Data Protection Bill

Written evidence submitted by Reprieve (DPB27)

I. ABOUT REPRIEVE

Reprieve is a legal action charity which seeks to uphold the rule of law and the rights of individuals around the world. Over the past 20 years Reprieve has provided legal and investigative support to hundreds of prisoners on death row; the families of innocents killed in lethal drone strikes; victims of torture and extraordinary rendition; and scores of prisoners in Guantanamo Bay.

II. EXECUTIVE SUMMARY

· The current version of the Data Protection Bill contains no safeguards on data-sharing by UK intelligence agencies. In the context of the UK’s involvement in US drone strikes, the lack of safeguards is dangerous. It risks innocent people being targeted on the basis of data wrongly shared with the Trump administration, and potential criminal liability for UK personnel for unlawful killing overseas.

· The UK has played an active role in supporting the US drone programme. British personnel have helped create lists of potential targets in Yemen. [1] British intelligence officers in RAF bases in the UK work with their US counterparts to "task targets" in support of drone strikes. [2] They do so while acting under a cloud of legal uncertainty.

· Courts and Parliament have warned that this uncertainty places UK personnel at risk. In 2013, the Court of Appeal held that "it is certainly not clear" UK personnel would be immune from criminal liability for their involvement in the programme. [3] In 2016, the Joint Committee on Human Rights echoed that finding and found that "front-line personnel […] should be entitled to more legal certainty." [4] This gap is even more dangerous under the Trump Administration, which has rolled back safeguards on the targeting of drone strikes and radically increased the US use of lethal force outside of armed conflict. [5]

· The Data Protection Bill presents an opportunity to implement legal safeguards to protect civilians from harm and UK personnel from criminal prosecution. Clause 109 governs the transfer of data from UK agencies to foreign counterparts. It currently offers no protections against abusive use of the data provided to foreign intelligence services. The lack of real safeguards on data sharing in Part 4 of the Bill leaves a significant gap in protection.

· Reprieve urges Members of Parliament to plug this gap and place meaningful safeguards on the sharing of data by the intelligence agencies. Reprieve supports Amendments 159 and 160, and New Clause 14, which would fix the Bill by taking the protections on data-sharing by law enforcement agencies set out in Part 3 of the Bill and applying them as the baseline standard for intelligence agencies.

III. HOW CAN DATA BE LETHAL?

1. The US’s drone programme is powered by data. As former CIA Director General Michael Hayden admitted in 2014, "[w]e kill people based on metadata." [6] The US and UK use bulk surveillance techniques, intercepting, collecting and processing billions of mobile phone signals, calls and texts, and social media impressions. For the UK, this includes the targeted, thematic and bulk surveillance of communications and personal datasets under the Investigatory Powers Act 2016. Algorithms determine whether an individual fits into a particular profile. In turn this profile may determine whether or not an individual is targeted for killing by the US Government.

2. Reprieve has documented this programme over several years. A Reprieve investigation found that in Yemen and Pakistan, US drone strikes killed as many as 1,147 unknown people, including children, in failed attempts to kill 41 named individuals. [7] These 41 men were reported to have been killed multiple times – sometimes as many as seven – leaving a trail of innocents, mistaken for the target, killed in their wake.

3. Such strikes are often imprecise because the data behind them can be highly misleading. In one case Reprieve uncovered in Pakistan, these strikes led to the killing of someone simply with the same name as the individual sought by the US Government. [8]

4. In another case, Reprieve client and acclaimed Al Jazeera journalist Ahmad Zaidan – producer of the widely-praised documentary "In search of Al-Qaeda", and who first interviewed Osama Bin Laden – is challenging the US Government in Court to stop them from killing him as a result of his data. [9] Mr Zaidan is a journalist who frequently reports on the activities of armed groups-even those proscribed by the US and the UK. As part of his work, he regularly communicates-via telephone and otherwise-with members of such groups.

5. According to US Government documents, NSA algorithms wrongly labelled him an Al Qaeda courier in Pakistan on the basis of these communications. [10] This places him at risk of being targeted by a drone strike. It is deeply concerning that the algorithmic programmes used by the US Government are not sophisticated enough to realise Ahmad is a journalist, not a target.

IV. UK INVOLVEMENT IN THE US DRONE PROGRAMME

6. UK agencies routinely share intelligence material with their US counterparts. While this relationship remains opaque, reports, investigations and FOIA disclosures suggest that the UK provides critical support to the US’s use of lethal force outside armed conflict.

