Striking the Balance

[Ian G Batten]

On Tue, 29 Oct 2002, Watkin Simon wrote:

> I said that I would try to summarise the things you've raised with me about,
> firstly, the general issue around intrusion into privacy to prevent and
> detect crime (the balance between privacy and public safety).

An excellent summation of the issues, I think.  Would there be a purpose
to holding a meeting of interested parties with this as an agenda?

> The Government is committed to ensuring that privacy is respected, so far as

That's a very clear and unambiguous statement.  That's good.

> is practical in meeting the wider public interests of protection from crime
> and public safety,

But that's not.  The implication is that privacy is a narrow concern,
but that crime and public safety are somehow broader.  What disturbs
people about burglary, for example, is not so much the physical damage
but the sense of violation, of intrusion.  That's a privacy concern, and
to argue that we should violate privacy to prevent the violation of
privacy is a stretch.  I think that unfortunately ``the man in the
street'' doesn't see it this way in the abstract, but probably would in
the concrete.  They assume that the violation of privacy won't happen to
them.

> but where there is intrusion into privacy for those
> purposes it must be:
> 
> - lawful

That's circular, or tautological, or redundant, or something.  Whatever
is legal is lawful.  We are concerned with making sure that that what is
lawful is tightly drafted.

> - necessary (justified) and proportionate (minimised)

Yes.

> - authorised appropriately

Yes.

> - exercised accountably

Yes, and there's not the slightest evidence that the proposed framework
provides that in any meaningful way.

> - subject to oversight and review

Ditto.

> There is concern, in some quarters, that public authorities can use new and
> emerging technologies capable of generating and manipulating data, for both
> positive and sinister reasons.  These concerns centre around a perception of
> mass surveillance facilitated by advances in information technology and
> biological science.  Those advances are creating opportunities for public
> authorities tasked with public protection - but those opportunities must
> (and are) taken in a transparent and accountable way.

``but those...'' onwards needs correctly, as I assume there's a ``be''
missing in there somewhere.  To say they must be taken in a transparent
and accountable way is true.  To say they are currently is clearly
untrue.

> (a) that, in the information age, privacy is increasingly becoming a
> more fundamental principle of society;

Or, alternatively, that we should take Scott McNealy's position that
``privacy is over, deal with it''.  The government should make clear
where it stands on this important issue, and should talk privacy and do
invasion.

> (b) that Government and, to varying degrees, law enforcement agencies
> do not command the full trust of the public and cannot be trusted with
> powers to invade privacy (and in particular concern that insufficient
> account is seen to be taken about abuse of those powers);

Street level law enforcement does command the trust of most, but not
all, of the population.  The more senior aspects of the police might
do.  What certainly is not trusted are the spooks, local councils,
health service management and the rest of the apparatchiks the RIPA CoP
would introduce to the piece.

> (c) that surveillance activity is too secretive and there is
> insufficient public accountability, appropriate to a democratic
> society, about the extent to which it is undertaken;

Yes.  If it's not ``those with nothing to hide have nothing to fear''
it's ``there, there, little people, what you don't know won't hurt
you''.

> (d) that surveillance can intrude into the privacy of individuals not
> under investigation (concern that any collateral intrusion can take
> place);

Yes.

> (e) that the targets of surveillance are not automatically notified
> they have been a target of surveillance and may never know (and as
> such mechanisms are needed that would require disclosure of the fact
> that intrusion has taken place, subject to safeguards, for example
> disclosure after a set period of time)

Yes, or at least that the notification should be discussed as a
possibility.

> (f) that the courts are not involved in the authorisation of intrusive
> surveillance activity (and should be involved over and above a certain
> level of intrusion);

Yes, for a low value of ``certain''.

> (g) that certain intrusive surveillance activity can be authorised
> lawfully within the agency conducting the investigation;

Disagree.  All instrusive surveillance should be court authorised.
Reverse lookup may be an exception, but it should clearly be an
exception and not a general rule.

> (h) that intrusion into privacy is, and is seen to be, proportionate
> to the offence (or the matter) under investigation;

Yes.  Clocking of cars doesn't justify it.

> (i) that powers to undertake intrusive activity are open to a wide
> range of public authorities (and access to such powers should be
> graduated according to the degree of intrusion, with more complex and
> intrusive activity requiring a warrant)

They should not be.  Police, under court supervision.  End of
conversation.  Anyone else should get the police to do it for them.  If
that causes jurisdictional conflicts, tough: these bodies exist for our
benefit, not their own.

> (j) that without a trusted, effective and open regime for oversight,
> mass surveillance of the population (through communications data
> retention) will take place unchallenged;

Yes.

> (k) that the collection of data about everyone, on the off chance they
> may become a suspect, is less productive and less intrusive than
> collecting data about suspects;

Less productive and MORE intrusive, surely?  Or is that a revealing
slip?

> (l) that the sanctions or penalties for abuse of privacy invasive techniques
> or abuses of
> power are unclear, insufficient or absent;

Absent.  And that's bad.

> (m) that the circumstances in which lawful intrusion of privacy is
> possible, together with information about what can be done if things
> go wrong, should be clear and open to public scrutiny (and be
> accessible to all sections of the community not just the technically
> literate and privacy literate);

Yes.

> (n) that legislation relating to conduct of intrusive activity should
> be brought together and made HRA compliant (for example at issue is
> public authorities' future use of DPA to seek disclosure of personal
> information);

MAde HRA compliant, but not by changing the HRA.

> (o) that more information about the processes of lawful intrusion and
> the extent to which lawful surveillance is conducted should be in the
> public domain (not least to ensure exposure of abuse or corruption);

Yes.

> (p) that processes exist to ensure those who engage in crime and who
> forfeit their right to be left alone (proportionately?) are counter
> balanced by processes to ensure those who do not engage in crime do
> not forfeit their rights (disproportionately?) and receive redress
> when their rights are violated.

Absolutely.  And I agree with your parenthetical insertions (there's a
chatup line, eh?)

> - Are these the concerns?  Are there others?

I think that covers mine.

> - How far should public authorities be permitted to intrude into a
> person's private life to investigate crime or to protect the public?

Proportionately, but that is different between suspects (using the US
definition of ``probable cause'', perhaps) and bystanders.  If I am
neither a victim nor a suspect, it should not be assumed that my privacy
is automatically transparent for the purpose of investigating crimes
that don't affect me.  We don't, in general, compell testimony from
witnesses who do not wish to make a statement, do we?

> - In what circumstances can intrusion into privacy be necessary and
> proportionate (and conversely, when is intrusion, disproportionate or
> unnecessary)?

Mass data retention is disproportionate.  Telephone tapping of the #1
suspect in a murder case is proportionate.  Between that it's for case
law.

> - The Government wants to make the UK a place where the right of privacy is
> respected and acknowledged whilst ensuring the UK remains a safe country in
> which to live and work, safe from crime and terrorism.  Can those objectives
> ever be mutually exclusive?

Yes, in many cases.  You could reduce crime by tapping every phone, but
it would be be reasonable to do so.  The trick is to find the balance.


ian