Saul Formoso
email: saul.formoso@hpe.com

Massimo Felici
email: massimo.felici@hpe.com

Evidence-Based Security and Privacy Assurance in Cloud Ecosystems

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Cloud computing provides an alternative way of providing and using Information Technology (IT) that differs from traditional systems [1,2]. It can be characterized in terms of its main features [START_REF]The NIST Definition of Cloud Computing[END_REF], i.e. on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Alternative cloud computing deployments (e.g. public cloud, private cloud, and hybrid cloud) can accommodate different customer needs [1]. Alongside the new opportunities offered by cloud computing, there are new challenges related to security and privacy of data stored in the cloud [START_REF]Cloud Computing Benefits, risks and recommendations for information security[END_REF]. Cloud customers as well as cloud providers are concerned with such challenges. Security and privacy are therefore shared responsibilities among the parties involved in cloud supply chainsthat is, all actors that participate in the provision and consumption of cloud services.

In order to mitigate emerging security and privacy threats, consequently reducing risks in the cloud, different security and privacy controls are deployed across cloud supply chains [2]. Such security and privacy controls diffuse organisational boundaries as emphasised by the security conservation principle: "for a particular service migrated to the cloud, the full set of necessary Security Components and controls that must be implemented to secure the cloud Ecosystem is always the same; however, the division of responsibility for those Components and controls changes based upon the characteristics of the cloud, particularly the service deployment." [2].

This paper is related to the Cloud Accountability Project, which has defined an approach and related mechanisms for accountability in the cloud [START_REF] Felici | Accountability for Data Governance in the Cloud[END_REF]. In particular, this paper looks into how different technologies are deployed in order to support security and privacy in a cloud ecosystem -"A cloud computing business ecosystem (cloud ecosystem) is a business ecosystem of interacting organisations and individualsthe actors of the cloud ecosystemproviding and consuming cloud services" [START_REF] Felici | Cloud Accountability: Glossary of Terms and Definitions[END_REF]. Although the security and privacy controls are easy to identify, it is yet challenging to assess their effectiveness operationally. There is yet a lack of support for assessing how such technologies work as a whole and how they are appropriate for the specific cloud ecosystems they are deployed in. It is necessary to understand how security and privacy controls enable organisations to comply with high level policies (drawn from relevant regulatory regimes).

This paper is structured as follows. Section 2 highlights relevant security and privacy research and industry practices, which provide a background to the research and development work presented here. The problem is then to provide evidence-based assurance that security and privacy controls are appropriate and operationally effective for the cloud ecosystems they are deployed in. Section 3 characterises the problem of security and privacy assurance in cloud supply chains. Section 4 discusses mechanisms that are necessary in order to implement evidence-based assurance in practice. These mechanisms have been used for tailoring a software defined storage system for the cloud in order to gather evidence related to the security and privacy controls deployed in the ecosystem. The evidence collected supports assurance and eases auditing the cloud supply chain. This aims to map the security and privacy controls deployed in the cloud supply chain for monitoring and auditing purposes. Section 5 explains the resulting implementation for evidence-based assurance in the context of a use case demonstrator drawn from the Cloud Accountability Project. This shows how the implemented system is useful in order to support assurance. An example explains how two sample SLAs between different cloud actors can be monitored. To sum up, this paper provides practical insights for implementing and supporting evidence-based assurance for security and privacy controls in cloud ecosystems.

Security and Privacy Practices

Cloud environments, due to their different nature, have an additional set of security and privacy requirements compared to traditional systems [1,2]. While traditional systems require a large emphasis on the infrastructure, cloud computing focuses mainly on the provision of the services, relegating the former to a secondary level. Cloud environments' inherent ubiquity brings along security and privacy risks that need to be addressed (e.g. broad, network access, decreased visibility and control by customers, multi-tenancy, data residency, etc. [2]). These have originated practices, certification schemes (including guidelines), and technologies.

As this is a topic of increasing interest, there are research projects putting effort into complying with the aforementioned requirements. The main point is that in order to support security and privacy, it is necessary to adopt diverse mechanisms, from technical tools to process-oriented approaches, including certification and auditing. A brief overview of security and privacy practices, in particular, frameworks, certification schemes, technologies, and research projects, is provided hereunder:  Frameworks: different frameworks capture industry best practices that guide stakeholders in order to enhance security and privacy in operations. For example, at the architectural level, it is possible to identify different security controls that organisations need to implement [2]. From a management viewpoint, it is possible to identify critical processes (e.g. security risk assessment and privacy management) that address the mitigation of security and privacy threats [START_REF]Privacy Management Accountability Framework[END_REF].



Assurance in Cloud Ecosystems

This section points out the role of evidence in supporting assurance. In particular, it recalls the concept of accountability which highlights the responsibilities of an organisation in order to be accountable [START_REF] Felici | Accountability for Data Governance in the Cloud[END_REF]. This is central to the concept of accountability [START_REF] Felici | Cloud Accountability: Glossary of Terms and Definitions[END_REF]: "Accountability for an organisation consists of accepting responsibility for data with which it is entrusted in a cloud environment, for its use of the data from the time it is collected until when the data is destroyed (including onward transfer to and from third parties). It involves the commitment to norms, explaining and demonstrating compliance to stakeholders and remedying any failure to act properly". Underpinning the concept of accountability is the provision of an account, which involves the gathering of evidence supporting organisational practices. This section then discusses the problem of assurance in a sample cloud supply chain. This discussion helps clarifying the requirements for supporting security and privacy assurance in cloud ecosystems.

Evidence-Based Accountability

The Cloud Accountability Project points out the need for evidence-based accountability in order to support the assessment of whether adopted security and privacy solutions (e.g. technologies, processes, etc.) are suitable for the specific cloud ecosystems, and hence provide assurance [START_REF] Felici | Accountability for Data Governance in the Cloud[END_REF]. Cloud ecosystems involve various actors with different responsibilities. Emergent relationships among cloud actors give rise to the need for chains of evidence -"A process and record that shows who obtained the evidence; where and when the evidence was obtained; who secured the evidence; and who had control and possession of the evidence" [START_REF] Felici | Cloud Accountability: Glossary of Terms and Definitions[END_REF] and evidence in terms of organisational practices. On the one hand, it is necessary to validate gathered evidence and trace its source. On the other hand, evidence (is transformed and) propagates across system and organisational boundaries. From a technical viewpoint, evidence is considered among the three fundamental capabilities of an accountable system [START_REF]ENISA: Privacy, Accountability and Trust -Challenges and Opportunities[END_REF]:

 Validation: "It allows users, operators and third parties to verify a posteriori if the system has performed a data processing task as expected"  Attribution: "In case of a deviation from the expected behaviour (fault), it reveals which component is responsible"  Evidence: "It produces evidence that can be used to convince a third party that a fault has or has not occurred".

Therefore, gathering evidence has a critical role in supporting assurance -"Assurance is about providing confidence to stakeholders that the qualities of service and stewardship with which they are concerned are being managed and maintained appropriately" [START_REF] Baldwin | Enterprise Information Risk Management: Dealing with Cloud Computing[END_REF]. This is also particularly important while dealing with emergent threats [START_REF] Csa | The Notorious Nine Cloud Computing Top Threats in 2013[END_REF] due to a certain extent to the shift required while deploying new technological paradigms like cloud computing.

3.2

Example of Cloud Supply Chain Fig. 1 shows a sample supply chain involving different actors: a cloud customer and two cloud service providers. The emergent relationships among actors form cloud supply chains defined in terms of cloud roles [START_REF] Felici | Accountability for Data Governance in the Cloud[END_REF]. From a data protection perspective [START_REF] Pearson | Accountability in Cloud Service Provision Ecosystems[END_REF], cloud actors also have different roles and responsibilities (i.e. data subject, data controller, and data processor).

