Regulating Foreign Surveillance through International Law
Regulating Foreign Surveillance through International Law
Abstract and Keywords
Regulating how governments conduct foreign electronic surveillance against another state’s citizens poses a complex challenge. In the wake of Edward Snowden’s leaks in 2013, the extent to which governments conduct surveillance of foreign state leaders and citizens became strikingly clear. This chapter argues that, although states traditionally have been loath to regulate their intelligence activities using international law, that body of law offers an important avenue by which states can reduce criticisms stemming from human rights and other groups, help set the agenda for the future of foreign surveillance, and respond to foreign and domestic fears that government surveillance is unconstrained. The chapter describes the variety of pressures states face to modulate their foreign surveillance, explains some of the benefits that states may accrue by doing so, and suggests six procedural norms around which certain Western democracies may be able to coalesce.
Regulating how governments conduct foreign electronic surveillance against another state’s citizens poses a complex challenge. In the wake of Edward Snowden’s leaks in 2013, the extent to which governments conduct surveillance of foreign state leaders and citizens became strikingly clear. And the extent to which the subjects of that surveillance are discontent with the status quo also became apparent. This chapter argues that, although states traditionally have been loath to regulate their intelligence activities using international law, that body of law offers an important avenue by which states can reduce criticisms stemming from human rights and other groups, help set the agenda for the future of foreign surveillance, and respond to foreign and domestic fears that government surveillance is unconstrained. The chapter describes the variety of pressures states face to modulate their foreign surveillance, explains some of the benefits that states may accrue by doing so, and suggests six procedural norms around which certain Western democracies may be able to coalesce.
Regulating how governments conduct electronic surveillance against their own citizens and in their own territory is a potent challenge, in view of the scope and speed of technological developments and the evolving nature of security threats. Regulating how governments conduct foreign electronic surveillance against another state’s citizens poses an even more complex challenge—but a (p.350) critical one.1 In the wake of Edward Snowden’s leaks in 2013, the extent to which governments—especially the United States but also states such as the United Kingdom, Germany, Australia, France, and Sweden—conduct surveillance of foreign state leaders and citizens became strikingly clear. And the extent to which the subjects of that surveillance are discontent with the status quo also became apparent.
This chapter argues that, although states traditionally have been loath to regulate their intelligence activities using international law, that body of law offers an important avenue by which states can reduce criticisms stemming from human rights and other groups, help set the agenda for the future of foreign surveillance, and respond to foreign and domestic fears that government surveillance is unconstrained. The chapter describes the variety of pressures states face to modulate their foreign surveillance, explains some of the benefits that states may accrue by doing so, and suggests six procedural norms around which certain Western democracies may be able to coalesce.
III. Pressures to Regulate
At least until recently, states have treated their spying activities as existing in an uneasy but stable relationship with international law. Most states and scholars seem to share the view that international law neither authorizes nor condemns spying by one state on another—or on the other’s citizens. Some even believe that international law affirmatively permits spying. This group usually points to the widespread and long-standing practice of spying in support of the claim that international law does not purport to regulate this type of activity. Before the Snowden leaks, there was little pressure on states to revisit this approach.
A smaller group of actors criticizes spying as a violation of international law. Until recently, this was a minority view, but this approach has garnered some traction as ordinary citizens begin to realize the extent to which foreign states are able to monitor and collect their data. These actors argue that foreign surveillance implicates—and often runs afoul of—areas of international law such as human rights (and especially the right to privacy), diplomatic law, and customary rules about the sovereignty and territorial integrity of states. It remains unclear the extent to which states actually crafted these rules to reach surveillance, but some actors seek to “repurpose” these existing rules for today’s foreign surveillance.
These demands on (Western, democratic) states to regulate their overseas surveillance come from disparate quarters, and arise against a contemporary backdrop characterized by three important conditions. First, many individuals (p.351) around the globe have developed a personal understanding and concern about how foreign government surveillance affects them, because the government techniques involve accumulating large volumes of data of “ordinary” people. Second, the interests of corporations, foreign leaders, citizens, and elite opinion in the United States and Europe are aligning in a pro-regulation direction. Third, the very governments whose activities were most exposed by the documents revealed by Snowden are governments that are sensitive to public and elite pressures.
