Extraterritorial Application of the European Convention on Human Rights to Online Surveillance

(1)

1 MASTER’S THESIS

Extraterritorial Application of the European Convention on Human Rights

to Online Surveillance

26 June 2015

Thomas Verstege

10091300

Under the supervision of Prof. Y.M. Donders

International and European Law: Public International Law 12 ECTS

(2)

2

INTRODUCTION

Judging from recent revelations by Edward Snowden, online surveillance by governments has become the rule rather than the exception. In an increased effort to prevent threats to national security, states are resorting to drastic measures to ensure the safety of their citizens. The American ‘National Security Agency’ (NSA) and the British ‘Government Communications Headquarters’ (GCHQ) for example, are at the centre of a collective effort by certain states to collect and share as much ‘intelligence’ as possible.1 A shift has taken place in states’ practice: from surveilling targeted individuals based on a concrete suspicion to collecting and analyzing as much data as possible.2 Edward Snowden’s revelations shocked the world because they exposed the scale of the latter practice; which is now often referred to as ‘mass surveillance’.

The methods that state agencies use to conduct this surveillance vary greatly in scope, complexity and duration. A few noteworthy examples are the hacking into ‘fibre-optic cables’ that carry communications from all over the world,3 the hacking of a Dutch SIM manufacturer to gain access to cell phone communications around the world,4 and the attempted hacking of Google’s App store to send malware to people’s smartphones.5

States have been using surveillance techniques for centuries and naturally these techniques evolve as technology develops. The rise of the internet combined with the changing nature of security threats has caused two particularly interesting developments in government surveillance. First, states now collect and analyze vast amounts of personal data without any prior suspicion against the individual. Second, states can just as easily collect and analyze information about foreigners as they can about their nationals; national legislation often makes it even easier for states to

1 _Paul _Farrell, _‘History _of ₅ _Eyes’, _The _Guardian, ₂ _December _2013,

http://www.theguardian.com/world/2013/dec/02/history-of-5-eyes-explainer 2

Kai Biermann, ‘BND stores 220 million telephone data – every day’, Zeit Online, 2 February 2015,

http://www.zeit.de/digital/datenschutz/2015-02/bnd-nsa-mass-surveillance.

‘Everyone is under surveillance now, says whistleblower Edward Snowden’, The Guardian, 3 May 2014,

http://www.theguardian.com/world/2014/may/03/everyone-is-under-surveillance-now-says-whistleblower-edward-snowden.

3

Ewan MacAskill, Julian Borger, Nick Hopkins, Nick Davies & James Ball, ‘GCHQ taps fibre-optic cables for secret access to world’s communications’, The Guardian, 21 June 2013,

http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa. 4

Jeremy Scahill & Josh Begley, ‘The Great Sim Heist: How spies stole the keys to the encryption castle’, First Look: The intercept, 19 February 2015, https://firstlook.org/theintercept/2015/02/19/great-sim-heist/; Dominic Rush, ‘Sim card database hack gave US and UK spies access to billions of cellphones’, The Guardian, 19 February 2015, http://www.theguardian.com/us-news/2015/feb/19/nsa-gchq-sim-card-billions-cellphones-hacking.

5

Juan S. Galt, ‘'Five Eyes' Spy Agencies Planned to Hack Samsung and Google's Mobile Support’, The Coin Telegraph, 25 May 2015, http://cointelegraph.com/news/114371/five-eyes-spy-agencies-planned-to-hack-samsung-and-googles-mobile-support.

(5)

5 collect information about foreigners.6 These two developments have caused a large increase in the potential impact of states’ surveillance activities on individuals.

These activities have the potential to interfere with a number of human rights under the European Convention for Human Rights (ECHR).7 Of course, the ECHR is not the only legal instrument that deals with issues such as the right to privacy, data collection, and online surveillance. Another example is Article 8 of the Charter of Fundamental Rights of the European Union which deals specifically with the ‘protection of personal data’.8

In addition, one can think of the EU’s attempts to reform its current data protection rules.9

However, it is outside the scope of this thesis to assess all these instruments and it is limited to issues of extraterritorial application arising under the ECHR. Extraterritorial application has long been a much debated issue in the jurisprudence of the European Court of Human Rights (hereinafter: the Court). That jurisprudence is relatively far developed and, contrary to the judgments of the Human Rights Committee for example, has the potential to bind the Contracting States. Its judgments will have the most impact on the activities of states. As such, the ECHR is the most interesting legal instrument to assess in relation to online surveillance. Some signalled problems and recommendations will also be relevant to other human rights treaties and other factual scenarios relevant to the rights of the ECHR.

The most relevant right under the ECHR is the right to respect for private and family life enshrined in Article 8:

‘Everyone has the right to respect for his private and family life, his home and his correspondence.’

The concept of private life is a broad term not susceptible to exhaustive definition10 and has been held to extend to ‘telephone, facsimile, and e-mail communications’,11

as well as to

6

Intelligence and Security Committee of Parliament, ‘Privacy and security: a modern and transparent framework’, HC 1075, 12 March 2015, p. 39.

7

Council of Europe, European Convention for the Protection of Human Rights and Fundamental Freedoms, as

amended by Protocols Nos. 11 and 14, 4 November 1950, ETS 5.

8

European Union, Charter of Fundamental Rights of the European Union, 26 October 2012, 2012/C 326/02, art. 8.

9

European Commission – Press release, ‘Commission proposes a comprehensive reform of data protection rules

to increase users’ control of their data and to cut costs for businesses’, 12 January 2015, last update: 12

February 2015, http://europa.eu/rapid/press-release_IP-12-46_en.htm?locale=en. 10

S. and Marper v. United Kingdom, App no 30562/04 and 30566/04, (ECtHR, 4 December 2008) (hereinafter:

S. and Marper), par. 66; Marckx v. Belgium App no 6833/74, (ECtHR, 13 June 1979), par. 31:

‘the object of the Article is "essentially" that of protecting the individual against arbitrary interference by the public authorities’

11

(6)

6 personal data.12 The mere storing of data relating to the private life of an individual amounts to an interference within the meaning of Article 8.13 In addition to Article 8 ECHR, other rights may be affected as well. Examples are the right to freedom of expression including the right to hold opinions and to receive and impart information in Article 10 ECHR and the freedom of peaceful assembly and association in Article 11 ECHR. Mass surveillance, the interception of digital communications, and storage of personal data all have the potential to limit individuals’ actual or perceived freedom in exercising these rights. Not every interference with these rights is automatically in violation of the ECHR. Paragraph 2 of each of these articles specifies in which situations the right may be limited. Such limitations must be prescribed by law, have a legitimate aim, and be necessary in a democratic society.

