← The Lawfare Podcast
The Lawfare Podcast
Lawfare Daily: The European Court of Human Rights Takes on Digital Rights in War, with Asaf Lubin and Deb Housen-Couriel
00:47:16
Loading summary
Transcript48 lines
- [00:01]
Podcast Host (Ad Intro)
The following podcast contains advertising to access an ad free version of the Lawfare Podcast. Become a material supporter of lawfare@patreon.com lawfare that's patreon.com Lawfair also check out Lawfare's other podcast offerings, Rational Security Chatter, Lawfare, no Bull and the Aftermath.
- [00:32]
Deborah Howson Kuriel
Carol, you're in remission. I think what gets me most about this whole journey that I've been through is just how many jigsaw pieces come.
- [00:41]
Scott R. Anderson
Together to help someone like me.
- [00:43]
Deborah Howson Kuriel
I've met people who have just packaged.
- [00:45]
Asaf Lubin
The drugs, just this white box saying.
- [00:47]
Deborah Howson Kuriel
World Courier on it.
- [00:48]
Asaf Lubin
But I want to better say thank you to every single person that works on these things because they've saved my life.
- [00:54]
Scott R. Anderson
Every single one of them. Every minute, World Courier makes another life changing delivery. Learn more Search World Courier hi, this is Joe from Vanta in today's digital world, compliance regulations are changing constantly and earning customer trust has never mattered more. Vanta helps companies get compliant fast and stay secure with the most advanced AI automation and continuous monitoring out there. So whether you're a startup going for your first SoC2 or ISO 27001 or a growing enterprise managing vendor risk, Vanta makes it quick, easy and scalable. And I'm not just saying that because I work here. Get started@vanta.com.
- [01:35]
Deborah Howson Kuriel
All of these measures taken together Filtration measures taken together not only are standalone violations of Article 8, but the court has characterized them as gateway violations that permit or have permitted Russian forces to to violate additional human rights, including forced kidnappings, detentions, people who've simply been lost and cannot be contacted by their families. They've been disappeared.
- [02:05]
Scott R. Anderson
It's the Lawfare podcast. I'm Senior Editor Scott R. Anderson, contributing Editor Asaf Lubin of the Indiana University Mara School of Law, and Deborah Howson Kuriel of the Hebrew University of Jerusalem.
- [02:16]
Asaf Lubin
The court has not Both in a case called Centrum Fort Visa v. Sweden and a case called Big Brother Watch Vuk, the court has not rejected the possibility of foreign mass surveillance. That is not what the court does. Rather, the court tries to identify whether, in choosing to employ foreign mass surveillance, you've taken all the necessary precautions to avoid abuse and to ensure protection.
- [02:41]
Scott R. Anderson
Today we're talking about the European Court of Human Rights recent decision in Ukraine and the Netherlands v. Russia in UK the and its landmark approach to digital rights in the context of armed conflict. Today we're here to talk about a really interesting decision that came down a few weeks ago from the European Court of Human Rights, the Grand Chamber of the European Court of Human Rights, a judicial body a lot of Americans don't spend a lot of time thinking about, but has done something here interesting in a lot of different regards. You all wrote a piece for Lawfare highlighting one particular way. It's interesting that even among international law commentators hasn't quite gotten as much attention and has a lot of relevance to people around the world, including Americans. And a lot of people in our target audience, particularly those interested in national security, were fighting law of armed conflict questions. So I want to dig into that technical aspect of this opinion. A lot of the issues you raise about privacy, digital privacy and the intersection of the law of armed conflict. Before we do, though, let's talk about this case itself, this Ukraine and the Netherlands v. Russia. Deb, give us a little bit of background about the procedural posture, what led us to the decision, and the kind of broader universe of issues that the court was facing before we dig into the specific lane you all focus on in your piece.
- [03:58]
Deborah Howson Kuriel
So in the July 9 judgment, the European Court of Human Rights ruled many important and critical issues. Our focus here is on the ruling on data privacy rights under Article 8 of the European Convention on Human Rights. Not only was there a substantive ruling on how digital privacy rights play out in wartime, but there was even a more detailed specific ruling on the part of the Court on how digital privacy rights should be implemented by countries in wartime and in occupied territories specifically. So it was in the privacy context, it was really a two part landmark decision sort of at the highest level. So that's at the first level. There are a few more things that are really interesting about the case just at the top at the legal level, but more at the almost surprising level of what this judgment did. So first of all, it's a giant, it's 500 pages long and 18 of those pages approximately are devoted specifically to the digital privacy issues, which is an awful lot. Secondly, out of the European Convention on Human Rights, which is the basic the treaty which is the basis of the judgment, 26 out of the 46 state parties intervene as third parties to the judgment. That's never happened before. And the court registrar, in communicating the judgment to the public, said this is without precedence and it's one of the most consequential judgments in the history of the court. And finally, sort of an extra, almost an extra legal point is that the court itself stated that this judgment was really a restatement of the raison d' etre of the treaty itself and the post war legal human rights regime that obtains in the European context.
