Enhancing due process rights of individuals who are subject to surveillance

Revised Draft of Second Essay

The present legal regime for communications surveillance regulation in India has been subject to heavy criticism. Several stakeholders have called for an overhaul of the legal framework. Some have even attempted to provide a draft legislation complete with substantive and procedural rules. This article attempts to lay out broad but minimum substantive safeguards that should form a part of any new legal framework or statute intending to replace the current one. The safeguards are drawn from experiences in jurisdictions across the world and related commentary. Wherever possible, the principles are contextualised with developments in India.

SUBSTANTIVE SAFEGUARDS

Prescribed by law – Although the requirement is guaranteed by the Indian Constitution, a new legal framework must reiterate that surveillance may be undertaken only in the manner prescribed under the framework and notwithstanding any other law.

Reports suggest that the Indian government routinely requires third parties to retain communications data, including, in some cases, the content of communications. For instance, in licenses granted to telecommunication enterprises by the Indian government, broadly worded terms require such enterprises to retain communication data en-masse. Government agencies, it appears, subsequently request for specific information from such enterprises without having to comply even with the current safeguards under the Indian Telegraph Act and the Information Technology Act.

Accordingly, this suggested safeguard will ensure that (a) the law stipulated in the new framework will be the only means available to government agencies to conduct communications surveillance and (b) the powers of the government under other laws (such as the ability to issue telecommunication licenses) are not cited to escape the rigours of the framework.

Prescribed by law, as a principle, should also guide the drafters of the new framework to ensure that the framework is publicly accessible and that the language of the framework permits individuals to clearly foresee under what conditions might government authorities be permitted to undertake communications surveillance.

Legitimate aim – The present framework articulates broad state interests which may justify surveillance. As is now acknowledged, “vague and unspecified” phrases such as ‘public order’ or ‘national security’ are routinely asserted by states casually (without further explanation) to justify surveillance measures in individual cases. The new framework must mandate a requesting government authority to “precisely and concretely” demonstrate how the person sought to be surveilled threatens, for instance, ‘national security’ or ‘public order’. Further guidance, in the form of illustrations, on how phrases such as ‘national security’ or ‘public order’ may be understood and (more significantly) not understood should be provided.

Proportionality – The Indian Supreme Court, in Puttaswamy v Union of India (2017), endorsed the applicability of the proportionality doctrine in examining permitted interferences to an individual’s privacy. The new framework should codify this requirement. The language of the codification should ensure that it resolves some contemporary issues in the field without room for doubt.

For instance, the Madras High Court currently appears to be struggling to decide on a petition that effectively requests the Court to ensure the communication service provided by WhatsApp? is not truly “end-to-end” encrypted. Any measure that prevents individuals from using encrypted communication methods should always fall foul of the proportionality doctrine. As captured succinctly elsewhere:

“Just as it would be unreasonable for governments to insist that all residents of houses should leave their doors unlocked just in case the police need to search a particular property, or to require all persons to install surveillance cameras in their houses on the basis that it might be useful to future prosecutions, it is equally disproportionate for governments to interfere with the integrity of everyone’s communications in order to facilitate its investigations or to require the identification of users as a precondition for service provision [..]”

In similar vein, when properly understood, the proportionality principle will prohibit policies mandating default or en-mass communications related data retention by third parties. A new legal framework must articulate the proportionality doctrine appropriately to ensure that scenarios such as the ones discussed above are readily and conclusively answered.

Due process rights – Ex-ante judicial authorisation, the availability of ‘public advocates’ (lawyers representing the interests of the individual sought to be surveilled without getting in touch with the individual) and post-facto user-notification are three important means that strengthen an affected individual’s due process rights. A new legal framework must capture these three measures. Procedural and allied rules must ensure that the spirit of these measures is not destroyed.

Effective remedies – The new framework must provide for specific remedies available to an individual when it is adjudged that her communication was intercepted in breach of the framework. At a conceptual level, no remedy for the improper breach of one’s privacy can be fully compensatory – but at a minimum they must explicitly provide for (a) destruction of any unlawfully obtained communication, (b) substantial safeguards that prevent any information gathered from the unlawfully obtained communication from being used or shared further, (c) where relevant, appropriate repercussions for government officials or others responsible for the illegality, and (d) monetary compensation for the individual without any proof of ‘actual harm’.

Public oversight mechanism – A new framework must incorporate a democratic oversight mechanism where the overseeing body has legitimate power to review the government's use of surveillance measures. Publication of reports from such an overseeing body will foster democratic engagement and debate on the state’s surveillance activities. This measure might encourage the government to limit surveillance activities to genuine scenarios, keep ‘public advocates’ accountable to the larger public and deter an ex-ante reviewing judicial authority from turning into a rubber-stamp.

Prohibit circumvention of domestic law by seeking co-operation from foreign governments – It is now widely believed that states sometimes seek surveillance material in relation to their own citizens or subjects from foreign intelligence agencies when the applicable domestic law does not permit the state to do so directly. The new framework should explicitly prohibit such attempts to circumvent applicable domestic law. As a corollary, the framework must stipulate that Indian authorities will not aid their foreign counterparts when these counterparts attempt to circumvent their own domestic law.

