On December 4, the Grand Chamber of the European Court of Human Rights unanimously ruled that the SORM system of direct access to communications networks in Russia violated the right to privacy enshrined in Article 8 of the European Convention on Human Rights. Zakharov v. Russia is the most recent judgment on the proper limits of communications surveillance powers, and its release at a time when the United Kingdom’s Draft Investigatory Powers Bill is under consideration is not likely to be coincidental. This post will focus on three noteworthy aspects of the judgment: its clarification of requirements for standing when challenging communications surveillance laws, its treatment of data retention standards, and its conclusions regarding direct access systems.
At the heart of the Zakharov case is the SORM system of surveillance which is present in Russia and several former Soviet states. It allows law enforcement authorities to intercept the content of communications and to obtain non-content data by means of a direct connection to the networks of communications service providers (CSPs). According to the European Telecommunications Standards Institute, CSPs should facilitate the transfer of data to authorities when an order for interception is presented, but law enforcement should not have direct access to networks. European telecommunications companies and Privacy International have disclosed that direct access is employed by a range of states beyond the Eurasia region.
In his application to the European Court, the chair of a civil society organization alleged that the system of covert interception of mobile communications in Russia did not comply with Article 8, despite the fact that judicial authorization of surveillance was required by law. The case reached the Grand Chamber when the First Section relinquished jurisdiction pursuant to Article 30 of the European Convention, which may be applied when a case “raises a serious question affecting the interpretation of the Convention or the protocols thereto.” The Grand Chamber held that several aspects of Russian law were incompatible with the Convention, including that communications surveillance was permitted for a broad range of criminal offenses (including pickpocketing), surveillance was not limited to those suspected of having committed offenses, and robust oversight mechanisms and effective remedies were lacking. Continue reading