CENTRUM FÖR RÄTTVISA v. SWEDEN JUDGMENT
advances in information and communications technology. Hostile actors
changed their devices and digital identities at a pace which made it difficult
to track them over time. It was also difficult to discover and counteract
hostile cyber operations in a timely manner without tools capable of
discovering anomalies and relevant signatures. It was therefore without
doubt that modern capacities like bulk interception were needed in order to
find unknown threats operating in the digital domain and to enable the
services to discover and follow relevant intelligence threats.
234. As a consequence, the Court’s oversight should be based on an
overall assessment of whether the procedural safeguards against abuse
which are in place are sufficient and adequate. It should therefore avoid
enumerated and absolute requirements. It should also not apply criteria that
would undermine indirectly the wide margin of appreciation afforded to
States in deciding to operate a bulk interception regime for national security
reasons. A “reasonable suspicion” or “subsequent notification” requirement
would have this effect.
235. Finally, the Norwegian Government encouraged the Court to
refrain from importing concepts and criteria from the CJEU. First of all, at
the relevant time nineteen Council of Europe Contracting States were not
members of the European Union. Secondly, while the Convention and the
Charter of Fundamental Rights had many features in common, there were
also differences, most notably Article 8 of the Charter which contained a
right to the protection of personal data. The CJEU also formulated
“proportionality” differently, using a “strict necessity” method which did
not compare to that used by the Court.
4. The Court’s assessment
(a) Preliminary remarks
236. The present complaint concerns the bulk interception of crossborder communications by the intelligence services. While it is not the first
time the Court has considered this kind of surveillance (see Weber and
Saravia and Liberty and Others, both cited above), in the course of the
proceedings it has become apparent that the assessment of any such regime
faces specific difficulties. In the current, increasingly digital, age the vast
majority of communications take digital form and are transported across
global telecommunications networks using a combination of the quickest
and cheapest paths without any meaningful reference to national borders.
Surveillance which is not targeted directly at individuals therefore has the
capacity to have a very wide reach indeed, both inside and outside the
territory of the surveilling State. Safeguards are therefore pivotal and yet
elusive. Unlike the targeted interception which has been the subject of much
of the Court’s case-law, and which is primarily used for the investigation of
crime, bulk interception is also – perhaps even predominantly – used for