A shout out for the Open Rights Group!

Screen Shot 2015-03-17 at 10.04.26Today is #DigitalRightsMatter day – and yes, I know there are days for many things (including, despite the complaints from some, an International Men’s Day (November 19th)). I’m usually fairly cynical about these days – but they do serve a purpose – to focus minds on significant issues, and hopefully to find ways to actually do something about them. In this case, the issue is digital rights – one close to my heart – and the thing to do is to support the Open Rights Group (ORG).

I should say, right from the start, that I’m on the Advisory Council of ORG so I have something of a vested interest – but I’m only on the Advisory Council because I think what ORG does is of critical importance, particularly right now. Never has there been a time when digital rights have been more important, and never has there been a time when they are more under threat. We use the internet for more and more things – from our work to our personal life, from our political activism to our entertainment, from finding jobs to finding romance. Indeed, there are pretty much no parts of our lives that are untouched by the internet – so what happens online, what happens to our digital freedoms and rights, is of ever increasing importance.

Now is when we need them

The threats that we face to our freedoms are growing at a seemingly exponential rate. Surveillance is almost everywhere, and the political pressure to increase it is frightening. Censorship, the other side of that authoritarian coin, is growing almost as fast – from more and more uses for ‘web-blocking’ to ‘porn’ filters that hide vastly more than porn, from critically important sex education websites to sites that discuss alcohol, anorexia and hate speech. David Cameron talks about banning encryption without seemingly having any idea of what he’s talking about – or the implications of his suggestions.

This last point highlights one of the reasons ORG is critically important right now. Politicians from all the mainstream parties seem to have very little grasp of how the internet works – and they reach for ‘easy’ solutions which get the right headlines in the Tabloid press but are not only almost always counterproductive and authoritarian but actually encourage the perpetuation of damaging myths that will make things continue to get worse. The media, left to their own devices, also have a tendency to look for easy headlines and worse.

That’s one of the places that ORG comes in. It campaigns on these issues – current campaigns include ‘Don’t Spy On Us’ dealing with surveillance, Blocked! which looks at filtering, and 451 Unavailable which tries to bring transparency to the blocking of websites by court orders. It produces information that cuts through the confusion and makes sense of these issues – and tries to help politicians and the media to understand them more. And it works – ORG representatives are now quoted regularly in the media and when they make submissions to government inquiries they’re the ones who are given hearings and referred to in reports.

They do much more than this. They help with court cases working with other excellent advocacy groups like Privacy International – the current challenge to the Data Retention and Investigatory Powers Act (DRIPA) is just one of many they’ve been involved in, and these cases really matter. They don’t always win – indeed, sadly they don’t win often – but they often force the disclosure of critical information, they sometimes bring about changes in the law, and they raise the profile of critical issues. ORG are also part of the critical European organisation EDRi who bring together digital rights groups from all over Europe to even more effect.

Now is when they need us

ORG, like other advocacy groups, regularly punches above its weight. It doesn’t have the massive resources of the government agencies and international corporations whose activities they often have to campaign against. There are no deep pockets in ORG, and no massive numbers of staff – they rely on donations, and on volunteers. That’s where #DigitalRightsMatter day comes in – ORG is trying to find new members, get more donations and find access to more expertise. Can you help?

ORG’s joining page is here

Their blog about #DigitalRightsMatter day is here

I would encourage anyone to consider joining – because Digital Rights really do matter, and not just on #DigitalRightsMatter day.

Now it’s time for a review OF the ISC

Screen Shot 2015-03-13 at 06.45.25Like many others in the privacy field, I had waited for the Intelligence and Security Committee report ‘Privacy and Security: A modern and transparent legal framework’ with some trepidation – though after having made a submission myself, and participated in the ISC’s ’round table’ events that formed part of the consultation I had felt a little less overwhelming pessimism than I had previously. Having read it through after its release yesterday I feel a little underwhelmed. It isn’t quite as bad as I had feared – but it does come close. The general feeling I had, though, was that the ISC is still essentially out of touch, out of date, and unable to fulfil the critical role of scrutiny that it is tasked with.

