Opinion: “Freedom of Information in the Wikileaks era” – Andrew Murray

This is the text of Andrew Murray’s opening statement  at the BIICL debate on Freedom of Information in the WikiLeaks Era.   It was originally posted on his blog, “The IT Lawyer” and is reproduced with permission and thanks.  There was a report of the full debate by Judith Townend posted on Wednesday.

Introduction

I am pleased to be here tonight among a panel of expert commentators. I believe the role of the academic on occasions such as this is to provide the broader viewpoint that is afforded by the freedom of not having to support either a client viewpoint or a professional one. Although all the panellists tonight are speaking a private capacity their views are always going to be the product of their experiences and one of the vital roles of academia is academic freedom to explore the unsaid and sometimes unsayable. Thus I start, I suspect from a radically different position to the many of the others on the panel.

My starting point is Wikileaks is bad for democracy, bad for freedom of information and generally an example of the type of behaviour in the information society which fails to comply with socially normative behaviour outside of a small self‐referential grouping as predicted by Cass Sunstein in his book Republic.com. With my position clearly set out I should say I will also try to position myself within the panel but of course at the time of preparing this I had not had the benefit of the presentations of the other speakers – hence why I have no doubt been scribbling notes in the margins during the preceding presentations.

Let me begin by turning to the two things which are at the focus of this evening’s event: the nature of Wikileaks; and the legal principles of Freedom of Information.

Wikileaks describes itself as “a not‐for‐profit media organisation [whose] goal is to bring important news and information to the public.” They employ a simple mechanic: “We provide an innovative, secure and anonymous way for sources to leak information to our journalists (via an electronic drop box).” The site then goes on to (in a very self congratulatory way) describe the value and importance of Wikileaks noting: “WikiLeaks has sustained and triumphed against legal and political attacks designed to silence our publishing organisation, our journalists and our anonymous sources. The broader principles on which our work is based are the defence of freedom of speech and media publishing, the improvement of our common historical record and the support of the rights of all people to create new history. We derive these principles from the Universal Declaration of Human Rights. In particular, Article 19 inspires the work of our journalists and other volunteers.”

Let’s step back for a minute and look at how Wikileaks works. Material is placed in their care (anonymously); Wikileaks then investigates that material to check veracity and accuracy. Then assuming the material passes these tests it will be published usually alongside a journalistic article about the material. Where does this material originate from? From anyone, anywhere globally, for as Wikileaks acknowledges: “we operate a number of servers across multiple international jurisdictions and we do not keep logs. Hence these logs cannot be seized. Anonymisation occurs early in the Wikileaks network, long before information passes to our web servers.”

With this in mind with whose legal norms apply? And whose social norms? Legally they are making use of what Post and Johnson called the “borderless nature of the internet”. As they indicated, as long ago as 1996, “Cyberspace radically undermines the relationship between legally significant (online) phenomena and physical location. The rise of the global computer network is destroying the link between geographical location and: (1) the power of local governments to assert control over online behaviour; (2) the effects of online behaviour on individuals or things; (3) the legitimacy of the efforts of a local sovereign to enforce rules applicable to global phenomena; and (4) the ability of physical location to give notice of which sets of rules apply.” This allows for an effect called regulatory arbitrage, where online organisations or even individuals may effectively absent themselves from the legal or social norms of any individual state (or even bloc of states) by the use of remote servers, mirrors and other tools.

Let us look at the role Wikileaks plays against this backdrop. Wikileaks claim they are a media organisation with free speech at their heart. It is of course trite to state that freedoms are won not given, and that freedoms are earned not expected. One of my favourite quotes is that found in the work of comic book artist Stan Lee “with great power comes great responsibility”, itself a reworking of the biblical quote “much will be required of the person to whom much is given” from Parable of the Faithful Servant

This is a statement media organisations must remember as they do not operate outwith legal or social norms. A UK‐based media organisation may make use of many tools to ensure that “publishing improves transparency”. They may make a Freedom of Information Request under the FOIA. Generally under s.1 of the FOIA: “Any person making a request for information to a public authority is entitled: (a) to be informed in writing by the public authority whether it holds information of the description specified in the request; and (b) if that is the case, to have that information communicated to him.”