7. GCHQ reportedly helps locate targets for US drone strikes and several UK military bases housing UK and US personnel conduct joint work on these operations. [11] British personnel are also assisting on the ground in countries such as Yemen, providing vital "human intelligence" to help the US target deadly strikes. [12] UK involvement directly enables lethal drone strikes against individuals through the sharing of data – often with tragic consequences.

8. For example, several military bases in the UK form a crucial link within the US’s drone programme. In 2016, an investigation by The Intercept showed that RAF Menwith Hill, in Yorkshire, plays a critical role in targeting individuals in Yemen. There are over 600 British personnel working at the base, and the UK Government has said that operations at the base "have always been, and continue to be carried out with the UK’s "knowledge and consent". There, GCHQ personnel use mass surveillance techniques to collect data on individuals and "task targets" to US programmes. [13]

9. In September 2017, The Intercept profiled another UK base, RAF Digby, involved in the drone programme. [14] Located in Lincolnshire, it allows the UK to conduct extensive surveillance and locate targets in a number of countries where the US conducts drone strikes, including Libya and Syria. [15]

10. Directly handling individuals’ data and passing it to the US Government for potential targeting, UK intelligence services form a critical part of the drone programme’s ‘Kill Chain’. Despite this, there is nothing to suggest that these transfers of data are subject to legal safeguards to prevent the transfer of wrong data on individuals who have nothing to do with US targets.

V. EXPANDING THE DRONE PROGRAMME AND DISMANTLING SAFEGUARDS

 

11. After taking office in January 2017, P resident Trump has escalated the drone programme and weakened previous safeguards on the use of drones. Limits on intelligence sharing are needed now more than ever.

12. Since January 2017, Yemen has seen a 288 % increase in drone strikes as compared with the number of strikes taken by former President Obama in 2016. [1] Strikes in Somalia in 2017 equalled the number of strikes taken in the previous fifteen years combined. [2] President Trump has threatened to resume strikes in Pakistan. [3] T he US also reportedly intends to begin drone strikes imminently in Niger . [4]

13. The radical expansion of the drone programme under President Trump has been accompanied by a systematic weaken ing of safeguards . [5] President Trump has reauthorised the CIA to carry out drone strikes. [6] He has removed Obama-era safeguards aimed at protecting civilians and the requirement that targets pose a "continuing and immi n ent threat" . He has drastically lowered the level of seniority required to authorise strikes. [7]

14. By diluting or scrapping Obama-era limits on the US ’s use of lethal force, President Trump has dramatically increased the risk that strikes violate international law . In turn, this increases the risk the UK will be complicit in abuses and illegality as a result of data shared with US agencies .

VI. THE DANGERS OF DATA-SHARING WITH THE TRUMP ADMINISTRATION

 

15. T here is no clarity around what safeguards – if any – are in place to protect the UK Government from complicity in violations of international law. Ambiguity around the Government’s policy in this area could put UK service personnel at risk of complicity in violations of international and criminal law.

16. In its 2016 report on targeted killing, Parliament’s Joint Committee on Human Rights (JCHR) highlighted how a lack of clarity around UK policy in this area could expose UK personnel to criminal liability, and stressed the need for a transparent policy around the use of lethal force outside of armed conflict:

"In our view, we owe it to all those involved in the chain of command for such uses of lethal force (intelligence personnel, armed services personnel, officials, Ministers and others) to provide them with absolute clarity about the circumstances in which they will have a defence against any possible future criminal prosecution, including those which might originate from outside the UK."

"UK personnel who facilitate such uses of lethal force outside of armed conflict by providing logistical support to the US, or who provide intelligence gathered through UK surveillance and reconnaissance, also deserve absolute clarity from the Government about the legal basis on which such support is being provided to the US, to provide the necessary reassurance that they are not at any risk of criminal prosecution for complicity in killings which may lack international legal justification." [8]

17. UK involvement in the US drone programme also implicates the UK in a counter-terrorism strategy increasingly considered to be counterproductive, including by senior military and intelligence figures. This includes General Stanley McChrystal – who led coalition forces in Afghanistan – who has warned that it creates "resentment" towards "American arrogance." [9] The CIA’s former Pakistan station chief, Robert Grenier, also said US drone strikes "are creating more enemies than we are removing from the battlefield. We are already there with regards to Pakistan and Afghanistan." [10]

18. This hinders the work of the intelligence agencies overseas, both with local and regional partners, and harms national security in the long term. Participation in a drone programme that violates human rights is contrary to national security and the UK’s international interests.

