03 Dec 2014 Hong Kong’s spy commissioner found ten non-compliance cases by law enforcement agencies
Darryl Saw, the Commissioner on Interception of Communications and Surveillance, said at a briefing of its 2013 annual report on 2 December that ten irregularities by the law enforcement agencies were found last year.
These cases include one inadvertent unauthorised interception, one case of an omission of a legal professional privilege assessment in an application for interception operation, and one case of omission of information in the device request form.
Saw said although the overall performance of the law enforcement agencies in complying with the ordinance was satisfactory, he “was naturally disappointed” at the non-compliance case where the applicant failed to assess the likelihood of legal professional privilege in the application, which led to the rejection of the application by panel judges.
“The failure to include such a fundamental statutory requirement in an application is a serious matter given the reasons why such an assessment is required to be made in any application,” Saw noted. “It was disconcerting to note that the omission was not detected by the LEA throughout the checking process in the preparation of the application by the chain of officers.”
Under the Interception of Communications and Surveillance Ordinance that took force in 2006, four law enforcement agencies, namely the Police force, Customs and Excise Department, Immigration Department and Independent Commission Against Corruption (ICAC), can apply to conduct interception and surveillance operations to detect and prevent serious crimes and protect public security.
Saw’s major duty includes overseeing the compliance by the law enforcement agencies with the ordinance and conducting regular reviews. In 2013, Saw conducted 208 reviews on weekly reports submitted by law enforcement agencies and panel judges, 28 inspection visits and 35 reviews of legal professional privilege cases.
In 2013, panel judges and authorising officers issued a total of 1,412 authorisations and denied only 11 applications. Saw said the low rejection rate is due to the commissioner’s endeavour to put rigid constraints on the law enforcement agencies’ applications.
“Over a period of years since the inception of the legislation, my predecessor and myself have made sure there are rigid constraints on the LEA to ensure when they make an application, they do send properly justified materials and supporting documents,” Saw said.
All the law enforcement agencies are under legal obligation to report to the commissioner any failure by the department or its officers to comply with the ordinance, according to the interception legislation.
Saw made the observation that most of the irregularities encountered and mistakes made by law enforcement officers “were attributable to their inadvertence or negligence, which were uniquely related to the individuals concerned rather than defects in any of the control systems”.
The interception commissioner’s report sheds light on the kind of independent oversight the government needs to keep it in check when it requests user data from service providers. Officers who are found not in compliance with the interception ordinance will face disciplinary action, which includes verbal advice or warning.
Currently there is no adequate regulation or guidelines governing the government agencies’ requests for online user data, except the broadly defined Personal Data (Privacy) Ordinance. There is no independent body to oversee the government’s request-making process.
The only procedure that checks the legitimacy of the government data requests is through court orders. Yet as the Hong Kong Transparency Report noted in the 2014 report, many government agencies are making requests for user data from service providers without court orders. For instance, from February to October this year, only partial of the police’s 2,621 requests were made under court orders, and none of the customs’ 357 requests were made under court orders, according to information disclosed by the government upon Legislator James To’s request.