CEDH · CASELAW;COMMUNICATEDCASES;ENG — 24 novembre 2015

.s800EAC49 { font-size:12pt } .sFE10DC93 { margin-top:0pt; margin-bottom:0pt; text-align:center } .sBB9EE52A { font-family:Arial } .sA6BC7FA7 { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt; text-align:right } .s9793A85B { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt } .s5E1364CA { margin-top:0pt; margin-bottom:12pt; text-align:center; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s8229ABDD { margin-top:0pt; margin-bottom:12pt; text-align:center } .s68C46B95 { margin-top:36pt; margin-bottom:12pt; text-align:center } .s3F59B822 { font-family:Arial; font-weight:bold; text-transform:uppercase } .sA8776625 { margin-top:18pt; margin-left:29.2pt; margin-bottom:12pt; text-indent:-17.6pt; page-break-inside:avoid; page-break-after:avoid } .s29100277 { font-family:Arial; font-weight:bold } .s72C8F48C { margin-top:12pt; margin-left:36.6pt; margin-bottom:6pt; text-indent:-15.05pt; page-break-inside:avoid; page-break-after:avoid } .sA36B60A1 { font-family:Arial; font-style:italic } .sA20670C4 { margin-top:12pt; margin-left:48.75pt; margin-bottom:6pt; text-indent:-17pt; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .sF7A86111 { margin-top:6pt; margin-left:21.25pt; margin-bottom:6pt; text-indent:7.1pt; font-size:10pt } .sC7EAD8B { font-family:Arial; font-weight:bold; text-decoration:underline } .s20FC8552 { font-family:Arial; font-size:11.5pt } .sD3B63DAD { margin-top:36pt; margin-bottom:12pt; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s32563E28 { margin-top:0pt; margin-bottom:0pt } .sCB9E0544 { margin-top:0pt; margin-bottom:0pt; text-align:left } .s76CF415B { page-break-before:always; clear:both } .s9FF10068 { margin-top:0pt; margin-bottom:12pt } .s6B505E72 { margin:0pt; padding-left:0pt } .s2C7E9239 { margin-left:15.01pt; margin-bottom:6pt; padding-left:2.99pt; font-family:Arial } .sFBC99493 { font-style:italic } .s516A1808 { margin-left:18pt; margin-bottom:6pt; font-family:Arial }     Communicated on 24 November 2015   FIRST SECTION Application no. 24960/15 10 HUMAN RIGHTS ORGANISATIONS and Others against the United Kingdom lodged on 20 May 2015 STATEMENT OF FACTS The applicants are ten human rights organisations whose details are set out in the Appendix. A.     The circumstances of the case The facts of the case, as submitted by the applicants, may be summarised as follows. 1.     The background facts The applicants communicate on a regular basis with a range of groups and individuals, both nationally and internationally, as part of their human rights activities. Their contacts include other non-governmental organisations, politicians, government officials, journalists, lawyers, victims of human rights abuses and whistle-blowers. The applicants’ staff members communicate using a variety of means including email, text messages, phone calls, video calls, social media and instant messaging. The information contained in their communications frequently includes material which is sensitive, confidential and, in some cases, legally privileged. Because of the nature of their activities, the applicants believe that it is very likely that the content of their private communications and their communications data have been obtained by the United Kingdom intelligence services via interception powers exercised pursuant to the Regulation of Investigatory Powers Act 2000 (“RIPA”), under the domestic interception and collection programme, Tempora, or by way of the Prism or Upstream programmes operated by the United States National Security Agency (“NSA”). Further details of these programmes are set out below. 2.     The three surveillance programmes In 2013 Mr Edward Snowden, a former systems administrator with the NSA, leaked information revealing mass surveillance programmes operated by the NSA. According to the leaked documents, the Prism programme allows access to the content of communications (including emails, chats, video, images, documents, links and other information) and communications data (information permitting the identification and location of internet users) in respect of communications which pass through large US companies, including Microsoft, Apple, Yahoo, Google, Facebook, PalTalk, AOL, Skype and YouTube. Since Global internet data take a mixture of the cheapest and fastest routes rather than the most direct route, a substantial amount of global data passes through the servers of US companies. The leaked documents show that the United Kingdom Government Communications Headquarters (“GCHQ”) has had access to Prism since July 2010 and has used it to generate intelligence reports. The Upstream programme allows the collection of content and communications data from fibre-optic cables and infrastructure owned by US communications service providers. This programme has broad access to global data, in particular of non-US citizens, which can then be collected, stored and searched using keywords. GCHQ’s operates its own surveillance programme, Tempora. This programme allows GCHQ to access content and communications data passing through fibre optic cables running from the United Kingdom to North America and then use “selector terms” (such as phone numbers and email addresses) to filter the data. The Tempora program is authorised by a section 8(4) warrant under the Regulation of Investigatory Powers Act 2000 (“RIPA” – see “Relevant domestic law and practice”, below). According to the applicants, the United States Government have access to the information collected by Tempora. 3.     