- [05:57]
Asaf Lubin
I'll just specifically add, just to hit on that procedural posture issue. So the case comes to the court because of a series of applications. The first said of which comes from Ukraine in March and June 2014, August 2015, and then the latest in February 22nd. That's after the invasion. And there's another application that comes from the Netherlands. That's why we get the case being called Ukraine and the Netherlands v. Russia, because the Netherlands submitted an application in July 2020 focusing on the downing of Flight MH17, alleging Russians responsibility for the missile attack and the failure to investigate the deaths that have occurred on board that flight. And so what the court is doing across those 500 pages that deb was talking about is trying to answer all of these various complaints all at once in response to the myriad of allegations of violations by Russia of human rights across years of conflict in that region. That's the context.
- [06:59]
Deborah Howson Kuriel
Doing this all in the absence of a live Russian body. So Russia is, as a result of being taken out of the whole treaty context as a result of its invasion the Ukraine and its own refusal to accept the court's jurisdiction. We don't have a Russian presence in the courtroom. And Russia is formally not has formally declared itself not party to the proceedings and now willing to accept the judgment. So that's an additional outside of the courtroom or outside of the judgment situation that feeds into the complexity of the judgment as a sub presenting it as well.
- [07:34]
Scott R. Anderson
So as you mentioned, the scope of this matter is huge. The jurisdiction of the court runs till six months after the expulsion of Russia from the Council of Europe, which happened in March 2022, shortly after its invasion of Ukraine. So up until September 2022. So it covers critical months of the Ukraine conflict, but notably not the bulk of it, but it does cover Crimea and a bunch of other actions that Russia has clearly been involved in. I think it's fair to say there's no shortage of human rights violations Russia is credibly accused of in the decade plus prior to September 2022. But this specific set of actions are what were most clearly implicated in relation to the privacy questions you all are most interested in. And that is a process that is described as filtration. Deb, talk to us about what this filtration is and why it raised so squarely these questions about privacy in the context of armed conflict that are relatively novel, or at least the way the court chose to address them is relatively novel.
- [08:41]
Deborah Howson Kuriel
Scott, we have in terms of the amount of Ukrainians being taken into this Campaign, this Russian data collection campaign, about a million and various estimates. We have a million people, a quarter of them minors, those who are processed in a compulsory procedure that the Russian military forces and associated forces have set up. So 21 filtration centers both within occupied Ukrainian territory and at Russian border points, going in both directions. So whether you're coming into occupied Ukraine or leaving occupied to pin back into Russia, and you're a Ukrainian, you are compelled to go through these filtration measures. And what these filtration measures include, according to evidence that we've had from reports from human rights NGOs, several of them which have more or less been incorporated into the court's judgment. So overall, invasive and even abusive security checks of individuals, their telephones, their computers, their personal belongings. What does that mean? Forced provision of passwords to mobile phones and to computers, downloading of phone contact lists, videos, photos, email exchanges. Again, we're talking reminding us that we're talking about Ukrainian civilians in the wartime situation, not combatants. Registering identification numbers of telephones, including the IMEI numbers. Collecting passport numbers, scanning for biometrics, taking fingerprints and taking palm prints. Other surveillance that was less well documented, but clearly cameras at detention sites and at these correction sites. And all of these measures taken together. Filtration measures taken together not only are standalone violations of Article 8, but the court has characterized them as gateway violations that permit or have permitted Russian forces to to violate additional human rights, including forced kidnappings, detentions, people who've simply been lost and could not be contacted by their families, they've been disappeared, forced kidnappings of minors and others. So on two counts, infiltration measures, standalone as a severe violation of Article 8, and have also permitted severe violations of other articles of the treaty.
- [11:08]
Asaf Lubin
I just want to acknowledge specifically the work of Yale School of Public Health Humanitarian Research Lab. My dear, dear colleague and friend Nathaniel Raymond has been involved for years now in research on these issues. The reason I want to highlight it is because much of their investigations to identify the location of the filtration sites and the exact activity involved include a lot of open source analysis. We will talk a lot about digital collection and I wanted to highlight that there could be positive uses of digital investigations, not just negative ones. In the context of what we'll talk about, they've done so much work. The report is called System of Filtration Mapping Russia's Detention Operations. And in that report, which the court relies on, in part, they identify a lot of the locations, the nature of the activity. A lot of it was also, of course, based on witness reports and investigations.
- [11:59]
Deborah Howson Kuriel
In that context, it's important as international lawyers, we need to say up front, clearly the in wartime situations would justify, permit certain steps, certain measures to be taken on the part of military forces and occupation forces to identify civilians and to identify risks to military forces. We need to make that absolutely clear. So Geneva Force Article 27 allows for necessary measures of control and security. We need to say that up front. The question is how the court will balance what's permitted with what the Russians did, far beyond what's permitted in Assaf, will take us down that road later on.
