Videosurveillance and privacy in a transatlantic perspective

by Fiammetta Berardo (1)

The following article aims at illustrating how the creation of “societies under surveillance”, whose instruments reshape all people’s life, had started well before September the 11th. For instance within the USA in 1978 an investigation on the privacy violations committed in the course of foreign intelligence surveillance programmes had been leading to the adoption of a special law, the Foreign Intelligence Surveillance Act or FISA. The attacks to the Twin Towers have been offering the context and the casualty for an improvement in quality and intensity. For some political forces or for some economic actors this was an extraordinary opportunity to further develop programmes, ideas (for instance John Ashcroft’s projects previous to September the 11th) or already existing technologies in the field of mass surveillance.

Introduction

Videosurveillance and other surveillance techniques are now used as a tool in the fight against international terrorism worldwide. In Europe measures used in the fight against terrorism that interfere with privacy (in particular body searches, house searches, bugging, telephone tapping, surveillance of correspondence and use of undercover agents) must be provided for by law. But it must be possible to challenge the lawfulness of these measures before a Court.

For instance, with regard to wiretapping, it must be done in conformity with the provisions of Article 8 of the European Convention on Human Rights, notably it must be done in accordance with the law. The adoption of such tools has then to be balanced with the right to privacy. The author tries to sum up the main privacy concerns surveillance techniques and mainly videosurveillance do raise in order to question whether the adoption of these tools in the fight against international terrorism has been challenging such a fundamental right.

Videosurveillance in the United States of America as a response to international terrorism

Already on the 20th of September 2001 Joseph Atick, founder and CEO at Visionics, a New Jersey leader enterprise in the field of biometrics, did present to a government’s committee established by the Secretary of Transportation, the technology called Facelt, able to codify facial structures via eighty unique and non repeatable identifiers.

It was then of fundamental importance to simply put in key areas television cameras, not so recognisable, but rather easily identifiable. The places more suitable for this purpose were first of all airports (300 cameras proposed for the Reagan National Airport in Washington). A rapid scan of passengers’ faces and a counter check made in real time with the codes on the list of suspects should have been sufficient for individuating and capturing terrorists well before they could pass the modern borders, which is to say flights’ boarding lounges (Lyon, 2003). Always in the technological field, the government has been asking the Pentagon to present a project with great expectations.

The Information Awareness Office (IAO) and the Defense Advanced Research Projects Agency (DARPA) completed in January 2002 the Total lnformation Awareness project (TIA). It exploited data-mining technologies, employed since time in the business sector, in order to draw the profiles of potential terrorists and also of Muslim Arabs. With an initial budget of 200 million dollars the programme had the aim of encoding millions and millions of Americans, underveiling their tastes, sexual orientations, religious and political beliefs. The programme implied the constitution of a big database with an antiterrorist function, deputy to the inventory of new algorithms for the deriving, linking and bettering of data.

The majority of them belonged to the kind already screened for years by commercial databases with the purpose of defining the profile of selectioned consumers as special contacts. Up till then intelligence, with the only exception of the most critical phase of Cold War, had mainly been taking care about external enemies, while police activities concerned internal population. Nowadays the techniques of data collection on spies and foreign countries’ rebels are used within a national context. In the same way once data concerning ordinary consumers, apart from those cases of persons under police suspicion for valid reasons, were of no interest, if not for marketing experts.

With the TIA programme those limits have been bypassed and researches on the daily aspects of life have been carried on: the ones on the purchases at automatic bank counters, on credit cards’ receipts, on the consulted web sites via cookies, with a special regard to government ones, on the enrolments at schools, on the subscriptions to magazines and newspapers, on medical archives, on cargo planes’ lists of air companies, on the passages of property and of course on addresses and telephone numbers.

On the contrary the broadening of the definition of terrorist did not imply solely the possibility that critics or even the lack of action could raise not only suspects, but also the reinforcement of strict controls over social and humanitarian activities, mainly among Muslims. On the one side Frank Furedi’s prophecy according to which all foreign disliked persons become terrorists, seemed to come true. Moreover terrorism is newly defined as a multifaceted metaphor every time the Third World asks for a commonly agreed intervention of the Western World (Furedi, 1994).

