In its Concluding Observations on the United States’ report on the progress of the implementation of the International Covenant on Civil and Political Rights (UN Doc CCPR/C/SR/3061) (ICCPR), the UN Human Rights Committee addressed among other matters fundamental and human rights issues in respect to the right to privacy that have sparked worldwide debates, known as the National Security Agency (NSA) affair. Its brief comments point in the right direction, but they disregard crucial aspects in the struggle over constitutionalising the Internet in the era of global surveillance.
The global surveillance machinery establishes a polycentric transnational panopticon, whose self-governance architecture can – building on Foucault – only be overcome by putting in place refractions and vision breaks, to prevent the apparatuses from sniffling out the remotest social corners. A systems theoretical perspective expands the Foucauldian vision, taking into account a multiplicity of threats to societal autonomies that emerge not only from the political system, but also from other societal systems. In this perspective, the global panopticon is an expression of societal polycentricity in a world society fragmented into different functional systems, each pursuing its own systemic logic. Footnote 1 Against this background, the core issues in the struggles for a global Internet constitution cast a different light on the way in which classic liberal doctrine has traditionally posited itself. The constitutional task in the transnational constellation is to release social energies in various communicative spheres and – at the same time – prevent those energies from harming human and social autonomies. The dramatic consequences of this challenge is brought to the surface in the struggles for a global Internet constitution.
I. Global surveillance
With the revelations he made in the summer of 2013, Edward Snowden drew the world public’s attention to the degree to which the global networks of surveillance apparatuses control our lives. There isn’t a text message, call, Facebook chat, or Google search request, a credit card operation or an email that couldn’t at least potentially be downloaded, saved, scanned and fed into a network of metadata for further analysis. This is staggering in scope as approximately 194 million text message metadata run through global data bunkers every single day. Tapping into the optical fibre cables between Europe and the Far East, the NSA scans somewhere between three and six petabyte of data per day, which corresponds to the data volume of one and a half to three billion digitalised songs. These data undergo a selection process and are then stored in databases, including in the US. Footnote 2 What we call ‘the cloud’ may in fact be nothing more than a euphemism for a dark bunker in Idaho.
Panopticism
Edward Snowden’s revelations have provided critical insight into a gigantic transnational panopticon. Footnote 3 Alluding to the hundred-eyed Panóptes of the Greek mythology, panopticon is a term that refers to a system of complete surveillance. Already in the eighteenth century, in his book Panopticon or The Inspection House, the utilitarian philosopher Jeremy Bentham suggested surveillance as governance technique. The panopticon, he argued, was the ideal form of organisation for prisons, factories, poor houses, hospitals, schools, etc, since it increased performance and nipped opposition in the bud early by permanent, equal, universal and all inclusive surveillance: ‘Ideal perfection, if that were the object, would require that each person should actually be in that predicament, during every instant of time.’ Footnote 4
What Jeremy Bentham conceptualised as cost–benefit optimisation, Michel Foucault took as point of departure for a searing critique of society. Foucault shows how the panoptic principle pervades social conditions in all of their ramifications. In Discipline and Punish, he describes panopticism as the governance technique of modern societies. His criticism is directed at the resulting loss of liberty: ‘Whenever one is dealing with a multiplicity of individuals on whom a task or a particular form of behaviour must be imposed, the panoptic schema may be used.’ Footnote 5 But even more revealing was Foucault’s analysis on the subtle effect of the casual coercion of surveillance. Security dispositives do not rely on physical coercion. They optimise powerful knowledge techniques. Interrogation management, psychiatric surveys, moralising campaigns and social work replace corporal punishment, but ultimately they affect the body more intensely. Surveillance stimulates a self-technology, which operates not externally but by initiating an observer-observation. The individuals observe themselves through the eyes of the observer. As a result, the panoptic scheme operates by way of self-discipline: ‘He who is subjected to a field of visibility, and who knows it, assumes responsibility for the constraints of power; he makes them play spontaneously upon himself; he inscribes in himself the power relation in which he simultaneously plays both roles; he becomes the principle of his own subjection.’ Footnote 6 To break this pattern, it is not enough to capture the control centre. Simply occupying the tower of the panopticon does not mean stepping outside of the schema of hegemony and counter-hegemony. The goal, as Foucault puts it in his essay ‘The Eye of Power’, must be to rob the tower guards of their vision, to create refractions, to alter the architecture, depriving the panoptic dispositive of its premises. Footnote 7
Transnational surveillance apparatuses
Both Bentham and Foucault start from the political dimension of surveillance and the effect it has on the subject. However, in a functionally differentiated world society, the panoptic schema operates in a much more complex manner.
Polycentric surveillance.
Panopticism isn’t limited to individual institutions with a top, a centre and a surveillance tower. Rather, the panoptic schema operates without limits; it is organised polycentrically. Transnational networks of surveillance apparatuses surveil even the remotest corners of society. World society is a surveillance society. It may be ‘without an apex or center’ Footnote 8 but the polycentric surveillance networks are no less effective than centralised panoptic institutions.