It is challenging to support operational compliance to policies and regulations. Security and privacy depend on the operational effectiveness and appropriateness of deployed controls and their dependencies. It is desirable to build and maintain dynamic assurance cases of security and privacy controls (providing security and privacy assurance of the cloud supply chain through continuous monitoring). The following points characterise some aspects of assurance in cloud supply chains (Fig. 1):

1. Different security and privacy controls are deployed across a cloud supply chain. 2. It is challenging to provide transparency and assurance to cloud customers. 3. It is necessary to provide technological solutions to support continuous assurance. 4. Operational evidence of security and privacy controls is required to provide assurance. This evidence can then be used for certification.

Fig. 1. Assurance in a cloud supply chain

Throughout the cloud supply chain, cloud actors share the overall responsibility of security and privacy. These objectives are achieved and supported by adopting and deploying different security and privacy technologies (as depicted in Fig. 1). Such technologies provide different support within and across cloud actors' domains. The problem then is how to provide assurance that the adopted technologies as a whole support security and privacy objectives across the supply chain, that is, how to provide supporting evidence that the adopted security and privacy technologies are appropriate and effective for the specific cloud supply chain.

Implementing Assurance

Keeping in mind what has been introduced so far, this section discusses various aspects of implementing assurance in cloud supply chains, that is, emerging technical considerations to be addressed while implementing a system supporting assurance. System functionalities that support assurance for the whole cloud supply chain are discussed. Notice that specific technical points are not implementation steps to follow, but rather insights which aim to inform on how assurance can be implemented in a concrete scenario.

Evidence of Cloud Controls

Cloud service providers often work together (e.g. sub-contract services or relies on third-party resources constrained by specific service level agreements) in order to provide specific services to cloud customers. This may result in complex cloud supply chains involving several cloud service providers working jointly (as depicted in Fig. 1). In a cloud supply chain, security is therefore a shared responsibility among the actors involved. Cloud providers deploy different security and privacy controls in order to guarantee critical service features.

In order to support accountability, cloud providers need to gather evidence as proof that security and privacy controls are effective and suitable in addressing emerging threats. Cloud providers can then be entrusted with sensitive data. Table 1, for example, lists some controls drawn from the CSA Cloud Control Matrix v3.0.1 [START_REF][END_REF], in particular, controls from two different domains: Data Security & Information Lifecycle Management, and Supply Chain Management, Transparency, and Accountability. Similarly, the NIST Cloud Computing Security Reference Architecture identifies a list of controls (requirements) to mitigate security risks [2].

However, both NIST and CSA aim mitigating security risks from a high-level perspective, providing no guidelines on which operational aspects of controls should be supervised and which data should be stored in order to prove that deployed controls are effective and suitable in addressing emerging threats. Therefore, a specific set of controls and associated (type of) evidence should be defined for each specific cloud environment. However, independently of any cloud environment, it is possible to build a general framework that will ease the task of managing these controls and evidence.

It is necessary that each security and privacy control clearly defines which (type of) evidence it requires to be gathered in a cloud supply chain. Evidence should focus on operational aspects of deployed controls that need to be monitored. If such evidence is not produced, controls cannot be regarded as supporting security and privacy objectives (e.g. in terms of compliance with security and privacy policies). The proposed Cloud-Trust Protocol (CTP), for example, provides a basic mechanism for sharing evidence across cloud supply chains [START_REF]CSC: A Precis for the CloudTrust Protocol (V2.0)[END_REF], hence supporting transparency in the cloud. All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated.

Supply Chain Management, Transparency and Accountability: Supply Chain Metrics

STA-07

Policies and procedures shall be implemented to ensure the consistent review of service agreements (e.g., SLAs) between providers and customers (tenants) across the relevant supply chain (upstream/downstream). Reviews shall performed at least annually and identity non-conformance to established agreements. The reviews should result in actions to address service-level conflicts or inconsistencies resulting from disparate supplier relationships.

Control-Evidence Data Model

As discussed in the previous section, it is necessary to associate controls to evidence about them. Such evidence can be gathered in a dedicated permanent storage platform (e.g. a software defined storage). There should be an entity in charge of creating, reading, updating, and deleting these controls and relating them to specific evidence. The same entity would also be in charge of the transactions to and from the storage platform. We will call this entity Control Manager. Our proposed implementation framework will hence include three main classes: 1) Control Manager, 2) Control, and 3) Evidence Item. Fig. 2 provides a diagrammatic representation of the proposed data model.

Each Control Manager may handle several Controls, and each of these may have different types of Evidence Items associated with it. Note that the same type of Control may be configured differently in operation, hence, it may be necessary to store different types of evidence. The only way to associate Controls and Evidence Items should be through a Control Manager. While instantiating specific controls, changes will be immediately applied to the storage platform. A Control Manager may also include some metadata defined by the cloud actor using the Control Manager. This metadata, for example, may include information about specific instances of controls which it handles and their associated types of evidence. The Control Manager should be able to communicate directly with the storage platform via a dedicated Application Program Interface (API). Finally, an Evidence Item is a collection of information that needs to be kept for a Control to support auditing. It can be regarded as a wrapper for the required information. Its contents are, a priori, not of interest for the Control Manager. On the contrary, they will be necessary for an auditor to grant that the deployed set of controls is suitable and effective in order to mitigate security and privacy threats. As with Controls, an Evidence Item may include user-defined metadata (e.g. type of evidence stored such as log file, configuration file, performance metrics, who generated it, etc.).

Roles in Providing Assurance

A cloud supply chain will need to meet certain controls to prove its accountability. These controls require evidence as proof of their fulfilment. As it was mentioned previously, it is necessary that there exists some permanent storage platform in the cloud supply chain where this evidence will be stored. This responsibility will be assigned to one cloud provider. This storage platform should be accessible by the other providers in the cloud supply chain, as this is where they will store their Evidence Items. It should count with the required security measures to guarantee confidentiality, integrity, and availability (e.g. access control, encryption, backups, etc.). Fig. 3 shows a sample cloud supply chain in terms of actors and their associated responsibilities in sharing and contributing to an evidence storage for controls.

In this example, different controls (numbered 1 to 5) are deployed to guarantee security and privacy of data. The evidence associated with them is stored in specific locations which are managed according to the responsibilities in the cloud supply chain. In this example, Cloud Provider A is in charge of managing a software defined storage platform, as well as it is responsible for providing the evidence for controls 1, 2, and 3. On the other hand, Cloud Provider B (subprovider) is only responsible for providing the evidence for controls 4 and 5, which are the ones that affect it. Once that all the evidence is produced, Cloud Provider A is able to reason over it and, if everything is correct, eventually demonstrate to the Cloud Costumer that all the controls are implemented adequately, hence providing assurance.

Fig. 3. Sample cloud supply chain

Evidence Access

As depicted in the previous section, specific Evidence Items are to be provided by specific cloud providers. The access to this evidence should be limited only to the providers who are responsible for them (and, when appropriate, to the auditors).

A Control may require several Evidence Items in order to be considered complied with. These Evidence Items could be supplied by different cloud providers. In this case, it would be desirable that each provider is only allowed access to its related Evidence Items and no others, hence preventing them from being tampered with by unrelated providers. This scenario is shown in Fig. 4, where Control B requires evidence coming from two different sources. Evidence Items 4 and 5 should only be accessed by Cloud Provider A and Evidence Item 6 only by Cloud Provider B. In this case, an object-level access control is required.

Fig. 4. Desirable requirements for access control

Three of the major software defined storage platforms -OpenStack Swift, Google Cloud Storage, and Amazon S3have a two-level hierarchy where the upper level serves as a container 4 for the objects which contain the relevant information to be stored. One can think of a container as a folder where only files (objects) can be stored, not allowing nested folders. The finest granularity that some software defined storage platforms allow (for example, OpenStack Swift [START_REF] Arnold | OpenStack Swift[END_REF]) is per container. This means that a user who is granted access rights to a specific container (Control) may then access all its objects (Evidence Items)depicted in Fig. 5. In order to support object-level access control, additional security mechanisms that allow finer access granularity are required.