The domestic proceedings (a)     The lodging of the complaints before the Investigatory Powers Tribunal Between June and December 2013, each of the ten applicants lodged a complaint before the Investigatory Powers Tribunal (“IPT”). They alleged that the intelligence services, the Home Secretary and the Foreign Secretary had acted in violation of Articles 8, 10, and 14 by: (i) accessing or otherwise receiving intercepted communications and communications data from the US Government under the Prism and Upstream programmes (“the Prism issue”); and (ii) intercepting, inspecting and retaining their communications and their communications data under the Tempora programme (“the section   8(4) issue”). The applicants sought disclosure of all relevant material relied on by the intelligence services in the context of their interception activities and, in particular, all policies and guidance. On 14 February 2014 the IPT ordered that the ten cases be joined. It subsequently appointed counsel to the tribunal. In their response to the applicants’ claims, the Government adopted a “neither confirm nor deny” approach, that is to say, they declined to confirm or deny whether the applicants’ communications had actually been intercepted. It was therefore agreed that the IPT would determine the legal issues on the basis of assumed facts, namely that the NSA had obtained the applicants’ communications and communications data via Prism or Upstream and had passed them to GCHQ, where they had been retained, stored, analysed and shared; and that the applicants’ communications and communications data had been intercepted by GCHQ under the Tempora programme and had been retained, stored, analysed and shared. The question was whether, on these assumed facts, interception, retention, storage and sharing of data was in accordance with the law under Articles   8 and 10, taken alone and together with Article 14. The IPT held a five-day, public hearing from 14-18 July 2014. The Government requested an additional closed hearing in order to enable the IPT to consider the GCHQ’s unpublished internal arrangements – so-called “below the waterline” – for processing data. The applicants objected, arguing that the holding of a closed hearing was not justified and that the failure to disclose the arrangements to them was unfair. The request for a closed hearing was granted pursuant to Rule 9 of the IPT’s Rules of Procedure (see “Relevant domestic law and practice”, below) and on 10   September a closed hearing took place. The applicants were neither present nor represented. In the closed hearing, the IPT examined the internal arrangements regulating the conduct and practice of the intelligence services. It found that it was entitled to look “below the waterline” to consider the adequacy of the applicable safeguards and whether any further information could or should be disclosed to the public in order to comply with the requirements of Articles 8 and 10. On 9 October 2014 the IPT notified the applicants that it was of the view that there was closed material which could be disclosed. It explained that it had invited the Government to disclose the material and that the Government had agreed to do so. The material was accordingly provided to the applicants in a note (“the 9 October disclosure”) and the parties were invited to make submissions to the IPT on the disclosed material. The applicants sought information on the context and source of the disclosure but the IPT declined to provide further details. The applicants made written submissions on the disclosure. The respondents subsequently further amended and amplified the disclosed material. Following final disclosures made on 12 November 2014, the 9 October disclosure provided as follows: “The US Government has publicly acknowledged that the Prism system and Upstream programme ... permit the acquisition of communications to, from, or about specific tasked selectors associated with non-US persons who are reasonably believed to be located outside the United States in order to acquire foreign intelligence information. To the extent that the Intelligence Services are permitted by the US Government to make requests for material obtained under the Prism system (and/or ... pursuant to the Upstream programme), those requests may only be made for unanalysed intercepted communications (and associated communications data) acquired in this way. 1. A request may only be made by the Intelligence Services to the government of a country or territory outside the United Kingdom for unanalysed intercepted communications (and associated communications data), otherwise than in accordance with an international mutual legal assistance agreement, if either: a. a relevant interception warrant under [RIPA] has already been issued by the Secretary of State, the assistance of the foreign government is necessary to obtain the communications at issue because they cannot be obtained under the relevant RIPA interception warrant and it is necessary and proportionate for the Intelligence Services to obtain those communications; or b. making the request for the communications at issue in the absence of a relevant RIPA interception warrant does not amount to a deliberate circumvention of RIPA or otherwise contravene the principle established in Padfield v. Minister of Agriculture, Fisheries and Food [1968] AC 997 [that a public body is required to exercise its discretionary powers to promote (and not to circumvent) the policy and the objects of the legislation which created those powers] (for example, because it is not technically feasible to obtain the communications via RIPA interception) , and it is necessary and proportionate for the Intelligence Services to obtain those communications. In these circumstances, the question whether the request should be made would be considered and decided upon by the Secretary of State personally. Any such request would only be made in exceptional circumstance, and has not occurred as at the date of this statement. ... 