Surveillance by intelligence services – Volume II: field perspectives and legal update
In general terms, as Table 4 illustrates, just over half
of the Member States involve the judiciary (judges
or prosecutors) in ex ante oversight, in relation to at
least one type of targeted surveillance measure. In
Portugal, the new law provides for access to metadata
by intelligence services to be authorised by a judicial
panel composed of the presidents of all criminal sections
of the Supreme Court and a judge appointed by the
Superior Council of Magistrates.380 In Italy, requests for
targeted interception measures need to be authorised
by the Prosecutor General of Rome.381 Three Member
States – Austria, Belgium and Germany – involve
expert bodies in all approval processes. At the same
time, in six Member States – Cyprus, France, Ireland,
Luxembourg, Malta and the Netherlands – all types of
targeted surveillance measures may be implemented
without ex ante oversight by an independent body with
binding decision powers. In France, for example, requests
for targeted surveillance measures are authorised by
the prime minister after a non-binding opinion of the
CNCTR, upon the receipt of a detailed request by the
relevant minister, outlining the technique(s) to be used;
the service for which it is presented; the purpose(s)
pursued; the reason(s) for the measures; the period of
validity of the authorisation; and the person(s), place
or vehicles concerned.382
Ex ante oversight
There is growing support for extending external authorisation to:
- untargeted bulk collection of information;
- the use of key words or selectors to extract data from
the information collected through bulk interception,
particularly where they are related to identifiable
individuals;
- the collection of and access to communications data
(including when held by the private sector); and
- computer network exploitation.
Council of Europe Commissioner for Human Rights (2015), p. 62
380 Portugal, Organic Law No. 4/2017, of 25 August, approving
and regulating the special procedure to grant the Security
Intelligence Service (SIS) and the Defence Strategic
Intelligence Service (SIED) access to communication and
Internet data and proceeds to the amendment to the Law
No. 62/2013 26 August (Law on the organisation of the
Judicial System), Art. 7.
381 Italy, Code of criminal procedure (Codice di procedura
penale), Art. 266 and following and Italy, Implementing
norms (norme di attuazione), Art. 226.
382 France, Interior Security Code (Code de la sécurité
intérieure), Art. L. 821-2.
96
Authorising general surveillance of
communications
Unlike targeted surveillance, general surveillance of
communications – at least during its initial stages –
targets not an individual but rather large flows of
data. As a consequence, such measures do not usually
allow for an individualised proportionality analysis.
Ex ante authorisation or approval has to focus on the
seriousness of the objective of the operation as an
intelligence requirement, the level of proportionality,
and whether access, filtering and selection algorithms
use discriminatory criteria. The analysis must establish
whether the proposed operations are compatible
with privacy rights. Table 5 presents the actors that
have a binding/final say in the approval of general
surveillance of communications measures in the
five Member States that have detailed legislation on
such surveillance measures.
In Sweden and Germany, an expert body is in charge
of authorising the intelligence services to gather
signals intelligence. In Sweden this is carried out by
the Defence Intelligence Court, which can have four
to nine members: two or three ordinary judges (the
chair and vice chair; there can be a second vice chair),
and two to six lay members.383 The panel that hears
a case and grants authorisations must be composed of
at least the chair and two lay members (and not more
than three lay members).384 The government appoints
all members. The chair and vice chair are appointed
after an open recruitment process led by the Judges’
Board (Domarnämnden).385 Lay members of the court
should have special knowledge in matters of importance
to the court’s activities.386 The interests of individuals
are represented by lawyers (integritetsskyddsombud)
who are or have been members of the bar or served
as judges, appointed for a four-year period.387 The court
may declare that its sessions are not public, and its
decisions may not be appealed.388
In contrast, in France, when it comes to the use of the
so-called ‘algorithm’, the prime minister authorises
automatic processing based on selected parameters.389
383 Sweden, Act on the Defence Intelligence Court (Lag (2009:966)
om Försvarsunderrättelsedomstol), 15 October 2009, Art. 2.
384 Ibid. Art. 9.
385 This is a government agency with a board consisting of nine
members. Five members should have been judges; two
should practice law outside of the court system (and one
of these should be ‘advokat’ (member of the bar)); and the
remaining two should represent ‘society’ (presently two
members of the national parliament).
386 Sweden, Act on the Defence Intelligence Court, Art. 3.
387 Ibid. Arts. 5 and 6.
388 Ibid. ss. 3, 5, 6, 9, 14 and 16. Details are provided in Sweden,
Regulation 2009:968 with instructions for the Defence
Intelligence Court. The website of the court is available in
Swedish only. The court was established in 2009, replacing
a previously existing Signals Intelligence Board.
389 France, Interior Security Code, Art. L. 851–3.