- [12:39]
Scott R. Anderson
So I do want to turn to the legal authorities for this filtration system, which is, you know, to be clear, a pretty dramatic effort to sort and organize and collect large amounts of data on a large number of Ukrainian civilians in a variety of contexts in occupied Ukraine through a variety of mechanisms and measures and activities that we have a fair amount of information on. It obviously raises questions, or would raise questions in a lot of contexts about privacy, about how you can obligate and impose yourself and collect this information. Privacy being a particular set of rights of particular concern to Europeans in a way that it is often not the same to Americans, at least in regard in a variety of contexts, are not always conceived the same. So let's talk about in the European context, and particularly the treaty context relevant to to this Tribunal, what exactly runs up against We've heard Article 8 mentioned already talk to us about the obligations that stem from that, the constraints and limits on it, and where the clear friction points are with this filtration process. Assaf sure.
- [13:44]
Asaf Lubin
So Article 8 of the European Convention on Human Rights and Fundamental Freedoms affirms a basic human right to privacy, which is defined as the right that everyone has to respect for their private and family life, their home, their and their correspondence. And it is precisely that latter category, the correspondence with which we've contemporaneously interpreted that to encompass our digital communication, in essence, informational privacy or data privacy, and not just privacy in the home or in the physical sense. Now, I should mention you correctly identified this as a European right under the European Convention applicable to European Council members. But there's an equivalent right, Article 17 of the International Covenant on Civil and Political Rights affirms much the same right, the right not to have an arbitrary intervention or interference in one's private life. And that is a treaty obligation that the United States is beholden to. Of course, the interpretation of that right to privacy differs, and some even suggest that there are different cultural interpretations of privacy in different contexts and so what the Court is interested in is identifying how might one arbitrarily interfere with the right to privacy. And over the course of decades now, the European Court of Human Rights has developed a body of jurisprudence that identifies a set of requirements, both procedural and substantive, for lawful or legitimate interferences with privacy by an organ of a state, both for criminal investigations that are targeted at an individual and for national security investigations that might involve what we colloquially call mass surveillance or bulk interception. And perhaps surprisingly to some, the European Court of Human Rights, in a series of decisions in the 2000 and tens, including one against Russia, Zakha v. Russia, has affirmed the right to engage in certain form of bulk interception of collection against not an individual, but a mass group subject to constraints that it be authorized by law that is necessary in a democratic society that is proportionate to the harms that is being addressed, that there's adequate safeguards, end to end safeguards, as the Court calls them in Big Brother Watch Vuk. These are a series of procedures around how data will be collected, stored, managed, shared with others, as well as ex ante authorization and ex post review by independent oversight and access to remedy when such remedy is available without interfering with the legitimate purposes of the investigation. What is interesting about this decision is that this entire body of jurisprudence has always been applied in peacetime to peacetime investigations, be them in the criminal context or the national security context. They have never been applied by the Court, and really they've never been applied by any international body to an armed conflict situation. And that's the big difference in this.
- [16:42]
Scott R. Anderson
Decision and notably this tribunal, I should say this particular matter. In considering this matter, they were doing it against a tricky legal train because this isn't the first time this Court has approached the question about how Convention on Human Rights obligations intersect with the law firm conflict. They spent a lot of time trying to navigate around a prior opinion relating to Georgia and Abkhazia and Russian actions there of what you refer to as Georgia too, in their opinion. I'm blanking on the original caption off the top of my head. Georgia v. Russia. That's what it is. The second Georgia, Georgia v. Russia too. So talk to us about that. Asaf. How do they get around that opinion, which seemed to really throw a lot of cold water on the idea that the convention of human rights obligations like Article 8 apply cleanly in an armed conflict context. They didn't find that to be such a barrier. Tell us how they arrived at that conclusion.
- [17:37]
Asaf Lubin
So a preliminary question to the application of human rights treaties in all of These contexts of surveillance is the extent to which the treaty applies outside the borders of the state. Traditionally speaking, countries parties to treaties are bound to apply treaty obligations within their four corners of their territory, their sovereign territory. And typically speaking, treaty obligations do not extend outside one's territory to third party territory over which they have no control. Here, too, the European Court of Human Rights, as well as the Human Rights Committee interpreting the International Covenant on Civil and Political Rights, have developed a body of jurisprudence to address what we call a extraterritorial application of human rights treaties. And traditionally, the test that has been adopted that is generally accepted to be the primary test is one of effective control. So a state would wherever a state employs effective control over a territory or over a person, the state is said to be bound at least by the negative obligations of protecting the rights of the individuals within that territory or the individuals under its control. What was interesting about the Georgia v. Russia decision is that the court in Georgia v. Russia addressed the five days in 2008 war in South Ossetia between Georgia and Russia, which was five very intense days of conflict. And the court drew a stark doctrinal theory in that case wherein it says that, quote, in the active phase of hostilities, end quote, the very reality of armed confrontation and fighting between the parties to establish control over an area in, quote, a context of chaos, means that there is no one party that can claim effective control over an area to trigger the application of the treaty. And that has led many international lawyers to write many, many, many papers and blog posts criticizing the decision. Marko Milanovic even said that it's exemplary only in its arbitrariness, because how define chaos? And when might an armed conflict rise to the level of chaos, that human rights law do not apply and do not rise to the level of chaos when human rights law applies? In the wake of Georgia too, human rights scholars were all wondering what the court will say in Ukraine and Netherlands v. Russia, which is too a space in which there is an active phase of hostilities. The court chose to distinguish that decision, not to completely reject it or disown. Suggested instead that because of the nature of the Russian activities, they announced that they are trying to take over territory that they claim and ultimately annexed that they claim as their own against the high contracting party on European soil, first time Since World War II in this level and magnitude, and given the interventions of member states, all affirming, as Deb was suggesting before the ratio d' etre, the core justification this treaty. In light of all this background, it will be ridiculous to suggest that Russia is not intending and therefore should not be beholden to a test of effective control. It's intending to achieve effective control. It should be beholden to the consequences of its effective control. But even that the test of chaos is not mentioned by the court. And Georgia v. Russia is just compared to under a quick parenthetical and nothing more. So the court is kind of trying to walk a careful line there additional.