On the other side the Big Brother’s threat was taking consistency even provoking denounces not only and any more from civil rights associations’ promoters, but also from parts of the Congress and of the Senate, that up till then had approved the main antiterrorist provisions. The TIA website did not leave any doubts: there was a big eye over a pyramid with the motto “Scientia est potentia”, a truly Orwellian Panopticon. There have then been many names trying to hide or to split into fragments the original scheme: Genoa II, Topsail, Basketball. The single projects delocalised on the US territory, have been retaining the original purposes and NSA has been keeping on illegally tapping telephone calls and communications via Internet. In the meantime both researches and the mise en oeuvre of the informatics tools foreseen by TIA, conferred to electronics corporates like AT&T, continued, making now reference to the Advanced Research and Development Activity (ARDA).

Telematic and telephone interceptions are quite an evident breach of the IV Amendment to the American Constitution which establishes for citizens’ safeguard precise limits to inquiries and arrests.

Already in 1978, an investigation on the privacy violations committed in the course of foreign intelligence surveillance programmes had been leading to the adoption of a special law, the Foreign Intelligence Surveillance Act or FISA. The Foreign Intelligence Surveillance Act regulates electronic surveillance inside the USA, balancing civil liberties and the objective of obtaining valuable intelligence in order to safeguard national security. FISA authorises electronic surveillance in specific situations and only if approved by a Court. It foresees exceptional circumstances for wartime where judges’ authorisation for domestic surveillance is not required provided that it will be lasting for the first fifteen days of a war only. It considers illegal every form of surveillance or of controls not authorised by statute.

In case AUMF could be interpreted like an implicit authorisation as the Department of Justice does (however the Congress has in relation to wiretapping referred the issue to the Foreign Intelligence Surveillance Act), there would be a time limit. Many recent Amendments to the Foreign Intelligence Surveillance Act do prove that the legal basis of FISA were weak despite the fact that they were meant to justify the regular breaches of the law made by its management body, the Foreign Intelligence Surveillance Court (FIS Court), like the indiscriminate collection of personal data over hundreds of thousands of individuals.

Section 215 of the Patriot Act modifies FISA, granting authorities the collection of data and of other “tangible things” in order to fight international terrorism and underground activities. 

Section 218 has instead introduced the Amendment on the basis of which for the ends of data storage or of the activation of the other screenings towards an individual, it is sufficient that he/she reveals a “significant purpose” of spoiling, instead of an undoubtful intention, therefore introducing further arbitrary criteria in investigations.

Section 505 broadens the conditions upon which FBI may send “national security letters” in order to compel banks, insurance companies, telephone companies and Internet providers to give information on the own clients without their knowledge. It is sufficient to declare to FBI that the requested data are of fundamental utility for investigations.

In July 2008, the Congress capitulated to the White House’s demands and scare tactics by passing the FISA Amendments Act of 2008, giving the NSA even more power to spy on Americans without warrants than it exercised under its illegal surveillance programme.  This new Act protects telecommunications’ companies from lawsuits for “past or future cooperation with federal law enforcement authorities and will assist the intelligence community in determining the plans of terrorists”. Such immunity is given by a certification process. The Act also permits the government not to keep records of searches and to destroy existing records (it requires it to keep the records for a period of 10 years). The time for warrantless surveillance is increased from 48 hours to 7 days.

FISA Court permission is required only to wiretap Americans who are overseas.

There is more than one discrimination between Americans and foreigners, for instance it is prohibited to target a foreigner to eavesdrop on an American’s calls or electronic mails without any Court approval. It allows Americans eavesdropping in emergencies and without Court approval, provided the government files the required papers within a week. Finally it allows the FISA Court 30 days to review existing but expiring surveillance orders before renewing them.  

On the same day of the adoption of the law the American Civil Liberties Union (ACLU) appealed before the Court of First Instance of the Southern District of New York the dismissal of its lawsuit challenging an unconstitutional government spying law: in particular the law would breach the right of freedom of speech and the right to privacy as protected by the I and IV Amendments.. In an interview organised by ACLU the writer Timothy Ferriss and the journalist Daniel Ellsberg, who had been at the time protagonist of the Pentagon Papers’ publication, have compared the last version of FISA to former DDR Stasi. Such comparisons make us understand how certain excesses in “self defence” risk of transforming modern democracies in their opposite or more easily to lower the human rights’ protection standards inside them.

