Legal Practices in National Security and in Whistleblowing

Leaks and Whistleblowing

Definition: A leak is the unauthorized disclosure of confidential or sensitive information to the public or media, often without the consent of the organization or government involved.

Legal Framework: Leaks are generally considered illegal if they involve classified, proprietary, or privileged information protected by laws such as the Espionage Act in the United States or Official Secrets Acts in the UK. These laws prohibit unauthorized disclosure of government secrets and may result in criminal charges for leakers.

Legal Consequences: Individuals found guilty of leaking sensitive information may face penalties ranging from fines to imprisonment, especially when the information pertains to national security. Unlike whistleblowing, leaks lack legal protection and often lead to prosecution unless the individual can argue a public interest defense (though this defense is limited in many countries).

Definition: Whistleblowing is the act of disclosing information about illegal, unethical, or harmful activities within an organization to authorities or the public, with the intent to address misconduct, prevent harm, or promote accountability.

Legal Framework: Whistleblowing is legally protected in many countries through laws such as the Whistleblower Protection Act in the United States, the Public Interest Disclosure Act in the UK, and the EU Whistleblower Protection Directive in the European Union. These laws provide a legal basis for individuals to report wrongdoing without fear of retaliation and often establish channels for safely reporting within or outside the organization.

Legal Protections: Whistleblowers are generally protected from employer retaliation, such as firing or harassment, when reporting certain types of misconduct. If whistleblowers follow legal reporting channels, they may also receive support in the form of confidentiality protections and, in some cases, financial incentives (such as in U.S. SEC or IRS whistleblower programs).

FISA amendment Section 702

Section 702 of the FISA Amendments Act allows the U.S. government to conduct warrantless surveillance on non-U.S. persons located outside the United States for the purpose of gathering foreign intelligence. It enables programs like PRISM (data collection from tech companies) and Upstream (intercepting data from internet infrastructure).

While it targets foreign individuals, the communications of U.S. persons can be incidentally collected, raising privacy concerns. Oversight is provided through minimization guidelines reviewed by the Foreign Intelligence Surveillance Court (FISC), but critics argue that transparency and protections for U.S. citizens remain insufficient.

Legal framework

1. International Law and Espionage:

* International law lacks explicit regulations on espionage activities, meaning there is no universal treaty or convention directly governing the legality of espionage between states. This leaves espionage in a largely unregulated space under international law.

* State sovereignty is a core principle of international law, and espionage inherently violates this principle when conducted by foreign operatives on another country’s soil. As such, espionage is often considered illegal or criminal within domestic laws, even though it isn’t specifically addressed as such in international law.

2. Acknowledgment of Intelligence Agencies:

* States typically acknowledge their own intelligence agencies and consider their activities as legitimate under national security justifications. This aligns with the notion that espionage, while secretive, is a recognized and routine function of statecraft. However, states carefully avoid openly admitting to or justifying specific espionage operations, especially when directed at allies or neutral countries, to avoid diplomatic fallout.

3. Condemnation of Foreign Espionage:

* Most countries strongly condemn foreign espionage on their soil and often criminalize assisting foreign intelligence operations. In the U.S., for instance, aiding foreign espionage can result in charges of espionage, conspiracy, or aiding an enemy, while countries in the European Union and beyond have similar laws protecting state secrets.

4. Specific Limits on Espionage Tactics:

* International law is indeed clear on prohibiting torture and other inhumane practices, as established in treaties like the UN Convention Against Torture. Such limits are universal, applying to all state activities, including intelligence gathering. Thus, while espionage itself isn't explicitly illegal in international law, certain methods used to gather intelligence—such as torture or cruel treatment—are prohibited.

In summary, while espionage itself is not outright banned or legalized in international law, the methods used in espionage are subject to international regulations and prohibitions, particularly regarding human rights. States accept their intelligence activities as necessary for security but criminalize foreign espionage domestically to protect sovereignty, and they generally avoid admitting specific acts of espionage to manage diplomatic relations.

After 9/11

Increased Intelligence Sharing with the U.S.

* In the wake of 9/11, the EU strengthened its cooperation with the U.S. on counter-terrorism, which involved more extensive intelligence sharing between EU and U.S. agencies. European countries became more willing to share data with U.S. intelligence agencies, despite the European Parliament’s earlier concerns about foreign surveillance practices like ECHELON.

* This cooperation led to agreements like the Passenger Name Record (PNR) framework, which required airlines to share detailed passenger data with U.S. authorities. The European Parliament was initially resistant to this agreement, as it conflicted with EU privacy laws, but it eventually passed under pressure from security priorities.

The Data Retention Directive (2006)

* The EU adopted the Data Retention Directive in 2006, which required telecom companies to retain data on all communications (metadata, such as the time, duration, and location of calls) for 6 to 24 months for law enforcement purposes. This directive contradicted the privacy-focused mandate from 2001, as it required the mass storage of citizens' data, making it more accessible to intelligence and law enforcement agencies.

* The directive was controversial from the outset and faced numerous legal challenges. In 2014, it was ultimately struck down by the Court of Justice of the European Union (CJEU), which ruled that it violated fundamental rights to privacy and data protection.

SAFE HARBOR Agreement

* To facilitate data transfers for businesses operating between the EU and the U.S., the Safe Harbor Agreement was established in 2000, allowing companies to transfer personal data across borders under a shared privacy framework. After 9/11, this agreement took on new significance, as data-sharing became more critical for both commerce and security.

* The EU-U.S. Safe Harbor Agreement later came under scrutiny due to concerns that U.S. surveillance programs, including PRISM (exposed in 2013), undermined the privacy protections Safe Harbor was meant to ensure. This ultimately led to the agreement being invalidated by the CJEU in 2015, and replaced by the EU-U.S. Privacy Shield (also invalidated in 2020), as privacy advocates argued it still did not fully protect EU citizens from U.S. surveillance.

Expansion of Surveillance Laws in EU Member States

* Many EU countries implemented their own enhanced surveillance laws that included mass data retention and increased authority for intelligence agencies, often modeled on the U.S. PATRIOT Act. Countries like the UK, France, and Germany passed laws that allowed for greater interception of communications and expanded intelligence-gathering powers to counter terrorism.

* For example, the UK’s Investigatory Powers Act (often called the “Snooper’s Charter”) legalized broad surveillance powers, allowing for the collection of metadata and intercepting of internet communications. France and Germany also passed laws to enable more comprehensive monitoring of potential terror suspects.

Growing Legal Pushback and Privacy Activism

* Despite these post-9/11 security measures, the European Parliament and EU courts maintained some oversight. Privacy-focused organizations, like the European Digital Rights (EDRi) and individuals such as activist Max Schrems, continued to challenge surveillance practices in EU courts, arguing they violated EU privacy protections.

* These challenges ultimately led to landmark rulings, such as the 2014 CJEU decision that annulled the Data Retention Directive and the invalidation of Safe Harbor and Privacy Shield agreements, signaling a gradual return to prioritizing privacy protections.

Introduction of the General Data Protection Regulation (GDPR)

* The EU eventually implemented the General Data Protection Regulation (GDPR) in 2018, reinforcing data protection rights for EU citizens and giving them more control over their personal information. While GDPR is primarily a data protection law, it reinforced the EU’s commitment to privacy rights despite the surveillance pressures of the post-9/11 era.

* GDPR’s strict rules around data processing and transfers also put indirect pressure on surveillance practices, as it reinforced standards for protecting personal data against unauthorized access.