2. Where the Intelligence Services receive intercepted communications content or communications data from the government of a country or territory outside the United Kingdom, irrespective whether it is/they are solicited or unsolicited, whether the content is analysed or unanalysed, or whether or not the communications data are associated with the content of communications, the communications content and data are, pursuant to internal “arrangements”, subject to the same internal rules and safeguards as the same categories of content or data, when they are obtained directly by the Intelligence Services as a result of interception under RIPA. 3. Those of the Intelligence Services that receive unanalysed intercepted material and related communications data from interception under a s.8(4) warrant have internal ‘arrangements’ that require a record to be created, explaining why access to the unanalysed intercepted material is required, before an authorised person is able to access such material pursuant to s.16 of RIPA. 4. The internal ‘arrangements’ of those of the Intelligence Services that receive unanalysed intercepted material and related communications data from interception under a s.8(4) warrant specify (or require to be determined, on a system-by-system basis) maximum retention periods for different categories of such data which reflect the nature and intrusiveness of the particular data at issue. The periods so specified (or determined) are normally no longer than 2 years, and in certain cases are significantly shorter (intelligence reports that draw on such data are treated as a separate category, and are retained for longer). Data may only be retained for longer than the applicable maximum retention period where prior authorisation has been obtained from a senior official within the particular Intelligence Service at issue on the basis that continued retention of the particular data at issue has been assessed to be necessary and proportionate (if the continued retention of any such data is thereafter assessed no longer to meet the tests of necessity and proportionality, such data are deleted). As far as possible, all retention periods are implemented by a process of automated deletion which is triggered once the applicable maximum retention period has been reached for the data at issue. The maximum retention periods are overseen by, and agreed with the Commissioner. As regards related communications data in particular, Sir Anthony May made a recommendation to those of the Intelligence Services that receive unanalysed intercepted material and related communications data from interception under a s8(4) warrant, and the interim Commissioner (Sir Paul Kennedy) has recently expressed himself to be content with the implementation of that recommendation. 5. The Intelligence Services’ internal ‘arrangements’ under SSA [the Security Services Act 1989], ISA [the Intelligence Services Act 1994] and ss.15-16 of RIPA are periodically reviewed to ensure that they remain up-to-date and effective. Further, the Intelligence Services are henceforth content to consider, during the course of such periodic reviews, whether more of those internal arrangements might safely and usefully be put into the public domain (for example, by way of inclusion in a relevant statutory Code of Practice).” (b)     The IPT’s first judgment of 5 December 2014 The IPT issued its first judgment on 5 December 2014. The judgment addressed the current arrangements in place (i.e. as of 5 December 2014) for intercepting and sharing data and made extensive reference throughout to this Court’s case-law, and in particular the cases of Weber and Saravia v.   Germany (dec.), no. 54934/00, ECHR 2006 ‑ XI; Liberty v. the United Kingdom , no. 58243/00, 1 July 2008; and Kennedy v. the United Kingdom , no.   26839/05, 18 May 2010. The tribunal identified two parts to the claim: the Prism issue and the section 8(4) issue (see the description of the complaints lodged, above). It began by underlining the importance of setting the complaints into context, explaining: “6. ... The actions of the Respondents... are all taken, or assumed to be taken, in the interests of national security, and at a time when ... the threat to the United Kingdom from international terrorism is ‘Substantial’, indicating that an attack is a strong possibility; this has been recently upgraded to ‘Severe’, meaning that an attack is highly likely. The Claimants accept that Convention jurisprudence recognises the need for states to defend themselves and to introduce measures in support of national security, and that the concept, familiar within the confines of Article 8, of accessibility and foreseeability, of laws, rules and arrangements established by democracies in that regard may be approached differently from those situations where national security is not an issue ...” The IPT accepted that the Prism issue engaged Article 8 and that there would need to be compliance by the authorities involved in processing the data with requirements imposed by that Article, particularly in relation to storage, sharing, retention and destruction. In its view, in order for the interference to be considered “in accordance with the law”, there could not be unfettered discretion for executive action, the nature of the rules had to be clear and the ambit of the rules had to be in the public domain so far as possible (citing Bykov v. Russia [GC], no. 4378/02, §§ 76 and 78, 10   March 2009). The tribunal considered it plain that in the field of national security, much less was required to be put in the public domain and the degree of foreseeability required by Article 8 had to be reduced, because otherwise the whole purpose of the steps taken to protect national security would be at risk (citing Leander v. Sweden , 26 March 1987, § 51, Series A no. 116). The IPT continued: “41. We consider that what is required is a sufficient signposting of the rules or arrangements insofar as they are not disclosed ... We are satisfied that in the field of intelligence sharing it is not to be expected that rules need to be contained in statute ( Weber ) or even in a code (as was required by virtue of the Court’s conclusion in Liberty v UK ). It is in our judgment sufficient that: i) Appropriate rules or arrangements exist and are publicly known and confirmed to exist, with their content sufficiently signposted, such as to give an adequate indication of it (as per Malone ... [ v. the United Kingdom , 2 August 1984, Series A no. 82]). ii) They are subject to proper oversight.” As to the existence of rules or arrangements, the IPT noted that arrangements were provided for in the statutory framework set out in the Security Services Act 1994 (“the SSA”) and the Intelligence Services Act 1994 (“the ISA” – see “Relevant domestic law and practice”, below). It further referred to a witness statement where the Director-General of the Office for Security and Counter Terrorism (“OSCT”) at the Home Office had explained that the statutory framework