One particular paragraph made the point most directly – and it concerned one of the most important areas of the review insofar as it relates to the areas that I work in. Paragraph 80 began with this startling sentence:

“We were surprised to discover that the primary value to GCHQ of bulk interception was not in reading the actual content of communications, but in the information associated with those communications.”

Surprised? Really? No-one who has paid any attention to the field over the last decade at least should have been surprised that the ‘information associated with those communications’ – essentially what is generally referred to as ‘metadata’ these days – is what GCHQ would be interested in. Academics and privacy advocates have been going on about it for years and years – and if the ISC were ‘surprised’ that this is what GCHQ are most directly interested in then it means one of three things: either they’ve not been paying attention (which is their main role), they don’t understand the technology at all (which is critically important to their role), or they’re deliberately dissembling about it (which means they can’t be trusted in their role).

That they even make the admission that they were ‘surprised’ in the official report suggests that they don’t understand the gravity of that admission, and how much it shows that they don’t understand what is happening. They compound that admission later on in the report, in paragraphs 136 and following, when they ask the question of whether Communications Data is ‘as intrusive’ as content, and essentially dismiss the possibility, hence giving the authorities much more freedom. They seem to have forgotten at this point what they had learned in paragraph 80, that the primary value is in the ‘information associated with’ the communications – their surprise didn’t illicit the kind of questions that it should have.

To be clear, the argument made by people like me is not that this information is more intrusive than content – but that it is more useful, for a number of reasons, from the fact that it can be analysed algorithmically (rather than by rooms full of old-fashioned spies pouring over reams of print-outs, which seems to the the ISC’s idea of surveillance), and that qualitative information can be gleaned from it. Profiling information – the kind of information that the massive internet advertising industry uses – that can be automatically processed and used. That, however, was something else that indicated how much the ISC was out of touch – they didn’t seem to acknowledge or understand the nature of the current, commercial, surveilled nature of the internet, and the critical role played by the corporations. Bruce Schneier put it most eloquently when talking about the NSA:

“The NSA didn’t wake up and say, ‘Let’s just spy on everybody.’ They looked up and said, ‘Wow, corporations are spying on everybody. Let’s get ourselves a copy.”

The corporates are much more interested in metadata because they understand its value – and so do GCHQ. The profiling techniques used by advertisers to find customers are the same sort of thing that GCHQ might use to find terrorists – just using different parameters. That the ISC doesn’t understand this – or didn’t understand this – is deeply revealing. One of the brighter spots of the report, however, is that they do at least make a tentative step towards recognising it through their new category of ‘Communications Data Plus’ in their recommendations. As they put it:

  • It is essential to be clear what constitutes CD. In particular, there is a ‘grey’ area of material which is not content, but neither does it appear to fit within the narrow ‘who, when and where’ of a communication, for example information such as web domains visited or the locational tracking information in a smartphone. This information, while not content, nevertheless has the potential to reveal a great deal about a person’s private life – his or her habits, tastes and preferences – and there are therefore legitimate concerns as to how that material is protected.
  • We have therefore recommended that this latter type of information should be treated as a separate category which we call ‘Communications Data Plus’. This should attract greater safeguards than the narrowly drawn category of Communications Data.

Personally, I suspect that the ‘grey area’ defined in this way will turn out to be the vast majority of what was previously considered ‘communications data’ – when data aggregation is considered, in particular, most data can be highly revealing. If the ISC had paid more attention to the advertising industry – effectively, if it had understood the context in which surveillance happens these days – it would not have had such a surprise. I look forward to hearing what these ‘greater safeguards’ it will attract will be.

There is much more in the report that should ring alarm bells – the discussion of encryption, the seemingly new idea of ‘bulk personal datasets, the casual dismissal of arguments against the fundamentally intrusive nature of ‘bulk collection’, and the attempt to characterise those who seek privacy as being happy to accept a few terrorist atrocities as a fair price to pay for a little personal privacy – and I am sure they will be written about extensively elsewhere. There was one other thing that struck me, though. At no point in the report, as far as I can see, did they mention the fact that the Data Retention Directive was  declared invalid in April 2014, and that the reason for its invalidity was that:

“It entails a wide-ranging and particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data, without that interference being limited to what is strictly necessary.”