The first development – the indiscriminate ‘hovering up’14 of all available information – raises the question whether online surveillance activities can be justified under the second paragraph of the relevant articles. Although this is a very interesting question it falls outside the scope of this thesis. Instead, this thesis assesses and critically analyzes the consequences of the second development – the hugely increased surveillance capability of states aimed at foreigners – on the protection of human rights under the ECHR. The ECHR imposes obligations upon its Contracting Parties that are ‘primarily territorial’ but the ECHR can be applied extraterritorially in ‘exceptional circumstances’.15 This thesis investigates which extraterritorial human rights obligations states have under the ECHR in relation to their activities in online surveillance. Subsequently, this thesis will critically assess whether the scope of these obligations properly reflects the aims of the ECHR. In order to do so it will take account of the case law that the Court has developed in interpreting Article 1 ECHR. In addition, it will rely on the writings of various scholars relating to the subject of extraterritorial application.

The first chapter will describe the current state of extraterritorial application of the ECHR. This descriptive assessment will be based on the text of Article 1 ECHR and its interpretation in the case law of the Court. The second chapter applies the findings of the first chapter to a situation of online surveillance and assesses which problems the Court will face in reaching a decision in a case of extraterritorial online surveillance. Consequently, it predicts which

12

S. and Marper, par. 66. 13

Ibid., par. 67. 14

Intelligence and Security Committee of Parliament, ‘Privacy and security: a modern and transparent framework’, HC 1075, 12 March 2015, p. 3.

15

Bankovic and others v. Belgium and others App no 52207/99 (ECtHR, 12 December 2001) (hereinafter:

(7)

7 conclusion the Court might reach in such a case and thus makes predictive statements according to the positive morality of the law of extraterritorial application. The third chapter argues that an alternative approach to jurisdiction is necessary in light of the findings in the second chapter. It presents some alternative approaches that have been proposed in legal literature. Consequently, it assesses which alternative approach to jurisdiction is best suited to overcome the problems identified in the second chapter. It introduces in interpretation suited for a case of online surveillance that reconciles two conflicting but essential principles of the ECHR: universality and effectiveness. Prescriptive statements will be made according to a critical morality.

The term ‘online surveillance’ will be used to refer to a varied spectrum of state activities in surveillance. They include, but are not limited to, the examples mentioned above.16 More relevant examples and possible situations will be addressed in the text. The term ‘right to private life’ will be used instead of the term right to private and family life when referring to Article 8 ECHR.

16

For a concise overview of the most common surveillance methods see section 2.1. See also: UNGA, Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Frank La Rue, A/HRC/23/40, 17 April 2013, p .10-13.

(8)

8

1. GENERAL FRAMEWORK

This chapter introduces the concept of jurisdiction and distinguishes it from the extraterritorial application of the ECHR. Subsequently it assesses the case law of the Court to come to an objective overview of the current doctrine of extraterritorial application of the ECHR.

1.1. INTRODUCTION

Jurisdiction is a threshold criterion and a necessary condition for a state to be held responsible for acts or omissions that interfere with ECHR rights.17 Article 1 of the ECHR states that

‘the High Contracting Parties shall secure to everyone within their jurisdiction the rights and freedoms defined in section 1 of this Convention’.

States only have human rights obligations towards individuals within their jurisdiction. Jurisdiction under human rights treaties refers to a certain relationship between human rights holders and duty bearers;18 although the exact content of this relationship or the criteria for its coming into existence are debated.19 Jurisdiction is presumed to be exercised throughout the state’s territory20 and the Court has consistently held that a state’s jurisdiction is ‘primarily territorial’.21

All individuals within a state’s territory have human rights against that state, regardless of citizenship, nationality, or any other status. In such cases we speak of the ‘territorial application’ of the ECHR. In addition, states can exercise jurisdiction outside of their national borders in ‘exceptional cases’.22

In such cases we speak of the ‘extraterritorial application’ of the ECHR. The Court has developed a doctrine on how the exercise of jurisdiction should be determined in cases of extraterritorial application. The next section will describe which tests the Court has developed in its case law. Its casuistic approach to

17

Ilascu and others v. Moldova and Russia (Merits and just satisfaction) App no 48787/99 (ECtHR, 8 July 2004) (hereinafter: Ilascu), par. 311.

18

Samantha Besson, ‘The extraterritoriality of the European Convention on Human Rights: Why Human Rights Depend on Jurisdiction and What Jurisdiction Amounts to’, LJIL, 25-4, December 2012 (hereinafter: Besson), p. 859;

19

See contrary to Besson: Milanovic, p. 8. 20

Al-Skeini and others v. The United Kingdom (Merits and just satisfaction) App no 55721/07 (ECtHR, 7 July 2011) (hereinafter: Al-Skeini), par. 131.

21

Ibid.; Bankovic, par. 59. 22

(9)

9 extraterritorial application has caused a lot of confusion because the Court refrained from explicating the overarching principle that ties these cases together.23

1.2. CASE LAW ON EXTRATERRITORIAL APPLICATION

1.2.1. Earliest case law

In Loizidou v. Turkey24 the Court had to assess human rights violations that took place right after Turkey occupied Northern Cyprus. The Court ruled that extraterritorial acts fall within a state’s jurisdiction when that state exercises ‘effective (overall) control over an area’ as a consequence of military occupation – whether lawful or unlawful. On this basis it held Turkey responsible for several human rights violations committed by the authorities of Northern Cyprus (the ‘TRNC’) because the Turkish army exercised ‘effective overall control’ over that area – through its subordinate TRNC administration. The Court did not find it necessary to determine whether Turkey exercised detailed control over the actions of TRNC but was satisfied with establishing an ‘overall control’.25

Thus the Court created the first model of extraterritorial application: the spatial model26 which relies on ‘effective (overall) control over an area’.

1.2.2. Bankovic

In Bankovic and others v. Belgium and others the Court assessed whether the bombing of areas in the Federal Republic of Yugoslavia (FRY) by NATO troops fell within the jurisdiction of the NATO member states. In a controversial decision27 the Court came to the conclusion that the bombing did not fall within the states’ jurisdiction. Firstly, the Court determined the ordinary meaning of the words ‘within their jurisdiction’ and came to the conclusion that jurisdiction under Article 1 was to be equated with the general concept of jurisdiction in international law – to enforce, adjudicate, and prescribe rules.28 Secondly, the Court held that the notion of jurisdiction cannot be based solely on whether someone is a

23

Speech by Lord Dyson, Master of the Rolls, ‘The Extraterritorial application of the European Convention on Human Rights: Now on a firmer footing, but is it a sound one?, Essex University, 30 January 2014.

