Governments must accept they have lost the debate over the legitimacy of mass surveillance and reform their oversight of intelligence gathering, Amnesty International and Privacy International said today in a briefing published two years after Edward Snowden blew the lid on US and UK intelligence agencies’ international spying network.

“The balance of power is beginning to shift,” said Edward Snowden in an article published today in newspapers around the world. “With each court victory, with every change in law, we demonstrate facts are more convincing than fear.”

The briefing, Two years after Snowden: Protecting human rights in an age of mass surveillance, warns that governments are looking to maintain and expand mass surveillance, despite the practice being condemned as a human rights violation by courts, parliaments and human rights bodies. It comes on the heels of the adoption of the USA Freedom Act by the US Congress this week, a solitary and limited example of legislative rollback of surveillance powers since Snowden's revelations began.

“Thanks to Edward Snowden, millions of ordinary people are now aware that not even their most intimate secrets are safe from government snooping. National and international expert bodies could not have spoken more clearly: the indiscriminate mass surveillance of communications is a violation of human rights. The game is up and the time has come for governments to reform their indiscriminate mass surveillance programmes,” said Carly Nyst, Legal Director at Privacy International.

"It is disappointing that governments have not accepted that mass surveillance violates human rights. While the passage of the USA Freedom Act shows that it is possible to roll back surveillance, the prospect of more intrusive spying powers in France and the UK shows that governments' appetite for ever more information on our private lives is unsated,” said Sherif Elsayed-Ali, Deputy Director of Global Issues at Amnesty International.

Governments defy public opinion by expanding surveillance

During the past two years, mass surveillance has been condemned as excessive and a violation of human rights by courts, parliamentary enquiries and legal and technology experts appointed by governments and international institutions such as the Council of Europe and the United Nations.

The briefing warns that, in defiance of global condemnation, UK and US spying programmes remain shrouded in secrecy, while several other governments are seeking new surveillance powers of their own.

Denmark, Finland, France, the Netherlands, Pakistan and Switzerland are discussing or set to present new intelligence bills that will increase their ability to spy on communications in these countries and beyond. The French Senate will next week vote on a new bill that would grant the authorities vastly increased surveillance powers.

The briefing also warns that technological advances will make surveillance technology cheaper, more powerful and more widespread. Much of the capability currently available only to US and UK intelligence agencies will likely be available to many more countries in future.

Seven-point plan for protecting human rights in the digital age

Amnesty International and Privacy International today presented a seven-point plan calling on governments to introduce checks and balances on the use of surveillance, including proper judicial control and parliamentary oversight.

The rights groups want communications surveillance to be reeled in within the bounds of international human rights law, which means it only happens when it is:

• Targeted, based on sufficient evidence of wrongdoing, and is authorized by a strictly independent authority, such as a judge,
• Overseen by transparent and independent parliamentary and judicial processes,
• Governed by publicly available and sufficiently detailed rules and policies.

The rights groups are also calling on powerful internet and telecoms companies to do more to protect the internet and phone communications of billions of people from invasive surveillance and criminal attacks. Companies should invest in new and better encryption and other privacy technologies for securing and anonymizing data, and inform users when the law may oblige them to hand their data over to governments.

“Tech companies must do much more to protect their users’ privacy and freedom of expression online. While some big firms like Apple and Google have started adopting stronger encryption standards, others are lagging behind. Tech companies need to introduce end-to-end encryption in their services by default, whenever possible,” said Sherif Elsayed-Ali.

“The legitimacy of collecting communications in bulk is no longer up for debate – it is a violation of human rights and international law. Mass surveillance must be dismantled and replaced by targeted, accountable measures that respect human rights,” said Carly Nyst.

Amnesty International and Privacy International’s seven-point plan for protecting human rights in the digital age

Legal and policy reform:

1. National laws should be reformed to ensure that they comply with international human rights law and standards, including by not allowing for indiscriminate mass surveillance. Key principles that must be upheld include:

a. Ensuring that surveillance of communications only happens when it is targeted, based on sufficient evidence of wrongdoing, and authorised by a strictly independent authority, such as a judge;
b. Ensuring there is transparent and independent parliamentary and judicial oversight of surveillance powers;
c. Making rules and policies about surveillance publicly available, including how governments are sharing information with other states;
d. Ensuring equal privacy protections apply for nationals and non-nationals, those within the territory of the state, and those outside it.
e. Intelligence sharing should be strictly regulated and conducted in a manner compliant with states’ human rights obligations.

2. Governments should not make encryption and anonimization technologies, or their use, illegal

3. Whistleblowers, including those working on national security issues, should be afforded strong legal protection from any form of retaliation, including by way of prosecution, for having disclosed public interest information such as on human rights violations.

Corporate due diligence

In line with companies’ responsibility to respect human rights:
4. Companies that own and/or operate telecommunications or internet infrastructure, including undersea telecommunications cables, and internet companies, must ensure that access to data is permitted only when it conforms to international law and standards on human rights, including by taking legal action to challenge government requests that seek bulk/wholesale access to communications traffic;

5. Major internet and telecommunications companies should lead the way in using strong encryption and other privacy technologies, including through implementing end-to-end encryption by default, where possible;

6. Internet service providers, telecommunications companies and internet companies should clearly inform users about legal requirements that they have to comply with, particularly in relation to handing over user information or content.
International standards

7. Further explore and develop means and measures needed to ensure better implementation of the international human rights standards applicable to communications surveillance, building on efforts towards identifying relevant elements that have started in the past two years, including reports by the UN Special Rapporteur on Freedom of Expression, the UN High Commissioner of Human Rights the Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism, as well as civil society initiatives such as the Necessary and Proportionate Principles.