Did the ISC not know about this, or not think it was relevant? If the former, they’re incompetent, if the latter, they’re dismissive of what are considered to be fundamental rights. Mostly, though, my suspicion is that they thought it was not within the terms of their review – and that, itself is revealing. Again, the words that spring to mind are ‘out of touch’. In a body charged with oversight of the intelligence services, being out of touch is a fundamental flaw.

The fall of the Chair of the ISC, Sir Malcolm Rifkind, through his being duped into selling his services to a fake Chinese company set up by journalists, highlights the point even more. Time for a change – and a root and branch change. The ISC is right to call for better transparency – but we need better oversight too, and the starting point of that better oversight should be a replacement of the ISC. More technical competence, more people ‘in touch’ with the real world, less subservience to those in authority who are supposed to be subject to their oversight, more openness to new ideas, more willingness to listen to people who don’t immediately fit into their world view.

We’ve had the review by the ISC. Now it’s time for a review of the ISC.

Rifkind of the ISC…

Sir Malcolm Leslie Rifkind, KCMG, QC, MP, former Defence Secretary, former Foreign Secretary, distinguished member of Margaret Thatcher’s cabinet, long standing member of parliament, has become ensnared in a ‘cash for access’ scandal. This has many implications – and many different angles to examine, from his claim that it would be ‘unrealistic’ to expect an MP to live on £67k per annum onward – but the one that may be the most important is his role as Chair of the Intelligence and Security Committee, the ISC. The ISC is the only parliamentary body that oversees the activities of the intelligence services – MI5, MI6 and GCHQ. It is a body that is made up only of people personally nominated by the Prime Minister, and given the nod by the leader of the opposition – and until last year, it operated effectively in private. It has had one public session (about which I have written before) in November last year, and it wasn’t exactly impressive – it felt rehearsed, and scripted, the heads of MI5, MI6 and GCHQ having been given details of the questions beforehand.

In practice, therefore, there is an enormous amount of responsibility on the ISC, and on its chair in particular. What they do is largely behind closed doors – so we have to trust that they do a good job. The latest events for Sir Malcolm Rifkind make that seem very doubtful. I have met Rifkind – I sat next to him at the ‘Round Table’ events as part of the ISC’s inquiry into surveillance – and I have to admit I liked him. He was charming, affable, a good listener, clearly intelligent, and in some ways what appears to be a consummate politician. His experience is enormous, his ability to ‘manage’ meetings very impressive – but does that make him suitable for the key role overseeing the UK’s intelligence services?

He does not have the technical knowledge or understanding of the technology – he made that entirely clear from the start of the Round Table discussion, asking for the most basic information and demonstrating some critical levels of technical ignorance. He does not have the legal understanding either – he admitted to me directly that he didn’t understand RIPA – the Regulation of Investigatory Powers Act that is central to the governance of surveillance in the UK. So what is left? His ‘gravitas’, his position as a ‘safe pair of hands’. And that, importantly, is what is now compromised. He is supposed to represent us – and from what we have seen about his ‘cash for access’ scandal, it seems pretty clear that his main representation is of himself. He was duped by a fake Chinese company, set up by journalists, for the chance of making money. What he said may (it has yet to be confirmed) be within the parliamentary guidelines, but in this context that cannot be nearly enough. Being Chair of the ISC is a huge responsibility – and it has huge sensitivity.

It isn’t just personal issues that are at stake, but national security to: just imagine the possibilities if the fake Chinese company had been a cover for Chinese Intelligence rather than journalists from Channel 4 and the Telegraph. It is almost a classic trap – the sort of thing that has been played out in many thrillers. Some thrillers, these days, would have had Rifkind compromised by people within the intelligence services, so that they can bend him to their will – but I don’t believe that is the real risk here. Rather, it shows inappropriate priorities – when priorities are particularly critical.

There is another side to this that should be deeply concerning. This kind of thing matters because companies – specifically companies involved in the development and supply of surveillance technology – are part of the problem with surveillance. They want to promote surveillance so they can be paid to develop and implement technology here that can then be exported elsewhere – there is a ready market for surveillance systems all over the world, particularly to the more oppressive and autocratic of governments. These companies can lobby, can manipulate, can bamboozle people without the technological knowledge or understanding to appreciate the risks. And Rifkind fits the bill.