24

Loizidou v. Turkey (Preliminary objections) App no 15318/89 (EctHR, 25 May 1995) (hereinafter Loizidou

PO), par. 62; Confirmed in Loizidou v. Turkey (Merits) App no 15318/89 (EctHR, 18 December 1996)

(hereinafter: Loizidou M), parr. 52, 54, and 56; as well as in Cyprus v. Turkey (Merits) App no 25871/94 (EctHR, 10 May 2001), par 76. 25 Loizidou M, par. 56. 26 Milanovic, p. 127. 27

Erik Roxstrom, Mark Gibney, Terje Einarsen, ‘The NATO bombing case (Bankovic et al. v. Belgium) and the

limits of western human rights protection’ 23 B.U. Int’l L.J. 55 2005.

28

(10)

10 victim of a human rights violation – as was suggested by the applicants – because it would render the function of jurisdiction as threshold criterion superfluous.29 Thirdly, the Court stated that the obligations under the ECHR cannot be ‘divided and tailored’ in accordance with the amount of control exercised by the State.30 This would mean that either all of the rights of the ECHR apply or none of them do. Accordingly, the amount of control that needs to be exercised has to allow a state to ensure all the rights under the ECHR. Lastly, the Court declared that the ECHR is a regional treaty that only operated in the legal space (espace juridique) of the Contracting States. Since the FRY was not part of that space the ECHR did not apply there.31 On these grounds the Court decided that the bombings by NATO states did not fall within those states’ jurisdiction.

1.2.3. Post-Bankovic

In Issa and others v. Turkey the Court expanded the notion of extraterritorial application it had devised in Bankovic. The case concerned the killing of Iraqi sheep herders in the northern part of Iraq; allegedly committed by Turkish soldiers operating in the area. The Court first confirmed the aforementioned holdings regarding the spatial model from the Loizidou judgment and then went on to state that:

‘a State may also be held accountable for violation of the Convention rights and freedoms of persons who are in the territory of another State but who are found to be under the former State's authority and control through its agents operating – whether lawfully or unlawfully - in the latter State.’32

It ambitiously added that this jurisdiction arises from the fact that a state cannot be allowed to commit human rights violations outside its territory that it would not be allowed to commit on its own territory. Through this dictum the Court confirmed the personal model33 of extraterritorial application which relies on ‘control and authority’ over a person instead of an area.34 The Court seemed to move away from the espace juridique requirement it had formulated in Bankovic by holding that Turkey could exercise jurisdiction if it had effective overall control over an area in the north of Iraq, while the latter is clearly not a part of the 29 Bankovic, par. 75. 30 Ibid. 31 Ibid., par. 80. 32

Issa and Others v. Turkey (Merits) App no 31821/96, (ECtHR, 16 November 2014) (hereinafter: Issa), par. 71. 33

Milanovic, p. 173. 34

This ‘personal model’ of extraterritorial application was first developed by the Court’s predecessor the European Commission for Human Rights. See App. Nos 6780/74 and 6950/75, Cyprus v. Turkey (dec.), 26 May 1975, p. 136, par. 8.

(11)

11 espace juridique of the ECHR.35 The Court came to the conclusion that there was insufficient evidence available to rule that Turkey exercised effective overall control over the area in which the interferences took place or that the interferences had been committed by Turkish soldiers.

The case of Pad and others v. Turkey concerned the killing of seven Iranian nationals in the north-western area of Iran. Turkey admitted to having bombed the area from helicopters because it suspected that terrorist suspects were in the area and later also admitted that the victims had been killed by that bombing. Even though the facts of the case were very similar to those of Bankovic – airstrikes on the territory of a foreign country by a party to the ECHR – the Court now came to the conclusion that the victims had been within Turkey’s jurisdiction. It applied the personal model as discussed above and again came to the implied conclusion that the Convention does apply outside the espace juridique of the member states.36

1.2.4. Al-Skeini

The Court attempted to clarify this confusing case law on extraterritorial application in the case of Al-Skeini and others v. United Kingdom. This case concerned the killing of six Iraqi civilians in Basra by British military forces. Five of the Iraqis were shot by British soldiers while they were on patrol. The sixth person was taken captive by the British forces and was so severely beaten during his captivity that he succumbed to his wounds and died.

The Court set out and discussed its previous case law in an attempt to reconcile notions that seemed contradictory. It started by restating that jurisdiction is essentially territorial but that exceptions to that rule have been accepted. It then went on to confirm that a state’s jurisdiction may extend to acts of its authorities which produce effects outside its own territory. It did so under the heading ‘state agent authority and control’. The Court discerned three possible ways through which this exercise of authority and control had been accepted in its case law. First, through the acts of diplomatic and consular staff on foreign territory who exercise authority and control over others.37 Second, when a state

35

Issa, par. 74. 36

Pad and others v. Turkey (Decision) App no 60167/00, (ECtHR, 28 June 2007), par. 53. 37

(12)

12 ‘through the consent, invitation or acquiescence of the Government of that territory, (...) exercises all or some of the public powers normally to be exercised by that Government (...).38

The Court referred to its decision in Bankovic where it had already formulated this ‘public powers requirement’.39

Third, the Court referred to instances in which a state’s agents use force to bring an individual under the control of that state’s authorities. In such cases jurisdiction does not solely arise from exercising control over an area or place but rather from the ‘exercise of physical power and control over that person’.40

The Court thus explicitly confirmed the personal model of jurisdiction it had developed in Issa; contrary to the findings of the UK House of Lords discussed above. The Court then comes to the conclusion that:

‘whenever the State, through its agents, exercises control and authority over an individual, and thus jurisdiction, the State is under an obligation under Article 1 to secure to that individual the rights and freedoms under Section I of the Convention that are relevant to the situation of that individual. In this sense, therefore, the Convention rights can be “divided and tailored” (compare Banković and Others, cited above, § 75)’.41

Interestingly, the last sentence is in contradiction with the Court’s ruling in Bankovic as discussed above. The ECHR rights apparently can be divided and tailored according to the circumstances of the case.