- [21:23]
Deborah Howson Kuriel
Twist that the court does add, and I agree completely that there's a dance around previous jurisprudence, but the court is very careful to emphasize in discussion of the Article 8 violations how systematic they were. So that's as it's sort of the subtext is we're talking about the non chaotic nature of this campaign. They carefully employ the word systematic collection of data and emphasized that there were 21 filtration centers. And as you've already described reading through the case, it was very interesting to note that emphasis, especially in the light of the jurisprudence that went before. So it's certainly a shadowy in the shadows impossible to come to the conclusion that the court ignored what went before. So I completely agree on that.
- [22:16]
Podcast Host (Ad Intro)
I mean some people have gotten used to it already. This crazy economic uncertainty. Are we all going to lose our jobs because of AI? Are we all going to pay through the roof because of tariffs, but then not pay any taxes? The market's up, it's down. For those people in their 30s and 40s, I'm still a little bit above that, have been forced to take matters into their own hands to protect themselves because we don't know where any of this is going. But one thing we might have forgotten is using life insurance. Fortunately, Select Quote is here to help. If you're new to life insurance, you're not alone. For over 40 years, SelectQuote has helped more than 2 million Americans understand their options and get the coverage they need. More than $700 billion in coverage and counting. As a broker, their mission is simple. To find you the right insurance policy at the best price. Select Quote takes the guesswork out of finding the right insurance policy. You don't have to sort through dozens of confusing options on your own. Just get one of their license agents and they will find the right policy at the right price for you. Comparing plans from trusted top rated insurance companies to find a policy that fits your health, your lifestyle, your budget. And here's the best part. It's free. You'll be covered faster than you think. Select Quote works with providers who offer same day coverage up to $2 million worth with no medical exam required. And you're not out of luck if you have pre existing health conditions because Select Quote partners with companies that offer policies for people with conditions like high blood pressure, diabetes or heart disease. Life insurance is never cheaper than today. Get the right life insurance for you for less and save more than 50%@SelectQuote.com Lawfare save more than 50% on term life insurance@SelectQuote.com Lawfair today to get started. That's SelectQuote.com Lawfair delete me makes it quick, easy and safe to remove your personal data online At a time when surveillance and data data breaches are common enough to make everyone vulnerable. Data brokers make a profit off your data. It's a commodity. Anyone on the web can buy private details about you your name, contact information, Social Security number, home address, even information about your family members. It can all be compiled by data brokers and sold online. And that can lead to identity theft, phishing attempt and harassment. But now you can protect your privacy with Delete Me. I've said it before and I'll say it again. I have been using Delete Me since before they were ever an advertiser. With Lawfare, I have an active online presence. I'm out there. I make arguments that people off and sometimes there can be blowback for that. And my privacy really is important to me. I don't want people mucking around in my personality beyond that which I choose to make public. I've been a victim of identity theft. I've been harassed. I've never been doxed. But you know, I expect it sometime. And if you haven't, you probably know someone who has. Delete Me can help. So take control of your data and keep your private life private by signing up for Delete Me now at a special discount for Lawfare listeners. Get 20% off your Delete Me plan when you go to JoinDeleteMe.comLawfare20 and use the promo code Lawfare20 at checkout. The only way to get 20% off is to go to JoinDeleteMe.com Lawfare20 and enter code Lawfare20 at checkout. That's JoinDeleteMe.com Lawfare 20 code Lawfare20.
- [27:01]
Advertisement Voice
Oh, I'm not switching my team to some.
- [27:03]
Scott R. Anderson
Fancy work platform that somehow knows exactly.