set out in those Acts was underpinned by detailed internal guidance, including arrangements, in respect of which staff received mandatory training; and that the full details of the arrangements were confidential since they could not be safely published without undermining the interests of national security. The tribunal acknowledged that the arrangements were not made known in their detail to the public and that, to that extent, were not accessible. It further accepted that, unlike the Code of Practice published under RIPA, not even a summary of what they contained had been disclosed. However, the IPT considered it significant that the arrangements were subject to oversight and investigation by the Intelligence and Security Committee of Parliament and the independent Interception of Communications Commissioner. In so far as the claimants challenged the tribunal’s decision to look “below the waterline” when assessing the adequacy of the safeguards, the IPT considered itself entitled to look at the internal arrangements in order to be satisfied that there were adequate safeguards and that what was described “above the waterline” was accurate and gave a sufficiently clear signposting as to what was “below the waterline” without disclosing the detail of it. The IPT did not accept that the holding of a closed hearing, as it had been carried out in the applicants’ case, was unfair. In the IPT’s view, it accorded with the statutory procedure, gave the fullest and most transparent opportunity for hearing full arguments inter partes on hypothetical and actual facts with as much as possible heard in public, and protected the public interest and national security. The tribunal was satisfied that the 9   October disclosure (as subsequently amended) provided a clear and accurate summary of that part of the evidence given in the closed hearing which could and should be disclosed and that the rest of the evidence given in closed hearing was too sensitive for disclosure without risk to national security or to the “neither confirm nor deny” principle. In relation to the receipt of intercept material from Prism and Upstream, the IPT held that the internal arrangements were adequate for ensuring compliance with the statutory framework and with Articles 8 and 10 of the Convention. The tribunal was further satisfied that the arrangements were sufficiently signposted in the statutory framework, the statements of the Intelligence and Security Committee and the Interception of Communications Commissioner and the 9 October disclosure. They were also subject to appropriate oversight. It concluded that the scope of discretion conferred on the respondents to receive and handle the material, and the manner of its exercise were accordingly accessible with sufficient clarity to give the individual adequate protection against arbitrary interference. There was therefore was no breach of Articles 8 or 10. As regards the section 8(4) issue, the IPT reviewed the applicable legal framework in RIPA, including the sections 15 and 16 safeguards requiring the putting in place of appropriate arrangements for collecting and processing the data (see “Relevant domestic law and practice”, below), and the supporting Code of Practice. It referred again to the witness statement of the Director General, in which he had explained that while full details of the sections   15 and 16 arrangements could not be made public, they were made available to the Interception of Communications Commissioner who was required to keep them under review, each intercepting agency was required to keep a record of the arrangements in questions; and any breach of the arrangements had to be reported to the Commissioner. The IPT formulated four questions to be decided in order to determine whether the section 8(4) regime was compatible with Articles 8 of the Convention: “(1) Is the difficulty of determining the difference between external and internal communications ... such as to cause the s.8(4) regime not to be in accordance with law contrary to Article 8(2)? (2) Insofar as s.16 of RIPA is required as a safeguard in order to render the interference with Article 8 in accordance with law , is it a sufficient one? (3) Is the regime, whether with or without s.16, sufficiently compliant with the Weber requirements, insofar as such is necessary in order to be in accordance with law ? (4) Is s.16(2) indirectly discriminatory contrary to Article 14 of the Convention, and, if so, can it be justified?” In relation to the first question, the IPT found that the differences in view as to the definition of “external communications” did not render the section   8(4) regime incompatible with Article 8 § 2. The tribunal explained that the difficulty in distinguishing between “internal” and “external” communications had existed since the enactment of RIPA and that both types of communications, if intercepted under a section 8(4) warrant, were in any case to be considered for examination by reference to section   16 RIPA. In respect of the second question, the IPT held that the section 16 RIPA safeguards were sufficient. It explained that although the section provided greater protection in certain respects for communications content, rather than data, and while it was true that the Weber requirements also extended to communications data, the difference in treatment was justified and proportionate because that data were used to identify individuals whose intercepted material was protected by section 16 (that is, because of physical presence in the British Islands). Turning to the third question, the IPT concluded that the section   8(4) regime was sufficiently compliant with the Weber requirements and was in any event “in accordance with the law”. The failure to target communications at interception level was acceptable and inevitable. There was no requirement for search words to be included in an application for a warrant or in the warrant itself, or for the warrant to be judicially authorised. The tribunal was further of the view that it was not necessary that the precise details of all the safeguards should be published or contained in legislation. The undisclosed, administrative arrangements