Who is behind these surveillance apparatuses? The analysis of the NSA complex revealed a whole network of secret services. Thus, the so-called ‘Five Eyes’ cooperate under the United Kingdom – United States of America Agreement (UKUSA Agreement), that is, the secret services of five English-speaking countries: the US National Security Agency, the British Government Communications Headquarter (GCHQ), the Australian Signals Directorate (ASD), the Canadian Communications Security Establishment (CCSE) and the New-Zealand Government Communications Security Bureau (GCSB). These work with further national secret services, including the German Federal Intelligence Service (Bundesnachrichtendienst, BND).
These state services not only cooperate with one another but also work in close coordination with international organisations such as NATO as well as private actors. In the US, in addition to the 30,000 NSA staff, 60,000 employees work for external service providers of the NSA. At the time when he collected the NSA documents, Edward Snowden himself was not directly employed by the NSA, but worked for the PC company Dell, later for the NSA service provider Booz. On top of these subcontractors involved in the surveillance network, other global players including Facebook, Yahoo, Google, Microsoft and other transnational companies collaborate closely with state security organs Footnote 9
One of the most significant changes that the age of surveillance has brought about is the increasing difficulty of separating surveillance by governments from that by commercial entities. Public- and private-sector surveillance are intertwined – they use the same technologies and techniques, they operate through a variety of public/private partnerships, and their digital fruits can easily cross the public/private divide […] Even if we are primarily worried about state surveillance, perhaps because we fear the state’s powers of criminal enforcement, our solutions to the problem of surveillance can no longer be confined to regulation of government actors. Any solutions to the problem of surveillance must thus take into account private surveillance as well as public. Footnote 10
Functional differentiation in world society.
Finally, non-state actors are involved in surveillance not only through public–private partnerships but through functional areas, with each actor operating within them contributing to transnational panopticism. By collecting sensitive data, they pursue interests, specific to the respective functional system.
At the global economy level it is not security but the maximisation of consumption that is the key objective of the myriad international players. Data is a commodity and collecting it is a business model. At the various levels of the supply chain of the information and communications infrastructure, corporations such as Google, Apple and Facebook have virtually unlimited access to data and to the processes and content of communication within their area of authority. Applying different business models, they collect and analyse these data so as to sell them on to others for further use. Footnote 11 To optimise these business models, corporations develop their own spy software. Footnote 12 Academia, too, happily accesses the digital communication sphere to conduct research on data and surfing behaviour without obtaining user consent. Footnote 13 Other ‘functional systems’ contribute to transnational panopticism according to their own, specific logic. The religious system controls ‘res sacrae’ and believers via the Internet; Footnote 14 the health system surveys patients and promotes the health logic with Internet-based informational systems, and so forth. Footnote 15 The aim of these functional systems is clear – to regulate, and in some instances to control, the behaviour of users and followers.
In short, the functional systems of world society seek to put the worldwide web at their service, each according to their own particular interest. Surveillance and big data seeks to pursue a logic that is greater than that of securitisation. Footnote 16 Religious purification and the maximisation of profit and knowledge evoke threats as well. However, these do not result from ‘old governments or industries that hate openness’, but from industries and societal institutions ‘that oppose those old control freaks the most’. Footnote 17
Transformation of subjectivity
This functional differentiation of world society also transforms the understanding of subjectivity. Social discipline through subject discipline is only one manifestation of the panoptic schema. That schema is not – as Foucault conceived it – limited to involving political or legal subjects in a circle of observer-observation. The economy is not interested in potential terrorists, but in consumers; academia is interested in users as test subjects, religion in believers, health in patients, art in the homo aestheticus, etc. Footnote 18
Therefore, societal autonomies are not only threatened by the totalising tendencies of the political system to limit the liberties of its subjects but rather, functionally differentiated world society delineates boundaries within which individuals interact with the systems. It is in these parameters that threats arise from the specific energies of the specific functional systems. It is in these systemic relations within society, and in the relations of each social system to its environment, that the central problems of differentiated world society develop. Footnote 19
II. Internet surveillance before the UN Human Rights Committee
Against this background, how does law access this polycentric panoptic schema? Which normative, and this means counterfactual, expectations is the transnational facticity of surveillance confronted with?
Legal basis and procedure of the Committee
Law is engaged with surveillance measures in contending fragments of order. Both domestic proceedings, such as in US courts under the Foreign Intelligence Surveillance Act (FISA), and supranational norms Footnote 20 and proceedings, as in the case of Google Spain, Footnote 21 have attempted to address protection against panoptic governance technology. The UN Human Rights Committee’s Concluding Observations of 26 March 2014 Footnote 22 is the first commentary from a quasi-judicial panel at the global level. Footnote 23
The Committee operates on the basis of the International Covenant on Civil and Political Rights (ICCPR). Footnote 24 The Covenant was concluded in New York on 16 December 1966 and entered into force on 23 March 1976. It has 168 state parties; a further seven states (including Cuba and China) have signed but not ratified the Covenant. The US signed the Covenant on 5 October 1977, but the ratification took another 15 years. Since 8 June 1992, the US has been bound by the Covenant, which protects the right to privacy in its Article 17.