VII. THE NEED FOR SAFEGUARDS ON DATA-SHARING BY UK INTELLIGENCE AGENCIES

19. The Data Protection Bill currently contains no safeguards for data sharing by intelligence agencies. While safeguards exist for sharing of data by law enforcement personnel in Part 3 of the Bill, Part 4 of the Bill contains far fewer. Clause 109, as it stands, requires only that data-sharing to foreign partners be "necessary and proportionate" for the statutory functions of the intelligence services. By contrast, Clause 73 sets out detailed conditions before law enforcement agencies can transfer data, including that the transfer be based on an adequacy decision or appropriate safeguards. This represents a deeply worrying disparity in protections on the use of data – where mistakes made by the agencies may have lethal consequences.

20. Moreover, there are few other statutory protections to ensure shared data is not misused. The Investigatory Powers Act 2016 places only limited safeguards on the mass collection of data on individuals by UK intelligence agencies, and in any event places no protections on the use of that data thereafter.

VIII. CONCLUSION

21. Reprieve urges Members of Parliament to plug the gap in the Bill and place meaningful safeguards on the sharing of data by the intelligence agencies. Reprieve recommends Members of Parliament support Amendments 159 and 160, and New Clause 14, which apply protections on data-sharing by law enforcement agencies set out in Part 3 of the Bill – Clauses 73 and 77 – as the baseline standard for intelligence agencies as well.

22. Those existing provisions in the Bill recognise the dangers of data-sharing – with decisions made using shared data having potentially serious consequences for human rights. Part 3 even provides heightened safeguards in cases where the UK’s National Crime Agency, for example, shares data with a foreign intelligence service. [11]

23. These protections require the data controller to go through a check-list of important steps before data can be shared with a foreign agency, including: (i) the transfer is strictly necessary, (ii) the individual’s rights and freedoms do not override the public interest in making the transfer, (iii) the recipient agency is told what they can and cannot do with the data, and (iv) the Information Commissioner is told about the transfer.

24. These procedural safeguards would provide minimum protection against unlawful and disproportionate transfers. As in the rest of the Bill, the Information Commissioner plays a crucial role in overseeing the work of data controllers. Her oversight here would mirror that over other important uses of data.

March 2018

REFERENCES


[1] VICE News, Britain’s covert war in Yemen , 7 April 2016, available at: https://news.vice.com/article/britains-covert-war-in-yemen-a-vice-news-investigation

[2] The Intercept, Inside Menwith Hill , 6 September 2016, available at: https://theintercept.com/2016/09/06/nsa-menwith-hill-targeted-killing-surveillance/

[3] R(on the application of Noor Khan) v Secretary of State for Foreign and Commonwealth Affairs [2014] EWCA Civ 24, available at: https://www.reprieve.org.uk/wp-content/uploads/2015/04/2014_01_20_PUB-Noor-Khan-Court-of-Appeal-judgement.pdf

[4] Joint Committee on Human Rights, The Government’s policy on the use o f drones for targeted killing , Second Report of Session 2015-16, 10 May 2016, available at: https://publications.parliament.uk/pa/jt201516/jtselect/jtrights/574/574.pdf , paragraph 1.50, page 25

[5] New York Times, Trump Poised to Drop Some Limits on Drone Strikes and Commando Raids , 21 September 2017, available at: https://www.nytimes.com/2017/09/21/us/politics/trump-drone-strikes-commando-raids-rules.html

[6] See remarks at The Johns Hopkins Foreign Affairs Symposium Presents: The Price of Privacy: Re-Evaluating the NSA , available at: https://www.youtube.com/watch?v=kV2HDM86XgI .

[7] Reprieve, You Only Die Twice: Multiple Kills in the US Drone Program , available at: https://reprieve.org/wp-content/uploads/2014_11_24_PUB-You-Never-Die-Twice-Multiple-Kills-in-the-US-Drone-Program-1.pdf .

[8] The details of this case are confidential.

[9] Reprieve US, Take me off Trump’s Kill L ist, journalists urge US courts , 31 March 2017, available at: http://reprieve.org/2017/03/31/take-off-trumps-kill-list-journalists-urge-us-courts/ .

[10] The Intercept, US Government designated prominent Al Jazeera journalist as “member of Al Qaeda”, 8 May 2015, available at: https://theintercept.com/2015/05/08/u-s-government-designated-prominent-al-jazeera-journalist-al-qaeda-member-put-watch-list/

[11] For references and further detail, see Reprieve, ‘Submissions to the APPG Inquiry into the Use of Armed Drones: Working with Partners’, available at: http://appgdrones.org.uk/wp-content/uploads/2014/08/Submission-from-Reprieve.pdf , and ‘Additional Submission by Reprieve’, available at: http://appgdrones.org.uk/wp-content/uploads/2014/08/2.-2017_11_27_INT-Reprieve-Additional-Submission-to-the-APPG-Inquiry-Final-as-submitted.pdf .