Fig. 5. Access control using OpenStack Swift

Alongside access control, there are other security and privacy concerns that need to be addressed. As an example, integrity checks must be enforced in order to guarantee that the Evidence Items kept in the software defined storage platform have not been tampered with. Enabling monitoring of events at the object level could be useful in small scenarios. However, this may involve dealing with a remarkable amount of data in large scenarios, making it a hardly scalable solution.

In scenarios where two different cloud providers need to share the same Evidence Items, there is a risk of data aggregation. If this situation is likely to arise, additional mechanisms which filter the shared information to specific actors should be implementedfor example, transparency logs [START_REF] Pulls | Preserving Privacy in Transparency Logging[END_REF].

An Assurance Use Case

The main goal for the Cloud Accountability Project (A4Cloud) is to increase trust in cloud computing by devising methods and tools, through which cloud stakeholders can be made accountable for the privacy and confidentiality of information held in the cloud. Among other milestones, it has specified an accountability model for cloud supply chains ( [START_REF] Felici | Accountability for Data Governance in the Cloud[END_REF]) and several tools to support accountability have been implemented. In order to prove the application of the accountability model and related tools, a demonstrator scenario has been developed [START_REF]Deliverable "D38.2 Framework of evidence (final)[END_REF]. In this section, we recall this scenario in order to explain a realistic situation where the system depicted in the previous sections can prove useful.

Wearable Service Use Case Explained

Wearable Co. is a manufacturer of wearable devices that collect well-being data from its wearers. It uses the SaaS5 provider Kardio-Mon to provide additional services to its customers. Kardio-Mon integrates Map-on-Web's services into their own. Kardio-Mon and Map-on-Web use the IaaS 6 provider DataSpacer to run their services. This scenario is depicted in Fig. 6, where the interactions among the different actors have been numbered. For the sake of simplicity, only interactions between two actors have been considered.

These interactions are subject to be monitored (implementing controls), either continuously or occasionally. The evidence collected to support this process, supplied by the different cloud providers, will be stored in an OpenStack Swift server whose administrator will be Kardio-Mon. The reasons to use this platform are that the demonstrator scenario for the Cloud Accountability Project uses an OpenStack deployment and also because it is open-source. In the event of having an external auditor to audit these controls, she will require access to read this evidence. Fig. 6 shows also the access permissions 7 for all actors involved in the demonstrator use case.

An Assurance Example: Implementing SLAs

Given the scenario presented in the previous section, let's consider an example where service level agreements (SLA) among the different cloud providers are to be implemented and reviewed, as defined in control STA-07 from the CSA Cloud Control Matrix v3.0.1 (see Table 1). Each SLA will be considered as a separate Control.

For the sake of simplicity we will ignore one of the cloud providers (Map-On-Web) and we will focus on the SLAs between 1) Wearable Co and Kardio-Mon and 2) Kardio-Mon and DataSpacer. The case of having an external auditor in the system will also be considered.

As specified previously, Kardio-Mon will be the OpenStack Swift server administrator. Each Controlone per SLAneeds to be associated with a container in Open-Stack Swift. These will be named STA-07-SLA1 and STA-07-SLA2. Kardio-Mon is responsible for creating them and for granting the expected access rights. Let's consider that each Control requires only three Evidence Items to support its proper operation: 1) the SLA definition, 2) some performance metrics, and 3) some operation logs.

Let's consider that Kardio-Mon is the cloud provider in charge of supplying the SLA definitions and the updated performance metrics. The logs are to be supplied by the cloud provider running the service. This means that Kardio-Mon is responsible for all the Evidence Items from Control STA-07-SLA1 and for the SLA definition and performance metrics for STA-07-SLA2. With respect to DataSpacer, it should only provide the logs for STA-07-SLA2. This scenario is depicted in Fig. 7. As an auditor is to be expected to join the scenario, her access rights should be set in OpenStack Swift. She should be granted reading permissions to all the Controls. On a different note, the role of Wearable Co is limited to cloud customer, hence not being part of the cloud. Therefore, it should have no access rights whatsoever to the storage platform. All the access rights are collected in Fig. 8.

Fig. 8. Access rights for the different actors

Wearable Co is the one who, ultimately, is interested in receiving assurance that the data that it puts in the cloud will be adequately protected using privacy and security measures. This assurance may be provided by an external auditor or by an auditor within the cloud environment. In the latter case, one of the cloud providers should act as an auditor, providing comprehensive assurance about the cloud supply chain to the customer. Note that this system can be used as well for such internal auditing.

Concluding Remarks

This paper has briefly discussed security and privacy assurance in cloud ecosystems and provided some guidelines on how it can be implemented throughout a cloud supply chain. The controls to be set should be associated with evidence that supports compliance with security and privacy policies. This evidence should be saved in a permanent storage platform accessible to the different could providers.

The discussion provides a rationale for the assurance problem in the cloud and highlights some preliminary requirements. In order to provide support for security and privacy assurance throughout the cloud supply chain, it is necessary:

1. to regard security and privacy solutions as deployed across the cloud supply chain rather than from a single organisation viewpoint, 2. to design and implement means for supporting assurance, 3. to understand emergent dependencies among security and privacy solutions deployed in cloud ecosystems, 4. to assess how security and privacy solutions comply with (or enable to comply with) organisational as well as regulatory policies, 5. to gather operational evidence that supports security and privacy assurance across the cloud supply chain.

A system that can help gather and classify assurance evidence and control which users can access it is also introduced. This system can ease auditing the cloud supply chain, eventually contributing to providing security and privacy assurance.

Future research and development activities will focus on continuous monitoring of the cloud supply chain in order to address the security and privacy risks as soon as they arise, hence avoiding jeopardizing its assurance.

Fig. 2 .

 2 Fig. 2. Proposed Control-Evidence data model

Fig. 6 .

 6 Fig. 6. Wearable service use case: environment and storage platform with access permissions

Fig. 7 .

 7 Fig. 7. Example of a cloud environment with SLAs in place

Certification Schemes: ENISA

	released the Cloud Certification Schemes Meta-
	framework (CCSM) that classifies the different types of security certifications for
	cloud providers [8]. This metaframework is used to compare and compile a list
	(CCSL, Cloud Certification Schemes List) of different cloud certification schemes
	and map detailed security requirements to security objectives existing in them. The
	overall objective is to make the cloud transparent for cloud customers, in particular,
	in the way cloud providers meet specific security objectives. Relevant examples
	are the CSA STAR Certification and the ISO/IEC 27017 (cloud security) and
	ISO/IEC 27018 (cloud privacy) standards.
	 Technologies: among the various security and privacy technologies, Security In-
	formation and Event Management (SIEM) technologies have a critical role in mon-
	itoring operational security and supporting organisations in decision-making.
	These can be deployed to monitor computational resources in a cloud ecosystem,
	generating evidence that can be used to prove that security and privacy controls are
	complied with. Gartner reviews the most widely adopted SIEM technologies (e.g.
	Hewlett Packard Enterprise's ArcSight, IBM Security's QRadar, McAfee's Enter-
	prise Security Manager, etc.) in industry [9].
	 Research: recent and ongoing research projects (with a particular attention to Eu-
	ropean projects) have been concerned with providing the conceptual and techno-
	logical foundations underpinning the European Cloud Computing Strategy [10].
	For example, research has focused on accountability (A4Cloud 1 ), data sharing
	agreement (CocoCloud 2 ), security assurance (MUSA 3 ), certification, and many
	other aspects of security and privacy. This highlights an increasing interest in
	providing assurance in the cloud.