The Human Rights Committee (or CCPR) is the UN body charged with enforcing the Covenant. An individual complaint procedure can be commenced if the defendant state has ratified the First Optional Protocol to the Covenant, which entered into force on the same date. Since the US has not accepted this procedure, matters pertaining to its obligations under the ICCPR can only be brought before the Committee in the procedures provided for in the Covenant. The US has subjected itself to the state complaint procedure under Article 41 ICCPR, but this procedure has not been used once in the history of the Covenant. Thus, when pronouncing itself on the NSA affair, the Committee was acting not under a complaints procedure, but on the occasion of the state reporting procedure under Article 40 ICCPR. This procedure obliges state parties to regularly report on the progress made in respect to the enjoyment of rights as enshrined in the Covenant. In accordance with Article 40(4) ICCPR, the Committee studies these reports from which it formulates observations.
This procedure has the potential to promote transparency where it can function as a channel for civil society efforts to keep governments in check. Footnote 25 The official state reports are regularly accompanied by so-called ‘shadow reports’ from NGOs. Footnote 26 The Committee also consults with NGO representatives and uses their reports as a basis for subsequent in-depth discussions with the state party.
Unlike the complaints procedures, the reporting procedure does not result in a binding decision, but in ‘recommendations’. It is organised in a trial-like manner in that there is a hearing, followed by a final pronunciation that applies abstract legal norms to concrete societal facts. However, in contrast to an adversarial trail the reporting procedure doesn’t seek to adjudicate an individual case. Instead, the proceedings are open, the agenda evolves over the course of the procedure and there are several opportunities for NGO representatives to make interventions. Finally, the Concluding Observations do not set out binding legal obligations which emanate from a formal authority; their effectiveness depends first and foremost on whether the recommendations are accepted by society through the power of normative persuasion – which in turn mobilises the support of the wider public. Footnote 27
Walter Benjamin described the forms and virtues of the intercourse between state diplomats as delicate and peaceful, because it leads to nonviolent agreement beyond legal decision-making, ‘and therefore beyond violence’. Footnote 28 Similarly, the reporting procedure institutionalises forms and virtues of law that do not follow the traditional pattern of adversarial legalism, and are therefore also not characterised by the violent decision of a case. In this procedure, the methodology applied is the argumentative engagement with societal questions of responsibility. The reporting procedure is not characterised by authoritative decision-making of hard law, but by normative persuasion through argument, convincing positionality, participatory practice, responsive modes of operation, a sure sense of justice and an intuition for conflict. Footnote 29 However, under the current circumstances, this strength of the reporting procedure is also its weakness; it is often selective in the matters that it chooses to address and does not always offer an effective counterweight to the coercive apparatuses. For the problem of law and violence is profound; in a society marked by power-driven structures and conflicting interests, a procedure that forgoes legal enforcement structures risks rendering itself ineffective if it cannot counter the violence of other societal forces.
At the same time, where institutions renounce formal enforcement powers, the greatest threat arises from the political opportunism of the institution itself; a jurisprudence that panders to the interests of the states puts the legitimacy of the reporting procedure at risk. Therefore, it is rather misguided to contend that the legitimacy of forums of international justice is wholly dependent on the acceptance of the states. Indeed, global legal institutions require legitimacy with respect to the ‘peoples’ and ‘citizens’. Footnote 30 Transnational judicial forums cannot be limited to serving the needs of states, current court clients, nor can legitimacy be achieved if they do not enable those who are not included in the classic patterns of representation to be heard: the ‘unrepresented’ described by Jacques Derrida, the ‘excluded’, to quote Niklas Luhmann, the ‘superfluous’, as Susan Marks calls them, the ‘rural poor’ in Gayatri Spivak words, the ‘subaltern’, as Boaventura de Sousa Santos and César Rodríguez-Garavito write. Footnote 31 Transnational judicial forums will only find societal acceptance if they move beyond concentrating on procedural framing and start to critically engage with the myriad complexity of societal structural conflicts that are being translated into the quaestio iuris.
Applicability of the International Covenant on Civil and Political Rights
What stance, then, did the UN Human Rights Committee take on the panoptic schema? Any action by the Committee in the transnational surveillance case at hand presupposes that the Covenant is applicable in the first place.
Extraterritorial applicability: Article 2 ICCPR.