- [27:08]
Advertisement Voice
How we work, and its AI features are literally saving us hours every day. We're big fans, and just like that, teams all around the world are falling for Monday.com with intuitive design, seamless AI capabilities, and custom workflows. It's the work platform Your team will instantly click with head to Monday.com, the first work platform you'll love to use this Back to School season One thing is clear. Kids need a way to stay connected between pickups, practices and after school activities. Having a phone is a must, but it shouldn't come at the cost of their mental health. The youth mental health cris crisis is growing and social media is a major driver. Teens are spending up to nine hours a day on screens and studies show a direct link to anxiety, depression and even suicidal thoughts. That's where Gab comes in. Gab offers kids safe phones and watches with no Internet or social media apps and just the right features for their age. From GPS enabled watches for younger kids to phones with parent approved apps for teens, Gab's tech in steps approach grows with your child. So this school year skip the adult phone. Get them Gab social connection without the risks. Visit gab.com getgab and use the code getgab for a special back to school offer. That's G-A-B b.com getgab gab tech in steps Independence for them, Peace of mind for parents this is Mike. Mike's stuck in traffic. The only thing that could make this worse is if he promised to cook his date dinner at 8. Which he did. But it's now 7:30 and he's still on the 5. Good thing Mike has Grubhub plus with Prime $0 delivery fees, 0 stress, 0 rush. Dinner's covered and so is his reputation. Free Grubhub Plus. It's on Prime. Additional terms and fees apply.
- [29:04]
Scott R. Anderson
So as you mentioned, they distinguish the Georgia 2 situation based on the systemic and planned nature of the filtration exercise. This was not a product of the chaos of armed conflict of war. This was a deliberate policy adopted by the Russian Federation as part of a policy and anticipated before entering into the war. Which is an interesting line of distinction. I want to actually circle back to that a little bit in a second. Before we do that, let's talk about okay, so now they're able to get to Article 8 and its impact on the filtration system. Or where do they actually get on their Deb, talk to us about what they actually say. Here's the parts of the filtration system that run into tension into conflict with Article 8 obligations. Here's where Russia went too far. Here's what they did violated it. Give us that granular nature about what they actually held.
- [29:55]
Deborah Howson Kuriel
The pivot point is as you're describing it, Scott, is really I Think the gateway, what's done with the data and how once privacy has been violated by Russian Federation, it's important to say the Russian military forces and affiliated forces. So we have this is a sidebar point, but it is important. It's not only the military, it's forces that are affiliated with Russia that have been duly, the court duly connects them up. So it's not only do we have the previous passing violations of Article 8 as really clearly violated by the feasibility measures, but these feasibility measures, I'll give it. Let's give a specific example. So a Ukrainian citizen, a non competent, comes through with her family, three kids, husband may be abstinent in a different place. Her cell phone is taken away, she's required to give the password, family photos, communications with her husband in a different place. Perhaps he sent some Petrishnava protests against Russia that he participated in. All of this is downloaded and put into the database all of her kids health records, her health records, et cetera, et cetera. So that's the first part of the answer to your question is absolute violation of Article 8. Absolutely clear. What the Russian forces then do with this massive database of personal information that's been collected from again, approximately a million people is really where I think the data privacy rights take on this additional dimension of how severe they are. The kids are separated from their mom. One or two out of the three may be sent for adoption in Russia. Their personal records go with them. They're sent to their new families, their adoptive families, or their families taking care of them, or even if they're in the detention center and the mother is taken to a detention center, perhaps tortured, perhaps detained, cut off from the rest of her family. So these additional violations and our imaginations can, not only our imaginations, but the documentation of what was done in this data can take us into all of these different contexts.
- [32:17]
Asaf Lubin
Just if I can, just two more important thoughts in regards to that very good account from Deb. So one of the reasons why this case is so foundational is because there's always been a feeling that to talk about dignitary right violations like the rights to privacy or the right to data protection or the right to cybersecurity in the context of gross human rights abuses, wartime abuses, where life and death is happening, destruction of property is happening, these all seem like secondary violation, auxiliary to the main violations that need to be focused on first. And I've written a lot about these issues. That's a common critique or comment I receive. And I think what this court case does by referring to it explicitly as gatekeeping is to suggest this idea that privacy is a linchpin. It's a point from which other violations could occur, because once you've collected the information is when you can take actions to, to detain, to torture, to separate, to annex, to destroy. And I think that that is a crucial finding that the Court is making that will set a precedent on the importance of privacy protection, data protection in an informational context. That's the first point, though just one other important point is that it's odd to talk about human rights law as the primary controlling regiment to which to think about these issues, given that the context is one of armed conflict and occupation, which is typically governed by a different set of rules, those found in the Geneva Conventions and Additional Protocols. And so on this point, the Court spends significant time dealing with what it is introducing as quote, harmonious interpretation. What the Court is saying is not that international humanitarian law or that body of law that governs wartime is the lex specialis, the specialized regime that derogates from the lex generalis the general regime of human rights law, but rather that the two regimes should be read concurrently with one another in an harmonious fashion. And it does so by building on Article 31 of the Vienna Convention of the Law of Treaties, which says that treaties should be interpreted in light of other international obligations. And so we interpret the human rights treaty regime in light of the IHL regime. And on this point, the delegate of Russia to the United Nations Security Council explicitly said that IHL doesn't have the word filtration in it. And so clearly IHL is just moot on the issue of is filtration lawful or unlawful? And for the Russians will operate under Alexis specialist conception that says it's only IHL all the time, and it derogates from human rights law, that should be the end, all be all. IHL is silent on privacy, and there is no privacy derived from human rights law to be applicable in war. The Court rejects, clearly rejects this position, explicitly citing to the UN delegate in the judgment, suggesting instead, the human rights law continues to apply and should be interpreted harmoniously with ihl. And on this point, if IHL is indeed silent on such concepts as privacy and data protection, indeed, the Geneva Conventions were written in 1949, long before any of these technologies came to be, that doesn't mean that our body of jurisprudence that is fitting to the digital age cannot come in and help in an harmonious, progressive interpretation of what legal obligations militaries and occupiers have in these contexts.