The Court then goes on to confirm the other model of extraterritorial application: the spatial model. It confirms that a state’s jurisdiction can be engaged when that state exercises effective (overall) control over an area outside its national territory. In such cases it is not necessary to establish a detailed control over the policies and actions of possible local subordinate administration; leading to the requirement of ‘effective overall control’. The confirmation of this model of application was hardly surprising, judging from the Court’s previous case law. However, the UK House of Lords had denied the application of the spatial model on the ground of the espace juridique argument.42 The Court addressed this argument and found that

38 Ibid., par. 135. 39 Bankovic, par. 71. 40 Al-Skeini, par. 136. 41 Ibid., par. 137. 42

R (on the application of Al-Skeini and others) v. Secretary of State for Defence [2007] UKHL 26, [2008] AC 153, par. 78.

(13)

13 states can in fact exercise jurisdiction outside the territory of the Contracting States. It stated that no espace juridique restriction existed in the Court’s case law.43

Interestingly, when applying this doctrine to the facts of the case the Court did not use the personal or spatial model in the way one might expect; e.g. by ruling that the victims came within the UK’s jurisdiction because they were shot by UK troops. Instead, it established that the UK became an official occupying power under The Hague Conventions and that it thus assumed the exercise of some of the public powers normally to be exercised by a sovereign government. Therefore it exercised control and authority over the individuals when they were killed.44

1.2.5. Post-Al-Skeini

The Court took the opportunity of Al-Skeini to ‘summarize’ its rulings on Article 1 jurisdiction and it moved away from some of its earlier rulings, although not explicitly. On multiple occasions afterwards the Court cited paragraphs 130-142 of its Al-Skeini judgment in full, without adding to it; thus indicating that the doctrine is meant to apply as a general yardstick along which all extraterritorial actions of states could be measured. In Hassan v. UK for example the Court had to assess whether an Iraqi national who had been captured by British forces in Iraq and was later found dead under suspicious circumstances came within the jurisdiction of the UK. The Court applied the personal model to the case and found that the UK had exercised jurisdiction because the victim was within their physical power and control.45 In Jaloud v. The Netherlands the victim was killed at a security checkpoint in Iraq by Dutch forces. The Court again repeated its findings in Al-Skeini and came to the conclusion that the Netherlands exercised jurisdiction without clarifying whether this was on the basis of the personal or the spatial model.46

1.3. CONCLUSION

Jurisdiction should be distinguished from the territorial and extraterritorial application of the ECHR in the sense that jurisdiction is the broader term that encapsulates both types of application of the ECHR. These two types of application result in a different way of determining whether the state exercised jurisdiction. Territorial application is assumed and 43 Al-Skeini, par. 142. 44 Ibid., par. 149. 45

Hassan v. The United Kingdom (Merits) App no 29750/09, (ECtHR, 16 September 2014), par. 74-76. 46

(14)

14 does not pose any relevant problems. Extraterritorial application on the other hand can occur in two situations: when a state exercises ‘effective (overall) control over an area’ and when a state exercises ‘control and authority’ over an individual. These situations are respectively referred to as the spatial model and the personal model. Furthermore the Court’s case law shows that the ECHR is capable of applying outside the espace juridique of the contracting states, that its rights can be ‘divided and tailored’, and that jurisdiction cannot be assumed on the basis of an interference alone.

(15)

15

2. EXTRATERRITORIAL APPLICATION TO ONLINE

SURVEILLANCE

This chapter sets out how the Court would most likely decide a case of online surveillance based on its previous case law. Paragraph 2.1 will first set out how online surveillance is physically conducted by states. This factual description will show that two characteristics of online surveillance cases pose problems when determining jurisdiction. The first characteristic is the fact that the interference with an individual’s right to private life can take place from within the state’s territory while the victim is abroad. The consequences of this characteristic for the application of the ECHR will be discussed in paragraph 2.2. The second characteristic is that states do not have to exercise physical control over a victim or its property in order to interfere with his or her right to private life. This might be problematic because the current doctrine of extraterritorial application has been solely applied in the context of the exercise of physical control. The consequences of this second characteristic for the application of the personal model will be discussed in paragraph 2.3.

2.1. MODALITIES OF ONLINE SURVEILLACNE

The ingenuity and vast resources of states mean that they have a number of ways to conduct online surveillance. This section will only give a broad overview of the most important aspects of states’ activities in this regard.47 Recently, the UK’s ‘Intelligence and Security Committee of Parliament’ published a detailed report on the online surveillance activities of multiple UK agencies. 48 The below description is based on that report because it provides a uniquely detailed overview of the UK’s surveillance capabilities (even though parts of the report are redacted). Other reports show that surveillance activities in other countries are conducted in a similar fashion, although the details may differ of course.49

Online surveillance activities fall into two categories: targeted surveillance and mass surveillance.50 The former is targeted at specific individuals who are suspected of posing a

47

For a more extensive overview I refer to other available sources: UNGA, Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Frank La Rue, A/HRC/23/40, 17 April 2013, p .10-13.

48

Intelligence and Security Committee of Parliament, ‘Privacy and Security: A modern and transparent legal

framework’, HC 1075, 12 March 2015.

49

UNGA, Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Frank La Rue, A/HRC/23/40, 17 April 2013, p .10-13.

50

(16)

16 threat to the security. It aims at intercepting the communications of an individual consisting of both the content of the communications and the ‘data’51 of the communications. This type of surveillance has existed for a long time and used to consist of the tapping of a landline for example. Nowadays it also includes the interception of internet traffic that goes through an individual’s broadband connection or the collection of communications through internet services such as Gmail or WhatsApp.52 In the UK the most common way to access these communications is through a warrant forcing the provider of the communications service (e.g. Google, Facebook, internetproviders, etc.) to intercept the communications and to provide them to the government agencies.53 Mass surveillance, contrary to targeted surveillance, does not rely on the prior suspicion of an individual but instead aims to generate leads on potential threats to national security.54 These leads are increasingly generated from the bulk interception of online communications. Under UK law such bulk interception may only take place with regards to ‘external communications’; which are defined as communications either sent or received outside the UK.55 The vast majority of communications that is sent over the internet is carried by high capacity fibre optic cables. GCHQ, for example, has access to a number of the ‘bearers’ (sort of like tv-channels; all these bearers together represent the entire internet’s communication) that are contained in these cables. They gain this access by attaching ‘intercept probes’ to transatlantic fibre-optic cables where they land ashore in Britain; potentially with the help from commercial companies.56 The exact number of ‘bearers’ (and therefore the percentage of internet communications) that the GCHQ has access to remains classified but the amount of communications the GCHQ can potentially intercept is huge.57 All the communications that flow through these bearers are compared with certain ‘selectors’; specific identifiers relating to a target.58

All the communications and data that match these selectors are automatically collected whereas the rest are automatically discarded.