I don’t believe it is just Rifkind that is the issue here – though the idea that he could remain as Chair of the ISC after this is frankly deeply disturbing – but our whole system of oversight of intelligence. Depending on individuals, particularly individuals appointed through a system which is rife with patronage and inside connections, just doesn’t work. It creates vulnerability – and destroys the possibility of accountability. It needs root and branch reform – the involvement of technical experts, civil society and the judiciary, not just politicians and civil servants. Will it happen? It seems unlikely. Eventually Rifkind will probably fall on his sword, but nothing more will change. If only it would.

UPDATE: 10:15 February 24th: Rifkind has stepped down as Chair of the ISC, though he remains a member of the committee.

10:30 February 24th: Rifkind will also be stepping down as an MP in May

The Snoopers’ Charter: Shameful Opportunism

The news that four peers are trying to bring back the Snoopers’ Charter – in its last incarnation the Communications Data Bill – is depressingly predictable, but perhaps even more shameful than other attempts at legitimising mass data gathering and surveillance. It displays shameful opportunism that seems to plumb new depths – and in a number of different way

1     Bringing it in based on an event

It is a bit of an axiom that reactive law – knee-jerk law – is a bad idea. Law by its nature needs to be considered carefully, not passed in the heat of a moment. The more oppressive and ill-considered of ‘counter-terror’ legislation, however, seems to tend to be done this way all too often. The USA-PATRIOT Act (whose long name, the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act is worth a read in itself) is perhaps the best known example, but the Data Retention Directive worked just the same way, passed in the wake of the 7/7 bombings in London, and even making reference to those bombings in its preamble. That this directive was declared invalid by the Court of Justice of the European Union last year should give pause for thought. The CJEU said that the directive “entails a wide-ranging and particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data, without that interference being limited to what is strictly necessary.” Authoritarian legislation, passed in haste, takes a long time to overturn. Even now, the repercussions are still being felt

2     Bringing it in based on this particular event

Hanging legislation on a hideous event is one thing – bringing it in based on this particular event, the Charlie Hebdo shootings, is even worse, as a careful examination of this event should have revealed not that more mass data gathering and surveillance is necessary, but rather the opposite. As I have written before, the shootings in Paris damage rather than enhance the case for mass data gathering and surveillance. The perpetrators were known to the authorities – they didn’t need to be rooted out by mass surveillance. The authorities had stopped watching them six months before, because, it seems, of lack of resources, resources that might have been available if a targeted rather than mass surveillance approach had been taken. This is part of an almost overwhelming trend – the killers of Lee Rigby and the suspects in the Boston bombings were also known to the authorities. There was no need for mass data gathering and surveillance to stop them – so to use this particular event as an excuse for bringing back the Snoopers’ Charter is particularly shameful.

3     Trying to rush the legislation through

It is almost never appropriate to rush legislation through – but sadly this is also all too familiar. Last summer, Parliament brought itself into significant disrepute by rushing through the Data Retention and Investigatory Powers Act (DRIP) in a matter of mere days, with no real time for scrutiny, no opportunity for independent expert analysis, and no real opposition from any of the main parties. This is not the way to legislate – it wasn’t right then, and it wouldn’t be right now.

4     Doing this in the midst of investigations and legal challenges

The one saving grace in DRIP was that it was intended to give breathing space, to allow proper, detailed and careful consideration to the many issues involved in surveillance. At the same time, there are a series of reviews over surveillance legislation in process – from the Intelligence and Security Committee and by the Independent Reviewer of Terrorism Legislation to start with. Moreover, DRIP itself is subject to legal challenge. To try to pass much more comprehensive and far-reaching legislation even before these reviews have been completed and their reports scrutinised, and before the legal challenges even make their way into the court room, is also deeply shameful – prejudging the results of those reports, and, in effect, disrespecting all those involved.

5     Doing this in the face of a clear CJEU ruling

What is perhaps even worse, is that on the face of it the planned legislation flies directly in the face of the CJEU ruling on data retention. The ruling was strong, clear and direct – but does not seem, on immediate reading of the legislation, to have been taken into account at all. Of course this may be wrong – but as the new legislation only appeared yesterday, and is planned to go before the Lords on Monday, there has not been time for proper, detailed analysis – and nor has there been any kind of explanation or reconciliation presented. This again highlights the point of taking time over legislation – and going through proper, detailed procedures.