- [36:02]
Deborah Howson Kuriel
One of the weird things that comes on top of the oddity of using human rights as the entry point. And this is in a different context, but it was very strange to have the court refrain from any glance, interpretive glance, at the privacy rights that Ukrainian citizens may have enjoyed under Ukrainian law as a kind of standard for the law that the occupier should applied in looking at these rights. Now, maybe it's the second court case that we'll see in this respect, but it was very strange to have that vacuum and not even, you know, don't even go to the Ukraine, look at the Russian data privacy law and see sort of what those, what those standards. And again, we're relying on, I'm personally relying on translations of these laws, but looking to have the court refrain from even a sideways glance to see, well, let's see what a peacetime standard, minimum, minimum standard might look like and how military necessity might bump up against those standards, I think was very strange. And one of the critiques that we had of the decision of the judgment that that was not taken into account.
- [37:13]
Scott R. Anderson
So it's a very interesting framework that's been set up here, essentially establishing that even in armed conflict, there are substantial constraints on the ability to collect some sort of data. But I want to dig into or a lot of data, and it seems to me there's kind of a couple dimensions they seem to have problems with. You know, one is the mass nature of the collection data, the sheer scale of collection. Another is the depth, the degree to which they're gathering immense amounts of data about individuals. And a third is kind of the systematic element of it, the degree to which it is applied cohesively, even if not in a mass environment, very aggressively, to a whole kind of category of people. It also strikes me that there are activities that take place in armed conflicts regarding information collection that have been discussed or that are in some cases strike me as kind of routine, that don't look terribly different from elements of this. And at least, as I understand, although, correct me if I'm wrong, the terrible consequences that flowed from many things Russia did with this data, while the gateway concept, while relevant to the significance of privacy even in our conflict context, was in itself the basis for finding a violation. Right? It was the article 8 itself was a violation that was a justification for the significance of that armed conflict. So let me run through a couple hypotheticals. I'm curious about how the court would look at through this sort of framework. Let's talk about one that comes up a lot as a possibility as we look forward to future conflicts, which is the idea of collecting mass data on, for example, civilian populations in a conflict conflict zone, because we're in an era now where you could imagine a state that wants to exercise the use of lethal force in a manner that minimize impact on civilians, actually trying to collect a huge amount of data about a civilian population, let's say, in a given city where it's about to pursue a bombing campaign, so that they can say, we're going to document where every civilian goes every day over the last six months, and we're going to use AI or complicated computers and formulas to try and say, okay, here's where we can hit these targets at the exact windows, where it minimizes the likelihood that civilians are going to be there. But to get there, you got to collect a ton of data about where people act and where people go about their lives. How do you think this sort of framework would view that sort of exercise, which is one that would go towards greater compliance with a foundational principle of international humanitarian law, the principle of distinction? ASSAF why don't we start with you on that, and I'll come to you, Deb, after that to supplement.
- [39:46]
Asaf Lubin
So the court will first ask for some rudimentary baseline requirements, that is that you have an authority in law justifying the collection, that law is accessible and foreseeable, so that people can know that they are likely to be the target of possible collection. The law would require that there be a legitimate aim, which you have now laid out, a good legitimate aim aim for such collection to minimize civilian damage in the context of war. Sounds like a pretty legitimate aim, but that the collection has a nexus, that the mode of collection, the measures employed are in some connection with that aim, and where they are disproportionate to the aim, predominantly where there is a lesser intrusive means of achieving the same aim, you first should pursue that measure before adopting another. And so if there is a different way, less intrusive, less dragnet to achieve that measure, that is something the court would consider. But as it relates to this decision, the Court adds a set of procedural requirements which were also lacking for Russia here, or at least ones that Russia did not explicitly, because it was not a party to the proceeding, did not present to the court for it to rule on, and that is whether or not you employed measures so that only those with the right access credentials criteria can access the information that the data is stored for a particular period of time and can be deleted once it's no longer in use for achieving the same AIM rules around review and oversight to ensure that the data is not leaked or shared with others that should not have that access. And when harm are felt, when there is an abuse of any of these procedures, someone can seek remedy in the case of that abuse. So a set of both procedural and substantive obligations is what the Court's jurisprudence expects you to do across all of these scenarios. And so it is not and the Court has not. Both in a case called Centrum Fort Visa vis Sweden and a case called Big Brother Watch Vuk, the Court has not rejected the possibility of foreign mass surveillance. That is not what the Court does. Rather, the Court tries to identify whether in choosing to employ foreign mass surveillance, you've taken all the necessary precautions to avoid abuse and to ensure protection. Last thing I want to highlight is that all we've done so far is applied just the right to privacy in this context. There are other emerging rights in general international law, like the right to data protection, like the rights, and these are really emergent. The right to cybersecurity in the context of AI, the right to have decisions made about you with human supervision, the right to accessing the Internet. These are broader swaths of digital rights which could equally be implicated in various ways by different kinds of data collection regimes that militaries employ, for which the European Court of Human Rights has been silent so far in suggesting that those two somehow get triggered in the context of the right to privacy.
