The news that the Investigatory Powers Tribunal has sent a letter confirming and apologising for an ‘error’ in its ‘Determination of 22 June 2015’ – a ruling on the case taken by Liberty, Privacy International and others (notably including Amnesty International) has created quite a stir. The IPT has admitted that it mistakenly suggested that the breach they had suggested related to the Egyptian Initiative for Personal Rights had in fact been in relation to Amnesty International.
This will no doubt be analysed at depth – particularly by Amnesty International and others. I have just two points to make at this stage in relation to it.
A ‘technical’ breach
The first concerns the nature of the breach. Effectively, the breach was that data, once gathered, was held for too long – in the words of the determination of 22 June 2015 (paragraph 14):
“…the time limit for retention permitted under the internal policies of GCHQ, the intercepting agency, was overlooked in regard to the product of that interception, such that it was retained for materially longer than permitted under those policies.”
This is regarded as a ‘technical’ breach, as the IPT was satisfied that the data was not accessed after the expiry of the ‘relevant retention time limit’, but is still a breach of Article 8 of the ECHR. That, however, does not really give the whole picture. Data retention periods matter, and in a way that is far more significant than regarding a ‘technical’ breach as insignificant. Where a surveillance approach is based on ‘gather as much as possible, hold for later use’ is concerned, the data retention period is one of the most important dimensions.
Moreover, it should be noted that it is internal policy that determines the retention period here, not anything set down in law or subject to public scrutiny.
A deeply worrying confusion
The second, perhaps even more worrying issue, is the nature of the ‘confusion’ between the two NGOs. Amnesty International are a very different beast than the Egyptian Initiative for Personal Rights. Different in scale, different in nature, different in origin, different in focus. For the IPT to make an error like this is deeply worrying – and casts doubt on a number of aspects of their ability to properly scrutinise the activities of GCHQ. As noted in Paragraph 3 of the Determination of 22 June 2015
“The Tribunal has also found it useful and important to ask itself in the course of its consideration the following questions (derived from an amalgam and adaptation of the submissions of Mr Ryder QC and Mr Tomlinson QC):
(a) What is the identity and nature of the claimants concerned and the nature of their communications and their activities (including their position as NGOs)?”
How can the IPT have made an appropriate decision based on the ‘identity and nature of the claimants’ – including their position as NGOs – when it was confused between two such radically different (in identity and nature) claimants as Amnesty International and the Egyptian Initiative for Personal Rights?
A question of trust?
David Anderson QC, the Independent Reviewer of Terrorism Legislation, entitled his recent report on surveillance ‘A question of trust’ and did so for a reason. Trust is needed – but it needs to be earned. One possible explanation for the IPT’s error is that they were basing their analysis on too much trust in GCHQ. Indeed, it appears it was GCHQ who alerted the IPT to their error – which in itself raises a lot of interesting points. These points, along with the nature of the error itself, makes it harder to trust the IPT’s ability to oversee the activities of GCHQ.
That matters. David Anderson’s conclusions seem even more significant now – and in particular his recommendation for a ‘new, powerful, visible and accountable intelligence and surveillance auditor and regulator’. The current system – from the rubber-stamping Intelligence and Security Committee to the IPT, does not inspire trust at all.
Paul Bernal's Blog 
Reblogged this on sdbast.