Is Internet privacy dead? Recovering Internet privacy in an increasingly surveillant society. Jeremy Michael Harmer Submitted in accordance with the requirements for the degree of Doctor of Philosophy The University of Leeds School of Law January, 2017 - ii - The candidate confirms that the work submitted is his own and that appropriate credit has been given where reference has been made to the work of others. This copy has been supplied on the understanding that it is copyright material and that no quotation from the thesis may be published without proper acknowledgement. The right of Jeremy Michael Harmer to be identified as Author of this work has been asserted by him in accordance with the Copyright, Designs and Patents Act 1988. © 2017 The University of Leeds and Jeremy Michael Harmer - iii - Acknowledgements This thesis concludes 8 years and 7 months of research (including 2 extensions given on medical grounds) as a part-time Ph.D. student in School of Law at the University of Leeds. First and foremost, I am grateful to my employer - IT Services at the University of Leeds - for subsidising part of my academic fee and allowing me 5 days study leave from work annually to conduct and complete this doctoral research. I would also like to express my greatest thanks to my supervisors, Dr. Subhajit Basu and Mr. Nick Taylor, for supervision and understanding and encouraging me at critical stages of my research. I am grateful to have had the opportunity to benefit from their academic guidance, motivation, encouragement and support. Also, I would like to express my thanks and appreciation to Dr. Yaman Akdeniz for his guidance and support during the first few months of my research. I would especially like to thank my wife Yim Ling and my two children for their endless support and understanding, in particular through stressful times and my ill health. - iv - Abstract Surveillance on the Internet is a new battleground which attracts attention from all walks of life in our society. Since the 2013 Snowden revelations, the practice of Internet surveillance has become common knowledge. This research critically examines whether or not Internet privacy is dead, with a specific focus on the technical aspects of the Internet in order to express how technology is used to enhance and to invade privacy. This sets it apart from the existing literature in the field. In this research, three jurisdictions are chosen as case studies: the US and the UK as western jurisdictions with different legal systems, and China which has extensive surveillance and limited Internet privacy. The research explores the meaning of privacy in the information society and investigates the ways in which Internet privacy is integrated in the three chosen jurisdictions are critically analysed and discussed. The research findings reveal that Internet privacy is being taken away in both the US and the UK and it is hard to be optimistic for the future in the light of the 2013 Snowden revelations and ongoing changes to legislation, particularly the Investigatory Powers Bill in the UK. Through the examination of the evolution of the Internet in China and its nascent and evolving laws relating to data protection and privacy, the research findings demonstrate that China holds a great deal of control over its Internet and has implemented technical measures of surveillance, effectively meaning that Internet privacy in China is dead. Most importantly, through the examination of these three jurisdictions, there is strong evidence to suggest that these nation states are not so different when it comes to the invasion of Internet privacy. Despite these, there is still hope and the research concludes by examining possible ways to prevent the demise of Internet privacy. - v - Table of Contents Acknowledgements ............................................................................ iii Abstract ............................................................................................... iv Table of Contents ................................................................................ v List of Tables ...................................................................................... ix List of Figures ..................................................................................... x Table of Cases .................................................................................... xi Table of Legislation .......................................................................... xvi List of Abbreviations ...................................................................... xxiii Chapter 1: Introduction ....................................................................... 1 1.1 Background ............................................................................. 1 1.2 Research scope, aim and objectives ....................................... 4 1.3 Justification of the chosen jurisdictions ................................... 6 1.4 Research methodology ......................................................... 10 1.5 Research limitations .............................................................. 11 1.6 Structure of the thesis ........................................................... 12 Chapter 2: Privacy and the Internet ................................................. 13 2.1 Introduction ........................................................................... 13 2.2 Privacy defined ...................................................................... 16 2.2.1 Privacy and international human rights ...................... 22 2.2.2 The European Convention on Human Rights ............. 24 2.2.3 Sources of privacy in the US ...................................... 28 2.2.4 Sources of privacy in the UK ...................................... 32 2.2.5 Sources of privacy in China ........................................ 36 2.2.6 Summary .................................................................... 39 2.3 The Internet and privacy risks ............................................... 41 2.3.1 Privacy and the Information Society ........................... 41 2.3.1.1 EU Data Protection.......................................... 43 2.3.1.2 Evolving EU data protection law ...................... 45 2.3.1.3 Updating EU data protection ........................... 46 2.3.2 Internet structure ........................................................ 49 2.3.3 Data network communication ..................................... 54 2.3.4 Network Address Translation ..................................... 55 2.3.5 Privacy implications of an IP address ......................... 56 2.3.6 Internet infrastructure ................................................. 60 - vi - 2.3.6.1 Carrier Grade Network Address Translation ... 61 2.3.7 The Domain Name Service (DNS) ............................. 62 2.3.8 Internet summary ....................................................... 63 2.4 The growth of the web as a social environment .................... 63 2.5 The evolving Internet - Internet of Things (IoT) and cloud based services .................................................................... 65 2.5.1 Cloud based services ................................................. 66 2.5.2 The Internet of Things (IoT) ........................................ 66 2.6 Conclusion ............................................................................ 67 Chapter 3: Internet privacy and communications surveillance in the US ......................................................................................... 69 3.1 Introduction ........................................................................... 69 3.2 Communications surveillance in the USA .............................. 69 3.2.1 The introduction of warrant requirements ................... 72 3.2.2 Strengthening warrant requirements .......................... 74 3.3 The Foreign Intelligence Surveillance Act of 1978 ................ 76 3.4 Privacy in communications data given voluntarily ................. 80 3.5 Executive Order 12333: Expanding FISAs reach .................. 81 3.6 The Electronic Communications Privacy Act ......................... 82 3.6.1 The Stored Communications Act ................................ 83 3.6.2 Warshak, a challenge to the SCA grant of access to e- mails ............................................................................ 84 3.7 The Communications Assistance for Law Enforcement Act (CALEA) .............................................................................. 86 3.8 9/11 and the USA PATRIOT Act ........................................... 88 3.8.1 Expanding surveillance capabilities ............................ 90 3.8.2 Bulk collection programs ............................................ 96 3.9 Conclusion ............................................................................ 98 Chapter 4: Internet privacy and communications surveillance in UK ............................................................................................. 101 4.1 Introduction ......................................................................... 101 4.2 Communications surveillance in the UK .............................. 101 4.2.1 Telephone interception – the Malone cases ............. 103 4.2.2 The Telecommunications Act ................................... 105 4.2.3 The Interception of Communications Act .................. 106 4.2.4 Halford: the issue of private communications systems ..................................................................... 108 - vii - 4.2.5 Copland: the issue of