could be taken into account provided that the scope of the discretion and the manner of its exercise were disclosed. The IPT was satisfied that, as a result of what it had heard at the closed hearings and the 9 October disclosure as amended, there was no large databank of communications data being built up and that there were adequate arrangements in respect of duration of retention of data and its destruction. As with the Prism issue, the tribunal considered that the section   8(4) arrangements were sufficiently signposted in statute, in the Code of Practice, in the Interception of Communications Commissioner’s reports and, now, in its own judgment. As regards the fourth and final question, the IPT did not make any finding as to whether there was in fact indirect discrimination on grounds of national origin as a result of the different regimes applicable to individuals located in the British Islands and those located outside. It considered that any indirect discrimination was sufficiently justified on the grounds that it was harder to investigate terrorism and crime threats from abroad and that to require a certificate under section 16(3) RIPA (see “Relevant domestic law and practice”, below), which exceptionally allows access to material concerning persons within the British Islands intercepted under a section   8(4) warrant on a case-by-case basis, would radically undermine the efficacy of the section 8(4) regime. Finally, the IPT noted that there was no separate argument in relation to Article   10, over and above that arising in respect of Article 8, save that there might be a special argument relating to Article 10 with respect to the need for judicial pre-authorisation of a warrant (referring to Sanoma Uitgevers B.V. v. the Netherlands [GC], no. 38224/03, 14 September 2010). In relation to this, the tribunal emphasised that the applicants’ case did not concern targeted surveillance of journalists or non-governmental organisations. In the context of untargeted monitoring via a section 8(4) warrant, it was “clearly impossible” to anticipate a judicial pre-authorisation prior to the warrant limited to what might turn out to impact upon Article 10. Although the tribunal accepted that an issue might arise in the event that, in the course of examination of the contents, some question of journalistic confidence arose, it observed that there were additional safeguards in the Code of Practice in relation to treatment of such material. Following the publication of the judgment, the parties were invited to make submissions on whether, prior to the judgment, the legal regime in place in respect of the Prism issue complied with Articles 8 and 10 and on the proportionality and lawfulness of any alleged interception of their communications. The tribunal did not permit further submissions on the proportionality of the section 8(4) regime as a whole. (c)     The IPT’s second judgment of 6 February 2015 In its second judgment of 6 February 2015, the IPT considered whether, prior to its December 2014 judgment, the Prism or Upstream arrangements breached Article 8 or 10. It agreed that it was only by reference to the 9 October disclosure as amended that it was satisfied the current regime was “in accordance with the law”. The tribunal was of the view that without the disclosures made, there would not have been adequate signposting, as was required under Articles   8 and 10. It therefore made a declaration that prior to the disclosures made: “23. ... [T]he regime governing the soliciting, receiving, storing and transmitting by UK authorities of private communications of individuals located in the UK, which have been obtained by US authorities pursuant to Prism and/or ... Upstream, contravened Articles 8 or 10 ECHR, but now complies.” (d)     The IPT’s third judgment of 22 June 2015 as amended by its 1 July 2015 letter The third judgment of the IPT, published on 22 June 2015, determined whether the applicants’ communications obtained under Prism or Upstream had been solicited, received, stored or transmitted by the United Kingdom authorities in contravention of Articles 8 or 10 of the Convention; and whether the applicants’ communications had been intercepted, viewed, stored or transmitted by the United Kingdom authorities so as to amount to unlawful conduct or in contravention of Articles 8 or 10 . The tribunal made no determination in favour of eight of the ten applicants. In line with its usual practice where it did not find in favour of the claimant, it did not confirm whether or not their communications had been intercepted. The IPT made determinations in favour of two organisations. The identity of one of the organisations was wrongly noted in the judgment and the error was corrected by the IPT’s letter of 1 July 2015. In respect of Amnesty International, the IPT found that email communications had been lawfully and proportionately intercepted and accessed pursuant to section 8(4) RIPA but that the time-limit for retention permitted under the internal policies of GCHQ had been overlooked and the material had therefore been retained for longer than permitted. However, the IPT was satisfied that the material had not been accessed after the expiry of the relevant retention time-limit and that the breach could be characterised as a technical one. It amounted nonetheless to a breach of Article 8 and GCHQ was ordered to destroy any of the communications which had been retained for longer than the relevant period and to deliver one hard copy of the documents within seven days to the Interception of Communications Commissioner to retain for five years in case they were needed for any further legal proceedings. GCHQ was also ordered to provide a closed report within fourteen days confirming the destruction of the documents. No award of compensation was made. In respect of the Legal Resources Centre, the IPT found that communications from an email address associated with the applicant had been intercepted and selected for examination under a section 8(4) warrant. Although it was satisfied the interception was lawful and proportionate and that selection for examination was proportionate, the IPT found that the internal procedure for selection was, in error, not followed. There had therefore been a breach of the Legal Resources Centre’s Article 8 rights. However, the IPT was satisfied that no use was made of the material and that no record had been retained so the applicant had not suffered material detriment, damage or prejudice. Its determination therefore constituted just satisfaction and no compensation was awarded. B.     