- [42:56]
Scott R. Anderson
So let me go to my next hypothetical, Deb. I'll direct this one towards you. Let's imagine you are in a situation where you are a war fighter or a lawyer advising war fighter, dealing with something that is an established part of the law of armed conflict, which is trying to engage in, for example, status determination tribunals like, is somebody a powder? Are they a combatant? Are they a civilian entitled to protection? The status of the individual is unclear. Whether they're deceiving themselves and the state, the authority in this case uses a variety of means to collect a huge depth of information from them. Capturing their cell phone, capturing their laptops, examining that information, those sorts of access points. Once you crack into those systems, it is hard to avoid collecting huge amounts of private information from. For these people, most people you got into my phone, you get a lot of information about me, right? What does this have to say about. Is it really about the protection and the balancing with the interests pursued? Is it saying it's not prohibitive? Do we give a sense about how they would approach that sort of circumstance and how they may reconcile it with what is a well established and even encouraged practice under international humanitarian law, which is trying to distinguish between civilians and POWs and engaging in an inquisitory process to determine status.
- [44:14]
Deborah Howson Kuriel
I think exactly the question that we were left with, having read the Court's decision and really needing to know the answers to how that balance is achieved. So sure, the advantages of using the data for purposes of distinction and the hypothetical that you gave earlier to SAF is absolutely a brilliant one because it's a happy ending, discounting everything that the qualification, but also sort of opening up a whole horizon to how we really can do a much better job with identifying status. On the other hand, even beyond the safeguards that you really needed the Court to provide to military advisors and military leaders to get into the actual practicalities of how this is done, there are additional unanswered questions. So I'm answering your question with a kind of another open question. We need to know, for example, for how long data, personal data that's needed to identify non competence is held. How is it held? What happens if it's breached? And what if it's breached by terrorist organizations outside of this realm of conflict and converted into different uses that haven't been foreseen even by the most meticulous military data? The collection campaign that we can imagine. There are too many unknowns and the end of the day the Court did not address even that uncertainty that you've raised. And it gets even more complicated and we're getting a little bit ahead of ourselves in terms of our time, the timeline, but not too far ahead. It's going to be easy very soon to collect DNA samples as a matter of routine, exactly at the points that you're describing of determining status and the full potential. That is another podcast entirely about how the integrity of personal data is maintained by whoever holds it. Beyond determining the status of POW civilian's competence, there are no criteria, no guidelines whatsoever that the Court has given or even a look at the question of how critical that exact point is.
- [46:26]
Asaf Lubin
Just to interject, the Court is at step zero because society is at step zero, that is to say, at the moment. Take the General Data Protection Regulation or even the more recent AI act from the European Union. In both of these scenarios, there is explicit carve outs for national security data collection or for national security AI activity. And so it is common in most data collection regimes to exclude the military, to exclude armed conflict situations. And for that reason, to the extent that militaries employed this, they have done this on either because they claim that the Constitution extends to early Germany, as German Constitutional court has said so, or because they've done so not as a matter of a legal obligation, but only as a matter of standardization domestically, we're looking at militaries to first take the step of articulating that they do into their military manuals, that they do have a legal obligation to protect data privacy, so that we can start debating how do we apply that obligation in various contexts. But we are not even at step zero yet, and that's definitely what the court has affirmed today. You need legal authority in order to engage in military data collection.
- [47:36]
Scott R. Anderson
Moving forward, we've got an idea about how this important European institution, which impacts a ton of countries, many close allies of the United States, many countries that are major powers in their own right in the global scheme, look through this, are going to have to look at this sort of issue to maintain their compliance with their treaty obligations and their general good standing in their broader community. But this is still holding by one treaty body relating to one set of obligations that is not universal. Talk to us about the significance of this in the broader scheme and to make it maybe more directly relevant to the, the center of gravity of our audience. Talk to me about why it matters to Americans, not just because their allies will care about this, although that is a good reason. But how do you see this impacting the trajectory of the understanding of broader systems of international law that bear on Americans and bear on conflicts outside of Europe?
- [48:32]
Deborah Howson Kuriel
We're both international lawyers and I think for me, I'll take it upon myself, but my starting point is international law law. So once we have jumping ahead to, you know, three European or other regional court decisions ahead, we're looking at ground zero of the development of customary law, either under IHL or under other specific, specific treaties to which the US May or may not be part. And I look to customary law into the starting in Europe with the evolution of, I would say, regional customs in wartime. And unfortunately, we have many examples of such, I see that customary norms will, will develop at a regional, on a regional level over time. It will take a while to get to US shores. But on the other hand, and I'm looking here to work that Assaf and I have done together, I've that we've done together in a book that Assaf edited co edited a few years ago on the personal data under military conflicts in coalition arrangements, such as the NATO coalitions, in which the US Is a strong participant, at least so far, there will be no choice other than to look at the evolution of first, a very practical military parameters for gathering data as the US cooperates with other militaries. And eventually I believe there'll be no option other than the US Military looking at these issues of data privacy in its own military manuals and practice.
