Last month, the Supreme Court of the United Kingdom delivered a landmark judgment in R (Privacy International) v Investigatory Powers Tribunal and others (hereinafter Privacy International). The case began as a challenge to the U.K. government’s hacking powers, which were revealed by NSA contractor Edward Snowden. The judgment opens the door for that challenge to proceed, but it also has implications that go far beyond the rather narrow question at its core – whether the British Parliament had used sufficiently clear language to “oust” the Investigatory Powers Tribunal (IPT) from review by the ordinary courts.
The Court’s short answer to that question is: No. The broader effect of the judgment is that the IPT, which hears challenges against the U.K. intelligence services, is now subject to oversight by the courts. That means a court of generalized jurisdiction will be able to deal with legal questions arising from the activities of the intelligence services, preventing the development of “local law” governing only their conduct.
Even more expansively, Privacy International emphasizes the importance of the courts in their role as guardians of the rule of law. In the leading judgment, three of the seven Justices articulate a simplified view of the relationship between the U.K. courts and Parliament, concluding “that it is ultimately for the courts, not the legislature, to determine the limits set by the rule of law to the power to exclude review.”
Privacy International, therefore, sets an important precedent for oversight of questions of law arising from the activities of intelligence agencies – one that might beneficially be replicated in other countries, including the United States, where the Foreign Intelligence Surveillance Court continues to operate with little transparency. It is also a new link in a chain of U.K. public law cases that are solidifying the circumstances in which the U.K. courts can assert their authority. Finally, now that Privacy International’s underlying challenge can proceed, the U.K. courts will be asked to grapple with another significant question, relevant on both sides of the Atlantic: whether general warrants (of the type prohibited by the U.S. Fourth Amendment) can be used to authorize hacking.
The Genesis of the Case
The IPT is a specialist tribunal of limited jurisdiction that hears claims against the U.K. security and intelligence services, as well as challenges to certain types of surveillance practices such as the interception of communications, whether carried out by the intelligence services or another public body.
In 2013, the Snowden disclosures revealed that the U.K. security and intelligence services were using hacking techniques to gain access to devices, including computers and mobile phones, in bulk. Privacy International challenged these bulk hacking practices in the IPT.
During the proceedings, the U.K. government asserted that it could rely on broad “general warrants,” not based on individualized, reasonable suspicion, to conduct hacking. The U.K. government even argued that a single warrant could, in principle, give permission to hack every mobile phone in a U.K. city. In February 2016, the IPT agreed with the U.K. government.
We felt the IPT’s decision involved a serious error of law, so Privacy International sought permission to judicially review the IPT’s decision in the High Court. The High Court is the main court of first instance in England and Wales (Scotland and Northern Ireland having separate systems), with unlimited jurisdiction to address almost any claim that comes before it unless Parliament has expressly ousted that jurisdiction. A judicial review is a challenge to the lawfulness of a decision or action made by a public body, which in our case was the IPT. It is not a direct appeal. At the time we filed the case, there was no route for directly appealing the IPT.
As a preliminary matter, the parties were asked if the High Court had the power to judicially review the IPT. In support of its argument that judicial review was not available, the government pointed to section 67(8) of the Regulation of Investigatory Powers Act 2000 (RIPA), which provides:
Except to such extent as the Secretary of State may by order otherwise provide, determinations, awards, orders and other decisions of the Tribunal (including decisions as to whether they have jurisdiction) shall not be subject to appeal or be liable to be questioned in any court.
We argued in response that, when placed in the context of a long line of cases creating a strong presumption against ouster, the language used in section 67(8) was not sufficient to oust the jurisdiction of the High Court over the IPT.
In a split decision, the High Court ultimately agreed with the government. The Court of Appeal upheld the decision of the High Court. In March 2018, the U.K. Supreme Court granted us permission to appeal.
The Decision
The Supreme Court was asked to tackle two questions:
- Whether section 67(8) of RIPA 2000 “ousts” the supervisory jurisdiction of the High Court to quash a judgment of the IPT for error of law?