51

Often referred to as metadata, this is data that describes other data. For example, when a person called with another, how long the call took, and where the call was made from. It does not, however, extend to the content of the telephone call. Collecting a sufficient amount of metadata can result in a very accurate description of that individual’s activities. Collection of metadata is an important part of most state’s surveillance programs. See: Intelligence and Security Committee of Parliament, ‘Privacy and Security: A modern and transparent legal

framework’, HC 1075, 12 March 2015, p. 3, par. vii

52 Ibid. par. 28. 53 Ibid. par. 29. 54 Ibid. par. 51. 55

Ibid. p. 25. See also: par. 91. 56

Ewan MacAskill, Julian Borger, Nick Hopkins, Nick Davies & James Ball, ‘GCHQ taps fibre-optic cables for secret access to world’s communications’, The Guardian, 21 June 2013,

http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa

57 Ibid. 58

(17)

17 These collected communications are still too vast to be analyzed individually by agents and still contain a lot of irrelevant communications. So another automated selection of the communications takes place to determine which will be examined by an agent.59 The communications that have been selected after this final round will be read and analyzed by an agent. The other collected communications are stored for an unknown amount of days before being discarded.

2.2. GEOGRAPHICAL SEPARATION BETWEEN VICTIM AND SOURCE OF

THE INTERFERENCE

From the previous assessment of state’s online surveillance activities one particularly interesting thing becomes clear: mass surveillance is mostly conducted from within the territory of the state but potentially interferes with the privacy of individuals in every other country in the world. A first question that needs to be answered is: how does the ECHR apply in this situation? Does the ECHR apply ‘territorially’ solely because the infringing activity takes place from within the state’s territory? If that is the case then jurisdiction can be assumed because ‘jurisdiction is presumed to be exercised throughout a state’s territory’.60 Or does the ECHR apply ‘extraterritorially’ because the victim is located abroad? If this is the case then the Court has to resort to the personal or spatial model in order to determine whether the state was exercising jurisdiction. The case law of the Court does not make unambiguously clear how the ECHR should apply in this situation of online surveillance; territorially or extraterritorially.

2.2.1. Relational nature of jurisdiction

Milanovic argues that extraterritorial application of the ECHR – or any other human rights treaty – simply means that the victim of the interference is abroad:

‘Extraterritorial application simply means that at the moment of the alleged violation of his or her human rights the individual concerned is not physically located in the territory of the state party in question, a geographical area over which the state has sovereignty or title. Extraterritorial application of a human rights treaty is an issue that will most frequently arise from an extraterritorial state act, i.e. conduct attributable to the state, either of commission or of

59

Ibid. par. 74-75. 60

(18)

18 omission, performed outside its sovereign borders—for example, the killing of

a suspected terrorist in Pakistan by a US drone. However—and this is a crucial point—extraterritorial application does not require an extraterritorial state act, but solely that the individual concerned is located outside the state’s territory, while the injury to his rights may as well take place inside it.’61

This statement indicates that the most standard situation of mass surveillance aimed at a foreigner would require extraterritorial application of the ECHR. Interestingly, Milanovic does not cite any sources for this statement but merely relies on the fact that the text of Article 1 ECHR refers to ‘everyone within their jurisdiction’ and therefore requires the individual, rather than the state agent, to be within the state’s jurisdiction.62 This seems to make sense in light of the relational nature of jurisdiction: it reflects a certain relationship between the state and the victim.63 This relationship can be assumed to exist with regards to everyone within a state’s territory because the state is free to act within its territory and is thus able to exercise control over individuals within its territory. Such a relationship does not automatically exist when the individual is outside the state’s territory; even if the state interferes with that individual’s human rights from within its territory. So the personal or spatial model would have to be applied in order to determine whether the state was exercising jurisdiction. These models in turn are aimed at determining the relationship of the state to the victim and not to the state agent, which is another reflection of the relational nature of jurisdiction.

2.2.2. Extraterritorial act

There is some case law of the Court in relation to similar situations that can be applied to the present case of online surveillance in order to determine how the ECHR should be applied. In Bankovic the Court stated that it ‘has accepted only in exceptional cases that acts of the Contracting States performed, or producing effects, outside their territories can constitute an exercise of jurisdiction’ (emphasis added).64

This addition of ‘producing effects’ seems to indicate that the ECHR can also be applied extraterritorially to acts from within a state’s territory that produce some effect outside that territory. In Ben El Mahi and Others v. Denmark the applicants were Moroccan nationals living in Morocco who complained that the Danish government had violated a number of their ECHR rights by allowing cartoons 61 Milanovic, p. 8. 62 Ibid., p. 8, fn. 26. 63 See section 1.1. 64

Drozd and Janousek v. France and Spain App no 12747/87, (ECtHR, 26 June 1992) (hereinafter: Drozd and

(19)

19 depicting the prophet Mohammed to be published in Denmark. So the alleged violation took place on the state’s territory but the victims were abroad. The Court applied the ECHR extraterritorially and came to the conclusion that there was no jurisdictional link between any of the applicants and Denmark.65 It confirmed that acts performed outside a state’s territory, or which produce effects there, should be considered ‘extraterritorial acts’,66 thereby indicating that such acts warrant the extraterritorial application of the ECHR. The case of Stephens v. Malta concerned the detention by Spanish authorities of a UK national living in Spain on the basis of an arrest warrant issued by Maltese authorities alleging that the man was involved in smuggling drugs into Malta. The warrant turned out to be defective for procedural reasons and the applicant claimed that Malta had violated his Article 5 ECHR right by causing him to be detained by Spanish authorities. Again we are considering an act committed on the state’s territory that is producing effects vis-a-vis an individual located abroad. The Court resorted to extraterritorial application of the ECHR and came to the conclusion that Malta had ECHR obligations vis-a-vis the applicant while he was located in Spain. In the case of Weber and Saravia v. Germany both the applicants were living in Uruguay and they claimed that Germany’s surveillance legislation interfered with their rights under Article 8 ECHR. The facts of the case do not show whether the interference took place in Uruguay or in Germany. Still the German government argued that ‘the monitoring of telecommunications made from abroad, however, had to be qualified as an extraterritorial act’;67 solely on the ground that the applicants were residing in Uruguay. The Court unfortunately avoided the issue of jurisdiction by stating that the application was inadmissible on other grounds.68

So with regards to the example of mass surveillance as outlined in the previous paragraph one could argue that it constitutes an ‘extraterritorial act’ when directed at a foreigner and that it warrants the extraterritorial application of the ECHR because it produces an effect vis-a-vis a victim that is located abroad.