- [50:05]
Asaf Lubin
I'll just add, so the ICJ and the wall advisory opinion over 20 years ago affirmed that the ICCPR obligation on the right to privacy applies in occupation. It said nothing more than that. And so the ICCPR, to which the United States is beholden to, is going to be interpreted in part by looking to the interpretation of the right to privacy and other instruments. And so that might come to the US shores indirectly through interpretations. And in fact, I worked at an organization called Privacy International. They sue governments for spying and we like to say internally in that organization that it's a death by a thousand footnotes. That is to say that once one court introduces that, another court will cite to that and another sort of building on on what Deb was describing as the evolution of either treaty interpretation or customary international law. But as Deb correctly mentioned, if you want to send American soldiers to train with German soldiers today, you have to take into account German standards of data protection because Germany will not allow German soldiers data to be shared with America only to be jeopardized in some way because the Americans are not to going complying with basic data protection standards in the coalition activity. And so it will be in our interest to at least be aware of what the European data protection standards are if we are ever to collaborate with Europeans in the future in all kinds of military contexts.
- [51:34]
Scott R. Anderson
It is really fascinating legal development for those of us who follow law firm conflict developments, who look at it through the lens of these emerging technologies. Thinking about this, I think it's absolutely interesting and I really appreciate your piece bringing this issue to my attention. Certainly as somebody who's not tried to tackle the 500 plus page opinion in much detail, other than skimming briefly other parts of it that I found interesting, but not this part admittedly Talk to me about what we should look for next if we're interested in this. These cases don't arise all that often. We're probably not going to get another seminal judgment about these issues set in the near future. Although correct me if I'm wrong, if there's something something on the horizon. But you mentioned there's work happening in academia and in intergovernmental bodies. Talk to us about that and where we should be looking for further development of this law along the lines that the court highlights and that you all have highlighted needs to happen.
- [52:24]
Asaf Lubin
So a lot of the locus for much of this analysis has happened within NATO bodies precisely because it invites multiple countries with diverging data protection regimes to collaborate together in some way that is uniform and standardized. So it's been truly an initiative of NATO across different domains tailored to the specific application context. So they have pushed for scholarship and analysis by practitioners for biometric data collection. They have a future book dealing specifically with data protection in the context of AI, which is emerging as an new technology in the context of armed conflict and more broadly. Deb had already mentioned that in 2022 they published a book on data protection and privacy in armed conflict. They are about to release in 2026 a practitioner guide that takes all of this academic work and tries to translate it to how a lawyer in the military can think about these issues. And they use an interesting color coding scheme between red, green and yellow on the levels of intensity of the fighting to what the data protection obligations should be trying to resolve precisely the kind of hypotheticals we have started to talk about today. But it will build 100% on nation states, incorporating some of these standards into their military manuals, into their military guidelines, and then trying to understand how those help shape a baseline of practice long before it bases baseline of legal interpretation. Because it will start from the ground up and because, as you suggested, I am not aware of any international court decision in the horizon to deal with this.
- [54:07]
Deborah Howson Kuriel
Well, Scott, I'm much more of a pessimist than a Seth. I'm looking to the first massive breach of such a database or even a military database, military collected database that will out extremely sensitive data. Unfortunately, as that curve, the curve of cyber attacks continues to rise. I think that that may be the trigger, as in so often another context, for the military legalists to really put their attention on this and get some practical applications underway, unfortunately.
- [54:44]
Scott R. Anderson
Well, that suggests to me that we'll have opportunity to talk about this more in the future. But for now we are out of time. Thank you you both for joining us here today on the Lawfare podcast.
- [54:52]
Asaf Lubin
Thank you very much.
- [54:53]
Deborah Howson Kuriel
Thank you very much, Scott.
- [54:57]
Scott R. Anderson
The Lawfare Podcast is produced in cooperation with the Brookings Institution. You can get an ad free versions of this and other Lawfare podcasts by becoming a Lawfare material supporter at our website lawfairmedia.org support. You'll also get access to special events and other content available only to our supporters. Please rate and review us wherever you get your podcasts. And look out for other podcasts including Rational Security Allies, the Aftermath and Escalation our latest Lawfare Presents podcast series about the war in Ukraine. In addition, check out our written work@lawfaremedia.org the podcast is edited by Jen Patch and our audio engineer. This episode was Kara Schillen of Go Rodeo. Our theme song is from Alibi Music. As always, thank you for listening.
- [55:40]
Advertisement Voice
This is Rose Rose's flight is delayed again. At this point, she has walked the entire terminal twice and has memorized every news headline on the airport tv. All she really wants to do is take off. Good thing Rose has a library of free ebooks with Prime. Suddenly she's chasing bad guys, kissing hot vampires, solving murders. You know, living her best life. Free ebooks library. It's on Prime.