Authorities urged to rescind decree creating communications surveillance agency

Reporters Without Borders calls on the government to rescind Decree No. 2013-4506 providing for “the creation of the Technical Agency for Telecommunications (ATT) and determining its administrative and financial organization and methods of functioning.” The decree’s publication in the Official Gazette of the Tunisian Republic on 12 November was followed by a Ministry of Information and Communications Technology statement eight days later announcing the ATT’s creation. Reporters Without Borders believes that the creation of such an agency requires thorough reflexion on all the legislation affecting communications surveillance in Tunisia – reflexion that should include debates in the National Constituent Assembly (ANC) and consultation with civil society. This decree does not respect international standards or the recommendations that Frank La Rue, the UN special rapporteur on the promotion and protection of the right to freedom of opinion and expression, submitted to the UN Human Rights Council during its latest session. In a report dated 17 April, La Rue stressed that the creation of surveillance mechanisms to combat online crime has consequences for privacy and freedom of information. Reporters Without Borders has joined Access, EFF, Privacy International and around 100 other NGOs in signing 13 “international principles on the application of human rights to communications surveillance” that are intended to provide civil society, the private sector and governments with a framework for ensuring that surveillance legislation and practices respect human rights. “This decree establishing a system of communications surveillance managed by the Technical Agency for Telecommunications (ATT) has revived memories of the activities of the Tunisian Internet Agency (ATI), former President Zine el-Abine Ben Ali’s centre for technical censorship,” Reporters Without Borders said. “The fact that there is provision, under articles 15 and 17 of this decree, for the ATT to receive donations and for officials in active service to continue to receive bonuses and benefits has given rise to fears that ATI personnel and equipment will be reassigned to the ATT. “This decree violates the principles that should govern Internet surveillance mechanisms, above all control by an independent judicial authority and the principles of need, relevance and proportionality of surveillance measures, as well as transparency and monitoring by the public.” The decree’s omissions and vagueness are extremely dangerous. Given Tunisia’s recent history, the current political context and the revelations about NSA surveillance, they could open the way for interpretations that could extend the scope of communications surveillance without real safeguards and controls. Article 2 gives the ATT the job of providing technical support for judicial investigations into “information and communication crimes” without defining these crimes and without referring to any crimes defined in the penal code. Similarly, the decree refers at least six times to “legislation in effect” without specifying which legislative provisions it means, at a time when all legislative provisions affecting surveillance and personal data need to be overhauled. Lack of independent judicial control Article 1 of the decree establishes the ATT as a “public entity of an administrative nature” under the ministry of information and communications technology’s aegis. Article 12 says that its director-general and department directors are “named by decree on the proposal of the ministry of information and communications technology.” This questionable choice completely sidelines the justice ministry. According to article 5, the agency is required to carry out “any other mission linked to its activity that it is assigned by the ministry of information and communications technology.” This means that it could become the ministry’s mechanism for communications surveillance as well as providing technical support for “judicial investigations.” It is also disturbing that at no point does the decree mention any intervention by the judiciary, although it is the only authority that should be able to authorize and monitor surveillance measures. The decree does not say who can refer matters to the ATT or who can give it “investigation orders.” Nothing is specified. How will investigation requests be made? Will the ATT just assist judicial investigations at the request of an investigating judge, will its investigations be the result of administrative measures, or will they be part of investigations by the prosecutor’s office? The decree mentions an “office of legal proceedings that receives investigation orders” (article 9), “investigations on orders received” (article 11) and “referral (of investigation orders) to the departments concerned with the obligation to specify reasons” (article 6). But it is very vague about procedure and who issues the orders. The decree also says little about supervision of the ATT’s activities. The duties of an Oversight Committee, which could have played a supervisory role, are not clearly defined. Article 6 says this committee “ensures the proper functioning of the national systems for controlling telecommunications traffic in the framework of the protection of personal data and civil liberties.” But the committee’s members are free to define “proper” functioning as they see fit – a freedom that is worrying given the committee’s composition. Article 7 says that various government ministries directly name seven of its nine members. This does not guarantee its independence. Nothing is said about the competence of its members although they would face complex technical and legal issues. This Oversight Committee does not therefore seem to have been designed as a mechanism for controlling the measures that the ATT is asked to carry out, and if it were, it would lack the required independence. Abstract reference to “civil liberties” and “treaties” There are references to “international human rights treaties” in article 2 and to “civil liberties” in article 6, but these issues are clearly not at the centre of the concerns of the officials who drafted the decree. In the absence of details about the nature of any guarantees, these references seem purely formal. In his report on the implications of government communications surveillance for the right to privacy and freedom of opinion and expression, special rapporteur Frank La Rue said: “In order to meet their human rights obligations, states must ensure the rights to freedom of expression and privacy are the heart of their communications surveillance framework.” He added: “Legislation must stipulate that state surveillance of communications must only occur under the most exceptional circumstances and exclusively under the supervision of an independent judicial authority. Safeguards must be articulated in law relating to the nature, scope and duration of the possible measures, the grounds required for ordering them, the authorities competent to authorize, carry out and supervise them, and the kind of remedy provided by the national law.” The decree says nothing on these points although it is essential that the methods for giving the ATT orders should be precisely defined. The rules governing surveillance measures need to spelled out in detail, especially as regards their duration, proportionality and purpose. Lack of transparency and public information on surveillance measures As Reporters Without Borders, Access, EFF and Privacy International said in the presentation on surveillance principles to the UN Human Rights Council in Geneva in September, the principles of user notification, transparency and public oversight are fundamental. But, as envisaged in the decree, the ATT’s way of functioning will be completely opaque. The decree does not provide for user notification or any method for challenging the legality of surveillance measures. When a surveillance decision is taken, those affected will not be notified and will not have “enough information to enable them to appeal the decision” or “access to the materials presented in support of the application for authorisation,” as the 13 Principles recommend. The requirements of an investigation may sometimes justify the professional confidentiality and the confidentiality of decision-making provided for in article 8, but they should not prevent all forms of transparency and provision of information to civil society. Article 6 of the decree refers to annual reports on the handling of investigation orders. What is the point of these reports if they are to be filed and not made public? Shouldn’t they be designed to improve the agency’s function and to transparently shed light on the new technical and legal challenges of surveillance? Finally, article 16 says that “contracts linked to the agency’s specific characteristics may be exempted from the requirement of the decree regulating public contracts.” By exempting the ATT from the transparency obligations imposed on other state agencies (above all as regards public bidding), this agency enjoys a degree of leeway that endangers respect for fundamental freedoms. The “special characteristics” of an agency responsible for communications surveillance should result in more concern for transparency and oversight, not opacity and special dispensations.