First Draft of Second Essay

Prior judicial authorisation of individual surveillance is viewed as an important safeguard against abusive practices by the executive. In order to prevent such a judicial authority from turning into a rubber stamp, privacy activists suggest allowing a ‘public advocate’ i.e. an attorney other than the attorney for the government to challenge requests for surveillance authorisations before the judicial authority. This ‘public advocate’ may represent the interests of the individual sought to be surveilled (without getting in touch with the individual) and the general interests of the public against abusive surveillance.

Surely there are merits to this proposition. Without a ‘public advocate’, a judge deciding on a surveillance request will be presented with only the government’s side of the facts. In-fact, over a period of time, judges may only be presented with the government’s interpretation of the law allowing the executive to effectively curate convenient jurisprudence. A ‘public advocate’ offers opportunity for an adversarial proceeding and consequently for the judge to make a better decision.

However, I argue that this remedy operates with limitation. This model may fall into some of the same pitfalls as the rubber stamp courts. It may very well be impossible to ensure that a ‘public advocate’ will effectively represent the interests of the individual concerned or the public at large. Pragmatic details about who might appoint such ‘public advocates’, what service rules will they be subject to, who will they be reporting to, who can fire them and under what circumstances, will impact how well such advocates will serve the intended purpose.

Some of these limitations can be remedied with a more radical solution. Even if a surveillance request by the executive is ex-ante judicially authorised, even if the general interests of the concerned individual is represented by a public advocate, and even if further safeguards such as an effective public oversight mechanism are available, an impacted individual’s due process rights are not fully realised until he is presented with the option to personally challenge the surveillance.

Needless to say, from the perspective of the surveillance seeking executive official, it may be imprudent to allow the concerned individual to be informed when the initial authorisation request is preferred before the judicial authority. But when the surveillance itself has been completed and the period of surveillance for which the authorisation was obtained for has lapsed, the concerned individual may be informed of the surveillance allowing the individual to challenge it if he deems necessary.

Admittedly, this is a complex debate. Other factors maybe be relevant, such as the possibility of investigating agencies seeking further surveillance of the same individual in the near future. Putting the individual in notice that some surveillance was conducted recently, from the perspective of the executive, may be counterproductive. Even if the executive is certain that no further surveillance requests in the near future will be necessary, it might not want to put the individual in notice of an on-going investigation of which some non-surveillance aspects may still be incomplete.

These asserted government interests are regularly cited in arguments against post-facto user notification. According to this view, notifying the individual at any stage of the process, is inherently contradictory to the purpose of secret surveillance. Proponents of this view suggest that notification is not required to enhance the due process rights of the individual. According to them, due process rights are sufficiently ensured because an individual will be able to challenge any information obtained from the surveillance (and by extension the surveillance itself) when it is used in a court proceeding against the individual.

Again, this view does not take into account that the State undertakes surveillance activities for a range of objectives – such as to prevent inconvenient protests against the government, spying on those who fund opposing political parties etc. Only a percentage of surveillance activities are possibly commenced for future use in court proceedings against the relevant individual. Even in such cases, it may not always be disclosed or evident that the information being used against the individual in a court proceeding has been obtained from surveillance of the individual. Accordingly, except in limited instances, individuals are unlikely to know that they were subject to surveillance and therefore unable to challenge it in court.

Certain jurisdictions have made bold attempts in acknowledging that post-facto notification is an essential component of the right to privacy. For instance, in 2007, the European Court of Human Rights (ECtHR? ) noted:

“unless they [individuals subject to surveillance] are subsequently prosecuted on the basis of the material gathered through covert surveillance, or unless there has been a leak of information, the persons concerned cannot learn whether they have ever been monitored and are accordingly unable to seek redress for unlawful interferences with their [..] rights.” (at para 101)

In 2015, developing on the reasoning above, the ECtHR? held:

“absence of a requirement to notify the subject of interception at any point [is] incompatible with the [European Human Rights] Convention, in that it deprive[s] the interception subject of an opportunity to seek redress for unlawful interferences with his or her Article 8 rights and render[s] the remedies available under the national law theoretical and illusory rather than practical and effective.” (at para 288)

This is an important determination. If the concerned individual is not notified, his rights against unwarranted intrusion to his privacy are rendered meaningless. Rights without opportunity to seek remedies are no rights at all.

Accordingly, the dilemma between the interests of the executive in not compromising live investigations and the interests of the individual in being informed of the surveillance post-facto must be resolved in favour of the individual. Post-facto notification also enhances the effectiveness of judicial authorities that are tasked with prior-authorisation and any ‘public advocates’ appearing before them.

To be sure, post-facto notification, by itself, is no-magic wand. Other factors will be at play: the notification recipient must have effective access to judicial forums; the substantive law employed to challenge the surveillance must be ideal; and remedies must be meaningful.