Relevant domestic and international law 1.     The operation of the intelligence services There are three intelligence services in the United Kingdom: the security service (“MI5”), the secret intelligence service (“MI6”) and GCHQ. Section 1 of the Security Services Act 1994 (“SSA”) provides a statutory basis for the operation of MI5. The functions of MI5 are the protection of national security and, in particular, its protection against threats from espionage, terrorism and sabotage, from the activities of agents of foreign powers and from actions intended to overthrow or undermine parliamentary democracy by political, industrial or violent means; to safeguard the economic well-being of the United Kingdom against threats posed by the actions or intentions of persons outside the British Islands; and to act in support of the activities of police forces, the National Crime Agency and other law enforcement agencies in the prevention and detection of serious crime. Pursuant to section 2 of the SSA, the operations of MI5 are under the control of the Director-General, who is appointed by the Secretary of State. It is the duty of the Director-General to ensure that there are arrangements for securing that no information is obtained by MI5 except so far as necessary for the proper discharge of its functions or disclosed by it except so far as necessary for that purpose or for the purpose of the prevention or detection of serious crime or for the purpose of any criminal proceedings. Section 1 of the Intelligence Services Act 1994 (“ISA”) provides a statutory basis for the operation of MI6. The functions of MI6 are to obtain and provide information relating to the actions or intentions of persons outside the British Islands; and to perform other tasks relating to the actions or intentions of such persons. MI6 can only exercise its functions in the interests of national security, with particular reference to the State’s defence and foreign policies, in the interests of the economic well-being of the United Kingdom or in support of the prevention or detection of serious crime. Section 2 of ISA provides for the control of the operations of MI6 by a Chief of Service, to be appointed by the Secretary of State. The Chief’s duties include ensuring that there are arrangements for securing that no information is obtained by MI6 except so far as necessary for the proper discharge of its functions, and that no information is disclosed by it except so far as necessary for that purpose, in the interests of national security, for the purposes of the prevention or detection of serious crime or for the purpose of any criminal proceedings. Section 3 of ISA sets out the authority for the operation of GCHQ. One of the functions of GCHQ is to monitor or interfere with electromagnetic, acoustic and other emissions and any equipment producing such emissions and to obtain and provide information derived from or related to such emissions or equipment and from encrypted material. Again, this function is exercisable only in the interests of national security, with particular reference to the State’s defence and foreign policies, in the interests of the economic well-being of the United Kingdom in relation to the actions or intentions of persons outside the British Islands or in support of the prevention or detection of serious crime. Section 4 provides that GCHQ’s operations are under the control of a Director, who is appointed by the Secretary of State. It is the duty of the Director to ensure that there are arrangements for securing that no information is obtained by GCHQ except so far as necessary for the proper discharge of its functions and that no information is disclosed by it except so far as necessary. Section 19 of the Counter-Terrorism Act 2008 allows the disclosure of information to any of the intelligence services for the purpose of the exercise of any of its functions. It provides that the information an intelligence service obtains in connection with its functions may be used by that service in connection with any of its other functions. Information obtained by MI5 and MI6 may be disclosed by them for the purpose of the proper discharge of their functions, in the interests of national security, for the purpose of the prevention or detection of serious crime or for the purpose of any criminal proceedings”. Information obtained by GCHQ may be disclosed by it for the purpose of the proper discharge of its functions or for the purpose of any criminal proceedings. 2.     The interception of communications The Regulation of Investigatory Powers Act 2000 (“RIPA”) came into force on 15 December 2000. The explanatory memorandum described the main purpose of the Act as being to ensure that the relevant investigatory powers were used in accordance with human rights. Section 1(1) of RIPA makes it an offence for a person intentionally and without lawful authority to intercept, at any place in the United Kingdom, any communication in the course of its transmission by means of a public postal service or a public telecommunication system. Section 8(4) and (5) allows the Secretary of State to issue a warrant for “the interception of external communications in the course of their transmission by means of a telecommunication system”. At the time of issuing such a warrant, he must also issue a certificate setting out a description of the intercepted material which he considers it necessary to be examined, and stating that the warrant is necessary, inter alia , in the interests of national security, for the purpose of preventing or detecting serious crime or for the purpose of safeguarding the economic well-being of the United Kingdom and that the conduct authorised by the warrant is proportionate to what is sought to be achieved by that