- Whether, and, if so, in accordance with what principles, Parliament may by statute “oust” the supervisory jurisdiction of the High Court to quash the decision of an inferior court or tribunal of limited statutory jurisdiction?
As to the first question, the majority of justices concluded that section 67(8) was not sufficient to oust the supervisory jurisdiction of the High Court.
Lord Carnwath, with whom Lady Hale and Lord Kerr agreed, engaged in a thorough review of several hundred years of case law and commentary dealing with ouster clauses. That precedent revealed a strong presumption against ousting the High Court’s powers of review, especially with regard to errors of jurisdiction. The seminal case of Anisminic, and those that later interpreted it, expanded that presumption to include non-jurisdictional errors of law. These cases often avoided the application of ouster clauses that precluded review of “decisions” or “determinations” by reasoning that any decision that was founded on an error of law was in fact not a decision at all, but a “nullity” that was not covered by the ouster clause. Thus, only a very clearly worded ouster clause might be sufficient to protect an error of law from review. Such a clause would need to specify that nullities or “purported determinations” were included within its purview. Lord Carnwath concluded that, because it did not use such language, section 67(8) was not sufficiently clear to oust review of the IPT. Lord Lloyd-Jones concurred in the result on the first question.
Having decided the first question in the negative, the Justices did not need to reach a decision on the second question, yet six of them addressed it anyway.
Lord Carnwath, with whom Lady Hale and Lord Kerr agreed, proposed doing away with “such elusive concepts as jurisdiction (wide or narrow), ultra vires, or nullity” in favor of recognizing that the rule of law makes the courts an essential “counterpart to the power of Parliament to make law.” Parliament makes the law, but the courts interpret it. He therefore concluded that there is a “strong case for holding that, consistently with the rule of law, binding effect cannot be given to a clause which purports wholly to exclude the supervisory jurisdiction of the High Court to review a decision of an inferior court or tribunal, whether for excess or abuse of jurisdiction, or error of law.”
Lords Sumption, Reed and Wilson adopted a narrower interpretation of the requirements of the rule of law. While they agreed that there are some questions that should remain within the purview of the courts, they had different conceptions of what those questions might be. Lord Sumption reasoned that “[i]f Parliament on the true construction of an enactment has created a tribunal of legally limited jurisdiction, then it must have intended that those limits should have effect in law,” and that the courts would apply that law. But he ultimately dodged the second question by stating it was not applicable in the present case, since the alleged error of the IPT was one of law, not jurisdiction.
Lord Wilson appears to have agreed with Lord Carnwath that, if Parliament “chooses to make a law which sets the limits of a jurisdiction,” Parliament cannot then deprive the courts of their duty to interpret and enforce those jurisdictional limits. But Lord Wilson did not agree that the courts can always claim review of errors of law, and felt such review was not necessary in this case.
Implications of the Judgment
Oversight of the U.K. Intelligence Services
The Supreme Court’s judgment has opened up the decisions of the IPT to review in the U.K.’s regular court system. This is a significant boon for oversight of the U.K. intelligence services, as it means legal questions regarding their activities can be addressed in the ordinary courts.
As many of the justices noted in their judgments, the IPT has a number of procedural peculiarities that are designed to protect the secrecy of material that may be presented by the intelligence services. Having litigated several cases before the IPT, I can say these procedures can be quite frustrating at times, especially when the IPT is unable or unwilling to disclose relevant material to the claimant. The IPT, however, has found a way to address – in open – some of the most significant questions of law posed by the intelligence services’ activities. That includes the question at the heart of this case as to whether bulk hacking is lawful.
Once such questions are (correctly) brought into the open, I agree with Lord Carnwath that there seems to be no reason why they could not be heard in the ordinary U.K. courts. Indeed, to take the underlying case as an example again, U.K. courts have been tackling the question of whether general warrants are permissible for several hundred years, including in national security contexts. It is important that such questions not be removed from their jurisdiction now, especially to prevent the development of “local law” governing only the intelligence services. And, as Lord Carnwath noted, “[t]he legal issue decided by the IPT is not only one of general public importance, but also has possible implications for legal rights and remedies going beyond the scope of the IPT’s remit.”
