CHAPTER 11: SERVICE PROVIDERS
approach” and was viewed as “a disturbing precedent” for other, more authoritarian
countries.
11.18. In practice, engagement with overseas companies has to date been entirely on a
voluntary basis, although it is necessary for the UK agencies to acquire the appropriate
legal instrument, an interception warrant or communications data authorisation or
notice, before they seek the cooperation. The degree of cooperation diminished
generally post-Snowden and varies between companies and between data types.
Thus:
(a)
Where interception is concerned, many US companies consider themselves to
be constrained by federal law limiting voluntary disclosure to cases in which a
provider reasonably believes that immediate disclosure is required by an
emergency involving “imminent danger of death or serious physical injury”.14
While this might allow service providers to assist e.g. in cases of kidnap or
bomb threat, many serious investigations (including terrorist investigations) do
not satisfy these criteria.
(b)
The sharing of communications data is less legally constrained, with the result
that service providers can accede to simple requests to verify subscriber
identity, though this is not universal.
(c)
There are also issues at the margins where companies can make their own
interpretation of the dividing line between content and non-content.
There have been recent and limited signs of improving cooperation, driven in part by
the spread of ISIL and its dependence on social media. But it is also relevant to note
that many OTT providers in Silicon Valley and elsewhere are small and relatively new
companies, often with a strong libertarian ethos and without the legal or regulatory
expertise to deal on an informed basis with requests from foreign governments.
11.19. A number of major US companies, accustomed to the FISC procedure in the US,
disliked the notion of authorisation by the Secretary of State and indicated to me that
they would be more comfortable about complying with a warrant if it were judicially
authorised, providing “another pair of eyes that is separate from the investigative
apparatus”. While it was appreciated that other sorts of independence could be built
into the system, “the UK is in a minority with political authorisation, and perceptions do
matter”. It was also felt that “improving RIPA” in this way would “set a good guide for
other jurisdictions”. One major company went so far as to suggest that if the UK
introduced judicial authorisation, more cooperation would be forthcoming, though I was
not left with the impression that this was a universal view.
11.20. The overseas service providers with whom I discussed the matter apply their own
judgement to a request put to them from the UK before they comply with it. Some
companies have published transparency reports, which show their assessment of how
many requests from the British authorities they have met.15 The figures for rejection of
14
15
18 US Code §2702.
E.g. Google, http://www.google.com/transparencyreport/; Yahoo, https://transparency.yahoo.com;
Twitter: https://transparency.twitter.com.
207