First, the extraterritoriality of the measures may constitute an obstacle to the applicability of the ICCPR. The interference of surveillance measures habitually takes place beyond the territory of the surveying state, across and between boundaries. Pursuant to Article 2(1) ICCPR, a State party must grant the rights of the Covenant ‘to all individuals within its territory and subject to its jurisdiction’. These two criteria apply alternatively, not cumulatively. Footnote 32 The exercise of jurisdiction over an individual makes the Covenant applicable even if she is not present in the territory of the State party. Footnote 33
There has long been debate over the definition and scope of jurisdiction; however, there is little jurisprudence from the Committee on what constitutes the exercise of ‘effective control’. Indeed, already over a decade ago, the Committee, in its General Comment No 31 of 29 March 2004, asked whether the individual in question is ‘within the power of effective control’ of the respective state. Footnote 34 However, the European Court of Human Rights (ECtHR) expounded upon the concept of effective control in its Al-Skeini judgment on the extraterritorial applicability of the European Convention on Human Rights (ECHR) which serves as guidance for Article 2(1) ICCPR. The ECtHR distinguishes three forms of ‘effective control’, namely (1) the exercise of physical force that can bring persons under the state’s control extraterritorially; (2) individualised exercise of jurisdiction by state organs abroad; and (3) domestic acts of state with extraterritorial effects. Footnote 35 Following this elaboration, surveillance measures do not necessarily amount to physical control over a person but instead to virtual control, which, due to its disciplinary effect mentioned above, can be considered equivalent to physical control with respect to the scope of application of the Covenant. Footnote 36
Consequently, in its Concluding Observations on the United States’ report, the UN Human Rights Committee determined against the continuing opposition of the US Footnote 37 that the ICCPR also applies to the US’ surveillance measures – both with respect to measures within and outside of the US. It also clarified that the Covenant applies irrespective of the nationality and place of domicile of the persons concerned. Footnote 38 Affirming the extraterritorial applicability of the Covenant with respect to the surveillance measures, this jurisprudence thus constitutes a first step to overcoming the legal territorial dilemma. Footnote 39 Since then, it has been supported by a number of statements in the course of the Universal Periodic Review Procedure of the Human Rights Council in May 2015. In response to the US report, Footnote 40 states and stakeholders have submitted substantial recommendations, a lot of which invoke the extraterritorial dimension of the right to privacy. Footnote 41
No public emergency: Article 4 ICCPR.
The US routinely justifies the surveillance measures with security requirements that, it argues, after 9/11 have deeply transformed the ‘balance between security and civil liberties’. Footnote 42 Article 4(1) ICCPR provides for the possibility of suspending specific rights ‘in time of public emergency which threatens the life of the nation and the existence of which is officially proclaimed’. It is thus conceivable that the US could employ the securitisation argument in a legal manner to suspend the right to privacy generally. Since the right to privacy, protected by Article 17 ICCPR, is not among the non-derogable rights contained in Article 4(2) ICCPR, such a suspension in situations of emergency is permissible.
However, the threshold for a public emergency is high. Footnote 43 Not every measure can be justified through a public emergency premise, and not every catastrophe constitutes a public emergency. Even in armed conflict, the possibility of relying on the pronouncement of a public emergency is limited. Footnote 44 Indeed, at best, surveillance measures may constitute acts of hazard control; they do not conform to the Committee’s strict criteria for the existence of a public emergency. The security argument can therefore not dispense the US from the binding force of the Covenant provisions. Consequently, the US has not even moved towards taking procedural steps to declare a public emergency, which namely requires the issuing an official proclamation (Article 4(1) ICCPR) and notifying other State parties (Article 4(3) ICCPR).
Self-executiveness.
Finally, the applicability of the Covenant might be put into question by the declaration made on the occasion of the ratification of the Covenant, namely ‘that the provisions of articles 1 through 27 of the Covenant are not self-executing’. However, this declaration does not divest these provisions of their internationally binding effect; it merely serves to limit their domestic applicability and the generation of subjective legal positions in domestic law. The declaration cannot undermine the binding character of the Covenant rights under international law. Footnote 45
Right to privacy: Article 17 ICCPR
The question is therefore, which legal framework does the Covenant set for surveillance measures? The provision of primary relevance Footnote 46 here is Article 17 ICCPR, according to which ‘[n]o one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence’. Article 17(2) grants everyone the ‘right to the protection of the law against such interference or attacks’. Footnote 47
By using the general term ‘correspondence’, the Covenant does not distinguish between written, oral, electronic, visual, haptic or other forms of correspondence. As the Committee noted in its General Comment No 16, Article 17 ICCPR protects the integrity and confidentiality of all forms of communication: ‘Surveillance, whether electronic or otherwise, interceptions of telephonic, telegraphic and other forms of communication, wiretapping and recording of conversations should be prohibited.’ Footnote 48 Article 17 ICCPR prohibits ‘arbitrary or illegal’ interferences. Even interferences that are based on a domestic statute, such as FISA in the US, must not be arbitrary, Footnote 49 that is, they must be undertaken ‘in accordance with the provisions, aims and objectives of the Covenant and should be, in any event, reasonable in the particular circumstances’. Footnote 50
Against this background, the Committee applied the Covenant and in particular Article 17 to the surveillance measures and urged the US to uphold its obligations to the implementation of the Covenant. Footnote 51 In detail, the Committee requested a redesign of the measures within the following parameters:
-
• Respect for the principles of legality, proportionality and necessity regardless of the nationality or location of individuals whose communications are under direct surveillance;
-
• Respect for the requirement of a legal basis;
-
• Introducing precise criteria limiting the measures in substance as well as in duration;
-
• Establishing a statutory authorization procedure as well as procedures for the use and storage of the data collected;
-
• Strengthening judicial involvement and introducing effective monitoring mechanisms;
-
• Refraining from imposing mandatory retention of data by third parties;
-
• Ensuring access to effective remedies.