conduct. RIPA sets out a number of general safeguards in section 15. Pursuant to Section 15(1), it is the duty of the Secretary of State to ensure, in relation to all interception warrants, that such arrangements are in force as he considers necessary for securing that the requirements of subsections (2) and (3) are satisfied in relation to the intercepted material and any related communications data; and, in the case of warrants in relation to which there are section 8(4) certificates, that the requirements of section 16 are also satisfied. Section 15(2) provides: “The requirements of this subsection are satisfied in relation to the intercepted material and any related communications data if each of the following– (a) the number of persons to whom any of the material or data is disclosed or otherwise made available, (b) the extent to which any of the material or data is disclosed or otherwise made available, (c) the extent to which any of the material or data is copied, and (d) the number of copies that are made, is limited to the minimum that is necessary for the authorised purposes.” Section 15(3) provides: “The requirements of this subsection are satisfied in relation to the intercepted material and any related communications data if each copy made of any of the material or data (if not destroyed earlier) is destroyed as soon as there are no longer any grounds for retaining it as necessary for any of the authorised purposes.” Pursuant to section 15(4), something is necessary for the authorised purposes if, and only if, it continues to be, or is likely to become, necessary as mentioned in section 5(3) of the Act; it is necessary for facilitating the carrying out of any of the interception functions of the Secretary of State; it is necessary for facilitating the carrying out of any functions of the Interception of Communications Commissioner or of the Tribunal; it is necessary to ensure that a person conducting a criminal prosecution has the information he needs to determine what is required of him by his duty to secure the fairness of the prosecution; or it is necessary for the performance of any duty imposed on any person under public records legislation. Section 15(5) requires the arrangements in place to secure compliance with section 15(2) to include such arrangements as the Secretary of State considers necessary for securing that every copy of the material or data that is made is stored, for so long as it is retained, in a secure manner. Pursuant to section 15(6), the arrangements to which section 15(1) refers are not required to secure that the requirements of section 15(2) and (3) are satisfied in so far as they relate to any of the intercepted material or related communications data, or any copy of any such material or data, possession of which has been surrendered to any authorities of a country or territory outside the United Kingdom. However, such arrangements are required to secure, in the case of every such warrant, that possession of the intercepted material and data and of copies of the material or data is surrendered to authorities of a country or territory outside the United Kingdom only if the requirements of section 15(7) are satisfied. Section 15(7) provides: “The requirements of this subsection are satisfied in the case of a warrant if it appears to the Secretary of State– (a) that requirements corresponding to those of subsections (2) and (3) will apply, to such extent (if any) as the Secretary of State thinks fit, in relation to any of the intercepted material or related communications data possession of which, or of any copy of which, is surrendered to the authorities in question; and (b) that restrictions are in force which would prevent, to such extent (if any) as the Secretary of State thinks fit, the doing of anything in, for the purposes of or in connection with any proceedings outside the United Kingdom which would result in such a disclosure as, by virtue of section 17, could not be made in the United Kingdom.” Section 16 sets out additional safeguards in relation to interception of “external” communications under section 8(4) warrants. Section 16(1) explains that the requirements of section 16, for the purposes of section 15, are that the intercepted material is read, looked at or listened to by the persons to whom it becomes available by virtue of the warrant to the extent only that it has been certified as material the examination of which is necessary as mentioned in section 5(3)(a), (b) or (c) of the Act; and falls within section 16(2). Section 16(2) provides: “Subject to subsections (3) and (4), intercepted material falls within this subsection so far only as it is selected to be read, looked at or listened to otherwise than according to a factor which– (a) is referable to an individual who is known to be for the time being in the British Islands; and (b) has as its purpose, or one of its purposes, the identification of material contained in communications sent by him, or intended for him.” Pursuant to section 16(3), intercepted material falls within section 16(2), even if it is selected by reference to one of the factors mentioned that subsection, if it is certified by the Secretary of State for the purposes of section   8(4) that the examination of material selected according to factors referable to the individual in question is necessary as mentioned in subsection 5(3)(a), (b) or (c) of the Act; and the material relates only to communications sent during a period specified in the certificate that is no longer than the permitted maximum. The “permitted maximum” is defined in section 16(3A) as follows: “(a) in the case of material the examination of which is certified for the purposes of section 8(4) as necessary in the interests of national security, six months; and (b) in any other case, three months.” Pursuant to section 16(4), intercepted material also falls within section   16(2), even if it is selected by reference to one of the factors mentioned that subsection, if the person to whom the warrant is addressed believes, on reasonable grounds, that the circumstances are such that the material would fall within that subsection; or the conditions set out in