As you are probably aware, Mr. Miranda is the partner of the Guardian journalist who has been using the documentation provided by whistleblower Mr Snowdon to publicise mass surveillance by the NSA and GCHQ. Last Sunday, under the Terrorism Act 2000, he was detained at Heathrow for nine hours whilst in transit from Germany to Brazil; his equipment was also seized (laptop, phone etc).
I thought I would do a detailed blog on the interplay between data protection and terrorism law as it applies to Mr. Miranda’s seized phone/computer at London Airport; clearly the Data Protection Act applies as both seized items hold personal data and Mr. Miranda’s contacts and friends are data subjects.
Although Mr. Miranda is taking legal action, the linkage between these two Acts could provide a vehicle for those data subjects to test whether their personal data were lawfully obtained by the authorities.
Additionally, every newspaper journalist appears to be mentioning Schedule 7 of the Terrorism Act 2000 as if that is the issue. Sadly it isn’t. The legal problem, if there is one, is the wide ranging definition of “terrorism” itself - concerns that have been raised by the Independent Reviewer of the Terrorism legislation.
What I will first show is that according to definitions found in UK law, Mr. Miranda is likely to pass the legal definition of “terrorist” and is, therefore, a threat to “national security”. Then I will turn to a data protection analysis to show that data subjects are not wholly impotent in the face of the exemptions that might be applied.
The relevant elements of Schedule 7
The much quoted “Schedule 7” of the Terrorism Act states in paragraph 2(1) that an “examining officer” (e.g. police officer, immigration official) “may question a person to whom this paragraph applies for the purpose of determining whether he appears to be a person falling within section 40(1)(b)”.
Schedule 7, paragraph 2(4) then states that “An examining officer may exercise his powers under this paragraph whether or not he has grounds for suspecting that a person falls within section 40(1)(b)”. Failure to answer questions, be obstructive etc etc on the part of the examined person is an offence and carries a maximum 3 month prison sentence or a fine or both.
As can be seen, one needs to understand section 40(1)(b) before we really understand the relevant parts of Schedule 7 (this comes later). However, we can immediately recognise that the examining officer does not need any suspicion or grounds for detention - as has been well reported.
The powers of seizure (Schedule 7, paragraph 11) states that sized equipment can be kept “for a period not exceeding seven days”. Note the importance of this; the seizure and retention of Mr. Miranda’s electronic kit is separate from his detention. For instance, the authorities could have seized the equipment and then sent Mr. Miranda on his way within 30 minutes; but instead they decided to detain him for the maximum nine hours.
Note that this nine hour period specified in paragraph 6(4) of Schedule 7 is being reduced to six – care of Schedule 6 of the Anti-Social Behaviour, Crime and Policing Bill currently before Parliament. This makes the 9 hour detention in Mr. Miranda’s case even more exceptional.
Section 40(1)(b) of the Terrorism Act 2000.
As shown above, Schedule 7 relies on Section 40(1)(b) of the Terrorism Act; this subsection is very brief and merely states that a “terrorist” means a person who—
“(a) has committed an offence under any of sections 11, 12, 15 to 18, 54 and 56 to 63”, or
“(b) is or has been concerned in the commission, preparation or instigation of acts of terrorism”.
The first limb (i.e. Section 40(1)(a)) is not relevant in Mr. Miranda’s case as it relates to actual offences such as being a member of a proscribed organisation, or funding such an organisation etc. Other offences in S.40(1)(a) relate to using weapons, training, directing or scouting for terrorism etc – again not relevant.
However, the second limb only makes sense when you look at the definition of “terrorism”. So to understand Schedule 7, we need to consider this definition.
Section 1: the definition of “terrorism”
The main part or the “terrorism” definition in Section 1(1) has three limbs and all of them have to be satisfied:
“1(1) The term ‘terrorism’ means the use or threat of action where—
(a) the action falls within subsection(2),
(b) the use or threat is designed to influence the government or an international governmental organisation or to intimidate the public or a section of the public, and
(c) the use or threat is made for the purpose of advancing a political, religious, racial or ideological cause”.
Subsection (2) provides a list of actions but only one limb is needed if an action (or threat of action) is to be defined as an act of terrorism. Terrorism is an action that:
“(a) involves serious violence against a person,
(b) involves serious damage to property,
(c) endangers a person’s life, other than that of the person committing the action,
(d) creates a serious risk to the health or safety of the public or a section of the public, or
(e) is designed seriously to interfere with or seriously to disrupt an electronic system”.
Note the combination: you need one action (or threat of action) defined in subsection(2) and then both the two remaining limbs (b) and (c) of subsection (1). To be a terrorist, therefore, the authorities need an action (defined in subsection (2)) and two motives for that action (paragraphs (b) and (c) of subsection (1)).