Current US practice does not comply with these recommendations. The temporal and substantive limits to surveillance contained in FISA are too vague. Also, differential treatment on the basis of nationality or place of residence is not compatible with the Covenant. Finally, effective remedies against abuse are absent. Footnote 52
III. Structural elements of the Internet constitution
In the end, in its Concluding Observations on the US, the Committee was brief in its comments on the US’ surveillance practice. Footnote 53 While this is certainly more than nothing, the Committee’s approach fell short of capturing the fundamental character of the problem as it continued to treat crucial questions of global communication rights exclusively within the traditional framework that is primarily interested in subjective rights against state interference. This approach misconceives that the struggle over the transnational constitution of the Internet cannot merely be posited as a struggle of individuals against nation states as the need for regulation doesn’t only arise from individual legal subjects defending their spheres of liberty against the encroachments of domestic, supranational or even global political systems, as classic constitutionalism envisages it. Rather, it is transnational legal challenges that are at issue – challenges that arise from societal structural conflicts which, by their very nature, are beyond the individual. Footnote 54 The problem of protecting fundamental rights and democracy in the transnational constellation requires answers that transcend statist and legal-subjectivist reductionism.
Fundamental rights
The protection of the integrity of communication systems is a fundamental rights question that concerns the autonomy of communications processes. Unlike human rights protecting the physical and psychological integrity of individual corporeality, the protection of communicative spheres is directed at problems of societal communication that are structured quite differently, by (a) guaranteeing institutional autonomies and (b) developing personal spheres for enabling within the framework of these autonomies. Footnote 55
Protection of systems: Institutional autonomies.
First, this requires the radical de-individualisation of communication rights, especially with respect to guaranteeing the confidentiality and integrity of IT systems, which are particularly affected by the surveillance measures. It is therefore necessary to disconnect the protection objective of the liberties concerned from their relation to the individual. Footnote 56 Individual rights are no longer the starting point of the evolution of protection objectives; rather, they function as a procedural means of enforcement – legal subjects become advocates of un-individual rights, which provide subjective entitlements not in substantive terms but in a procedural sense. The individual right becomes the annex to an un-individual fundamental right. Footnote 57 As Wolfgang Hoffmann-Riem puts it: ‘In the area of global communication structures, the protection of communication firstly depends on the protection of the system.’ Footnote 58
The Committee does not yet sufficiently take into account that the protection against surveillance measures is not primarily about keeping the individual private sphere free from state intervention. Rather, autonomous societal communication processes also have to be protected from the usurpation by other societal communications processes. This requires a more complex concept of fundamental rights, which no longer forces scopes of protection and situations of interference into the schema of private/societal vs public/statist. This framing does not live up to the transformations of the relation between private and public. The critical issue of transnational constitutionalism is not just binding domestic security organisations Footnote 59 or global security apparatuses Footnote 60 to fundamental rights. With respect to the Internet constitution, both of these variations of an ‘international law of the Internet’ reduce the constitutional question to the containment of political violence. Footnote 61 The new constitutional question is much more comprehensive. Whereas the old constitutional question concerned the justification and limitation of political violence,
[w]ith the new constitutional question, the concern is to release quite different social energies – particularly visible in the economy, but also in science and technology, medicine and the new media – and to effectively limit their destructive effects. Footnote 62
With respect to the surveillance of the Internet, the challenge is thus to both protect the communications systems from the encroachment of other societal functional spheres and, at the same time, to protect these functional spheres from being threatened in their integrity by a net communication that is oriented toward maximising its own rationality. Put differently, the Internet must be protected from the global functional systems such as politics, science, the economy, etc. But vice versa, the Internet constitution also has to protect these spheres from encroachments by Internet communication. The ‘private sphere’ of Internet communication thus acquires a public function and an obligation to the public. The public character of the sphere of Internet communication is its intrinsic normativity in relation to society, to human individuals, and to ecology. Private/public is therefore not a schema of differentiation between private subjects of law and public statehood, but in a polycontextural society refers to the fact that the (private) integrity of autonomous societal spheres has to be coupled with the (public) world society context in such a manner that one sphere enables the freedom of the other sphere. Footnote 63 Freedom is the freedom of the others, a constitution is a mechanism of dependency. Footnote 64 It constitutively binds together societal spheres of autonomy.
Horizontal effect of fundamental rights.
