Quis Custodiet Ipsos Custodiet—Who Will Guard the Guards

The temptation to make excessive use of spyware and the apparent failure of the current oversight mechanisms compel a significant reinforcement of existing mechanisms. The creation of a new independent commission to monitor online surveillance is necessary.

Shutterstock

For the Israel Police, the reports published in recent weeks in Israeli media (led by Calalist newspaper) about its use of spyware without a court order represent a sort of Judgment Day. It suggests the mutation of the organization from a law enforcement agency into a hub of unlawful activity that severely infringes on the right to privacy of many Israelis and undermines basic democratic principles. It is also a sort of Judgment Day for those who supervise the police: the judges- who issued orders on the basis of intelligence data obtained illegally, without clarifying its nature; the State prosecution - which failed to properly monitor the police’s activity; and the political echelons responsible for all of these public bodies, who did not prevent such illegal conduct from occurring.

A broader perspective on the current illegal surveillance scandal raises suspicions that, so far as the system is concerned, illegality is not a “bug,” but rather-a “feature”: In a world of online surveillance, spyware falls into the category of non-conventional weapons. It gives those who deploy it an outsized capacity to collect information about the object of the surveillance, while, unless an extraordinary effort is made by those supervising its use, the likelihood that its use will be discovered is negligible. The combination of vast power and deep secrecy pose a strong temptation to deploy such nonconventional weaponry: the curiosity-driven urge to open this modern-day Pandora’s Box can hardly be contained. So, it is not surprising that the Israel Police, like other Pegasus-using law enforcement agencies throughout the world, have abused this software in a way that violates contractual and other legal conditions for its use (sale contracts for the software typically allow its use only for thwarting terrorism and other serious criminal activity).

The temptation to make excessive use of spyware on the one hand, and the failure of the current oversight mechanisms to check this extraordinary power on the other hand, have generated a crucial need for new legislation that defines what the police may do, tightens the ban on improper use of surveillance technology, and significantly strengthens the oversight of online surveillance, providing it with the capacity to effectively tackle the challenges brought about by new technology.

A study written two years ago by Amir Cahane, a researcher working under my supervision in the Israel Democracy Institute, proposed that Israel should set up a new online surveillance oversight body, modeled on the Investigatory Powers Commission (IPC) established in Great Britain in 2016. The new proposed agency would comprise legal scholars, technology experts, and researchers with a background in police work, national security, and intelligence gathering. It would be fully independent and have three main powers: first, approval of applications to conduct online surveillance, in addition to or instead of courts; second, ongoing oversight and monitoring of the operations of the online surveillance units of the police and other enforcement agencies; third, review of complaints by individuals who suspect that they have been the victims of unlawful online surveillance and of information submitted by security agency whistle-blowers about violations of laws or procedures.

The great advantage of a special commission like this is the concentration in one oversight body of significant amounts of knowledge and expertise, and the focused organizational effort to oversee the use of the aforementioned "nonconventional weapons". The commission would have better tools than the courts for identifying problems in the way the police submits applications to conduct surveillance and searches, setting proper boundaries for surveillance or search, and limiting unnecessary infringement of the privacy rights of those targeted. Thanks to its members’ technology and intelligence skills, the commission could also more effectively supervise the cyber units’ implementation of search and surveillance orders. In addition, an independent and professional commission could help rebuild public trust in the police and its investigative methods. The recent 2021 Israeli Democracy Index found that—only 42% of Jews and only 13% of Arabs trust the police "very much or to some extent".

But until such a body is established, there is still much that can be done. For example, there should be greater transparency in the various security agencies’ periodic reports to the Knesset and the Attorney General on their use of electronic and online surveillance. Judges and other relevant parties involved in reviewed the exercise of surveillance powers should be offered frequent trainings on the matter. The Attorney General’s office should include a designated official for monitoring online surveillance activity. An independent expert representing the public interest of safeguarding privacy should be invited to appear in ex parte court proceedings where the police requests the issuance of surveillance orders. And legislation should pass requiring that the targets of surveillance be made aware after the fact of its existence, to the extent possible.

These steps would not fully resolve the problem of the abuse of power and authority; that will evidently require treatment at its source—focusing mostly on the organizational culture of the police. It also seems unlikely that such measures would suffice to restore public trust. But they could provide Israeli citizens with some guarantee that the police’s power to continue to deploy advanced technological means—to open the digital Pandora’s Box from time to time—is under proper institutional supervision.

The article was published in the Times of Israel.