6     Using a highly dodgy political method

The method which has been chosen to try to introduce this law is, to put it mildly, somewhat doubtful. Rather than a full Bill, the four peers have tabled an amendment – 18 pages of additional clauses – to an existing bill, the Counter Terrorism and Security, which has already gone through most of the processes necessary before becoming law. It’s like slipping in an entirely new law just before the first law is passed – it makes a mockery of parliamentary process, and in effect disrespects the whole of parliament.  Describing it as trying to sneak in the Snoopers’ Charter by the back door may even be too kind.

7     Ignoring the committee

The original Communications Data Bill was subject to analysis by a full parliamentary committee – and that parliamentary committee came out with a highly critical report, a report which ultimately led to the abandonment of the Bill.  By trying to bring it back now, seemingly virtually unchanged, the peers proposing the amendment are ignoring the committee and its findings – and as a consequence ignoring the whole process of parliamentary scrutiny.

8     Doing it at this time, in the run up to the election

To try to push through legislation like this in the run up to the election is in itself highly dubious tactics. Politicians have their minds on other things – and many of them may care much more about being re-elected than about whether the details of legislation to be passed are a good idea or not. Whether they ‘look’ good is what matters, and whether that makes them more electable. Right now, in the light of the anger and fear resulting from the Charlie Hebdo shootings, to oppose something that might make people safer, will be difficult – and may hinder the electoral prospects of MPs. This kind of thing has happened before – the way that the Digital Economy Act was passed in 2010 springs to mind – and again makes the timing of the bringing forward of the amendment feel very wrong

Why are they doing it this way?

The whole process – all these layers of opportunism – should make the alarm bells ring. This is a hugely significant piece of law – not just in terms of what it does but in terms of what it signifies, in terms of what kind of society we want to be living in, what kind of an internet we want to have. If we are going to make decisions like this, we should make them in careful, considered ways, weighing the evidence and seeking expert opinion. That’s the idea behind the parliamentary committee system, and the time it takes to bring laws in through normal procedures.

Why, then, are these procedures being avoided, and why are these underhand methods being used? It is hard to escape the conclusion that it is because those pushing it are afraid that if it is given the appropriate amount of time, of attention, and of scrutiny, then it will once again be defeated, as it was the last time around. In the cold light of day, do we want to live in such a surveillance society? I’m not sure – but I do think that trying to make those decisions in this way, in the heat of the moment and without the opportunity to give proper thought and proper scrutiny, is a disastrous way to proceed. Those behind it should be ashamed.

Facebook And Twitter – Handling Extremism And Disorder

After extensive consultation, FAT-HEAD has been amended to take into account its lack of clarity over costs (see 8) and the unfortunate limitation of extent (see 9).


 

Facebook And Twitter – Handling Extremism And Disorder Bill (‘FAT-HEAD’)

Contents:

  1. When this Act applies
  2. Facebook and Twitter
  3. Social and Moral Responsibility
  4. Code of conduct
  5. Extremism
  6. Disorder
  7. Acceptance of blame
  8. Costs
  9. Extent, commencement and short title

A

Bill

to

Make provision as to matters concerning the social and moral responsibility of Facebook and Twitter, to ensure that proper cooperation is made with the authorities in relation to morality, extremism and disorder.

BE IT ENACTED by the Queen’s most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:—

1. When this Act applies

This Act applies whenever an event of such significance, as determined by the Secretary of State, requires it to. Events include but are not restricted to acts of extremism, of disorder and of embarrassment to the Secretary of State, the government, the intelligence and security services and the police, or any other event deemed appropriate by the Secretary of State.

2. Facebook and Twitter

The powers conferred through this Act apply to Facebook, Twitter and any other online services, systems, or their equivalents, successors or alternatives (‘the services’) as determined by the Secretary of State.

3. Social and moral responsibility

The services shall recognise that they have a social and moral responsibility above and beyond any requirements hitherto required by the law. The requirements that constitute this social and moral responsibility shall be determined by the Secretary of State, in consultation with the editors of the Sun and the Daily Mail.