In light of this, not only state and para-state sovereign acts require justification. Rather, the challenge is also to curtail polycentric societal spheres in their destructive tendencies so as to enable the curtailing of violence beyond the traditional regulatory formats of classic international law. The need for this reveals the gap in the Human Rights Committee’s Concluding Observations, as the question of how the expansive tendencies of globally operating communication media can be effectively countered remains unanswered.
To conceive the constitutional curtailment at the transnational level according to the public character of the actor, Footnote 65 falls just as short as identifying International Public Authority with coercive forms of action. Footnote 66 The intensity and scope of the binding character of fundamental rights result neither from intrinsic characteristics of the actors nor from reasons innate to their action, but from societal structures, which the law reconstructs as public legal relationships – as the case may be, with corresponding duties and obligations. The point is to take seriously the fundamental rights dimension of the structural collisions of society and to concretise the legal requirements, starting from these collisions. This requires overcoming the question of who are the exclusive beneficiaries and obligated parties of fundamental rights. It calls for the development of structures that are able to adequately address the complexity described, structures that can counter the expansive tendencies of societal communication media appropriately, by way of organisation and reinforcement of self-limitating procedures. Footnote 67 This is true for the harmful effects on society of an unfettered global economy just as much as it concerns the dangerous maximisations of the rationality of the health system, of the law, of religion, of science and the media.
No sector is exempt from the responsibility of being responsive to the needs of global society. However, it would be a mistake to draw a simple analogy and apply the fundamental rights obligations designed for the Big Brothers, from the NSA to the Federal Intelligence Service, par for par to the Big Sisters, from Google to Facebook, without doctrinal adaptations. This would be too direct a transfer of fundamental rights, originally state-orientated, into other societal spheres. Instead, procedural solutions have to be developed that oblige both state and non-state actors to organise the protection of fundamental rights, each in their own way.
Some first steps toward such a new framework are gaining momentum in international legal practice, not least by the UN Human Rights Committee. In its General Comment No 16, it stated that the rights protected by Article 17 ICCPR have to be guaranteed against attacks and interferences irrespective of ‘whether they emanate from State authorities or from natural or legal persons’. Footnote 68 Also, the former Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, Frank La Rue, has emphasised the obligations of the various sectors in society to respect data protection provisions, Footnote 69 basing himself on the respect, protect and remedy triad of obligations developed in the Ruggie Report. Footnote 70 This line of argument is explicitly carried forth by the actual Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, David Kaye. Footnote 71
In respect to global surveillance measures, unfortunately, the UN Human Rights Committee is less interested in this non-state dimension of surveillance – not a word has been written on the liability exemptions contained in FISA for the involvement of private actors in surveillance measures, which constitute a violation of the obligation to protect fundamental rights; Footnote 72 nor a word on the extraterritorial obligations to surrender information, which are being enforced also against US companies in Europe, despite well-meaning Safe Harbor agreements; Footnote 73 and finally, no mention has been made of the corporate due diligence obligations developed in the Ruggie Report, following a network of transnational codes, from the UN Global Compact’s ten universal principles and the G3 Guidelines of the Global Reporting Initiative, to the ISO 260000 on Social Responsibility of the International Organization for Standardization, the ILO Declaration on Fundamental Principles and Rights at Work and the OECD Guidelines for Multinational Corporations.
All of these initiatives promote respect for human rights among private actors, Footnote 74 and – as the Guiding Principles state – they clarify the ‘role of business enterprises as specialized organs of society performing specialized functions, required to comply with all applicable laws and to respect human rights’. Footnote 75 International and transnational arbitral tribunals, too, have long begun, in the area of lex digitalis publica, to bind private actors to specific fundamental human rights. Footnote 76 And even the CJEU, in its pragmatic manner of binding non-state actors to fundamental rights via the general principles of EU law, has asserted that Google is bound by the European Charter of Fundamental Rights:
Inasmuch as the activity of a search engine is therefore liable to affect significantly … the fundamental rights to privacy and to the protection of personal data, the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the framework of its responsibilities, powers and capabilities, that the activity meets the requirements … in order that the guarantees … may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved. Footnote 77
The cooperation between governments and private actors worldwide in the digital domain evokes the need to reconsider the very concept of human rights as individual rights. Self-evidently, ‘[i]nternet governance should be framed around fundamental human rights principles, in particular transparency, openness, inclusivity, non-discrimination and equality, and should incorporate the right to an effective remedy’. Footnote 78 But the fact that Internet communication and big data enhance ‘the capacity of governments, companies and individuals to undertake surveillance, interception and data collection, which may violate or abuse human rights, in particular the right to privacy, as set out in article 12 of the Universal Declaration of Human Rights and article 17 of the International Covenant on Civil and Political Rights, and is therefore an issue of increasing concern’, Footnote 79 is not only problematic as it affects individual rights, Footnote 80 but above all as the transnational constellation poses new challenges to our understanding of fundamental rights.
As the UN Human Rights Committee is only interested in these crucial questions of global fundamental rights protection within the traditional framework, which seeks to defend subjective liberties against state encroachment, it cannot give direction for the regulation of complex societal structural conflicts such as those manifested in the global surveillance measures. This inappropriate framing falls short of adequately translating the societal structural conflict into law. It also obstructs the view to possible solutions for this conflict.
