority and where it might – on the contrary – even be undermined through the interaction of different states. Yet the fact that the state as the politically legitimated and accountable actor is bound by fundamental rights ensures that fundamental rights protection keeps up with an international extension of state activities. The European Convention on Human Rights, which constitutes a guideline for the interpretation of fundamental rights, also suggests such an understanding of the scope of the fundamental rights of the Basic Law (...). It has not yet been comprehensively determined to what extent its guarantees apply to actions of the Contracting Parties outside of their own territory. The European Court of Human Rights is mainly guided by the criterion of whether a state exercises effective control over an area outside its own territory; on this basis, it has in many cases affirmed the applicability of Convention rights abroad (cf. in summary ECtHR [GC], Al-Skeini and Others v. the United Kingdom , Judgment of 7 July 2011, no. 55721/07, §§ 132 et seq . with further references; cf. also Aust, Archiv des Völkerrechts 52 <2014>, p. 375 <394 et seq. > with further references). However, there has been no final determination as to whether protection is afforded against surveillance measures carried out by Contracting Parties in other states.” 37.     The Constitutional Court noted that at the time the cases of B ig Brother Watch and Others v. the United Kingdom and Centrum för Rättvisa v. Sweden were pending before the Grand Chamber. It continued: “Irrespective of the outcome of these proceedings, the European Convention on Human Rights does not stand in the way of the applicability of German fundamental rights abroad. This is because the Convention is an international treaty with its own separate scope of application; no direct inferences can be drawn from it with regard to the scope of fundamental rights protection under the Basic Law. In any case, the Convention does not rule out further-reaching fundamental rights protection by the Contracting Parties (Art. 53 ECHR).” 38 .     With regard to technological developments, it noted that: “The developments in information technology have led to a situation where data is shared through global channels, where it is randomly routed via satellite or cable according to technical criteria that have no regard to national borders (...). This makes it possible to intercept a considerable number of foreign communications from within Germany. Moreover,