The possibility for this type of open consideration of legal questions regarding the operation of the U.K. intelligence services contrasts with the situation in the United States. There, the Foreign Intelligence Surveillance Court (FISC) is in many ways analogous to the IPT. It is a specialised court that considers legal issues raised by the activities of the U.S. intelligence agencies, among other questions. While the FISC is beginning to be more open and transparent regarding its legal opinions in light of the USA Freedom Act of 2015, it still has a ways to go as many decisions remain classified.
Transparency is also not the same as a mechanism that permits open and fully adversarial consideration of those questions of law. At present, the FISC can hear from designated amicus curiae on novel and significant interpretations of law, but that process is a far cry from allowing a claimant such as Privacy International to raise and fully vet questions of law in open court through written submissions, oral argument, and multiple levels of review.
Separation of Powers?
The Privacy International judgment may be as close as the U.K. has come to defining the role of the courts in relation to Parliament. Six of the seven justices seem to accept that U.K. law requires an independent, impartial and authoritative interpreter.
Lord Carnwath has articulated a simple and compelling vision of the courts as a “counterpart” to Parliament, with the courts, not Parliament, determining “the limits set by the rule of law to the power to exclude review.” Lord Carnwath’s vision suggests that no future ouster clause, no matter how clear, would be fully enforceable.
Lord Wilson does not go as far as Lord Carnwath, however, as he would limit the courts’ authority to enforcing jurisdictional limits where Parliament has created tribunals of limited jurisdiction. Lord Sumption may not even go as far as Lord Wilson, who, as noted above, ultimately dodges the question of whether Parliament, if it was very clear, could remove jurisdictional consideration from the courts. Because of the plurality opinion, the judgment is likely to give rise to years of discussion – and further cases – regarding whether it effectively precludes Parliament from ousting judicial review. It has certainly set a high bar for such an ouster, if it is still available.
Our Challenge to U.K. Bulk Hacking Will Proceed
Privacy International’s underlying substantive challenge to the U.K.’s bulk hacking will now proceed before the High Court. As explained above, the case focuses on the U.K. government’s assertion that it can hack a large number of devices with a single warrant. Such warrants have been termed “thematic warrants” in the U.K. context. We have analogized them to the general warrants that were long ago prohibited under U.K. law and banned in the U.S. under the Fourth Amendment.
A classic general warrant in the U.K. was described by the Lord Chief Justice over 250 years ago in Wilkes v Wood (1763) Lofft 1, 98 ER 489:
The defendants claimed a right, under precedents, to force persons houses, break open escrutores, seize their papers, &c. upon a general warrant, where no inventory is made of the things thus taken away, and where no offenders names are specified in the warrant, and therefore a discretionary power given to messengers to search wherever their suspicions may chance to fall. If such a power is truly invested in a Secretary of State, and he can delegate this power, it certainly may affect the person and property of every man in this kingdom, and is totally subversive of the liberty of the subject.
The U.K. Government’s assertion that one warrant could authorize the hacking of any or all devices within a U.K. city is indistinguishable. Such a warrant would leave the decision as to which and how many devices to hack to the intelligence agencies. This is exactly the type of delegation of authority, with its associated risk of abuse, that the prohibition on general warrants is supposed to prevent.
The harm is only compounded when hacking is permitted under such a warrant, as it can be even more intrusive than a thorough search of a house given how much we now store on our digital devices, and their ability to go with us everywhere. As Chief Justice John Roberts of the U.S. Supreme Court acknowledged in Riley v. California, 134 S.Ct. 2473, 2491 (2014), “a cell phone search would typically expose to the government far more than the most exhaustive search of a house” (emphasis in original).
We at Privacy International look forward to bringing these arguments to the High Court.