Table 1 .

 1 Examples of controls from the CSA Cloud Control Matrix v3.0.1

	Control Domain	CCM V3.0	Updated Control Specification
		Control ID
	Data Security & In-	DSI-01	Data and objects containing data shall be assigned a
	formation Lifecycle		classification by the data owner based on data type,
	Management: Clas-		value, sensitivity, and criticality to the organization.
	sification
	Data Security & In-	DSI-04	Policies and procedures shall be established for the la-
	formation Lifecycle		beling, handling, and security of data and objects
	Management: Han-		which contain data. Mechanisms for label inheritance
	dling / Labeling /		shall be implemented for objects that act as aggregate
	Security Policy		containers for data.
	Data Security & In-	DSI-06
	formation Lifecycle
	Management: Own-
	ership / Stewardship

http://www.a4cloud.eu/

http://www.coco-cloud.eu/

http://www.tut.fi/musa-project/

SaaS: Software as a Service.

IaaS: Infrastructure as a Service.

Note that each control will be associated with a container in OpenStack Swift.

Acknowledgements. This work has been partly funded by the European Commission's Seventh Framework Programme (FP7/2007-2013), grant agreement 317550, Cloud Accountability Projecthttp://www.a4cloud.eu/ -(A4Cloud).


Felix Bieker
email: fbieker@datenschutzzentrum.de

Walther Schücking

United Kingdom

Keywords: Investigatory Powers Tribunal, GCHQ, NSA, RIPA, Draft Investigatory Powers Bill, Mass Surveillance, Privacy, Snowden Documents, Europe-

d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The documents leaked by Edward Snowden in 2013 informed the general public about the practices of the US National Security Agency (NSA) and its UK counterpart, the Government Communications Headquarters (GCHQ) to tap into electronic communications on a massive scale. This case comment, as the judgments analysed, will focus on the major programs: With its Upstream program the NSA accesses in-formation from fibre-optic cables, while under its Prism program it obtained access to the networks of technology companies such as Google, Microsoft, Facebook and Apple for in-depth surveillance of online communication [START_REF] Greenwald | NSA Prism program taps in to user data of Apple, Google and others[END_REF]. This information is shared with GCHQ [START_REF] Hopkins | UK gathering secret intelligence via covert NSA operation[END_REF], which in turn shares information it gathers in its own mass surveillance program: Tempora enables GCHQ to access the fibre-optic cables transporting internet traffic and phone calls, which cross the British isles [START_REF] Macaskill | GCHQ taps fibreoptic cables for secret access to world's communications[END_REF].

In the meantime, further details about surveillance programmes of both the NSA and GCHQ, as well as similar programmes of inter alia the French intelligence services, have become public [START_REF] Chrisafis | France 'runs vast electronic spying operation using NSA-style methods[END_REF]. Additionally, cooperation between NSA and other European intelligence services, such as the German BND, has been in the focus [START_REF]BND leitet massenhaft Metadaten an die NSA weiter[END_REF][START_REF] Mascolo | Zusammenarbeit zweier Geheimdienste -Codename "Eikonal[END_REF].

However, as only Tempora and Prism/Upstream have been subject to judicial scrutiny, the present article will address these programmes. The UK Investigatory Powers Tribunal (IPT or the Tribunal) as well as the European Court of Human Rights (EC-tHR) were asked to rule on the compatibility of these programmes with the European Convention on Human Rights (ECHR), namely the right to privacy as guaranteed by Article 8 ECHR [START_REF]IPT: Liberty and Others v[END_REF][START_REF]IPT: Liberty and Others v[END_REF][START_REF]IPT: Liberty and Others v[END_REF][START_REF]IPT: Liberty and Others v[END_REF][START_REF] Ecthr | Big Brother Watch and others v. the United Kingdom[END_REF][START_REF] Ecthr | the United Kingdom[END_REF].

In line with this Summer School's topical question concerning the need for a revolution, this case comment analyses the judicial response to the Snowden revelations. As a substantial amount of time has passed since the first revelations on the activities of GCHQ, the question is whether the existing legal framework is apt to provide sufficient remedies for these actions or whether they require a revolutionary reform. In the following, this article will set out the UK legal framework for the exchange of information with other intelligence services and the operation of interception of communications by GCHQ [START_REF] Hopkins | UK gathering secret intelligence via covert NSA operation[END_REF], detail the requirements of the ECHR with regard to measures of secret surveillance [START_REF] Macaskill | GCHQ taps fibreoptic cables for secret access to world's communications[END_REF] and focus on the proceedings before the IPT (4). It will then critically evaluate the Tribunal's findings [START_REF]BND leitet massenhaft Metadaten an die NSA weiter[END_REF] and in an outlook turn to the proceedings instigated before the ECtHR, to provide guidance on possible outcomes and outline efforts to reform the regime of surveillance as well as judicial oversight [START_REF] Mascolo | Zusammenarbeit zweier Geheimdienste -Codename "Eikonal[END_REF], before drawing final conclusions [START_REF]IPT: Liberty and Others v[END_REF] on this matter.

2

The UK Legal Framework

The Mission of the Intelligence Services

According to Section 3 of the Intelligence Services Act (ISA), GCHQ is competent to monitor electronic signals and gather information relating to national security, the economic well-being of the United Kingdom and to support the prevention and detection of serious crime. Under Section 4(2) ISA it is for the Director of GCHQ to ensure that information is obtained only in as far as it is necessary for the proper achievement of its functions. Similar clauses are contained in the relevant provisions for the Security Service, also known as MI5, and the Secret Intelligence Service, better known as MI6. All information obtained by an intelligence service may be used in relation to any of its functions, as emphasized by Section 19 [START_REF] Hopkins | UK gathering secret intelligence via covert NSA operation[END_REF] Counter-Terrorism Act.

2.2

Measures of Secret Surveillance

Measures of secret surveillance and their review are laid down in the Regulation of Investigatory Powers Act (RIPA). Section 1 RIPA contains a general prohibition of any interception of communications, unless there is an interception warrant as prescribed by Section 5 RIPA. In order to obtain such a warrant GCHQ must apply to the Secretary of State under Section 6 RIPA, who may order the interception and disclosure of communications during their transmission in the interests of national security, the economic well-being of the United Kingdom or the prevention and detection of serious crime. According to Section 5(2) RIPA the Secretary of State has to believe that the warrant is necessary and proportionate to achieve one of these goals.

Interception warrants based on national security or the economic well-being are valid for six months, those relating to the detection and prevention of serious crime for three. Both kinds may be repeatedly extended for another six or three months, respectively, according to Section 9(1) and ( 6) RIPA, if the Secretary of State believes that this continues to be necessary for the reasons set out under Section 5(3) RIPA.

Section 8 RIPA then distinguishes between targeted and strategic warrants: targeted warrants under Section 8(1) RIPA are directed against specific individuals or premises. Strategic warrants according to Section 8(4) and ( 5) RIPA concern the interception of external communications, which is of interest here. This term is defined in Section 20 RIPA as any communication, which is either sent or received outside the United Kingdom. As, on a technical level, such a differentiation is not possible, the interception entails a two-step process: firstly, all communications are intercepted. In a second step, intercepted material may only be processed where it has been verified that its examination is necessary for the reasons of Section 5(3)(a-c) RIPA and it is believed that the person concerned is not within the United Kingdom, as prescribed by Section 16 RIPA As a safeguard, Section 15 RIPA demands that any information obtained under Section 8 RIPA must be made accessible or distributed only as much as necessary and be destroyed once this is no longer the case. Under Section 15(4)(a) RIPA necessity means that it is likely that the information is needed for the any of the purposes of Section 5(3) RIPA, i.e. national security, the economic well-being or the detection and prevention of serious crime.