Democracy and public control
As a consequence, the Committee also ignores the transnational dimensions of the democratic question raised by the case of the global surveillance measures.
It is often enunciated that ‘cooperation between governments and private actors worldwide in the digital domain, including the Internet Governance Forum, calls for clear checks and balances and must not lead to the undermining of democratic and judicial oversight’. Footnote 81 But what remains unresolved is the question of the adequate structures for this oversight to be performed efficiently.
If Internet governance is – as in the Tunis Declaration Footnote 82 – defined as ‘the development and application by governments, the private sector and civil society, in their respective roles, of shared principles, norms, rules, decision-making procedures, and programmes that shape the evolution and use of the Internet’, Footnote 83 then it is obvious that the democratic question goes beyond the question of states’ democracy. In the transnational constellation it affects all spheres of Internet governance: civil society, multistakeholder processes like NETmundial, International Organisations and hybrid forms of collaboration.
The crucial point here is that for those flexible networks and organisations, adequate procedures and forms for self-limitation must be developed, by which societal communication spheres are organised democratically. In its Concluding Observations, the UN Human Rights Committee focuses on the requirement of a domestic legal basis. This is an important building block in a system of self-regulation of functional spheres, but it stops short of the self-limitation of politics. In the transnational constellation, however, democratic requirements must also be enforced in relation to other actors aside from states. In the area of global communication structures, the monopoly of information
becomes a problem for the constitution of the new media which cannot be reduced to economic issues. Its worldwide digital networking activities, which have enabled massive intrusions into the rights to privacy, informational self-determination and freedom of communication, represent typical problems for the constitution of the global Internet. And the lack of transparency in Google’s governance structures points to constitutional questions of democracy and of public controls. Footnote 84
These constitutional questions cannot simply be answered by tightening the net of partial democratic legitimation through the nation states. Footnote 85 Rather, the principles of democracy and of public control need to be anchored and, if necessary, legally enforced within the polycentric patterns of order themselves. Footnote 86 For example, this applies to the data protection standards of Google, Footnote 87 but also to the practice of Wikileaks, Footnote 88 which has recognised rights set out in the Universal Declaration of Human Rights in their ‘harm minimization procedure’. Such procedures provide for the deletion of information in the case that ‘life and limb of innocent people’ require protection. Footnote 89
It is in this ultra-cyclical link between private standards and international legal codifications that we find untapped potential for the development of societal constitutionalisation processes. This, however, requires the institutionalisation of reflexive processes and procedures that allow via secondary norms for the enactment, modification, interpretation and implementation of the primary norms. Monitoring and implementation bodies need to be established, tasked with mediating between the abstract corporate principles and the concrete corporate decisions. Footnote 90
Such procedures do not spring forth spontaneously and fully formed. Indeed, it requires external and internal pressure and, if need be, judicial advocacy and control to be exerted if Codes of Conduct are to be more than PR strategies, for a Safe Harbor initiative such as the EU’s Footnote 91 not to end up as a mere merchandising instrument. Footnote 92 A strengthening of self-limiting procedures can be achieved by introducing institutionalised forms of self-regulation, through political control. Such externally regulated self-regulation is distinct from deregulation in that it doesn’t renounce control in a laissez-faire manner, but introduces binding, even judicial control mechanisms that combine internal and external monitoring bodies. Footnote 93
The first steps in this direction have been made, for instance, by strengthening transparency through reporting duties for businesses with respect to human rights scenarios, or by requiring the establishment of Corporate Social Responsibility institutions. Footnote 94 Only when these mechanisms and institutions are obliged to cooperate with politically established institutions – penal and administrative agencies, domestic courts, national and international human rights bodies – can a network of legal control develop in which legal norms become effective. This requires the adjustment of an asymmetrical judicialisation, as a result of which private actors and transnational corporations can enforce their claims in various international forums, most notably courts of arbitration, while it is virtually inconceivable that they will ever find themselves in the position of defendant in the forums of global justice. Footnote 95 Their partial recognition as subjects of international law results in an entitlement under international law without sufficiently effective corresponding obligations. Only if these gaps are closed by a combination of internal and external control mechanisms can a juridification develop that is powerful enough to enforce the promises of the Codes of Conduct and of the Corporate Social Responsibility initiatives.
Beyond establishing opportunities for control and participation that link the levels of the organisation with societal constitutions, the preconditions for forming a democratic public must be secured.
Empowering a critical public.
This requires first and foremost that a critical public can find spaces to bring such concerns to attention. Footnote 96 However, the UN Human Rights Committee has shown little interest in the question of transnational control mechanisms, as the suppression of whistleblowing and restrictions on democratic procedures are not discussed in its Concluding Observations. Even though the shadow reports to the US state report called for substantive protection for whistleblowers with reference to Article 19 ICCPR, Footnote 97 the Committee chooses to ignore the matter entirely.
