Surveillance by intelligence services – Volume II: field perspectives and legal update
share a common purpose or who carry on, or may carry
on, a particular activity” or “more than one person or
organisation, or more than one set of premises, where
the conduct authorised or required by the warrant is for
the purposes of a single investigation or operation”.106
This type of targeted interception warrant can be
called ‘thematic’.107 The potential scope of thematic
interception warrants can be quite broad given that
the “[d]escriptions of persons, organisations or sets
of premises [in the warrant] must be as granular as
reasonably practicable in order to sufficiently enable
proper assessment of the proportionality and intrusion
involved in the interception.”108
In Portugal, a recently adopted law grants powers to the
intelligence services to conduct targeted surveillance. It
allows for the intelligence services to access source and
equipment location data retained by telecommunication
providers for the purposes of ensuring national defence,
internal security and prevention of acts of sabotage,
espionage, terrorism, proliferation of weapons of mass
destruction and highly organised criminality. Such
measures cannot exceed the duration of three months
and can be deployed exclusively in relation to a concrete
operation, involving specific targets. The law explicitly
bans real-time network traffic surveillance.109
4.3. Member States
reform legislation on
general surveillance of
communications
The 2015 FRA report showed that five Member States –
France, Germany, the Netherlands, Sweden and the
United Kingdom – detail the conditions that permit the
use of both targeted and untargeted surveillance.110 This
report focuses on these same five Member States when
discussing detailed legislation on general surveillance
of communications. FRA’s selection is based on
the fact that this type of collection is prescribed, in
detail, in the law. The list of five Member States is in
no way exhaustive, in the sense that other Member
States’ laws might allow for general surveillance of
communications – but they do not regulate it in detail.
106 United Kingdom, Investigatory Powers Act 2016, s. 17 (2).
107 Anderson, D. (2016), p. 21.
108 United Kingdom, Home Office (2017), ‘Interception of
communications: draft code of practice’, 23 February 2017,
para. 5.13.
109 Portugal, Organic Law No. 4/2017, of 25 August, approving
and regulating the special procedure to grant the Security
Intelligence Service (SIS) and the Defence Strategic
Intelligence Service (SIED) access to communication and
Internet data and proceeds to the amendment to the Law
No. 62/2013 26 August (Law on the organisation of the
Judicial System), Art. 2-5.
110 FRA (2015a), p. 20 and following.
42
In Italy, for example, a Decree-Law of 2015 gives AISE
authority to perform its tasks also by electronic means
(assetti di ricerca elettronica). The law does not provide
more details about these surveillance means; it only
states that it should be exclusively directed abroad.111
In some cases, a lack of clarity on a provision’s scope
can prompt courts to deem it unconstitutional. The
French constitutional court reached this conclusion
when assessing a clause on surveillance and
control of radio transmissions (Article L. 811-5 of the
Interior Security Code).112 A June 2017 bill tries to address
this issue, clarifying the scope of the surveillance
technique and its oversight.113
Other Member States do not explicitly permit civil
intelligence services to engage in general surveillance
of communications. For example, in Belgium, the law
grants no general surveillance of communications’
powers to the civil intelligence service (State Security –
Sûreté de l’Etat). Only the military intelligence service
(General Intelligence and Security Service – Service
Général du Renseignement et de la Sécurité) – not
covered by this report – has these powers.114
In the United Kingdom, the Investigatory Powers Act
(IPA) received royal assent in November 2016, and its
various provisions have started entering into force
since 30 December 2016. At the time of writing, not
all provisions of the IPA were fully in force; these
will be brought into force in due course by means of
regulations implemented by the Secretary of State. The
IPA largely – but not entirely – replaces the Regulation
of Investigatory Powers Act 2000 (RIPA). Therefore,
111 Italy, Legislative Decree No. 7 of 18 February 2015 converted,
with amendments by law of 17 April 2015, No. 43, Art. 8.
See also Italy, COPASIR (2017), p. 11 and 18. For Poland, see
Poland, Act on Internal Security Agency and Intelligence
Agency (Ustawa o Agencji Bezpieczeństwa Wewnętrznego
i Agencji Wywiadu), 24 May 2002, Art. 5.1 which mentions
“electronic surveillance” (prowadzenie wywiadu
elektronicznego) as a task of the Internal Security Agency.
This task is not further regulated in the law, making it
difficult to describe the nature of such type of surveillance.
The same law prescribes that “the Agency is competent to
access metadata (telecommunication and internet data) in
order to complete its tasks”. Moreover, another task of the
Internal Security Agency is to investigate, prevent and detect
crimes “harming the economic foundations of the state”. In
2014, the Constitutional Tribunal ruled that such task is not
precise enough and violates the Constitution. See Poland,
Constitutional Tribunal, case no. K 23/11, 30 July 2014.
112 France, Constitutional Court (Conseil constitutionnel), La
Quadrature du Net and Others, Decision 2016-590 QPC,
21 October 2016. See also France, CNCTR (2016), p. 48
and following and France, Adam, P., Parliamentary
Delegation on Intelligence (2017), p. 72 and following.
113 France, Bill reinforcing internal security and the fight against
terrorism (Projet de loi renforçant la sécurité intérieure et la
lutte contre le terrorisme), 22 June 2017.
114 Belgium, Organic law on intelligence and security services
(Loi organique des services de renseignement et de
sécurité), Arts. 44 and 44/1 to 44/5.