Section 206 of the Patriot Act expands the authority of the Foreign Intelligence Surveillance Court (FISC) by allowing it to order roving or multi-point surveillance. Previously, the Foreign Intelligence Surveillance Act required a separate FISC authorisation to tap each device a target might be using. Technically, the Court’s order would direct a specific carrier or individual to assist in the surveillance. As a practical matter this required a separate application to the FISC each time a target switched from pay phone to mobile phone, from electronic mail to Blackberry and so on. The Court may then order a surveillance focused on the target, rather than the device he or she is using when the actions of the target of the application may have the effect of thwarting the identification of a specific device. This new order does not specify the person who is directed to assist; the government may serve the generic order on those individuals or carriers that it identifies2.

Section 215 vastly expands the FBI’s power to spy on ordinary people living in the United States, including citizens and permanent residents. It lets the government obtain personal records or things about anyone– from libraries, Internet service providers, hospitals or any other business – merely by asserting that the items are “sought for” an ongoing terrorism investigation. Section 215 threatens individual privacy, because it allows the government free reign to monitor private activities. It also endangers freedom of speech, because the threat of government surveillance inevitably discourages people from speaking out and especially from disagreeing with the government. Section 215 has amended, despite the protests of the judges from the ad hoc Court (FISC), the Foreign Intelligence Surveillance Act of 1978. FISA set out the procedures that the FBI had to follow when it wanted to conduct surveillance for foreign intelligence purposes. The system which has been put in place is unique, last but not least because the FISA Court meets in secret, almost never publishes its decisions and allows only the government to appear before it. But, of course, it applies only to foreign spies. Thanks to the Patriot Act, the FBI can use FISA even in investigations that do not involve foreign spies. In fact, under Section 215, the FBI can now spy on ordinary, law abiding Americans.

Section 218 amends FISA by changing the certification requirement when the government seeks a FISA surveillance or search order. Previously, the government was required to certify that “the purpose” of the application was to obtain foreign intelligence information. After Section 218, the government must certify that obtaining foreign intelligence information is a “significant purpose” of the application. This change was conceived to promote information sharing between intelligence and law enforcement officials and to eliminate what has become known as the metaphorical wall that separated law enforcement and intelligence investigations, protecting privacy in communications.

The FISA also set forth procedures for the conduct of electronic surveillance and physical searches for foreign intelligence purposes. Over the years, the Department of Justice interpreted the FISA’s requirement that “the purpose of collection” be foreign intelligence in order to restrict the use of FISA collection procedures when a law enforcement investigation was involved. The restriction was aimed at ensuring that prosecutors and criminal investigators did not use FISA to circumvent the more rigorous warrant requirements for criminal cases. But law enforcement and foreign intelligence investigations often do overlap and enforcing this separation between intelligence and law enforcement investigations (the “wall”) inhibited the coordination of these investigations and the sharing of foreign intelligence information with law enforcement officials. The change to a “significant purpose” was intended to clarify that such a separation is not necessary. It is not clear whether the change in section 218 was legally necessary to eliminate the “wall”. According to the advocates of the government’s measures, all this was not breaching the Fourth Amendment. The Foreign Intelligence Surveillance Court is still a neutral and disinterested judge, all cases, even if closed to the general public, do follow a standard procedure with a few exceptions that can be due to the special needs of the historical period. Moreover, as argues the former federal prosecutor, the republican Andrew C. McCarthy, “it is not sensible to suspect systematically dishonest resort to FISA. FISA applications require a specialized and rigorous internal approval process before presentation to the Court”. Assuming that an agent is willing to act corruptly, it would be far easier and less detectable to fabricate the evidence necessary to get an ordinary criminal wiretap than to fabricate a national security reason in order to use FISA. According to McCarthy, the FISA proceedings were misunderstood for nearly a quarter-century, as a reaction to Vietnam and Watergate they were seen as an abuse of domestic intelligence, but to a disastrous effect. Thanks to the Amendments of the Patriot Act the original aims of FISA would be restored.

