Comments on the Draft U.S. Guidance for Export of Surveillance Tech
Suggested edits below the comments.
There should at least be some mention of our constitutional framework, which recognizes many of our rights as held by the people outside our constitutional grant of sovereignty, and which has been especially durable and on which we have long relied -- at least until we began framing our approach to surveillance in relation to executive powers and the international arena by the formulation set up for the FISA Court in the Foreign Intelligence and Surveillance Act.
This will prevent our losing track of our own strong basis for rights while we acknowledge and work within the types of rights frameworks that may be constructed internationally, by intergovernmental agreements and other means. I offer a few inserts below to meet this concern.
This document needs to provide for recognition that our constitutional tradition brings important considerations to the question of surveillance that this document does not reflect. Without this recognition it may unfortunately serve to legitimate our overlooking these considerations in the international context, by presenting the issue of surveillance as if the framework for positive rights limits on business that it represents can address the issue adequately in itself.
It may be evident these days that the US very much needs to have a discussion about how best to address the basic framework for surveillance established for us in the US since the FISA, a framework which may need revisions with respect to how strong limits on executive and investigative powers should be formulated as they affect our own citizens. This conversation naturally includes the question of how regimes such as ours that enjoy strong constitutional rights should integrate with others, whether they enjoy rights that operate as strong limits on [their] own government, or work within other frameworks. We may lead in this area, as the work we do on this question may be emulative for the world at large as the global community proceeds with modeling governance into treaty-based and commercial law frameworks. These international frameworks establish different relationships between peoples and governments and between rights and powers than those to which we have long been accustomed, at least within the strictly domestic sphere.
The UN approach based on positive and treaty-based rights limits on business cannot provide the same strong standards of protection that we rely on in our judicial processes, for constitutional rights of the type we know well.
We should not allow privacy or surveillance to be addressed exclusively in this frame. Our strongest rights are enjoyed as limits on the government, and we risk losing sight of this if we fail to acknowledge our own constitutional tradition. Courts may apply various standards of review in various circumstances, but for strong fundamental rights retained against our government, they will apply the strongest standard available.
It isn't so much the mere *presence of government* that implicates the kinds of rights concerns we know well, as one might reasonably infer based on this document.
The security of our rights derives from the *relationship* we have to our government, as framed constitutionally; this sets the strong limits to which we are accustomed (however limited we may make the government's role). We grant sovereignty to our government by our constitutional act; we also secure our (many of our most prominent) rights at that moment by setting them outside that grant, thereby setting them outside the government's powers. (Many of our rights are framed in negative terms and in the Federal Constitution they are also governed by the 9th and 10th amendments, other constitution components that also secure our rights in this rigorous way.)
This basic constitutional foundation is the basis of the strict scrutiny standard by which our judiciary addresses many of our most important fundamental rights, including our right to be secure against unreasonable searches and seizures of our persons, places and effects.
Along with the guidelines provided in this document, exporters of items with surveillance capabilities also need to be given an indication of our own constitutional limits (and this concern may also appropriately apply to other constitutional contexts that may secure rights similarly. We may well craft arrangements with other countries of a type where both sides may rely on reciprocity in the special strength of our rights we secure by our domestic constitutional frameworks). Referencing strong rights secured constitutionally against government intervention lets us assure this basis now and going forwards.
Another part of the document that needs special attention is its framing in terms of *risk* of human rights abuses. We don't rely on risk assessment to secure our own rights, and unfortunately many pieces of the international governance frame articulate things in these terms. Our judiciary may overrule specific statutes and practices on a strict standard of review basis, which bars our government from proceeding where a fundamental right is affected, allowing it to encroach only if its acts are necessary for government to be a government at all -- and even then only if they are narrowly tailored to affect our rights to the least extent possible. This has little relationship to risk; it's just a strong application of the relevant law.