On the other hand, we see a different situation when we look at cases concerning the right to a fair trial or the right to property for example. If the individual is tried in absentia and is

65

Ben El Mahi and others v. Denmark App No 5853/06, (ECtHR, 11 December 2006). Interestingly, in the case of Caroline von Hannover v. Denmark the facts of the case were very similar in the sense that this concerned the publication in Germany of photos of the applicants who were living in Monaco. The applicants alleged that the refusal of the German courts to grant an injunction against further publication of photos was in violation of art. 8 ECHR. In this case however no issue of jurisdiction was addressed by the Court or raised by the parties.

Caroline von Hannover v. Denmark App No 40660/08 60641/08, (ECtHR, 7 February 2012).

66

Ben El Mahi and others v. Denmark App No 5853/06, (ECtHR, 11 December 2006) 67

Weber and Saravia, par. 66. 68

(20)

20 abroad during his trial he will still be awarded his rights under article 6 ECHR without a question of extraterritorial application arising.69 The same goes for interferences with an individual’s property rights under Article 1 of Protocol No. 1 to the ECHR. In such situations one can easily imagine the victim being abroad while, for example, his property is unlawfully seized.70 In Bosphorus Hava Yollari Turizm Ve Ticaret Anonim Sirketi v. Ireland (hereinafter: Boshporus v. Ireland) the applicant was a Turkish company that complained of the confiscation of its aircraft by Irish authorities on Irish soil. The Irish government argued that the actions did not fall within its jurisdiction. The Court held

the act (...) was implemented by the authorities of the respondent State on its territory following a decision made by the Irish Minister for Transport. In such circumstances the applicant company, as the addressee of the impugned act, fell within the “jurisdiction” of the Irish State.71

Furthermore, in Liberty and others v. United Kingdom the Court had to consider an application by, inter alia, two Irish companies who alleged that their telephone communications had been intercepted in London by the UK and that their article 8 ECHR rights had therefore been violated.72 Neither the government nor the applicants addressed the issue of jurisdiction in their submissions. The Court did not address the issue either and accepted the admissibility of the claim.

Arguably these examples – Bosphorus, Liberty, Brozicek, etc. – also concern ‘extraterritorial acts’: they are conducted on the state’s territory but produce effects vis-a-vis a victim who is located abroad. However, in these cases the Court did not apply the ECHR extraterritorially as it did in Ben El Mahi and Stephens.

69

Brozicek v. Italy (Merits and Just Satisfaction) App no 10964/84, (ECtHR, 19 December 1989). In the present case, the applicant was a German national residing in Germany who had been prosecuted by the Italian authorities in Italy. The Court awarded him rights to a fair trial under art. 6 ECHR and extraterritorial application was not even discussed. See also: Sejdovic v. Italy App no 56581/00, (ECtHR, 1 March 2006). The applicant was tried in Italy in absentia while he had fled to Germany. Still no issue was raised whether he should be awarded art. 6 ECHR rights.

70

See Dokic v. Bosnia and Herzegovina (Merits) App no 6518/04, (ECtHR, 27 May 2010). The applicant used to live in Bosnia and Herzegovina and owned an apartment there. Shortly after purchasing the apartment he moved to Serbia. For various reasons he could not establish title on the apartment and claimed that his right to property was violated by the government of Bosnia and Herzegovina. So even though the ‘victim’ was abroad the violation took place within the territory of Bosnia and Herzegovina. Still the Bosnian government did not argue that the applicant would be outside its jurisdiction nor did the Court address the issue.

71

Bosphorus Hava Yollari Turizm Ve Ticaret Anonim Sirketi v. Ireland App no 45036/98, (ECtHR, 30 June 2005), par. 135-137.

72

(21)

21

2.2.3. Extraterritorial application to online surveillance?

The above outlined case law does not give a clear answer to the question whether mass surveillance requires territorial or extraterritorial application of the ECHR. Milanovic argues that cases such as Bosphorus, Sejdovic, or Liberty have been decided inconsistently because the ECHR should have been applied extraterritorially.73 Such an inconsistency could be caused by the fact that it feels so counterintuitive to say that a state can interfere with a human right from within its territory but still argue that these actions do not automatically fall within its jurisdiction through territorial application. The object and purpose of the ECHR and of its jurisdiction clause specifically is often defined as limiting the obligations of contracting states to those situations in which the obligations can realistically be met and the human rights effectively protected.74 In that regard, it would be in line with the ECHR’s object and purpose to assume a state’s jurisdiction over any act that is performed on its territory because that state is perfectly capable of influencing the act and effectively protecting the human rights in question.

On the other hand, a case like Ben El Mahi forcefully illustrates that requiring the victim to be abroad for extraterritorial application prevents an enormous amount of applicants from automatically falling within a state’s jurisdiction. If the Court had automatically accepted Denmark’s jurisdiction on the sole basis that the alleged omission took place on its territory, virtually every Muslim in the world would have been allowed to bring a claim against Denmark. Another example relates to environmental pollution which interferes with Article 8 ECHR or other provisions.75 As a consequence, every individual in the world could bring a claim against a state for its contribution to global warming or its failure to prevent it.76 Such extreme consequences are prevented by requiring the extraterritorial application of the ECHR when the victim is abroad. However, note that the examples of Ben El Mahi and environmental pollution both relate to positive obligations.77 Positive obligations are usually obligations of conduct instead of result and imposes an obligation of due diligence on a

73

Milanovic, p. 202 74

Milanovic, p. 56; Besson, p. 862. See also section 3.2 of this paper for further sources and references. 75

Antonella Galetta & Paul De Hert, ‘Complementing the Surveillance Law Principles of the ECtHR with its

Environmental Law Principles: An Integrated Technology Approach to a Human Rights Framework for Surveillance’, Utrecht Law Review 55 2014, p. 56.

76

There are of course other obstacles that might prevent such a claim from succeeding, such as whether or not a clear cut obligation to that extent actually exists and whether any damage suffered can actually be attributed to that state. For the Court to assess these obstacles though it would first need to establish jurisdiction under Article 1 ECHR.

77

(22)

22 state.78 So assumption of jurisdiction in such cases does not necessarily impose an undue burden on the state. Furthermore, Article 34 ECHR poses an additional barrier to an excess amount of claims being brought against a state because it requires the potential applicant to be a ‘victim’79

in order to be allowed to bring a claim. In cases like Ben El Mahi or of environmental pollution the applicants would still need to show that they were victims under Article 34 ECHR.