Specific examples of pressure to curtail foreign surveillance abound in political, economic, and rights-based forms. Once US surveillance policies came to light, for instance, the United States faced significant political pressure from the leaders of Germany, Brazil, and France to cease spying on their cell phones. (As a result of this pressure, the United States tightened its policies about when it would monitor the communications of heads of state of friendly governments.) In the economic sphere, US corporations such as Google, Facebook, and Microsoft fear the perception that they are facilitating NSA surveillance and worry about losing business abroad. As a result, they have pressured the US government to reduce the breadth of its foreign intelligence-gathering. Third, activities in the United Nations, the International Court of Justice, domestic European courts, and the European Court of Human Rights reflect efforts (by foreign states, nongovernmental organizations, and individuals) to more aggressively protect the right to privacy. Some of these rights-based pressures may produce legal changes, as when a court rules against a government’s surveillance program. Other rights pressures may be less direct but persist over time, as actors urge states to adopt a more expansive definition of what the right to privacy of communications entails.
In short, new pressures on states to roll back some aspects of foreign surveillance abound. But given that states rarely have resorted to international law to collectively constrain their intelligence activities, why might some set of states wish to do so here? First and most obviously, they may agree to do so if the pressures just discussed continue to strengthen. That is, states may decide that it is worth adopting new norms to satisfy their domestic constituents. Second, each state presumably would prefer a world in which its officials and citizens were subject to less foreign surveillance, but the only way to achieve that is to establish agreed rules of cooperation among like-minded and trustworthy states. Third, the absence of agreed norms of foreign surveillance may force certain states to reduce their intelligence sharing with other states that they perceive to be acting in troubling ways. Establishing harmonious interpretations of joint international legal obligations could help sustain intelligence cooperation and data sharing.
IV. Six Norms
The first part of this chapter illustrated why the international landscape seems poised for change. If conditions and incentives stimulate states to develop international norms of foreign surveillance, what might those norms look like? The (p.352) best and most realistic place from which to draw inspiration is existing domestic surveillance laws. Many Western states have put in place domestic laws regulating how their governments may conduct surveillance of their own citizens (either at home or abroad) and how those governments may conduct surveillance of foreign actors who are communicating with those citizens. These laws have been tested in practice, have been developed in the crucible of public debates, and are, for the most part, publicly accessible. Although very few states currently regulate purely extraterritorial surveillance, the communications of some foreign nationals receive some incidental protections (particularly when the foreign actors are communicating with a state’s nationals). There is little reason, therefore, not to accord those types of protections to all foreign nationals. Further, states are more likely to achieve inter-state agreement by focusing on procedural norms, rather than trying to achieve consensus about the substance of privacy rights.
I extracted the following six proposed norms from common principles found in the domestic laws of the United States, the United Kingdom, Australia, Canada, and Germany. Although not representative of all states’ surveillance laws, these states have some of the most extensive laws regulating surveillance. That suggests that these states have paid careful attention to how to appropriately balance privacy and national security, how to monitor and counterbalance the government’s surveillance power, and how to internally protect data once they collect it. In proffering these principles, the hope is that the norms will increase the accountability of state officials engaged in surveillance, reduce (though not eliminate) the disparity in treatment between citizens and foreigners, limit the ability of government actors to act in overly discretionary ways, and advance the transparency of the rules being applied.
The six principles that states should adopt are: (1) notice to the public of the applicable rules, (2) limits on the reasons that states may collect or query data, (3) a requirement for periodic reviews of surveillance authorizations, (4) limits on the length of time for which the state may hold the data, (5) a preference for action by the host state intelligence services (rather than foreign intelligence services) wherever reasonable, and (6) the existence of a neutral body that will authorize surveillance ex ante or review it ex post.
The first principle is one of legality. People should know how their own state and foreign states are empowered or constrained in conducting foreign surveillance. This includes knowledge about who may be subject to surveillance, which agencies are conducting the surveillance, and the use to which the collected communications may be put. It does not mean that in any particular case a person has the right to know whether the state is monitoring his activities. But adopting this principle would improve the status quo, under which most individuals do not know whether states generally are engaged in foreign surveillance and under what rules.
The second principle is that states should limit the reasons they collect or query data. Most of the five states examined currently have collection limits or use limits, though the content of those limits differs. The United States, for instance, may use the bulk metadata it has collected only to detect and counter espionage (p.353) and other activities directed by foreign powers against US interests, terrorist threats, proliferation of weapons of mass destruction, cyber threats, threats to US or allied forces, and transnational criminal threats. Germany may conduct strategic, warrantless surveillance of telephonic and Internet communications to avert the risk of an armed attack on Germany, the commission of international terrorist acts with a direct relation to Germany, international weapons or drug trafficking, or certain cases of counterfeiting and money laundering. These offer examples of types of collection limits that states might agree to adopt. States also could agree to take certain types of data or uses of data off the table, such as attorney-client communications or the sharing by states of intelligence about foreign businesses with their domestic companies.