The international arena may develop systems of governance in relation to risk, but we should not overlook the full foundations of our own rigorous system of fundamental rights.
There is also a risk that in setting up this guideline regarding international surveillance technologies we will be facilitating a shift to a legal framework that can buttress unfortunate conceptions that are presently at play of how our own government should operate with respect to mass surveillance. The international framework misses this mark in a number of ways.
Some suggested inserts:
In the second introductory paragraph beginning "At the same time, these items can be misused to violate or abuse human rights", I urge you to reference freedom of the press explicitly. It is critical to the way our free system of government works.
Then add one additional sentence on the end:
Our own federal and state constitutions also secure fundamental rights against government intervention.
(This seems to me to present the structure of our constitutional rights framework well without leaning toward potentially ideological arguments, such as natural rights or how states' and federal frames interact under federalism. Regardless of how one conceives rights in the US order, the structure of our constitutional acts, claiming rights as possessed by the people outside of the grant of sovereignty to the government, is one that accounts for the durability of our negative rights, framing them as retained against government, regardless of certain more ideological disputes.)
Due Diligence: For the purpose of this document, “due diligence” is defined as the process by which an exporter works to identify, anticipate, prevent, mitigate, and account for how it addresses actual or potential adverse impacts on human rights of individuals
^^, and may apply to our own citizens within our own constitutional and statutory frameworks or foreign nationals.
Under Definitions, "Due Diligence, "Characteristics," add the phrase below on the end of the "Public Communication" bullet point:
Public Communication: Communication of the exporter’s commitment to a rigorous internal and external review of human rights risks and to adequate measures to address these risks
^^, whether internationally or domestically.
(By referencing both domestic and international contexts, this allows us to qualify this document's framing of risk so it applies to the international context, as opposed to the document allowing the whole scope of the issue to appear to be properly addressed in those terms. Leaving it the way it is could unfortunately serve to facilitate a misapplication of the international frame -- and that could exacerbate problems we are presently encountering in the application of surveillance at home)
Under Definitions, "Due Diligence, "Characteristics," add the sentence below after the "Alignment with Human Rights Instruments" bullet point:
Alignment with Human Rights Instruments: Review process should be based on the Universal Declaration of Human Rights, the International Covenant on Civil and Political Rights, the OECD Guidelines for Multinational Enterprises, and the UN Guiding Principles on Business and Human Rights.
^^These international rights frameworks are supplements for the rights US citizens enjoy under the strict standards reflected in our own state and federal constitutions.
Under Definitions, "Legitimate Law Enforcement Purpose," add the phrase below at the end:
Legitimate Law Enforcement Purpose: For the purpose of this document, “legitimate law enforcement purpose” means use by law enforcement, including government agency providing security services, consistent with state commitments to the Universal Declaration of Human Rights
^^, and other fundamental rights bases such as their own constitutions.
Under "Human Rights Due Diligence and Risk Mitigation Considerations:"
Under item 1, on tailoring the export item to minimize human rights misuse, add a sentence after the list of "privacy design features" to the following effect:
^^Our mention of these features in this guideline should not be construed as representing support for or a mandate for providing these functions to the US government or any other government except as provided within the bounds of international or domestic law.
There are various problems with the adequacy of items 3, 4, and 5, on reviewing government end-user human rights practices and laws, and how other stakeholder entities will operate. Rather than explaining these, I will just observe that the few inserts I've provided are a concise way of shaping the scope of the document so these concerns are handled well.
A similar point can be made about items 6 and 7, on contractual and procedural safeguards to mitigate human rights risks. I recommend an additional sentence be added to supplement the focus on private contractual provisions, that again are not as rigorous a foundation for strong rights as the constitutional foundation provides. Something along the lines of:
^^We encourage exporters to support at least the standards of privacy rights under international instruments and certainly our own standards for our own citizens (and perhaps for foreign nationals? -- that might be a tall order as a matter of legal fact and for all circumstances though)