We can now apply these tests in Mr. Miranda’s case if we assume his laptop contained some of Mr. Snowdon's documents:
(1) was Mr. Miranda carrying a laptop that contained material (e.g. documents) that could seriously disrupt an electronic system (e.g. GCHQ’s program of surveillance)?
(2) Could the publication of such material is “influence” UK Government policy towards surveillance in some way (does not matter in which way or to what degree)?.
(3) Is there a political cause to Mr. Snowden’s actions?”.
I think most people will answer “yes” to these three questions. If so, it follows that Mr. Miranda is a likely “terrorist”, especially if something is found on his laptop. Given this, you can now anticipate that Mr. Miranda’s legal action, when it gets to the Courts, could easily fail.
Note that whether he is a “terrorist” according to the natural meaning of this word is irrelevant; “terrorism” is a defined term and that is the only thing that matters. I should add that if Section 1(1) of this definition used the words “intimidate the Government” rather than “influence the government”, I would be much happier with the "terrorism" definition.
However, the definition does not contain the change I suggest, so it is instructive to explore the range of the "terrorism" definition. To do this, I have designed a small quiz: “Spot the terrorist”.
“Spot the terrorists” – a new game show
Consider the miners who took part in the Miners’ Strike of 1984; are they engaging in “terrorism”? Did the strike involve serious violence against a person (e.g. the battle of Orgreave)? Was the strike meant to influence the government? Was the miners’ strike “political”? If so, would many miners (defined by Mrs Thatcher to be the “enemy within”), if the strike happened now, become “terrorists” as defined.
And what about the UK firefighter dispute of 2002–2003. Was strike action designed to influence the government to accept its 40% pay claim? Did the fire-fighters’ dispute threaten serious damage to property (e.g. by possible non-attendance of a fire-fighting crew)? Did the Prime Minister, Tony Blair consider that the dispute had a political dimension (just Google this)? If so, are those fire-fighters terrorists?
What about those who involve themselves in “direct action”? For instance, suppose a group of teenagers use Facebook to speculatively chat about hacking or denial of service attacks on say companies involved in fracking (the current green cause célèbre of the moment). Are these people threatening to seriously interfere with an electronic system? Are they trying to influence to government change its energy policy? Is the action politically motivated? So are these teenagers terrorists, as defined? If so, you have just concluded that GCHQ are legally entitled to use their powers to intercept such communications via activities such as PRISM.
Now a question for aging hippies: could all those CND activists or the Greenham Common women be terrorists? What about those organising anti-war protests? Or about those against the “arms trade”?
I think the definition of terrorism is far too widely drawn, but of course, one can argue the opposite – any narrowing the definition would involve the risk that some terrorist actions would not be identified by the authorities. It is at the end of the day, a difficult judgment call that needs great care.
However, let us be clear on this – we are dependent on (or hoping that) the authorities, when they exercise their powers that follow from identifying an “act of terrorism”, are reasonably close to the natural meaning of these words and do not rely on the breadth of the legal definitions outlined above.
As soon as the authorities depart from the natural meaning of these words, we are in serious trouble. And of course, in essence, this is what I think has been very publicly exposed in Mr. Miranda’s case.
The Independent Reviewer of Terrorism
In his 2012 report (see references), the Independent Reviewer agrees that definition of “terrorism” has its problems. He says that “the TA 2000 definition is an easy target for criticism”. In particular:
“(a) It is longer and more complex than its predecessor.
(b) Its international reach renders it remarkably broad – absurdly so in some cases.
(c) The effect of that breadth is to grant unusually wide discretions to all those concerned with the application of the counter-terrorism law, from Ministers exercising their power to impose executive orders to police officers deciding whom to arrest or to stop at a port and prosecutors deciding whom to charge.
(d) Those discretions become wider still when conduct ancillary in only the broadest sense to terrorism is criminalised, and when dubious expansionary phrases such as “terrorism-related” and “terrorist or extremist” are allowed on to the statute book or into the statistics.”
Despite these problems, the Independent Reviewer makes:
“no specific recommendations at this stage for the amendment of the definition of terrorism under TA 2000 section 1. That is because I have identified no urgent need for change, based on my reading and observations; because the opportunity for change will not arise at this stage of the Parliament; and because in at least one important respect, the meaning of the existing definition is currently under consideration by the Supreme Court”.
However “At some stage it would be desirable for such a review (which would exceed the solitary resources of the Independent Reviewer) to take place”.
We can thus conclude that concern over this very wide definition is not limited to the usual suspects.
Overlap with national security
It is now known that the Home Secretary (Theresa May) and Prime Minister knew that Mr. Miranda was to be detained; Mrs May on BBC TV said that she was briefed in advance on this issue but that the detention of Mr. Miranda was an operational matter for the police. She also said that national security was involved.