[12] VICE News, Britain’s covert war in Yemen , 7 April 2016, available at: https://news.vice.com/article/britains-covert-war-in-yemen-a-vice-news-investigation

[13] The Intercept, Inside Menwith Hill , 6 September 2016, available at: https://theintercept.com/2016/09/06/nsa-menwith-hill-targeted-killing-surveillance/

[14] The Intercept, NSA’s Quiet Presence at a Base in England’s Countryside Revealed in Snowden Documents, 13 September 2017, available at: https://theintercept.com/2017/09/13/digby-uk-nsa-gchq-surveillance/

[15] Ibid.

[1] Bureau of Investigative Journalism, Drone Warfare, available at: https://www.thebureauinvestigates.com/projects/drone-war .

[2] La Repubblica, Libia, attacco Usa all’Isis I droni partiti da Sigonella , 26 September 2017.

[3] Reuters, Exclusive: Trump administration eyes hardening line toward Pakistan , 20 June 2017, available at: https://www.reuters.com/article/us-usa-pakistan-exclusive/exclusive-trump-administration-eyes-hardening-line-toward-pakistan-idUSKBN19B0C8 ; Politico, Pakistan terrorism crackdown ‘necessary’ to Trump’s Afghanistan strategy , 22 August 2017, available at: https://www.politico.eu/article/pakistan-terrorism-crackdown-necessary-to-trumps-afghanistan-strategy/

[4] Reuters, Niger defense minister asks U.S. to deploy armed drones against militants , 1 November 2017, available at: https://www.reuters.com/article/us-niger-security-usa/niger-defense-minister-asks-u-s-to-deploy-armed-drones-against-militants-idUSKBN1D14VA .

[5] Washington Post, Why CIA drone strikes have plummeted , 16 June 2016, available at: https://www.washingtonpost.com/world/national-security/cia-drone-strikes-plummet-as-white-house-shifts-authority-to-pentagon/2016/06/16/e0b28e90-335f-11e6-8ff7-7b6c1998b7a0_story.html?utm_term=.777600397687

[6] Wall Street Journal, Trump Broadens CIA Powers, Allows Deadly Drone Strikes , 13 March 2017, available at: https://www.wsj.com/articles/trump-gave-cia-power-to-launch-drone-strikes-1489444374 .

[7] Washington Post, Accelerating Yemen campaign, U.S. conducts flurry of strikes targeting al-Qaeda , 2 March 2017, available at: https://www.washingtonpost.com/world/national-security/accelerating-yemen-campaign-us-conducts-flurry-of-strikes-targeting-al-qaeda/2017/03/02/8a9af8cc-ff91-11e6-99b4-9e613afeb09f_story.html?utm_term=.6a99e1423b87 ; Reuters , Trump grants U.S. military more authority to attack militants in Somalia , 30 March 2017, available at: https://www.reuters.com/article/us-usa-defense-somalia/trump-grants-u-s-military-more-authority-to-attack-militants-in-somalia-idUSKBN1712OD ; New York Times, Trump Poised to Drop Some Limits on Drone Strikes and Commando Raids , 21 September 2017, available at: https://www.nytimes.com/2017/09/21/us/politics/trump-drone-strikes-commando-raids-rules.html

[8] Joint Committee on Human Rights, The Government’s policy on the use o f drones for targeted killing , Second Report of Session 2015-16, 10 May 2016, available at: https://publications.parliament.uk/pa/jt201516/jtselect/jtrights/574/574.pdf , paragraphs 1.51 and 3.88, pp. 25 and 59. For footnotes see original.

[9] Reuters, Retired general cautions ag ainst overuse of "hated" drones , 7 January 2013, available at: https://uk.reuters.com/article/us-usa-afghanistan-mcchrystal/retired-general-cautions-against-overuse-of-hated-drones-idUSBRE90608O20130107 .

[10] The Guardian, Drone attacks create terrorist safe ha vens, warns former CIA official , 5 June 2012, available at: https://www.theguardian.com/world/2012/jun/05/al-qaida-drone-attacks-too-broad .

[11] Data Protection Bill, Clause 77, available at: https://publications.parliament.uk/pa/bills/cbill/2017-2019/0153/18153.pdf

 

Prepared 13th March 2018