3

Requirements of the ECHR

As any national legislation, the RIPA regime has to adhere to the human rights requirements of the ECHR, as implemented by the Human Rights Act. It is not the task of the ECtHR to review national legislation in abstracto, but rather to assess whether the application of a law gives rise to a violation of the Convention. This is due to the fact, that the ECtHR is competent to interpret the ECHR under Art. 32(1) ECHR, while it is the task of national courts to interpret national legislation. Thus, in order to lodge an individual complaint under Art. 34 ECR, the applicant has to submit that he or she is directly affected by the measure concerned. However, when it comes to measures of secret surveillance, this requirement has to be adjusted, as -due to the very nature of the measure -the individual concerned is unaware whether he or she is affected. Consequently, an applicant can possibly be affected by a measure either because he or she belongs to a group of persons targeted by the legislation or because the provisions directly affect all users of a communication service as the communications are intercepted in bulk [13, para. 171]. In a second step, the standard of review by the ECtHR depends on the availability of remedies to persons suspecting to be subjects of secret surveillance: if such remedies are not available, the sole menace of surveillance is a direct interference with the rights of the ECHR. In contrast, if there are effective remedies available, the applicant must demonstrate that due to his or her personal situation he or she is potentially at risk. Article 8 ECHR is the relevant provision for the questions at hand in this case, as it protects the private life of a person. The provision itself contains various individual rights, which are all related to the notion of private life.

Most relevant here is the right to privacy, as enshrined in Article 8(1) ECHR: the right to privacy awards protection from measures of surveillance even beyond a person's home [14, para. 27]. This includes individual communications, whereby e.g. communications by telephone are protected as correspondence as well as under aspects of privacy [14, para. 28]. An interference with the right to privacy occurs, where measures to obtain information are used by the State, inter alia measures of secret surveillance [15, para. 41]. With regard to the protection of personal correspondence it is not necessary that contents are accessed -even where only metadata, i.e. data concerning the subscriber, the receiver, the time and duration of a communication, are made accessible to public authorities there is an interference [16, paras. 83 et seq.].

Article 8(1) ECHR further includes the right to the protection of personal data as a subcategory of the right to privacy [17, § 22 para. 10]. Each collection, storage or processing of such data constitutes a separate interference with this right [18, para. 48].

Like most rights of the ECHR, Article 8 it is not an absolute right, but may be restricted in accordance with the justifications clause of Article 8(2) ECHR. It may inter alia be restricted with regard to national security, the economic well-being of the State and for the prevention of serious crime, if the restriction is accordance with the law and necessary in a democratic society. The ECtHR has introduced specific requirements concerning the quality of a law in order to justify interferences under Article 8(2) ECHR: while the provisions do not necessarily have to be statutory law, they have to be sufficiently accessible and foreseeable [18, para. 67; 19, para. 76]. Particularly with regard to measures of secret surveillance there can be no unfettered discretion of public authorities; there must be limitations in order to allow for the review of such acts [19, para. 78]. Further, there have to be sufficient signposts to enable individuals to foresee on an abstract level, when they may become subjects of surveillance measures in order to prevent arbitrariness in the exercise of these powers [15, paras. 42 and 49]. While this must not be read as an obligation to inform an individual of specific surveillance measures -which, of course, would be detrimental to their very purpose -there have to be sufficient and effective safeguards against abuse [16, para. 67]. Measures striving to protect national security must not undermine or even destroy democracy [15, paras. 49

et seq.].
Accordingly, there can be no indiscriminate collection of data without provisions limiting the powers of a secret police [20, paras. 57 et seq.]. In its seminal Weber decision, the ECtHR set out specific requirements for telephone-tapping: the law has to define the offences which may trigger surveillance measures as well as the persons potentially affected by such measures [21, para. 95]. Further, limitations as to the duration of the measures and the procedure of processing the data have to be laid out. Lastly, there have to be safeguards with regard to the sharing of the data and their proper destruction.

Regarding a measure's necessity in a democratic society, the ECtHR generally awards the Contracting Parties a wide margin of appreciation when it comes to measures concerning national security [18, para. 59]. As the ECHR is an international treaty between 47 European States, it is intended to provide a minimum standard for the protection of fundamental rights. In order to accommodate the different political systems and to respect the national sovereignty of the Contracting Parties, the ECtHR allows them a certain amount of discretion in justifying national measures which interfere with fundamental rights. This discretion varies, depending on the measure and the area of concern. However, the ECtHR has embraced the approach of the European Court of Justice to apply a test of strict necessity in the assessment of secret surveillance measures, due to their great potential for abuse [22, para. 73].

As a last step, the assessment of proportionality calls for the striking of a balance between the interest of national security and the effect of secret surveillance measures on an individual [21, para. 106]. Thus, the result also depends on the gravity of the interference with the individual's rights [14, para. 98].

4

Oversight by the Investigatory Powers Tribunal

The Functions of the Investigatory Powers Tribunal

The judicial supervision of surveillance measures rests with the Investigatory Powers Tribunal as a specialized court for the intelligence services established under Section 65 RIPA. According to Section 65(2)(a) RIPA this includes applications for judicial review concerning individual rights of the ECHR under Section 7(1)(a) HRA, when they concern actions of the intelligence services. At the end of the proceedings, the IPT makes a Determination as to whether it upholds the claims brought before it according to Section 68(4) RIPA.

4.2

The Judgments Against GCHQ Soon after the Snowden revelations, British advocacy groups Liberty, Privacy International and Amnesty International applied for judicial review before the IPT. They claimed violations of their right to privacy under Article 8 ECHR and their right to freedom of speech according to Article 10 ECHR [7, paras. 5, 14 and 79]. The claimants saw no appropriate provisions for the exchange of information with the NSA and found the legal requirements for the interception of information transmitted by fibre-optic cables insufficient. The Tribunal, however, decided that Article 10 ECHR did not entail any questions beyond those posed by Article 8 ECHR and thus restricted its review to the right to privacy [7, para. 12].

4.3

The Judgment of 5 December 2014

In its judgment of 5 December 2014, the Tribunal addressed two substantive points raised by the claimants.

4.3.1

The Exchange of Information (Prism/Upstream) Concerning the first part of the action, the Tribunal assumed that the NSA collected communications from US service providers and that among those were such of the claimants, which was then forwarded to the British intelligence services [7, para. 14]. This raised the question, whether the legal regime was in accordance with the law as prescribed by Article 8(2) ECHR.

The intelligence services and the government as respondents argued that the competence to exchange information with other intelligence services followed from the general functions of the intelligence services as detailed above (2.1), which included appropriate limitations [7, paras. 19 et seq.]. They had access only with regard to their functions, which corresponded to those of interception warrants under Section 8 RIPA. The respondents strove to show that while there was an interference with the right of privacy of individuals concerned by this practice, it was a much lighter interference as it would be in cases where the GCHQ itself intercepted communications [7, paras. 34-36].

The Tribunal first examined whether the legal regime was in accordance with the law. It therefore referred to the ECtHR's judgments in Malone and Bykov when stating that for an interference to be in accordance with the law, public authorities were not to be given unfettered discretion and there needed to be appropriate safeguards against abuse [7, para. 37]. Further, the provisions needed to be sufficiently clear and foreseeable. The IPT held that the rules did not have to be implemented as statutory law, when there was sufficient signposting and effective supervisory mechanisms [7, paras. 38 et seq.]. While the arrangements further specifying the general provisions where confidential, they were monitored by the parliamentary Intelligence and Security Committee and the Interception of Communications Commissioner, who ensured that the intelligence services acted in compliance with these rules [7, paras. 42-44 and 22-24]. Further, judicial oversight was provided by the IPT itself with its extensive powers of investigation under Section 68(6) RIPA [7, para. 47]. In the course of a confidential hearing, the intelligence services disclosed that requests for information were made to foreign intelligence services only under an international mutual legal assistance agreement or in analogy to the rules on interception warrants under Section 8(1) or (4) RIPA. In cases where there was no interception warrant, communications could only be requested exceptionally, if RIPA was not thereby circumvented and it was necessary and proportionate for the intelligence services to receive the information. These latter requests could be issued only by the Secretary of State and had so far never occurred in practice [7, paras. 47 and 51]. In any case, all information thus obtained was treated in accordance with the safeguard clauses of Sections 15 and 16 RIPA.