4. Code of Conduct

The Secretary of State shall prepare a Code of Conduct to cover the actions of the services, in accordance with the social and moral responsibility as set out in section 1. This code of conduct shall cover extremism, disorder, obscenity, dissent and other factors as determined by the Secretary of State.

5. Extremism

i)  The services shall monitor the activities of all those who use their services for evidence of extremism, including but not limited to reading all their posts, messages and other communications, analysing all photographs, monitoring all location information, all music listened to and all areas of the internet linked to.

ii)  The services shall provide real-time access to all of their servers and all user information to the security services, the police and any others authorised by the Secretary of State, including the provision of tools to enable that access.

iii)  The services shall prepare reports on all its users activities, including but not limited to those activities relating to extremism, including contact information, personal details, locations visited and any other information that may be determined from such information.

iv)  The services shall provide these reports to the security services, the police and any others authorised by the Secretary of State.

v) The services shall delete the accounts of any user upon the request of the security services, the police or any others authorised by the Secretary of State.

vi)  The services may not report that they have provided the access or these reports to anyone without the express permission of the Secretary of State.

6. Disorder

At a time of disorder, as determined by the Secretary of State, the security services or a police officer, the services shall provide the following:

i) Immediate access to location data of all users.

ii) Immediate access to all communications data of all users

iii) Detailed information on all accounts that have any relationship to the disorder

iv) Deletion of accounts of any users deemed to be involved, or likely to be involved, in disorder.

v) Upon order by the Secretary of State, the security services or a police officer, the services shall block all access to their services in an area to be determined by the Secretary of State.

7. Acceptance of Blame

The services shall recognise that their social and moral responsibility includes the requirement to accept the blame for the existence, escalation or consequences of any extremism or disorder. This acceptance of blame must be acknowledged in writing and in the broadcast media, ensuring that the government, the security services and the police are not held responsible for their own roles in such extremism or disorder or their consequences.

8. Costs

All costs for the development, implementation, monitoring, updating and supporting the systems required for the services to comply with the Facebook And Twitter – Handling Extremism And Disorder Act 2014 shall be borne by the services.

9. Extent, commencement and short title

i) This Act extends to England, Wales, and anywhere else on the entire planet, and in addition to inner and outer space, the moon, any planets, comets and other bodies as deemed appropriate by the Secretary of State.

ii) This Act comes into force on the day on which this Act is passed.

iii) This Act may be cited as the Facebook And Twitter – Handling Extremism And Disorder Act 2014.


 

GCHQ: I’m not charmed yet….

A little over a week ago, GCHQ gave us a show. A giant poppy, part of the 2014 Armistice Day appeal. It was spectacular – and, for me at least, more than a little creepy.

GCHQ poppy

The poppy display seems to have been part of something bigger: the term that immediately sprang to mind was ‘charm offensive’. GCHQ has, over the last year or so, been trying to charm us into seeing them as purely positive, despite the revelations of Edward Snowden. They’re trying to appear less secretive, more something to be admired and supported than something to be concerned about and made accountable. The poppy was an open symbol of that. Look at us, GCHQ seemed to be saying, we’re patriotic, positive, part of what makes this country great. Support us, don’t be worried about it. Love us.

I assume that the speech by Robert Hannigan, the new Director of GCHQ, was intended to be part of that charm offensive. For me, however, it had precisely the opposite effect. The full speech was published in the FT here – but I wanted to pick out a few points.

Privacy an absolute right?

The first, which made the headlines in the Guardian and elsewhere, is Hannigan’s statement that ‘privacy is not an absolute right’. He’s right – but we all know that, even the staunchest of privacy advocates. Privacy is a right held in balance with other rights and needs – with freedom of expression, for example, when looking at press intrusions, with the duty of governments to provide security and so forth. That’s explicitly recognised in all the relevant human rights documents – in Article 8 of the European Convention of Human Rights, for example, it says of the right to a private life that:

“There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others”

So we already know that privacy is not an absolute right – so why is Hannigan making the point? It’s hard to see this as anything but disingenuous – almost as though he wants to imply that foolish privacy advocates want to help terrorists by demanding absolute privacy. We don’t. Absolutely we don’t. What we want is to have an appropriate balance, for the interference in our privacy to be lawful, proportionate and accountable. At the moment, it’s not at all clear that any of that is true – there are legal challenges to the surveillance, deep doubts as to its proportionality and little evidence that those undertaking the surveillance are properly accountable. On the accountability front, it’s interesting that he should make such a speech at a time when the Intelligence and Security Committee of Parliament, are undertaking a consultation – it made me wonder whether he’s trying to steer the committee in a particular direction.