Now of course we are well aware of a number of restrictions to this. For example under s.27 the information may be prevented from being released if “its disclosure under this Act would, or would be likely to, prejudice (a) relations between the United Kingdom and any other State, (b) relations between the United Kingdom and any international organisation or international court, (c) the interests of the United Kingdom abroad, or (d) the promotion or protection by the United Kingdom of its interests abroad.” Thus the Embassy Cables would probably have been exempt from a FOIA request in the UK. What about whistle‐blowing defences? The Public Interest Disclosure Act made amendments to the Employment Act 1996. This protects certain forms of disclosure where the employee believes illegal or harmful activity is taking place and where they fear victimisation or concealment of evidence by their employer. This is an extremely strict defence and usually requires the employee to speak to their employer, an external prescribed person (such as a regulator) or their legal counsel before public disclosure is justified. Wikileaks seems not to be a whistle‐blowing site in the traditional sense of the term as we would use it in UK legal normative language.

What is Wikileaks then in legal normative terms? It seems to me it is an Information Society Service Provider. In other words it is an online information provider. It is not (in my view and one I accept may be challenged by others) a media outlet. Why not? In my view a key characteristic of a media outlet is that it complies with legal and social normative principles: that is it submits itself to the courts in claims of defamation, invasion of privacy, copyright infringement etc. and to the necessary regulatory body – the PCC perhaps – in other matters. It seems to me that Wikileaks subverts both forms of regulation, legal and social‐normative by exploiting the regulatory arbitrage effect. Now, in the second half of my talk I will argue this is potentially harmful and damaging to society and we need to revisit this.

States and Privacy

We must start from the principle that there are no absolute freedoms. My right to privacy may be subverted in the interests of national security, or criminal investigation or to collect taxation etc. Similarly my right to free expression does not encompass a right to language likely to cause immediate harm – shouting “fire in a theatre”, which incites hatred or violence, which libels or which infringes another’s copyright. Sticking with these two “basic” rights – one of which Wikileaks brings to the fore and another it relegates to the background, we find that there is a natural tension between the two. Our right to free expression has a natural tension with our right to privacy – see Von Hannover, Campbell v MGN or Mosley v News Group Newspapers. The balance is struck in a democratic society by a mixture of legal and social norms with the preponderance of weight being on the legal norms. Social norms though do play a role: see for example the different way illegally obtained material is covered by the majority of media outlets. Material illegally obtained by the News of the World via phone hacking in breach of the Regulation of Investigatory Powers Act and the Data Protection Act is (rightly) vilified by columnists in popular newspapers; while material (probably) illegally obtained by Private Bradley Manning forms the focus of a widespread series of publications by a number of leading global newspapers and is lauded generally by press outlets – why? The only distinction seems to be the socially normative distinction – the first is not socially acceptable as it involves the illegal interception of personal communications while the second involves communications between states. Maybe as other panellists or audience members would like to point out this may be a legal normative distinction as under Art.8 of the ECHR “Everyone has the right to respect for his private and family life, his home and his correspondence.” i.e. the legal normative right is a personal right and not open to states‐actors.

Seven years ago I predicted exactly this issue would arise (at that time in relation to blogs and rolling news as I could not foresee then Wikileaks) when I wrote a paper entitles “Should States Have a Right to Informational privacy?”. We think of states as being non‐human actors. As such they do not benefit from traditional privacy rules designed to protect individuals, but is this so? The internet society is markedly different from days past where the Westminster Lobby or the Whitehouse Press Corps worked closely with government (admittedly often too closely) to protect the government from the full glare of scrutiny while policy was made and deals were done. Why do we protect individual privacy? The best work on this in my view is Alan Westin’s 1967 work “Privacy and Freedom”. Here he argues that “man’s need for privacy may be rooted in his animal origins”; “the animal’s struggle to achieve a balance between privacy and participation provides one of the basic processes of animal life. In this sense, the quest for privacy is not restricted to man alone, but arises in the biological and social processes in all life.”