The critics of Section 218 of the Patriot Act are split between those who think that the FISA “wall” in defence of privacy would have been lasting up till the year 2001 (Chesterman, 2011) and those who believe that the FISA Court was “too permissive, for allowing the government whatever eavesdropping powers it requested”(Greenwald, 2006)

It might then be questioned why the Administration decided to bypass the Court. Glenn Greenwald responds:  As Congress devised the law, the FISA court plays two critical, independent functions – not just warrant approval but also, more critically, judicial oversight. FISA’s truly meaningful check on abuse in the eavesdropping process is that the president is prevented from engaging in improper eavesdropping because he knows that every instance of eavesdropping he orders will be known to a federal judge – a high level judicial officer who is not subject to the president’s authority … it is precisely that safeguard which President Bush simply abolished by fiat.

In effect, President Bush changed the law all by himself, replacing the federal judges with his own employees at the NSA and abolishing the approval and warrant process entirely 3 However it seems quite difficult to deny the change occurred together with the Patriot Act: …the very purpose of Section 218’s revision deprives FISA of its constitutional justification. FISA searches are generally defended as constitutional without probable cause of criminal activity because they fall under the “administrative search” exception to the probable cause requirement.

But that exception, the Supreme Court has held, does not apply where the government’s purpose is criminal law enforcement. FISA’s pre-Patriot Act requirement that the search’s primary purpose be foreign intelligence gathering, not criminal law enforcement, may well have been constitutionally required to make FISA searches valid.

After the Patriot Act, foreign intelligence gathering need only be “a significant purpose” of the search—the primary purpose can be criminal law enforcement. That raises a serious constitutional concern 4. FISA defines “foreign power” not only a foreign government, fraction, entity or group, but also “a foreign based political organization, not substantially composed of United States persons”. An “agent” of a foreign power is “any person other than a United States person, who acts in the United States as an officer or employee of a foreign power”. Neither the agent nor the power needs to be involved in any wrongdoing. Thus, a British citizen working in the USA as an employee of Amnesty International is an “agent of a foreign power”. This might sound as paradoxical.

Videosurveillance in Europe at a glance

In Europe thanks not only to the intervention, where they exist, of national Constitutional Courts, but also of the two European Courts, a series of principles is finally being protected: renditions are not allowed in case guaranteed protections of human rights are absent, no military judges can adjudicate suspected terrorists, all alleged government abuses require effective investigations, detainees’ injuries require full investigations, all human rights’ law violation victims must have legal relief, evidence obtained by torture is inadmissible, judicially unsupervised electronic surveillance is strictly prohibited and so on.  According to the Court of Strasbourg the measures used in the fight against terrorism that interfere with privacy (in particular body searches, house searches, bugging, telephone tapping, surveillance of correspondence and use of undercover agents) must be provided for by law.

But it must be possible to challenge the lawfulness of these measures before a Court. The Court accepts that the fight against terrorism may allow the use of specific methods. Democratic societies nowadays find themselves threatened by highly sophisticated forms of espionage and by terrorism, with the result that the State must be able, in order effectively to counter such threats, to undertake the secret surveillance of subversive elements operating within its jurisdiction. The Court has therefore to accept that the existence of some legislation granting powers of secret surveillance over the mail, post and telecommunications is, under exceptional conditions, necessary in a democratic society in the interests of national security and/or for the prevention of disorder or crime5.

With regard to wiretapping, it must to be done in conformity with the provisions of Article 8 of the Convention, notably it must be done in accordance with the law. The Court, thus, recalled that: tapping and other forms of interception of telephone conversations constitute a serious interference with private life and correspondence and must accordingly be based on a “law” that is particularly precise. It is essential to have clear, detailed rules on the subject, especially as the technology available for use is continually becoming more sophisticated (see Kruslin and Huvig judgements, p. 23, para. 33, and p. 55, para. 32, respectively)6.