Third, states should require that at least one government actor periodically reconsider an authorized surveillance activity. This would ensure that a state actor considers at fixed intervals whether continued surveillance is appropriate and thus would avoid indefinite surveillance of a target.
Fourth, states should agree to limit the length of time they may retain collected data—perhaps to a year or 18 months. Intelligence officials have acknowledged that older data is less important. This norm therefore should not pose a significant operational challenge, but would offer an important check on intentional or accidental abuse or release of swaths of collected information.
Fifth, states should adopt a preference for surveillance by the state in which the suspicious activities are taking place. Assuming that the territorial state has the capacity to conduct surveillance and a positive relationship with the state seeking the information, collection by the territorial state is likely to be more rights-protective because domestic laws regulating surveillance tend to be more restrictive when a state is collecting on its own soil.
Finally, states should agree to a norm that requires neutral oversight—ex ante, ex post, or both—of the executive’s conduct of foreign surveillance. The laws of each state I examined provide at least one, and often multiple, forms of oversight. Those oversight bodies include courts, parliamentary committees, and inspectors general. States might even accept a norm that allows foreign nationals to submit allegations of unlawful surveillance to an adjudicatory body, though this is somewhat less common.
Creating international law takes time. One route is via a negotiated multilateral treaty, but it is unlikely that states engaged in the most extensive surveillance (including the United States, United Kingdom, China, and Russia) would be able to reach agreement on appropriate rules for foreign surveillance. It seems more likely that states will develop international norms as a matter of customary practice. The actual formation of customary international law is slow and requires widespread and consistent state practice followed out of a sense of legal obligation. In the shorter term, states could signal their support for these types of surveillance-related norms in several ways. A core group of Western states might make a public commitment to a set of foreign surveillance principles, including through the use of a political memorandum of understanding. Or they might issue parallel unilateral declarations that a certain set of norms (p.354) reflects internationally acceptable behavior. For now, the form is less important than the fact of a meeting of the minds among high-profile states engaged in foreign surveillance.
A final caveat: not all states will be attracted to these norms. One can sort states into three basic categories regarding surveillance regulation: Western and other democratic states; technologically powerful non-democracies or quasi-democracies, such as China and Russia; and states that lack robust surveillance capabilities. States in the third category have good reasons to push for extensive regulations because they will bear limited costs and obtain benefits for themselves and their nationals if such regulations are adopted. States in the second category seem unlikely to adopt new norms because they face little internal or external pressure to do so. States in the first category have stronger incentives to adopt international surveillance norms, but also have more at stake than states in the third category. Indeed, it seems likely that Western democracies will form the core group of states to consider these norms. States such as South Korea, Japan, and Israel might also seek to participate in developing these principles. And any state that adopts this set of international norms presumably would only apply those norms to the citizens of other states that have, correspondingly, adopted the norms themselves.
The approach set forth in this chapter attempts to navigate between two shoals: a deeply cynical approach to foreign surveillance—which submits that states will never agree to modify their foreign spying—and an excessively optimistic approach that believes that states soon will be able to arrive at a shared interpretation of robust privacy protections. One might think of this chapter’s approach as an intermediate step that preserves the possibility of a future substantive consensus about the essence of privacy rights, but provides certain nearer-term protections to the many private actors exposed to foreign electronic surveillance. Government programs that seek and obtain broad access to personal data of a large number of foreign citizens should embrace the six procedural constraints detailed herein: doing so would alleviate the sense that states are engaged in unfettered foreign surveillance, while imposing costs that states realistically can bear.
(*) The arguments in this chapter are drawn from Ashley S. Deeks, “An International Legal Framework for Surveillance,” 55 Virginia Journal of International Law 291 (2015).
(1.) By “foreign surveillance,” this chapter means to capture peacetime surveillance by one state of the communications of another state’s officials or citizens who are located outside the surveilling state’s territory, using electronic means such as Internet and cell phone monitoring or satellites. This type of surveillance currently faces the least amount of regulation in international law and in states’ domestic laws.