Thus, the IPT concluded that there were appropriate provisions to ensure that the exchange of information was in accordance with national law as well as Articles 8 and 10 ECHR and that after the disclosures made by the respondents, these rules were sufficiently accessible [7, para. 55]. It was also satisfied with the level of supervision and found that the limitations on the discretion of the security services were adequate to prevent arbitrary interferences.

4.3.2

The interception of external communications (Tempora) For examining the compatibility of the interception of external communications with Article 8 ECHR, the Tribunal assumed that the claimants' communications could have been intercepted and parts thereof might have been processed [7, para. 59]. The claimants argued that GCHQ with its Tempora programme intercepted all communication contents and their metadata which were transmitted by fibre-optic cables [7, para. 78]. These were then stored for an undefined period of time and searched automatically with selectors provided inter alia by the NSA and eventually forwarded to other public authorities.

It thus had to be assessed whether the difficulty in differentiating between internal and external communications led to an incompatibility of Section 8(4) RIPA with the requirements of Article 8(2) ECHR. As even communications only sent within the UK could entirely or partly be transmitted via cables outside the UK, this did not make them external communications [7, paras. 93 et seq. and 68 et seq.]. However, this was the reason why Section 8(5)(b) in conjunction with Section 5(6) RIPA allowed the interception of internal communications as a collateral. Yet, the Tribunal found that these collaterally intercepted communications were concerned only at a preliminary stage and subsequently treated differently for the purposes of Section 16 RIPA [7, paras. 101 et seq.]. As under this provision, material intercepted under Section 8(4) RIPA may only be accessed where it is assumed that the person concerned is not within the UK, it was ensured that internal communications were not used. However, Section 16 RIPA only concerns intercepted material, which under the definition of Section 20 RIPA includes only contents of communications, whereas related communications data, which are also defined by Section 20 RIPA, are not covered [7, paras. 107-109]. Related communications data can also be described as metadata. The respondents argued that the collection of metadata was a much lighter interference with the right to privacy than the collection of contents of communications. In order to underline this argument, the respondents referred to the judgment of the Court of Justice of the European Union (CJEU) in the Digital Rights Ireland case. 1 In this case, the CJEU invalidated the EU Data Retention Directive 2006/24/EC on the grounds that the bulk collection of online and telephone communications metadata was incompatible with the rights to privacy and data protection under the EU's fundamental rights. The respondents in the case at hand argued that the CJEU did so only due to the directive's missing nexus to a threat to the public order and missing limitations on the access of national authorities [23, paras. 59 et seq.]. Unlike the EU directive the national legislation of the UK, more precisely Section 8(4) RIPA on strategic warrants, was explicitly linked with a threat to national security or serious crime according to Section 5(3) RIPA. Furthermore, the metadata were required to make the determination under Section 16 RIPA whether the person concerned was within the UK [7, para. 112]. The IPT concurred, stating the limiting of the access to metadata for this purposes appeared as a "impossibly complicated or convoluted course" [7, para. 113]. The collection of metadata could also be justified under Section 15(3) and ( 4) RIPA for later use by the intelligence services for the reasons set out in Section 5(3) RIPA. As these data were not to be stored longer than necessary, the IPT held that the ECtHR's requirements concerning the minimum safeguards for surveillance measures were also satisfied [7, paras. 112 and 114].

When assessing the rules of RIPA as a whole, the Tribunal recapitulated the EC-tHR's requirements as set out in the Weber case. Firstly, it thus examined whether the nature of the offences which could trigger an interception warrant and the persons potentially affected, were sufficiently clear to prevent abuse. Concerning the aim of national security, it cited the case of Kennedy, where the ECtHR determined that the notion of national security was sufficiently clear and explicitly mentioned in Article 8(2) ECHR [7, para. 116 i)]. While it was not possible to distinguish between groups of persons with regard to internal or external communications on the first level of interception, the IPT found this to be inevitable [7, para. 116 ii)]. There was also no need for a predefined list of search terms to determine which communications would be further examined, as this would hinder the execution of the warrants and was unrealistic [7, para. 116 v)]. As the ECtHR had already ruled that there were sufficient safeguards with regard to the supervision by the Interception of Communications Commissioner and the extensive jurisdiction of the IPT itself, the Tribunal was satisfied that for strategic warrants, just as for targeted warrants, there was no need for a judicial pre-authorization [7, para. 116 vi)].

Secondly, the IPT examined the requirements regarding the duration of the surveillance measures and the procedure concerning the examination, use and storage as well as destruction of the intercepted information [7, para. 117]. These are laid down in Section 15 RIPA, the Code and the arrangements, which satisfied the requirements concerning the quality of the law as not all the details of the procedure needed to be statutory law.

Lastly, the Tribunal came to the question of proportionality, stating that a balance between the interest of national security and the gravity of the interference had to be achieved [7, para. 119]. Highlighting again the Interception of Communications Commissioner and its own jurisdiction, it held that there were adequate and effective measures in place to prevent the abuse of power. Additionally, the rules on the procedure for the issuance of warrants were sufficiently clear to ensure their foreseeability [7, paras. 120 et seq.]. As the ECtHR had already held in Kennedy with regard to the interception of internal communications, the safeguards of Section 15 RIPA satisfied the Weber requirements as they clearly laid down the duration of and possibilities to extend surveillance measures [7, para. 123]. Even though these could be extended indefinitely, the Secretary of State had to ensure each time that interception was still necessary. Section 15 RIPA also included appropriate safeguards concerning data security, while the Code further defined the persons competent to access the information and ensured that they were destroyed, if no longer necessary. Thus, the Tribunal concluded that with regard to the Tempora programme there was also no violation of Articles 8 and 10 ECHR.

4.4

The Judgment of 6 February 2015

Following up on its pronouncement that, with the disclosures made by the respondents during the initial hearings, the requirements of Article 8(2) ECHR were fulfilled, the Tribunal examined the period before these disclosures in a separate judgment. It found that without the explanations regarding the handling of requests to foreign intelligence services in analogy to Section 8(1) and (4) RIPA, there were no sufficient signposts as to the implementation of this practice [8, paras. 14-21]. Therefore, these provisions were not sufficiently accessible and foreseeable and thus did not meet the requirements of Article 8(2) ECHR. Thus, the exchange of information with foreign intelligence services prior to the disclosures violated Articles 8 and 10 ECHR. Although in this case, the IPT ruled against the government and the GCHQ, both judgments were subject to wide-spread criticism, which will be addressed in the following section.

Assessment of the Proceedings Before the Investigatory Powers Tribunal

In the introduction to its judgment of 5 December 2014 the Tribunal sets the scene for the assessment of possible violations of fundamental rights when it states that the relevant actions of the intelligence services are to be regarded in the context of national security [7, para. 6]. It stresses that international terrorism threatens the United Kingdom specifically and that further attacks are very likely to occur.

The provisions of RIPA as a whole are phrased in a very broad manner, which is manifested already in Section 5(2) RIPA, which allows the interception of communications for the far-reaching goals of national security, the economic well-being of the UK and the detection and prevention of serious crime. In order to issue such an interception, the Secretary of State only has to assume, that such a measure will serve one of these aims and is proportionate. With this subjectively phrased criterion, it is questionable, whether the issuance of an interception warrant can even be subject to any form of independent review [24, p. 652]. This gives the Secretary of State considerable discretion in how to interpret the evidence. If instead the provision required that the measure had to objectively serve one of the aims and be proportionate, the discre-tion of the Secretary of State would be limited and would allow for an independent assessment by a court.