Facebook – a tool for terrorists?

The other headline from the speech is the way Hannigan seems to be attacking Facebook and others for being too helpful to terrorists – which is an interesting reverse from the more commonly held view that they’re too helpful to the authorities. The argument seems to go that the ‘old’ forms of terrorists, exemplified by Al Qaeda, use the ‘dark web’, while the ‘new’ forms of terrorists, exemplified by IS, are using the social media – Facebook, Twitter and so forth. It’s an interesting point – and I’m sure there’s something in it. There’s no doubt that ‘bad guys’ do use what’s loosely called the dark web – and the social media activities of ‘bad guys’ all around the world are out there for all to see. Indeed, that’s the point – their visibility is the point. However, on the face of it, neither of those ‘facts’ support the need for the authorities to have better, more direct access to Facebook and so forth. Neither, on the face of it, is any justification for the kinds of mass data gathering and surveillance that seem to be going on – and that GCHQ and others seem to be asking us to approve.

By its very nature, the ‘dark web’ is not susceptible to mass surveillance and data gathering – so requires a more intelligent, targeted approach, something which privacy advocates would and do have no objection to. Social media – and Facebook in particular – don’t need mass surveillance either. To a great extent Facebook is mass surveillance. All that information is out there – that’s the point. It’s available for analysis, for aggregation, for pretty much whatever the authorities want it. And if Hannigan imagines that the secret activities of IS and others are undertaken on Facebook he’s more naive than I could imagine anyone in the intelligence services could be – they can’t have chosen to use Facebook and Twitter instead of using the dark web, but in addition to it. The secret stuff is still secret. The stuff on Facebook and Twitter is out there for all to see.

What’s more, there are already legal ways to access those bits of Facebook and Twitter than are not public – which is why the authorities already request that data on a massive scale.

Charming – or disarming?

Hannigan must know all of this – so why is he saying it? Does he think that the charm offensive has already worked, and that the giant GCHQ poppy has convinced us all that they’re wonderful, patriotic and entirely trustworthy? They may well be – I’m no conspiracy theorist, and suspect that they’re acting in good faith. That, however, is not the point. Trust isn’t enough here. We need accountability, we need transparency, we need honesty. Checks and balances. Not just charm.

What makes journalists special?

The news that the Sun were supporting an application to the European Court of Human Rights over the Met’s gathering of the communications data of the Sun’s political editor, was greeted with more than a few raised eyebrows. The levels of irony and hypocrisy here are almost magnificent in their chutzpah. The Sun, central to a Murdoch empire that has been mired in scandals over phone-tapping, furious at one of their own having his phone calls (and more, to be fair) looked at – the communications data surrounding them at least. The Sun, whose close links to the Met were a part of the whole scandal that brought about the Leveson Inquiry, calling the Met out for unethical procedure. The Sun, who just days before had been railing against the whole European Human Rights regime, and the court itself, trying to use those very rights to defend themselves.

Despite this, and despite my dislike of the Sun, I, and many others, would support the Sun in their action. Journalists do need protection from surveillance. They do need privacy. They do need to be able to protect their sources. As the Sun said:

“A free press is fundamental to all of our other freedoms. And to have a free press reporters need to be able to protect the identity of their sources.”

It’s a bold statement and one worth further examination. The role of the ‘free press’ can sometimes be understated, particularly when we look at the excesses of the current crop of tabloids. Anyone who followed the Leveson Inquiry knows quite how badly the press can and do behave. Desperate, despicable stuff at times – cruel, selfish, manipulative, voyeuristic, racist, sexist, homophobic, transphobic, divisive, misleading (or worse), doing their best to bring out the worst in people. Just plain nasty in so many ways – but that should not blind us to the importance of at least something of a free press. Without the press, things like the MPs expenses scandal would never have come to light. Without the press, Edward Snowden would have found it far harder to get his information out – and would have been far less likely to be believed. There are many more stories like this – too many to count.

