UN must reject mass surveillance to protect global privacy rights

In response to a consultation being undertaken by the UN in accordance with December’s General Assembly resolution on the right to privacy in the digital age, Privacy International today called on the United Nations to recognise that mass surveillance is incompatible with human rights.

The submission to the Office of the High Commissioner to Human Rights confronts some of the biggest challenges to the right to privacy in the digital age, debunks some of the justifications put forth by the Five Eyes governments in response to the Snowden revelations, and argues that States owe human rights obligations to all individuals subject to their jurisdiction.

Privacy International - in conjunction with Access, the Electronic Frontier Foundation, Article 19, the Association for Progressive Communications, Human Rights Watch and the World Wide Web Foundation - demand that the UN formally recognises that indiscriminate surveillance, such as the Prism and Tempora programmes being conducted by the NSA and GCHQ, are inherently disproportionate infringements on individual privacy, and can never be compatible with human rights.

The UN must recognise that the interception of digital communications is effected at the moment at which a communication is engaged with, and that States conducting global communications surveillance, like the US and UK, owe obligations to individuals both within and outside their borders.

Updating understandings of privacy in light of technological advances

Governments have been quick to attempt to colour the discourse around mass surveillance by rebranding their actions as “bulk collection” of communications, asserting that such collection in itself is a benign measure that does not offend privacy rights. Collection, the US and UK governments have asserted, is not the problem; privacy is only implicated when a state agent looks at or reads the communications that are collected.

We reject this argument, and call upon the UN to make a strong statement that any measure to collect, control or take custody of communications amounts to an interception, thus constituting an interference with privacy that must be justified in accordance with international human rights law.

The recording of all digital transmissions being sent to and from a certain IP address or set 
of IP addresses is akin to the inspection and recording of the address of every single piece of mail that passes through a certain post office, as well as the opening, inspection and potentially duplication of the contents of that piece of mail, prior to the forwarding on of the mail to its intended destination.

Just like with postal interception, the interception of digital communications is effected at the moment at which a communication is engaged with sufficiently to enable its collection and retention for analysis, either contemporaneously or subsequently. We call on the UN to adopt this analysis.

The historical distinction between data about an individual’s communications and the content of his or her communications has become insignificant. As data becomes more and more revelatory, either in isolation or when paired with other data, it is no longer appropriate to subject communication data to lower thresholds or consider its collection and processing a less invasive practice than interception of content. Communications data can now reveal equally sensitive information as communications content, and must enjoy equal protections under human rights law.

Protecting privacy across borders

States owe human rights obligations to all individuals subject to their jurisdiction. This extends not only to the territory of the State, but to anyone within the power and effective control of the State, even if they are outside the territory.The extension of these principles to the protection of privacy in the context of communications surveillance by a foreign State does not require a new normative framework.  Any State that can engage in extraterritorial surveillance over foreigners outside its territory is:

required to at a minimum “respect” the right to privacy, that is, to conduct surveillance in accord with the right as delimited in international law, and
is capable of exerting "effective control" over those persons' access to the right to privacy, and should thereby be required to apply the Covenant to its actions.

Given the invasive nature of the mechanisms by which surveillance of global communications networks is effective – the exploitation of the very infrastructure that makes up the internet – it is evident that the measures taken by States to achieve surveillance of foreigners communications allow them “effective control” of the privacy rights of all individuals whose communications pass within their reach.

Accordingly, the UN must recognise that States conducting global communications surveillance, like the US and UK, owe obligations to individuals both within and outside their borders.

Discriminatory legal frameworks

Finally, the submission contends that the patchwork of secret spying programmes and intelligence-sharing agreements implemented by parties to the Five Eyes arrangement (the US, UK, Canada, Australia and New Zealand) constitutes an integrated global surveillance arrangement that covers the majority of the worlds’ communications.  At the heart of this arrangement are carefully constructed legal frameworks (Appendix 1 to this submission) that provide differing levels of protections for internal versus external communications, or those relating to nationals versus non-nationals.

These discriminatory frameworks attempt to circumvent national constitutional or human rights protections governing interferences with the right to privacy of communications that, States purport, apply only to nationals or those within their territorial jurisdiction.

Individuals have a legitimate expectation that their human rights will be respected not only by the State upon whose territory they stand, but by the State within whose territory their rights are interfered with.

The UN should declare that the current legal frameworks of the Five Eyes States purport to discriminate between the rights and obligations owed to nationals or those physically within their territory, and those outside.