If one were to assume jurisdiction when the interference takes place from within the territory of the state, this would require the Court to be able to accurately determine the location of the interference. This poses some specific problems with regards to online surveillance because the ‘location’ of a human rights interference on the internet will be hard, if not impossible, to determine. A defining characteristic of the internet is that it transcends territorial boundaries and that it gives its users the possibility to access and send information all over the world. The location of the victim will still be easily determinable but the location of the interference will prove more elusive as it might concern a digital ‘place’. Furthermore, the location of the interference can fall apart in another two locations: the location where the state agent commits the interfering act and the location where the interference takes place (where an e-mail is intercepted or a server is broken into for example). The latter location will often be virtual and thereby nearly impossible to define geographically. One possible solution to this problem might be to create a legal fiction. For example, the Court could deem the location where a physical act is committed – like the breaking into the fibre-optic cable – or where the perpetrator of the act is located as the determining factor for the establishment of jurisdiction. The above assessment has shown that it is hard to accurately predict how the Court will apply the ECHR in a case of online surveillance based on its previous case law and the text of Article 1 because they can justify both types of application in relation to online surveillance. A very strict interpretation of the nature and meaning of jurisdiction might require the Court to apply the ECHR extraterritorially whenever the victim is abroad and it has actually applied the ECHR in that way in Stephens v. Malta. On the other hand, there are many more cases in which the victim was abroad but the issue of jurisdiction was not raised by the Court or the

78

De Schutter, p. 285. 79

Vallianatos and others v. Greece App no 29381/09, (ECtHR, 7 November 2013), par. 47:

‘The word “victim”, in the context of Article 34 of the Convention, denotes the person or persons directly or indirectly affected by the alleged violation (see SARL du Parc d’Activités de Blotzheim v.

France, no. 72377/01, § 20, 11 July 2006). Hence, Article 34 concerns not just the direct victim or victims of the alleged violation, but also any indirect victims to whom the violation would cause harm or who would have a valid and personal interest in seeing it brought to an end.’

(23)

23 parties and jurisdiction was simply assumed. Furthermore, the Court can take into account the object and purpose of the ECHR when interpreting the provisions of the convention.80 It might be inconsistent with the ECHR’s object and purpose if the Court would apply it extraterritorially whenever the victim of the interference is abroad.81 Therefore, the Court might rely on this interpretive tool to justify the assumption of jurisdiction over all acts within a state’s territory.

I assert that it is highly unlikely that the Court will apply the ECHR extraterritorially each time the victim is abroad. A consistent application of such a ‘rule’ would lead to extremely counterintuitive results and would limit the scope of the ECHR significantly. On the other hand, it seems equally unlikely that the Court will assume jurisdiction over all acts that originate from within a state’s territory, as the case of Ben El Mahi illustrates. Although the Court also has alternative means at its disposal to prevent imposing a disproportionate burden upon states in such cases, like the victim requirement and the due diligence obligation. Most likely, the Court will try to find a middle ground by assessing these situations on a case-by-case basis. In the case-by-case of Stephens v. Malta for example the Court did not automatically assume Malta’s jurisdiction but it also did not limit itself to a very strict application of the spatial or personal model. If it had very strictly applied the personal or spatial model it might have had to come to the conclusion that the applicant was not under the control of the Maltese authorities.

I do not, however, think that proceeding on such a case-by-case basis would be the best way for the Court to address this issue as it would create uncertainty for states and individuals. Therefore, chapter 3 will assess some alternative approaches to this problem.

2.2.4. Consequences for the application of the spatial model

When the Court determines that a case requires the extraterritorial application of the ECHR this merely means that it will not automatically assume the jurisdiction of the state. It will instead resort to the spatial or the personal model in order to determine whether the state exercised jurisdiction. The Court has now unambiguously accepted the spatial model of extraterritorial application as ‘effective (overall) control over a territory’.82 Assumption of

80 VCLT, art. 31, 32. 81 See section 3.2. 82 Al-Skeini, par. 138.

(24)

24 jurisdiction through the spatial model creates an obligation for states to secure the rights and freedoms set out in the Convention ‘in such an area’.83

The aforementioned geographical separation between interference and victim also poses problems to the use of the spatial model of extraterritorial application. So far the Court has applied the spatial model in cases – such as Loizidou – where both the state agent committing the interference and the victim of the interference are located in the territory under the state’s effective control. In such situations the application of the spatial model is undisputed and depends solely on the factual determination of the ‘effective control’ over the area in question. However, the factual situation can become more complicated when applying the spatial model to online surveillance. In addition to the above outlined modalities of online surveillance states are also using their embassies in foreign countries to spy on specific targets, among who are heads of state of foreign countries.84 The infringing activity then takes place in the embassy – which is most likely an area under the ‘effective control’ of the infringing state85 – but the victim is not located in that area. Another example is the recent revelation that a large part of US drone operations are being conducted from within the US Air Force base at Ramstein in Germany.86 In this scenario the US is using a foreign area under its effective control – the air force base – to conduct global operations that potentially interfere with the human rights of foreigners around the world.87 These two examples pose the question whether jurisdiction is exercised on the basis of the spatial model when the state is acting from a foreign area under its effective control while the victim is not in that area.

The question is similar to the one addressed in sections 2.2.1-2.2.3 and the arguments in favour or against successful application of the spatial model in such situations will be largely similar as well. One could point to the fact that jurisdiction is essentially a reflection of a relationship between the state and the victim and therefore by its nature focused on the victim. On the other hand, it feels counterintuitive that such situations would fall outside of the scope

83 Ibid. 84

Laura Poitras, Marcel Rosenbach & Holger Stark, ‘Codename Apalache: How America Spies on Europe and

the UN’, Spiegel Online International, 26 August 2013, http://www.spiegel.de/international/world/secret-nsa-documents-show-how-the-us-spies-on-europe-and-the-un-a-918625-2.html

85

To my knowledge the Court has not explicitly accepted every embassy as being an area under the effective control of the state. Most of its case law has used the fact that the acts were committed by embassy personnel as decisive for the determination of jurisdiction. An embassy does however seem to be fit to be an area under the state’s effective control.

86

‘A war waged from German soil: US Ramstein base key in drone attacks’, Spiegel Online International, 22 April 2015, http://www.spiegel.de/international/germany/ramstein-base-in-germany-a-key-center-in-us-drone-war-a-1029279.html

87

(25)

25 of the spatial model of jurisdiction. In any case, the case law of the Court does not give a clear indication on how it would apply the spatial model in such a situation.88

However, if the spatial model is deemed not to apply one could always alternatively resort to the personal model of extraterritorial application.89

2.2.5. Consequences for extraterritorial positive obligations

Online surveillance as defined in section 2.1 refers solely to the activities of government agencies themselves. However, it is undisputed that certain positive obligations are also part of states’ duties under the ECHR.90

Can these obligations apply extraterritorially as well and what are the consequences of the geographical separation for these obligations?

