Intelligence sharing is one of the most pervasive, and least regulated, surveillance practices in our modern world. It is facilitated by rapidly changing technology that has allowed for the collection, storage and transfer of vast amounts of data within and between countries. The privacy impacts of these developments are significant. In this report, Privacy International offers a set of recommendations aimed at addressing the legality and oversight gaps of intelligence sharing arrangements. In the past few decades, methods of communication have dramatically changed.
The development of new technology, especially the birth of the internet, has transformed the way individuals communicate with each other and increased the amount of information that can be collected by several orders of magnitude. In particular, communications – emails, instant messages, calls, social media posts, web searches, requests to visit a website – may transit multiple countries before reaching their destination. The dispersion of communications across the internet vastly increases the opportunities for communications and data to be intercepted by foreign governments, who may then share them with other governments. As methods of communications have dramatically changed, so too has intelligence gathering. Intelligence agencies have developed increasingly advanced ways of accessing, acquiring, storing, analysing and disseminating information. In particular,
they have developed methods for acquiring communications and data traveling the internet. The costs of storing this information have decreased dramatically and continue to do so. At the same time, technology now permits revelatory analyses of types and amounts of data that were previously considered meaningless or incoherent. Finally, the internet has facilitated remote access to information, meaning the sharing of communications and data no longer requires physical transfer from sender to recipient. The new scope and scale of intelligence gathering has given rise to a new scope and scale of the sharing of that intelligence between governments, particularly in response to threats to national security. Despite these dramatic changes, in many countries around the world, the public remains in the dark regarding state surveillance powers and capabilities, and whether those powers and capabilities are subject to the necessary safeguards pursuant to domestic and international law. One area of particular obscurity is arrangements between countries to share intelligence. These arrangements are typically confidential and not subject to public scrutiny. As surveillance is conducted by different state actors, so is the sharing of such intelligence. The most opaque, and arguably the most extensive, sharing takes place between intelligence agencies, and this type of intelligence sharing is therefore the focus of this report. However, other state security actors as well as law enforcement agencies also engage in information sharing. For example, the European Union is moving to link law enforcement and migration control databases and considering ways to allow member states to access these databases.1 At the global level, the United Nations Security Council recently passed Resolution 2396, demanding that states undertake a range of measures to enhance intelligence sharing as a tool for combatting terrorism, including by collecting and sharing passenger name records (“PNRs”) and developing and sharing lists or databases of known and suspected terrorists. Privacy International recognises the importance and benefit of intelligence
sharing, for example, in the context of preventing acts of terrorism or identifying other serious threats to national security. Intelligence sharing does not violate international human rights law per se. But it does interfere with fundamental human rights, including the right to privacy. Thus, just as government surveillance must be transparent and subject to adequate safeguards and oversight, so too must intelligence sharing arrangements. Non-transparent, unfettered and unaccountable intelligence sharing, on the other hand, poses substantive risks to human rights and
the democratic rule of law. In September 2017, Privacy International – in partnership with 40 national civil
society organisations – wrote to oversight bodies in 42 countries as part of a project to increase transparency around intelligence sharing and to encourage oversight bodies to scrutinise the law and practice of intelligence sharing in their respective countries. Over the past few months, we have received responses from oversight
bodies in 21 countries.
This report is a follow-up to our outreach to oversight bodies in September 2017. Part II provides essential background, by explaining what we mean by intelligence sharing and what both modern intelligence sharing and intelligence sharing arrangements look like. Part III presents the human rights concerns presented by intelligence sharing. Part IV considers issues related to the legality of intelligence sharing. Part V considers issues related to the oversight of intelligence sharing. This Part also provides a summary of responses received from oversight bodies,
focusing on the regulation of intelligence sharing in national laws and the practices of oversight bodies. The report concludes with a series of recommendations aimed at addressing the legality and oversight gaps of intelligence sharing practices. Read the report here.