Additionally, as shown above, the issuance of strategic warrants under Section 8(4) RIPA allows for collection of vast amounts of data. It does not only cover the interception of all communications where one of the subscribers is outside the UK, but also includes a comprehensive collection of metadata of any communications. This includes both internal and external communications, as the safeguards clause of Section 16 RIPA, which makes a further examination of information subject to further requirements, applies only to the contents of communications according to Section 20 RIPA. This leaves a loophole for the unfettered interception of metadata, which may be stored if it is likely that it may become useful with regard to the legitimate -and rather broad -aims of Section 5(3) RIPA. While the IPT is right when it states that the collection and use of metadata is a lighter interference than the collection and use of the contents of communications, it has to be stressed that even metadata allow very detailed insights into the life of a person. This contention was shared by the CJEU in its judgment in the case of Digital Rights Ireland [23, paras. 47, 54 et seq.]. It found the data retention envisaged by the directive likely to create a feeling of constant surveillance in all citizens due to its massive scale. While the respondents before the IPT contended that the CJEU only invalidated the directive because of a missing link to a threat to public security and insufficient restrictions on access of national authorities, there is more to the judgment than they let on. The requirements established by the CJEU with regard to the handling of the data and data security are indeed derived from the ECtHR's jurisprudence. Yet, the CJEU emphasized the need for the protection of individual communications due to the mass-scale and the particularly grave interference with the right to private life and data protection. It therefore opted for a strict review of the proportionality of the measure.

After the directive had been invalidated, member States were called upon to adapt their national implementation measures. While some national courts, inter alia in Austria, Slovakia, Slovenia and Romania, annulled the national legislation, other member States opted for reform [START_REF] Vaniaio | Telecommunications data retention after Digital Rights Ireland: legislative and judicial reactions in the Member States[END_REF][START_REF] Kühling | Returning through the National Back Door? The Future of Data Retention after the ECJ Judgment on Directive 2006/24 in the UK and Elsewhere[END_REF]. Amongst the latter group was the UK, where the government chose to fast-track legislation on data retention in a controversial manner [START_REF]Emergency surveillance bill clears Commons[END_REF]. Parliament enacted a new bill on data retention, the Data Retention and Investigatory Powers Act (DRIPA). The bill also included changes to RIPA: under Section 4 DRIPA the legal regime of RIPA is extended extraterritorially, to enable the UK to issue interception warrants to foreign communications service providers which offer their services in the UK [START_REF] Smith | Dissecting DRIP -the emergency Data Retention and Investigatory Powers Bill[END_REF]. However, after two Members of Parliament applied for judicial review of the act, the High Court in July 2015 ruled that the provisions regarding access to and use of the data were not sufficiently clear and objected to the fact that retention notices were not subjected to judicial or any other independent preauthorization [29, para. 114]. Thus, the High Court decided that Section 1 DRIPA had to be disapplied after 31 March 2016. However, the judgment deals only with data retention and not with the extension of RIPA and is currently under review in an appeal to the Supreme Court, which referred the case to the CJEU under the preliminary reference procedure of Art. 267 TFEU. There, the case has been fast-tracked and will thus swiftly provide an answer to the questions referred on the measure's compatibil-ity with EU fundamental rights and the CJEU's own judgment in Digital Rights Ireland [START_REF]CJEU: Case C-698/15 Davis and Others[END_REF].

Both the judgments of the CJEU and the High Court highlight the considerable issues the collection of metadata entails. With its judgment, the High Court has set limits, which have to be applied to similar contexts, such as the even more invasive collection of the contents of communications. This is even more so as the IPT did not even require the advance definition of search terms with regard to the interception of external communications under Section 8(4) RIPA.

The way the Tribunal compares the interception of internal communications under Section 8(1) RIPA and that of external communications under Section 8(4) RIPA is also troubling. In this context, the IPT cites the ECtHR's judgment in Kennedy to justify that strategic warrants do not require judicial pre-authorisation. Similarly, it argues with regard to the safeguards of Section 15 RIPA, which in its own reasoning make the surveillance measures lawful, even though they can be extended indefinitely. When it refers to Kennedy, the IPT refuses to admit the striking differences between the interception of internal and external communications. While individual warrants are directed against a specifically defined person or premise, this is not the case for strategic warrants [24, p. 652 et seq.]. They are indiscriminate measures with a much broader scope and therefore require more safeguards than the more specific and limited individual warrants.

Furthermore, the Tribunal's assessment of proportionality does not meet the requirements of the ECtHR, which it nonetheless cites. Instead of striking a balance between national security and the individual rights, the IPT is focused solely on the requirements of national security. It merely refers to the safeguards against abuse, i.e. the Interception of Communications Commissioner, its own jurisdiction and Section 15 RIPA, but in no instance does it actually assess the gravity of the interference with the right to privacy.

Concerning the exchange of information with the NSA, the IPT argued that the interference with the claimants' rights was less severe than if the GCHQ itself intercepted the information. Unfortunately, it did not further elaborate this contention, which seems questionable. From a fundamental rights perspective it does not make a difference for the individual whether his or her information is obtained by GCHQ or the NSA, if it ends up in the databases of the GCHQ either way. If anything, this argument sounds as though it was trying to allow GCHQ to escape its fundamental rights obligations by using the NSA for the collection of information.

Yet, the Tribunal's arguments concerning the lawfulness of the exchange of information in analogy to Section 8(4) RIPA is even more troubling. As has been shown, these provisions are also subject to grave concerns regarding their proportionality. While it is fortunate, that the Tribunal at least found the intelligence services' practice to be unlawful until the disclosures of the respondents, the proceedings were not transparent for the public, with the closed hearings of the respondents and even the latter judgment in no way affected their operation of the surveillance measures [31,[START_REF]Liberty: GCHQ intercepts communications of human rights groups[END_REF][START_REF] Wheelhouse | The Legality of Mass Surveillance Operations[END_REF].

Outlook

6.1

The Proceedings Pending Before the European Court for Human Rights Shortly after the Snowden revelations, in September 2013, several British advocacy groups and the spokesperson of German advocacy group Chaos Computer Club applied to the ECtHR with an individual complaint based on a violation of Article 8 ECHR [START_REF] Ecthr | Big Brother Watch and others v. the United Kingdom[END_REF]. They submit that there is no legal basis for the exchange of information with the NSA and that the legal regime governing strategic warrants is insufficient as it entails mass-scale interception of communications. These warrants are then continuously extended and the notion of national security is too vague. Lastly, the groups allege that the indiscriminate interception of external communications is disproportionate.

In September 2014 another application was filed by the Bureau of Investigative Journalism (BIJ) and one of their reporters, which is based on a violation of Articles 8 and 10 ECHR [START_REF] Ecthr | the United Kingdom[END_REF]. The BIJ is a non-profit organisation of journalists, whose highlevel investigations have had an international impact. Except for the exchange of information with the NSA, it is of a similar scope to the previous application. However, it focuses on the collection of metadata and external communications.

Aside from substantive questions to the parties, the ECtHR in both proceedings included a question on the exhaustion of domestic remedies [11, para. 10; 12, para. 4]. In order to lodge an application with the ECtHR all domestic remedies have to be exhausted according to Article 35(1) ECHR. Even though neither of the applicants had instigated proceedings before the IPT, the ECtHR is usually generous when it comes to this requirement and takes into account peculiarities of the respective national legal system [17, § 13 para. 23]. Further, the ECtHR points to its own case-law where it has repeatedly held that declarations of incompatibility under Section 4 HRA are not an adequate judicial remedy, as they oblige neither the executive nor the legislature to change the national law [34, paras. 40-44].