section   16(5) are satisfied in relation to the selection of the material. Section 16(5) provides: “Those conditions are satisfied in relation to the selection of intercepted material if – (a) it has appeared to the person to whom the warrant is addressed that there has been such a relevant change of circumstances as, but for subsection (4)(b), would prevent the intercepted material from falling within subsection (2); (b) since it first so appeared, a written authorisation to read, look at or listen to the material has been given by a senior official; and (c) the selection is made before the end of the permitted period.” Pursuant to section 16(5A), the “permitted period” means: “(a) in the case of material the examination of which is certified for the purposes of section 8(4) as necessary in the interests of national security, the period ending with the end of the fifth working day after it first appeared as mentioned in subsection   (5)(a) to the person to whom the warrant is addressed; and (b) in any other case, the period ending with the end of the first working day after it first so appeared to that person.” Section 16(6) explains that a “relevant change of circumstances” means that it appears that either the individual in question has entered the British Islands; or that a belief by the person to whom the warrant is addressed in the individual’s presence outside the British Islands was in fact mistaken. Part IV of RIPA provides for the appointment of an Interception of Communications Commissioner and an Intelligence Services Commissioner, charged with supervising the activities of the intelligence services. Section 65 of RIPA establishes the Investigatory Powers Tribunal, which has jurisdiction to determine claims related to the conduct of the intelligence services, including proceedings under the Human Rights Act 1998. Section 71 of RIPA requires the Secretary of State to issue Codes of Practice relating to the exercise and performance of the powers and duties under the Act. 3.     Data sharing A British-US Communication Intelligence Agreement of 5 March 1946 governs the arrangements between the British and United States authorities in relation to the exchange of intelligence information relating to “foreign” communications, defined by reference to countries other than the United States, the United Kingdom and the Commonwealth. Pursuant to the agreement, the parties undertook to exchange the products of a number of interception operations relating to foreign communications The Acquisition and Disclosure of Communications Data: Code of Practice, issued under section 71 RIPA, provides, in relation to the provision of data to foreign agencies: “ Acquisition of communication data on behalf of overseas authorities 7.11 Whilst the majority of public authorities which obtain communications data under the Act have no need to disclose that data to any authority outside the United Kingdom, there can be occasions when it is necessary, appropriate and lawful to do so in matters of international co-operation. 7.12 There are two methods by which communications data, whether obtained under the Act or not, can be acquired and disclosed to overseas public authorities: Judicial co-operation Non-judicial co-operation Neither method compels United Kingdom public authorities to disclose data to overseas authorities. Data can only be disclosed when a United Kingdom public authority is satisfied that it is in the public interest to do so and all relevant conditions imposed by domestic legislation have been fulfilled. ... Non-judicial co-operation 7.15 Public authorities in the United Kingdom can receive direct requests for assistance from their counterparts in other countries. These can include requests for the acquisition and disclosure of communications data for the purpose of preventing or detecting crime. On receipt of such a request the United Kingdom public authority may consider seeking the acquisition or disclosure of the requested data under the provisions of Chapter II of Part I of the Act. 7.16 The United Kingdom public authority must be satisfied that the request complies with United Kingdom obligations under human rights legislation. The necessity and proportionality of each case must be considered before the authority processes the authorisation or notice. Disclosure of communications data to overseas authorities 7.17 Where a United Kingdom public authority is considering the acquisition of communications data on behalf of an overseas authority and transferring the data to that authority it must consider whether the data will be adequately protected outside the United Kingdom and what safeguards may be needed to ensure that. Such safeguards might include attaching conditions to the processing, storage and destruction of the data. ... 7.21 The [Data Protection Act] recognises that it will not always be possible to ensure adequate data protection in countries outside of the European Union and the European Economic Area, and there are exemptions to the principle, for example if the transfer of data is necessary for reasons of ‘substantial public interest’. There may be circumstances when it is necessary, for example in the interests of national security, for communications data to be disclosed to a third party country, even though that country does not have adequate safeguards in place to protect the data. That is a decision that can only be taken by the public authority holding the data on a case by case basis.” 4.     IPT practice and procedure The IPT was established under section 65(1) RIPA to hear allegations by citizens of wrongful interference with their communications as a result of conduct covered by RIPA. Members of the tribunal must hold or have held high judicial office or be a qualified lawyer of at least ten years’ standing. Any person may bring a claim before the IPT and, save for vexatious or frivolous applications, the IPT must determine all claims brought before it (sections   67(1), (4) and (5) RIPA). Section 65(2) provides that the IPT is the only appropriate forum in relation to proceedings for acts incompatible with Convention rights which are proceedings against any of the intelligence ser