Milanovic: Surveillance and Cyber Operations

Marko Milanovic (Univ. of Nottingham - Law) has posted Surveillance and Cyber Operations (in Research Handbook on Extraterritorial Human Rights Obligations, Mark Gibney et al. eds., forthcoming). Here's the abstract:

This chapter examines the extent to and the basis on which human rights treaties apply extraterritorially to state surveillance and cyber operations. Consider only the following examples: (1) The targeted surveillance of a specific individual outside a state’s territory – as, for instance, with the operations allegedly conducted by the authorities of Saudi Arabia against Saudi dissidents abroad, one of which ultimately led to the plot to assassinate the journalist Jamal Khashoggi, or against the CEO of Amazon, Jeff Bezos, apparently in a rather crude attempt to blackmail him. (2) Mass surveillance or bulk collection programmes, such as those run by the US and UK signals intelligence agencies, that syphon the content of electronic communications of millions of people outside the state’s territory, or the metadata about these communications, in order to create searchable datasets in which persons of particular interest, e.g. suspected terrorists, can then be found. (3) Cyber operations that exfiltrate data on Covid-19 vaccine research, potentially affecting the development of vaccines that could save many thousands of lives. (4) Cyber operations that destroy or manipulate such data. (5) Cyber operations against hospitals or against critical infrastructure, which directly endanger many lives. (6) Cyber operations against media outlets, which disrupt their activities and inhibit their freedom of expression. (7) Online misinformation operations for various purposes, for example to manipulate the outcome of an election or to destroy public trust in state institutions during the pandemic. Common to all of these scenarios is that through entirely digital means states can violate a host of different human rights, from the rights to privacy and the freedom of expression, to the right to life and the right to health, of persons located outside their territories.

The chapter will first proceed to briefly outline how the traditional models of extraterritorial application, the spatial and the personal, would apply to surveillance and cyber operations, examining a few old cases in which the issue was raised, if never properly resolved. It will then look at recent developments that are particularly important in the surveillance and cyber context, even if some of them are not directly apposite: a judgment of the UK Investigatory Powers Tribunal, the advisory opinion of the Inter-American Court of Human Rights on the environment and human rights, the Human Rights Committee’s General Comment No. 36 on the right to life, and the judgment of the Federal Constitutional Court of Germany on the applicability of the German Basic Law to surveillance operations abroad. The chapter will then finally offer some concluding thoughts on the direction towards which the legal position is likely to evolve, and should evolve, regarding the applicability of human rights law to extraterritorial surveillance and cyber operations.