After the IPT's judgments, the applicants in these proceedings also lodged a complaint with the ECtHR [35]. The advocacy groups argue that the rules on the exchange of foreign communications under Prism and Upstream are excessively broad and that the Tempora programme does not comply with the minimum statutory requirements set out by the ECtHR. Besides these complaints under Articles 8 and 10 ECHR, they further contend that the IPT wrongly held closed hearings and thus violated the right to a fair hearing under Article 6 ECHR and that the framework for the interception of foreign communications under Section 8(4) RIPA is discriminatory on grounds of nationality and national origin and thus in violation of Article 14 taken in conjunction with Articles 8 and 10 ECHR.

While it is hardly possible to predict the outcome of these proceedings, especially as considerations of proportionality will be paramount, a few points for debate can be identified. The ECtHR, in previous decisions, has repeatedly referred to and taken inspiration from the rights of the European Charter of Fundamental Rights as interpreted by the CJEU, most recently in a case concerning the right to privacy [36, paras. 55 et seq.]. It is not inconceivable that the ECtHR in the cases at hand may draw on the ruling of the CJEU. On the other hand there may be considerable pressure on the ECtHR by the British government, which is generally sceptical of the court's rulings [START_REF] Watt | Cameron 'committed to breaking link with European court of human rights[END_REF]. The Conservative Party even detailed plans to leave the ECHR system [START_REF]Conservative Party: Protecting Human Rights in the UK[END_REF]. 2While the strictness of the ECtHR in its proportionality review depends on the legitimate aim it usually awards more discretion when it comes to measures in the interest of national security. However, RIPA relies on the prevention and detection of serious crime as well as the economic well-being. While the latter has now been put in the context of national security by amendments made to Section 5(3) RIPA by Section 3 DRIPA, the ECtHR awards less room for manoeuvre when it comes to reasons other than national security [14, para. 98]. Furthermore, the ECtHR has in the context of searches increased its scrutiny of the national provisions when there was no judicial pre-authorisation for these measures [39, para. 45]. In any case, with the judgments of the IPT the ECtHR has much to review.

Reform of the RIPA Regime

In the wake of the Snowden revelations there have been several reports evaluating the legal regime on security services: the Intelligence and Security Committee of Parliament conducted its own review. Further, DRIPA foresaw a review of the effectiveness of current legislation and investigating whether there was a need for new or amended legislation, which was conducted by an independent expert, David Anderson QC. Additionally, an independent report performed by the Royal United Services Institute, an independent think tank, was commissioned by then-Deputy Prime Minister Nick Clegg. The reports unanimously concluded that the regulations on the interception of communications were unsatisfactory [40, p. In the meantime, the newly strengthened Conservative government has prepared a draft Investigatory Powers Bill (IPB) [START_REF]Draft Investigatory Powers Bill[END_REF] and promised a modernized legal regime. Yet, the bill includes even further powers for the intelligence services. The proposal is largely seen as expanding the powers of intelligence services to intercept communication on mass-scale [START_REF]Draft Investigatory Powers Bill[END_REF][START_REF] Wheelhouse | The Investigatory Powers Bill: A (Somewhat) Different Balance Between Privacy and Security[END_REF]. The interception of external communications as currently governed by Section 8(4) and ( 5) RIPA is remodelled as Bulk Warrants under Part 6 IPB. Yet, the material scope -except for a slight shift of scope for the purpose of the economic well-being of the UK, which is now only met were it relates to persons outside the UK according to Section 107(2)(a) and (3) IPB -is of the same broad scope as it is under RIPA. The safeguards clauses of Sections 117 and 119 IPB are equally vague and make restrictions subject to their necessity as judged by the Secretary of State. Further, the government did not opt for a judicial pre-authorization of warrants. Instead, they are still issued by the Secretary of State under Section 107 IPB and have to be approved by a Judicial Commissioner according to Section 109 IPB. The standard of review to be applied has been subject to concerns, as the bill does not ensure that the Commissioners apply a strict approach [START_REF] Travis | Theresa May unveils UK surveillance measures in wake of Snowden claims: The Guardian[END_REF]. However, the IPB includes a right to appeal for decisions of the IPT in Section 180 IPB. These appeals are lodged with the Court of Appeal in lieu of specific regulations. As has been demonstrated by the High Court, the general courts may be more aware of the human rights dimensions of cases than the specialised IPT. Thus, this provision is an improvement of the status quo.

Nevertheless, in a recent report, the Intelligence and Security Committee of Parliament voiced serious concerns over the draft Bill, which it found disappointing as it did not cover the powers of the intelligence services, but rather left them scattered in various pieces of legislation [START_REF] Murphy | It's time to overhaul the Investigatory Powers Bill[END_REF]. Further, the committee harshly criticised the provisions for an inconsistent protection of privacy and its authorisations for the intelligence services, which were too broad and vague. It concluded that the legislation "suffered from a lack of sufficient time and preparation" [46, p. 2].

Conclusions

While the IPT's judgment was lauded by some as a victory of privacy rights, this assessment has to be seen critically. The judicial reconditioning of the Snowden revelations before the Tribunal competent to protect the human rights of individuals against government invasions of privacy has had no lasting effect on the ways the intelligence services operate. Luckily, the ECtHR will have a chance to remedy the failures of the IPT and conduct a proper examination and evaluation of GCHQ's activities. While it is hardly possible to predict the outcome of these proceedings, they have an intrinsic value to themselves: external oversight over a system that has more than once been described as opaque.

Regarding the reviews and the reform process initiated in the United Kingdom itself, caution has to be exercised. It appears as though the consequences of the revelations of mass surveillance are to further tighten the grip of intelligence services on online communications. Any efforts to expand the already over-stretched competences of intelligence services should, in turn, be closely monitored.

Further, the new legislation may also have an impact on the outcome of the proceedings before the ECtHR. It may provide the government with a convenient avenue to escape any criticism: the ECtHR will be concerned only with the compatibility of RIPA with the ECHR. If the court finds a violation of the Convention, the government can point to the new legislation. However, as the assessment of the IPB has shown, that would merely be a distraction, as the new regime of secret surveillance contains no limitation as to the points in question before the ECtHR. Additionally, although the judgments of the court are generally only effective inter partes according to Art. 46(1) ECHR, i.e. it is binding only between the parties involved in the case at hand, it is the function of the court according to Art. 32(1) ECHR to interpret the rights of the Convention. If it finds a violation of the Convention by a certain measure, this extends also to similar measures. Nevertheless, with the now clarified jurisprudence on access to the ECtHR in cases of secret surveillance in Zakharov, the court has opened the door for future litigation concerning the IPB as soon as it becomes the law.

  103; 39, pp. 258 and 285 et seq.; 41, pp. xi and 105 et seq.]. With regard to mass interception of data besides a major overhaul of the system of warrants, all but the ISC called for judicial preauthorization [41, pp. 108-112]. Concerning the oversight by the IPT, they urged more openness and a domestic appeals chamber [40, p. 116; 39, p. 305; 42, pp. 112 et seq.]. Nevertheless, neither of the reviewers questioned the extensive powers of the intelligence services themselves.

For an in-depth assessment of the judgment cf. Bieker, F.: The Court of Justice of the European Union, Data Retention and the Rights to Data Protection and Privacy -Where are we now?. In: Camenisch, J. et al. (eds.) Privacy and

Identity 2014. IFIP AICT 457, pp. 73-86. Springer, Heidelberg (2015).

For a comprehensive assessment of this proposal cf. Greer, S., Slowe, R.: The Conservative's proposal for a British Bill of Rights: Mired in Muddle, Misconception and Misrepresentation, European Human Rights Law Review 4

, 370-381 (2015).