Secret Law is Not Law

In the week leading up the first year anniversary of the 13 Necessary and Proportionate Principles, EFF and the coalition behind the 13 Principles will be conducting a Week of Action explaining some of the key guiding principles for surveillance law reform. Every day, we'll take on a different part of the principles, exploring what’s at stake and what we need to do to bring intelligence agencies and the police back under the rule of law. As part of this campaign, we'll be featuring several articles of this year Global Information Society Watch, a ground-breaking report on communication surveillance published by APC and Hivos. You can read the complete set of posts at: https://necessaryandproportionate.org/anniversary. Let's send a message to Member States at the United Nations and wherever else folks are tackling surveillance law reform: surveillance law can no longer ignore our human rights. Follow our discussion on twitter with the hashtag: #privacyisaright

The Secrecy of the Legal Justifications for NSA Surveillance Violates International Human Rights Law

One of the many ways that the NSA’s mass surveillance violates the human rights of both Americans and others around the world is that it teeters on a huge pile of secret law.

Let’s be clear. Under international human rights law, secret “law” doesn’t even qualify as “law” at all.

The Human Rights Committee confirms that law is only law if people know it exists and can act based on that knowledge. Article 19 of the ICCPR, protecting the freedoms of opinion and expression, requires that “to be characterized as a “law,” [a law] must be formulated with sufficient precision to enable an individual to regulate his or her conduct accordingly and it must be made accessible to the public. . . . “1 This same conclusion applies to Article 17, the right to privacy. The European Court of Human Rights similarly notes in the context of surveillance:

[T]he law must be sufficiently clear in its terms to give citizens an adequate indication as to the circumstances in which and the conditions on which public authorities are empowered to resort to this secret and potentially dangerous interference with the right to respect for private life and correspondence.2

This includes not just the law itself, but the judicial and executive interpretations of written laws because both of those are necessary to ensure that people have clear notice of what will trigger surveillance.

This is a basic and old legal requirement: it can be found in all of the founding human rights documents. It allows people the fundamental fairness of understanding when they can expect privacy from the government and when they cannot. It avoids the Kafkaesque situations in which people, like Joseph K in The Trial and the thousands of people on the secret No Fly Lists, cannot figure out what they did that resulted in government scrutiny, much less clear their names. And it ensures that government officials have actual limits to their discretion and that when those limits are crossed, redress is possible.

Just how far has the US strayed from this basic principle in its mass surveillance practices? Very far. The existence of the mass surveillance was kept officially secret from the world for over a decade, from when it started in earnest in 2001 until June of 2013 after the Snowden revelations. The surveillance at first had no judicial authorization whatsoever. Various pieces of it were brought under judicial authority -- email records in 2004, U.S. domestic telephone records in 2006 and backbone and other content collection in 2007 -- but these court decisions also happened entirely in secret, so the public still didn't know. Even today, large amounts of both the caselaw and the Executive Branch’s internal legal guidance have been kept from the public. To the extent we know anything about what the government is doing, this has been based on the piecemeal (and often highly fragmented) release of information as the result of dogged FOIA work and the legal cases brought by EFF plus our friends at the ACLU and EPIC.3

The breadth of the secret law is astonishing. For instance, only after the Snowden revelations did the government first admit its legal theories -- that its mass spying relied on outrageous secret interpretations of section 215 of the PATRIOT ACT and section 702 of the FISA Amendments Act -- neither of which even mentions mass surveillance much less authorizes it. We also now know about the NSA’s domestic telephone records collection and a past program that collected cell location information but we still don’t know the NSA’s full use of section 215. In fact, on September 2 the government sidestepped questions from the Second Circuit about whether its legal arguments in support of its telephone records collection could also support the mass collection of all credit card or bank records of Americans (hint: it could).

Nor are these secret, often extremely weak interpretations of otherwise public laws the only problem. Sometimes there’s no “law” at all. The NSA’s foreign collection processes, which are much more extensive than their domestic collections, are only ostensibly justified by an Executive Order, currently Executive Order12333. While E.O. 12333 is public, it’s not law at all and it certainly does not mention mass surveillance of millions of innocent people around the world. None of the government’s legal interpretations of it are public either. We've now seen evidence that this non-law with secret interpretations is the basis for the NSA's mass surveillance of communications not just in one place, but at nearly every step of their journey: from remote access to computers, to man-in-the-middle attacks on messages in transit, to attacking direct service providers like Google, to tapping into the undersea cables. Yet the legal basis for these unprecedented intrusions into privacy remains opaque.


To bring the U.S. in line with international law, it must stop the process of developing secret law and ensure that all Americans, and indeed all people who may be subject to its surveillance have clear notice of when surveillance might occur. Terrorists and other criminals already well understand that they can be subject to surveillance during an investigation, so the people who are hurt are the innocent. Some operational details can and should remain secret, of course, but the law must be sufficiently clear to allow innocent people to understand when and how they may be subject to surveillance and, as they wish, take steps to regain their privacy. Only then will the U.S. fulfill its obligations under international law.

• 1. See UN Human Rights Committee, General Comment no. 34 on freedoms of opinion and expression (Article 19 ICCPR), available at: http://www2.ohchr.org/english/bodies/hrc/docs/gc34.pdf. The European Court of Human Rights applied the principles developed under Article 10 ECHR (right to freedom of expression) in Sunday Times in the case of Silver and others v. the United Kingdom, nos. 5947/72; 6205/73; 7052/75; 7061/75; 7107/75; 7113/75; 7136/75, 25 March 1983, paras. 85-86, which concerned the right to privacy of prisoners under Article 8 ECHR.
• 2. Malone v. the United Kingdom, no. 8691/79, 2 August 1984, para. 67.
• 3. All too often the Intelligence Community shamefully elides the fact that its public releases were due to pressure from our work and even then only releases what it decides to release, likely skewing what the public learns.