I have to say that the Mrs May’s claim on the BBC that “this was an independent police decision” is complete rubbish; to call it "economical with the truth" would be wholly unfair to economics. This is because, if the matter was solely an independent policing matter, then there would be no need for the police to alert the Mrs May. So, we can safely conclude that the politicians were contacted to see if they objected. Simple as that!
Note that the report of the Independent Reviewer also shatters Mrs May's stance. He records that the effect of the “breadth of the definition of terrorism” is to “grant unusually wide discretions to …. Ministers exercising their power to impose executive orders to police officers deciding whom to arrest or to stop at a port and prosecutors deciding whom to charge”. (Full quote – see paragraph (c) above).
In other words, Mrs May's lack of action on the detention can be equated with approval to detain Mr Miranda. She should be challenged on this point and asked whether she thinks that Mr. Miranda is "a terrorist" as defined in the Terrorism Act, especially if Mr. Snowdon's documents are found on Mr. Miranda's computer.
Mrs May's claim of "national security" becomes involved as a result of the “terrorism” definition. For instance, the Security Service Act states that the “function of the Service shall be the protection of national security and, in particular, its protection against threats from espionage, terrorism and sabotage, from the activities of agents of foreign powers and from actions intended to overthrow or undermine parliamentary democracy by political, industrial or violent means” (my emphasis).
In law, because Mr. Miranda is a likely “terrorist” it follows that he is becomes a threat to “national security” and the “national security” threat is a consequence of the “terrorism” test being passed.
So when Mrs May stresses “national security” at the expense of the “terrorism” label, I think it is because she thinks the British public might not accept the branding of Mr. Miranda as a potential “terrorist” as this would focus the public gaze on this definition.
The interaction with data protection
As I said, the data subjects of concern are those identified as contacts on Mr. Miranda’s seized laptop and phone. The police and national security agencies are involved, so they are the data controllers concerned. Obviously an exemption (either S.28 or S.29 of the DPA) will be applied, but the application of any exemption can be tested.
In relation to the policing exemption, section 29(1), there is an exemption from “the first data protection principle (except to the extent to which it requires compliance with the conditions in Schedules 2 and 3) and section 7”. It follows that whatever processing is undertaken by the police, the acquisition of personal data for policing purpose needs a Schedule 2 condition, and since there is no data subject consent for the processing, that condition has to be “necessary…..(for something)”.
This means the ICO can respond to a call for assessments from any of Mr. Miranda's contacts under section 42 of the DPA) that the processing of personal data is indeed “necessary” in terms of proportionality and Article 8 of the Human Rights Act. Note that the Southampton City Council Enforcement Notice (Audio CCTV in all cabs) and Hertfordshire Police Enforcement Notice (ANPR covering all main roads to Royston) are examples of this type of enforcement where the meaning of the word “necessary” in the context of the processing was the focus of the assessment (see references).
In relation to section 28, there is the national security exemption. However, at the end of the day, there needs to be a Ministerial Certificate and the Information Commissioner can press matters until that Certificate is produced.
Then any data subject “directly affected by the issuing of a certificate” can appeal to the Administrative Appeals Chamber of the Upper Tribunal against the certificate. This Tribunal can apply judicial review principles to determine that “the Minister did not have reasonable grounds for issuing the certificate” with the result that “the Tribunal may allow the appeal and quash the certificate”.
In other words, data subjects can have their day in Court with respect of “necessary” – without the costs that accrue to Mr. Miranda’s form of action. I am not sure that they will win, but I think they should try.
The dilemma associated with balancing the national security purpose with individual privacy and transparency concerns is not a new issue. Back in 1979, the Lindop Report into Data Protection (Cmnd 7341, paras 23.21-23.24) stated that the national security agencies should be subject to a data protection Code of Practice that was independently supervised.
The Report concluded that it was important to take the national security agencies out of their “hermetically sealed” environment in order to ensure that these agencies would be "open to the healthy - and often constructive - criticism and debate which assures for many other public servants that they will not stray beyond their allotted functions".
So I end this blog by asking a rather basic question. Given recent revelations about PRISM etc, do you think that the national security agencies have been “straying”? If so, any review of terrorism legislation needs to go much further.
Independent Review of Terrorism Report 2012: https://terrorismlegislationreviewer.independent.gov.uk/wp-content/uploads/2013/07/Report-on-the-Terrorism-Acts-in-2012-FINAL_WEB1.pdf
Blog comments on the Southampton City Council use of CCTV: http://amberhawk.typepad.com/amberhawk/2012/11/information-commissioners-enforcement-proceedings-links-article-8-to-unlawful-processing.html
Blog comments on the Herefordshire use of ANPR at the end of the blog: http://amberhawk.typepad.com/amberhawk/2013/07/is-the-irish-commissioner-correct-to-claim-that-he-cant-investigate-apple-and-microsoft-over-prism.html
Still places on our Edinburgh Data Protection Course starting 15th September. Details on http://www.amberhawk.com/dp.asp