Such a definition of privacy suggests that the need for individual and group privacy is a bio‐social function: in part a biological response to certain stimuli such as a reaction to bereavement or a precursor to procreation. Also it is societal: reflecting the social norms of the community, family and individual. As Westin says, “limits are set to maintain a certain degree of distance at certain crucial times in his life.” This definition seems to offer little scope for extending protection to non‐human actors such as States. As non‐biological actors, States do not possess the necessary biological element. This suggests it would require an accepted social norm, to extend privacy protection to States. Although historically there appears to be little demand to do so, it my contention that it may be time to reconsider our social contract with the State. As Westin himself had noted, there is a need for privacy protection to be offered to organisations as well as individuals. In particular privacy is necessary during the early stages of policy formulation, or in Westin’s terminology “their staging processes”. The danger is that with the changes to society brought about by the rise of the information society we may now not be affording the necessary level of privacy protection to State actors to allow them to properly carry out this staging process.

Prior to the advent of digital media, the relationship between the State and its citizens was well defined by a clear social contract. Representatives were elected to carry out the wishes of the public. These representatives were primarily scrutinised by other elected, and in the case of the House of Lords unelected, representatives. External scrutiny came from a variety of sources, all of which were to a greater or lesser degree in a symbiotic relationship with representatives. Primarily, this external scrutiny was effected by the Fourth Estate. Media organisations, be they print or broadcast media, employed lobby correspondents: the relationship between representatives and lobby correspondents being a closely defined one. If a journalist failed to respect the privacy of any representative, particularly a member of the government, sanctions would quickly follow. As editors had a duty to protect their lobby correspondents, they would often self‐censor any story which breached this relationship of trust. In this fashion the social contract was respected by both the State and the media. Secondly, a degree of information would be put into the public domain through publications such as Hansard and through official reports and papers. Such reports and publications, though widely available in public libraries, were little read. Expensive to buy, individuals wishing to read such documents usually had to obtain them through their library, frequently encountering a delay should the report prove popular. In effect these reports were mostly only read by two sets of interested parties. The first of these were journalists, who as already discussed were required to respect the privacy of representatives in order to cultivate access. The second were academics. Scholarly comment on government initiatives and policy implementation would in time follow from professors of politics, sociology, government and law. Such comment was though of little impact upon the privacy rights of the State for three reasons. Firstly, they were usually generated by reference to such publicly available documents as those discussed above: thus the data carried little privacy implications. Secondly, the extended time before publication of such reports usually meant that the “staging process” had long since concluded and finally, they were overwhelmingly comment written by academics for academics: the readership of such commentaries being on the whole extremely narrow.

The advent of the always on, digital society has blasted this social contract wide open. Maybe this is a good thing – the expenses scandal showed how the agreement had arguably got too cosy, but just because we can point to one positive example does not make a statement proven. The Wikileaks cables have arguable undone a considerable amount of goodwill and diplomacy. Wikileaks argues that “Publishing improves transparency, and this transparency creates a better society for all people.” Not necessarily. Publishing may lead to greater obfuscation. In future records may not be kept at all or may be “spun” to give a different impression should a leak occur. This we have already seen. In response to the “greater transparency” of 24 hour news the UK Government has employed more “communications directors” and staff and less civil servants. We know their names: Alastair Campbell, Charlie Whelan, Damian McBride, Andy Coulson. All are massively controversial individuals. All did the same job: spin the news to suit their masters. Spin is the natural response of governments to invasions of their privacy. Spin does not improve transparency. We cannot know what harm the cable gate issue may do. Already there is evidence it may have harmed a carefully nurtured position with Beijing over North Korea, more harm will undoubtedly have been done though. We should not publish because we can but because it is in the interests of society to do so. This means complying with legal and social normative principles.

In terms of the UK position I believe Wikileaks fails to comply with the former; its compliance with the latter is a matter for debate.