Many major technology companies, like Google, Facebook, and Twitter, have a business model that is in part based on the profits it makes from selling its users’ data to third parties, like advertisers. Facebook, for example, has been sued under American law for violating its users’ privacy by ‘mining’ the data that those users send in private messages.91 Another example are the so called ‘data brokers’. These companies collect a staggering amount of information about unknowing individuals and sell it for a profit.92

Clearly, Facebook or these data brokers are not bound by the ECHR and do not have human rights obligations under it. However, states have an obligation to protect the human rights of ‘everyone within their jurisdiction’ from being interfered with by third party actions. This is often an obligation of conduct so states will not have to succeed in preventing all interferences with the right to a private life but they will at least have to take the measures they reasonably can to prevent third party interferences from happening. These are obligations of conduct instead of obligations of result; states have an obligation to exercise due diligence. This can result in an obligation for states to adopt measures93 aimed at preventing such acts by private actors, or an obligation to provide reparation and identify and punish perpetrators in case of a

88

Milanovic (again) argues that in such circumstances the location of the victim is decisive for the application of the spatial model and that therefore these examples would fall outside of the scope of the spatial model. See: Marko Milanovic, ‘Human Rights Treaties and Foreign Surveillance: Privacy in the Digital Age’, Harvard International Law Journal, 31 March 2014, forthcoming, p. 54-55.

89

See section 2.3. 90

Jean Francois Akandji-Kombe, ‘Positive obligations under the European Convention on Human Rights’, Human Rights handbooks, no. 7, Council of Europe, 2007.

91

Jennifer van Grove, ‘Facebook sued for allegedly intercepting private messages’, CNET, 2 January 2014,

http://www.cnet.com/news/facebook-sued-for-allegedly-intercepting-private-messages/ 92

Federal Trade Commission, ‘Data Brokers: A Call for Transparency and Accountability’, May 2014. 93

(26)

26 violation by private actors.94 Furthermore, the fact that Article 8 ECHR refers to ‘respect for private and family life’ has been held by the Court to mean that a state has certain inherent positive obligations in protecting that right.95 The notion of ‘respect’ is not clear-cut and its positive requirements will vary considerably from case to case.96

An analogy can be drawn with violations of Article 2 ECHR. That article contains certain positive obligations for the state as well; in particular an obligation to protect individuals whose lives are at risk97 and an obligation to investigate violations of the right to life.98 Especially the latter obligation to investigate has often been applied extraterritorially by the Court. In a number of the aforementioned cases concerning extraterritorial application of the ECHR, the complaint concerned a violation of the obligation to investigate under Article 2.99 Imagine Facebook operating from within the territory of the UK and interfering with the privacy of an individual in the Netherlands. This individual might lodge a complaint against the Dutch government that it has not done enough to prevent this interference from

happening. The Dutch government, however, will not be in a great position to regulate that particular conduct of Facebook; after all, Facebook is operating solely from within the UK in this instance. Therefore, the Dutch government’s obligation of conduct will easily be fulfilled without any significant result for the claimant. The UK government is in a much better

position to regulate Facebook’s conduct through legislation so the claimant might also lodge a claim against the UK government. However, as explained above, the UK government might argue that this situation requires the extraterritorial application of the ECHR because the victim is outside the territory of the UK. If such an argument is accepted by the Court, the claimant would most likely not fall within the UK’s jurisdiction because the UK does not exercise control over Dutch territory nor does it exercise control and authority over the

claimant. So the claimant will effectively be devoid of any protection under the ECHR against the actions of private actors operating from other states.

94

Olivier de Schutter, ‘Globalization and Jurisdiction: Lessons from the European Convention on Human

Rights’, Baltic Yearbook of International Law, Vol. 6 2006, p. 218-219.

95

Marckx v. Belgium App no 6833/74, (ECtHR, 13 June 1979), par. 31. 96

Sheffield and Horsham v. The United Kingdom App no 22985/93, (ECtHR, 30 July 1998), par. 52:

‘The Court reiterates that the notion of “respect” is not clear-cut, especially as far as the positive obligations inherent in that concept are concerned: having regard to the diversity of the practices followed and the situations obtaining in the Contracting States, the notion’s requirements will vary considerably from case to case. In determining whether or not a positive obligation exists, regard must be had to the fair balance that has to be struck between the general interest of the community and the interests of the individual, the search for which balance is inherent in the whole of the Convention’ 97

Mastromatteo v. Italy App no 37703/97, (ECtHR, 24 October 2002), par. 68. 98

Ibid., par. 89. 99

(27)

27

2.3. THE PERSONAL MODEL AND PHYSICAL CONTROL

The aforementioned second development arising out of online surveillance entails that states now have the possibility to interfere with individuals’ right to a private life without exercising physical control over the individual. This section investigates what the consequences of this development are on the application of the personal model. The personal model of jurisdiction entails that a state’s jurisdiction is engaged when it exercises ‘control and authority’ over an individual. The wording and amount of repetition by the Court of its Al-Skeini judgment indicate that it is meant to become a general criterion to be used as a yardstick in all cases of extraterritorial application.

Before applying this model to online surveillance a preliminary remark is in order: an individual cannot fall within a state’s jurisdiction simply because his rights are adversely affected by an act of that state.100 So the mere fact that an individual claims that his e-mail was read or intercepted does not bring that individual within the state’s jurisdiction. The individual has to establish that the state exercised control and authority over him which is a different – and arguably higher – threshold than interference.

2.3.1. Control and authority

My assertion is that at least certain forms of online surveillance can constitute an exercise of control and authority over an individual; even though online surveillance does not fall within the three examples listed by the Court in Al-Skeini. A close reading of that judgment shows that the Court merely listed and categorized the previous instances in which it accepted jurisdiction on the basis of the personal model. Consequently, it deduced the general principle of ‘control and authority’ from these three examples.101

Limiting the scope of the personal model to physical control – the context in which it has been developed – would exclude every form of online surveillance in advance. This would be contradictory to the Court’s finding that the question whether ‘the State was exercising jurisdiction extraterritorially must be determined with reference to the particular facts’.102 Such a limitation might even create a perverse incentive for states not to detain an individual but to just kill him straight away, since

100 Bankovic, par. 75. 101 Contrary: Besson, p.872 102 Al-Skeini, par. 132.

Extraterritorial Application of the European Convention on Human Rights to Online Surveillance