Whistleblowing is a crucial mechanism that promotes democratic control. Footnote 98 By ignoring this dimension, the UN Human Rights Committee misses an important opportunity to develop a legal framework through which democratic forces may impel greater regulation of the actions of the state. If, as Foucault developed in his critique of Bentham, Footnote 99 the total control of the network of the security apparatuses isn’t to be replaced by a panoptic scheme from below, there must of course also be limits to whistleblowing. However, these limits cannot be determined by the needs of politics or the military; rather, they must themselves be at the disposition of the democratic process. Footnote 100
A Right to encryption.
But the democratic question does not only call for a societal wide discussion of surveillance. A process of double reflexivity must be organised, in order to enable emancipation from the panoptic schema. The function of the constitution results from the very fact that it links reflexive processes of the law to reflexive processes of society. Politics is limited and constituted by a political constitution, the economy by the economic constitution, and so on. It is the very point of the constitutional idea that any constitution, while legally regulating the formation of law, also releases self-limiting forces.
Edward Snowden alludes to how this can be achieved for the Internet constitution when he replaces the idea of limiting power by the constitution with the idea of limiting power by cryptography, following Thomas Jefferson’s response to the question of political power:
While I pray that public awareness and debate will lead to reform, bear in mind that the policies of men change in time, and even the Constitution is subverted when the appetites of power demand it. In words from history: Let us speak no more of faith in man, but bind him down from mischief by the chains of cryptography. Footnote 101
Contrary to Snowden’s view, though, a constitution and cryptography are not mutually exclusive. To the contrary, cryptography must form a central element of the Internet constitution. In the reflexive application of the digital code to itself and in its linkage to a constitutionally protected right to use encryption, a capillary constitution of Internet communication develops. Cryptography becomes an element of a ‘constitutionalization from below’, in which the users overcome the panoptic schema. The fundamental right to cryptography and the free choice of encryption methods emanate from the right to privacy. This right must therefore also grant protection against prosecution based on the use of cryptography. The right to resist surveillance necessitates a counterbalance of a constitutional right to digital self-defence. This results in a duty – applicable to states and corporations – to promote opportunities for using cryptography.
Consequently, in their ‘Resolution in Support of the Freedom to Use Cryptography’, the members of the Global Internet Liberty Campaign (GILC) emphasise that the right to an unhindered use of cryptographic technologies flows from the right to privacy. Footnote 102 That legal access to encryption technologies and effective protection of the use of such technologies are crucial issues in the enforcement of the right to privacy, is also highlighted in the OECD Cryptography Policy Guidelines, Footnote 103 as well as in the Common Statement on Cryptography by the International Working Group on Data Protection in Telecommunication (IWGDPT). Footnote 104 While the UN Human Rights Committee has yet to take a position on this, the challenge will be to extend the scope of protection of Article 17 ICCPR to such forms of constitutionalisation of the Internet. Footnote 105
Cryptography modifies the panoptic schema and allows for the anonymisation of data and communication. It is part of a strategy to establish breaks, vision barriers and protection measures through the chains of social constitutions that foster the self-limiting procedures of social systems. In the end, the liberty safeguards that Foucault envisages in his critique of the panoptic schema Footnote 106 can only be established by way of a combination of constitutional limitation and visibility refraction; only in this way can the architecture of the transnational panopticon itself be changed, and only in this way is the core of the issue addressed: that the subtle mechanisms of societal energies (here, of Internet communication) have to be at once released and limited in their destructive effects.
IV. Conclusion
In its Concluding Observations to the 2014 US state report, the UN Human Rights Committee recalled essential preconditions for the regulation of global communication structures. It correctly emphasised the extraterritorial effect of fundamental rights and urgently called for proportionality in the use of extraterritorial surveillance measures, in accordance with law.
However, thus far the Committee has yet to thoroughly engage with issues resulting from transnational surveillance practice beyond subjective rights vis-à-vis state encroachment. However, as it has now become clear, the legal issues of the Internet constitution are too complex to be dealt with in this regulatory framework alone. The search for contemporary forms of protection for the integrity of communicative systems and the defence against threats from anonymous societal matrices requires in-depth engagement with world-society structural conflicts. The constitutional challenge is therefore, to enable the release and limitation of societal energies in a way that is adequate to their subject matter, beyond the state system of society. Consequentially, a framework for the horizontal effect of fundamental rights must be developed that takes into account democratic questions of procedures and forums in which societal self-normation practices can be institutionalised.
The Internet and email communication have only existed for about 30 years. In order to ensure that legal frameworks remain responsive to modern realities, the centuries-old ius inter gentes of the Westphalian state system must be advanced. If international law is to make a contribution to the struggle over the Internet constitution, our understanding of international public law needs to evolve alongside transnational forms of power generated by societal communication media beyond how we understand international law today – beyond the traditional political sphere. These regulation efforts must overcome subjectivist and statist reductionism, in order to be able to take such problematic constellations into account if we are to defend and protect human rights against an ever-encroaching global panopticon.