So a free press is important – and for that reason, the press get privileges. They do get – and might well deserve, though more of that later – better protection for privacy and confidentiality. They get more access to information – through briefings from politicians and others or from ‘press-only’ events, through networks of sources and supporters and so forth. They have an audience that ‘ordinary’ people find it very difficult to reach. They have even had specific legal protections – against defamation, for example, in what used to be known as the ‘Reynolds Defence’, though since the Defamation Act 2013 came along, that has broadened a little so as to be potentially accessible to non-journalists.

All this has historically been entirely right and proper – but there’s something of a deal going on here. Why should journalists get special protection, above and beyond that of ordinary people? What makes the ‘professional’ journalist special – and different from that increasingly common species, the ‘citizen journalist’? What makes a columnist in a newspaper different from a blogger? The unspoken deal was, just as with lawyers and doctors (and even priests) who also make claim to special rules on confidentiality, journalists were bound by different ethics, and had been properly and professionally trained so they could be more trusted – at least to do things like protect their sources. Journalists get protection, and in turn they protect us – and they need to behave ethically in response. Just as lawyers and doctors have ethical guides (which they may or may not follow) press journalists have their own ethical guides. In the past, as far as UK press journalists were concerned, this was the Code of Practice of the Press Complaints Commission – what it is now is still up in the air, and the new regulator IPSO tries to assert itself whilst the supporters of the Royal Charter try to bring about implementation of the Leveson Report. Either way, most journalists would claim that they have ethics.

The real question, then, is whether they follow these ethics – because if they don’t, there’s far less to differentiate them from the rest of us. I write a blog, have had a few pieces published in magazines and on newspapers’ websites – am I a journalist? Should I have the same rights as journalists do? My suspicion is that the lines between ‘real’ journalists and ‘citizen’ journalists, bloggers and so forth will if anything get more blurred. There are already many people on the borderlines, many who sometimes act as journalists, other times as bloggers and so forth. Where does that leave journalistic ethics, and where does that leave journalistic protections for privacy, freedom of expression and so forth?

There are two very different possible approaches. One is to strip away journalistic protections – the other is to broaden them to cover the rest of us too. Personally, I much prefer the latter. Now that technology has given us the capacity to exercise our freedom of expression, the law should help protect our ability to do so. I may not be a journalist, but I do want confidentiality, and I think I have the right to it.

In the meantime, though, we should rally behind journalists in their fight against intrusion. We should, however, also expect them to understand the deal that is going on – and to understand that the pressure is on them to behave more ethically. The less ethically they behave, the less responsibly they behave, the harder it is to justify a special deal. One particularly painful story this week has made this point to me: the death of Brenda Leyland, the women accused of being a ‘Twitter Troll’ towards the parents of Madeleine McCann. This is a story that has almost nothing good to be said about it. What actually constitutes a ‘troll’ is subject to a great deal of doubt, and even if some kind of definition is settled upon, whether Brenda Leyland fits it is another matter. These are complex questions. For better or worse, the law has been getting increasingly involved in activity on social media, whether for malicious communications, bullying, public order offences or defamation – and as the number of people participating in social media has grown, the incidents have similarly grown.

I’m not in any way a defender of ‘trolling’ – but neither am I a supporter of ‘counter-trolling’. Trolling the trolls does go on – and on my Twitter timeline (I follow a lot of people) I’ve seen people make deeply passionate arguments both in favour of the McCanns and defending Brenda Leyland and others. I don’t want to get into that argument – other than to say that I don’t know what happened to Madeleine McCann, and I’m a believer in the presumption of innocence – but the actions of the press, and Sky News in particular, are another matter. We don’t necessarily expect ordinary people on Twitter to behave responsibly, let alone to a special, higher standard of ethics and responsibility. We should, however, have higher expectations of the press. That’s part of the deal. Was the doorstepping of Brenda Leyland appropriate, ethical or well considered? Was it necessary? I hope Sky News is considering these questions – because press ethics matter, just as protection of the press matters. We need a free press – but we need a responsible press too.

 

UPDATED TO MAKE CLEAR THAT IT WAS TOM NEWTON DUNN’S COMMS DATA GATHERED BY THE POLICE, NOT HIS CALLS LISTENED TO.