Regulating Foreign Surveillance Through International Law

This Friday, the U.N. Human Rights Council will hold a session to discuss the right to privacy in the digital age. The Council is considering these issues in the wake of a General Assembly Resolution adopted in December (which affirmed that the same rights that people have offline must also be protected online) and a report by U.N. Special Rapporteur Frank La Rue on the protection of the right to privacy in the context of domestic and extraterritorial communications surveillance. That report offered some robust critiques of the ways in which states have conducted mass interception of internet and telephonic data and metadata, and in which they have used “national security exceptions” to allow expansive electronic surveillance. Pulling together experts from civil society, academia, and private industry, this week’s discussion seems intended to bear down on those critiques, including by identifying challenges that states face as they try to strike the appropriate balance between their security goals and individual privacy rights of citizens and foreigners. Given that states historically have not used international law to regulate spying, is there reason to think – at this point in time – that states may (or should) turn to international law to regulate their conduct of foreign surveillance? There is, I believe, but not necessarily in the manner or form in which many human rights and civil liberties groups advocate. I’ve posted on SSRN a draft of a forthcoming article on this issue, entitled An International Legal Framework for Surveillance. I welcome comments on it. The abstract is here:

Edward Snowden’s leaks laid bare the scope and breadth of the electronic surveillance that the U.S. National Security Agency and its foreign counterparts conduct. Suddenly, foreign surveillance is understood as personal and pervasive, capturing the communications not only of foreign leaders but also of private citizens. Yet to the chagrin of many state leaders, academics, and foreign citizens, international law has had little to say about foreign surveillance. Until recently, no court, treaty body, or government had suggested that international law, including basic privacy protections in human rights treaties, applied to purely foreign intelligence collection. This is now changing: several U.N. bodies, judicial tribunals, U.S. corporations, and subjects of foreign surveillance are pressuring states to bring that surveillance under tighter legal control. This article tackles three key, interrelated puzzles associated with this sudden transformation. First, it explores why international law has had so little to say about how, when, and where governments may spy on other states’ nationals. Second, it draws on international relations theory to argue that the development of new international norms regarding surveillance is both likely and essential. Third, it identifies six process-driven norms that states can and should adopt to ensure meaningful privacy restrictions on international surveillance without unduly harming their legitimate national security interests. These norms, which include limits on the use of collected data, periodic reviews of surveillance authorizations, and active oversight by neutral bodies, will increase the transparency, accountability, and legitimacy of foreign surveillance. This procedural approach challenges the limited emerging scholarship on surveillance, which urges states to apply existing — but vague and contested — substantive human rights norms to complicated, clandestine practices. In identifying and valuing new, objectively verifiable, neutral norms, the article offers a more viable and timely solution to the perils of foreign surveillance.

My argument about how states should proceed diverges from the approach of many human rights groups. In my view, new international norms, at least in the first instance, should be procedural rather than substantive, both because a consensus about procedural norms is easier to achieve in the context of secret activity, and because a focus on procedural norms will allow states to avoid, for the time being, contentious discussions about their disparate views on fundamental aspects of personal privacy. This approach rejects both an aggressively cynical view of the ability to regulate foreign surveillance and an unduly optimistic view that states will converge around robust international privacy protections in the short term. The cynics assume that pressures to modify the status quo will diminish in short order, overtaken by subsequent geopolitical crises. The optimists argue that states should develop the substantive principle of privacy contained in the ICCPR, and have robust aspirations for what that principle should contain. In my view, both of these approaches are unsatisfying, predictively and normatively. The cynics underestimate both the enduring nature of human rights pressures on states and the benefits to states of creating new international legal rules in this area. The optimists underestimate the difficulty of agreeing on concrete, substantive norms in a multilateral setting among states with varied incentives. For this reason, states should focus first on establishing procedural limitations that will reduce (though not eliminate) differences between the way in which they treat citizens and foreigners. At the same time, my proposed approach is not meant to exclude the parallel process of international law development that undoubtedly will take place: the ongoing interpretation of the privacy provisions in the ICCPR and the European Convention on Human Rights. Both states and other actors that undertake treaty interpretation will continue to engage in the process of claim and counterclaim about what those provisions mean and how to apply them to this new world of foreign surveillance. This interpretive process can coexist with a decision by certain states to adopt new procedural norms regulating surveillance, and likely would prove complementary in establishing appropriate standards. Even if states coalesce around the norms I identify in the article, the project is just starting. Many substantive questions remain unanswered: Should states treat bulk collection differently from collection on individual targets? Should states conclude that it is more permissible to collect on foreign officials, who presumably are on greater notice that they are engaged in matters of interest to other states, than to collect on average citizens? How wide a gap is acceptable between the treatment of the communications of a state’s nationals and foreign nationals? And does it make sense to draw geographic distinctions about where data is collected, held, or reviewed, as contemporary approaches do? My article proposes a launching point for basic international procedural norms of foreign surveillance. Conversations about these other thorny questions, many of which will occur as states flesh out the meaning of ICCPR article 17, almost certainly will take far longer to resolve. For now, the sense — among governments, elites, and average citizens — that something must fill in international law’s silence on foreign surveillance means that states should pursue basic procedural norms that restrain their foreign collection activities, at a cost they can bear.