At EU level the measures taken for the prevention, the pursuit of crimes and the unauthorised use of electronic communications, as foreseen by Article 13(1) of Directive 95/46/EC, have to be exceptional, based on specific and transparent laws. Such measures have to be authorised by the judicial authority or by other competent authorities, anyway never decided for groups or categories of individuals, but always for single cases. In fact it might be argued that any kind of general electronic surveillance, even if explorative, is against the provisions of the European Convention on Human Rights and against the European Court of Human Rights main case law7. On the 30th of May 2002 the European Parliament reviewed all its previous stances, by authorizing the preventive retention of connection data and the establishment of a general control on cybernauts.

In Germany on March the 3rd, 2004, the German Federal Constitutional Court8 decided that the regulations in the “Strafprozessordnung” (StPO – Code of Criminal Procedure) concerning acoustic surveillance of housing space (the so called “Grolier Lauschangriff”) partly violated the Grundgesetz. Article 13.3 of the Basic Law itself, which in 1998 integrated the right to acoustic surveillance of housing for reason of prosecution into the Basic Law, was nonetheless found to be constitutional 9. Article 13, subsection 3 therefore had to be interpreted in a restrictive way regarding human dignity. It does not affect the principles guaranteed in Articles 1 and 20. Those principles include the respect for and the protection of human dignity (Article 1, subsection 1 GG)10.

Finally, on the 27th of February 2008, in a landmark ruling 11, having determined that the existing rights are not sufficient to protect citizens from the threat against their personality rights, the Court established a new fundamental right in the confidentiality and integrity of information technology systems in order to close the regulatory gap.

In relation to France attention has to be paid to the Conseil constitutionnel’s main case law. In a 2010 decision, the Court ruled on several provisions of a legislative bill (the “Bill”) aimed at combating acts of group violence and at protecting public servants. This Bill would have authorised the owners of buildings to provide live, closed-circuit videosurveillance images of a building’s common areas to local or national law enforcement authorities in the event that activities taking place on the premises might require police intervention12. The Court ruled against this provision on the grounds that it did not provide those safeguards which were necessary to protect the privacy rights of individuals entering or living in the buildings. Following the Court’s ruling, the French Data Protection Authority (the “CNIL”) took the opportunity to restate that video surveillance images are considered “personal data” since they allow for the identification of individuals. Consequently, any video surveillance using a system that is installed on the private premises of a building (e.g. in hallways, staircases or elevators) constitutes a data processing activity within the scope of the Data Protection Act and requires prior notification to the CNIL.

Conclusions

Today in the U.S.A new data technologies, particularly the “knowledge discovery in databases” (KDD) applications make any privacy conceptualisation inadequate (Kuhn, 2007). Privacy interpretation as space, privacy as secrecy and privacy as information control cannot offer protection against federal “dataveillance programs”, according to the definition of the surveillance of a person’s or of mass’ activities through electronic data 13.

In the future, decisions about individuals would no longer be based on speculations or influenced by a purely subjective approach. However, the clearer it became that enhanced technology not only allows the processing of a practically endless amount of personal data but also an extendable linkage of data banks, the more the focus has shifted to preventive policies that in a growing number of cases initiate an intensive “predictive surveillance”(Lynch, 2009).

Privacy is now threatened more than ever by technological advances.

There are massive databases and Internet records of information about the individuals’ financial and credit history, medical records, purchases and telephone calls, for example and most people do not know what information is stored about them or who has access to it. The ability for the others to access and link databases, with few controls on how they use, share or exploit the information, makes the individual control over the information about oneself more difficult than in the past. There are many cases where the clash between privacy and technology is quite evident. For instance a caller identifier, originally designed to protect people from unwanted calls from harassers, telemarketers and so on, involves privacy concerns for both the caller and the called.

We gave an overview on the existing legislation at both sides of the Atlantic. The issues raised in the article are complex and demand more and more attention to be paid from public authorities. A new set of regulations will probably be established.

According to the words of Simson Garfinkel, it might then be concluded that: The future we’re rushing toward isn’t one in which our every move is watched and recorded by some all-knowing Big Brother. It is instead a future of a hundred kid brothers who constantly watch and interrupt our daily lives. Orwell thought the Communist system represented the ultimate threat to individual liberty. Over the next fifty years, we will see new kinds of threats to privacy that find their roots not in Communism but in capitalism, the free market, advanced technology and the unbridled exchange of electronic information14.

NOTES

References