Westminster eForum Keynote Seminar:

Regulation, responsibility and internet safety: policy, practicalities and the role of providers

Timing: Morning, Tuesday, 16^th January 2018

Venue: Hallam Conference Centre, 44 Hallam Street, London W1W 6JJ

Ensuring legislation effectively mitigates the increasing terror threat

Max Hill QC, Independent Reviewer of Terrorism Legislation

I have been asked to address legislative solutions to the threat from terrorism which we all face in this country, mindful of the atrocities committed on our streets and bridges commencing on 22^nd March last year in Westminster.

I accept the title given to me today, which is useful because it serves to underline my role and remit, which is to annually review our terrorism legislation, essentially the Terrorism Acts 2000 and 2006, together with the Terrorism Prevention and Investigation Measures (TPIM) Act 2011 and the Terrorist Asset Freezing Act 2010.

In addressing the title given to me for this short address, we must ask whether and to what extent legislation can ever provide the remedy? I have spoken and written about this many times before:

I am on record, from when I first came into post as Independent Reviewer in March this year, saying that in general we don’t need more terrorism offences, and there may be examples of redundant terrorism offences which time has proved are not as necessary as Parliament thought.

Careful study of the relevant section of the Crown Prosecution Service website reveals that a wide range of statutory offences were deployed in charging terrorism cases  recently, including preparation of terrorist acts (section 5, 2006 Act), encouraging terrorism (section 1, 2006), belonging to a proscribed organization  ie  ISIS (section 11, 2000, together with inviting support for such an organization, section 12), funding terrorism (section 17, 2000), disseminating terrorist publications (section 2, 2006), Interestingly, training for terrorism under sections 6 and 8 of the 2006 Act  was not charged at all in 2015 or 2016. Inciting terrorism overseas was charged once in the same two-year period. Possession of articles for terrorist purposes under section 57 of the 2000 Act was charged once in 2015 and not at all in 2016. Some revision and trimming of the current legislation may yet be possible, and that would be a good thing. In general, I would suggest that our legislators ie Parliament have provided for just about every descriptive action in relation to terrorism, so we should pause before rushing to add yet more offences to the already long list.

Let’s consider just a handful of recent convictions, concentrating upon those who have used online communications for terrorism related activity, asking ourselves the question whether these individuals have been successfully apprehended and convicted using existing legislation.

Tarik Hassan and Suheib Majeed, the latter a physics undergraduate at Kings College London, used a variety of secure and encrypted systems to communicate with each other (Hassane was studying in Khartoum) concerning their plot to carry out terrorist murders in London using a silenced firearm. The evidence included online reconnaissance of a police station and Territorial Army barracks. Charged with conspiracy to murder and preparation of terrorist acts under section 5 of the Terrorism Act 2006.

Tareena Shakil, 26 and the mother of an 18 month old son, became prolific on social media in support of Daesh. Her messages included an exhortation ‘to take to arms and not the keyboard’. She took her son to Turkey and on to Raqqa in Syria, joining Daesh and using the internet both to maintain contact with other family members and to glorify Daesh. Charged with encouraging terrorism under section 1 of the Terrorism Act 2006 and belonging to a proscribed organisation namely ISIS under section 11 of the 2000 Act.

Zafreen Khadam was investigated after complaints made to the police that a Twitter account was being used as a tool to post IS propaganda and to encourage others to join IS and instigate acts of violence. This defendant was found to have opened 14 Twitter accounts  in one month in the spring of 2015. Extreme content was posted, including a web based IS document encouraging the online dissemination of IS literature in order to support its cause. The document was viewed 1464 times by the time it was captured by the Police as evidence. In addition, the defendant used WhatsApp to send material including execution videos. Charged with ten counts of section 2 dissemination.

Mohammed Alam used Paltalk messenger to send links to an ISIS video. Charged with section 2 dissemination on the basis that he was reckless as to whether it would encourage CPI of terrorism.

Mohammed Ameen sent 8000 tweets over 7 months using 16 different Twitter accounts and using 42 different names, expressing support for Daesh. Charged with offences of encouragement under section 1 of the 2006 Act, one count of section 2 dissemination, and one of inviting support for a proscribed organisation under section 12 of the 2000 Act. The judge in passing sentence  (five years’ imprisonment) noted that the offending was aggravated by the explicit and intentional nature of the encouragement and by the persistence with which it was pursued.

So I continue to argue that we have the legislation we need. That does not mean that we stand still. Of course, there is a powerful argument that anything and everything proper should be done, within the law, to bear down upon terrorist use of the internet. In response, one new proposal has come forward in recent months, and it was announced by the Home Secretary at the Conservative Party Conference in October:

‘The government intends to change the law, so that people who repeatedly view terrorist content online could face up to 15 years behind bars. The proposed changes will strengthen the existing offence of possessing information likely to be useful to a terrorist (Section 58 Terrorism Act 2000) so that it applies to material that is viewed repeatedly or streamed online’.

We are told that ‘The updated offence will ensure that only those found to repeatedly view online terrorist material will be captured by the offence, to safeguard those who click on a link by mistake or who could argue that they did so out of curiosity rather than with criminal intent’. I welcome this, but we wait to see what the words ‘repeatedly view’ actually mean. Are two clicks on a link one too many, or will three clicks be required? Can an internet user be innocently curious twice, but not three times? These are matters for Parliamentary draughtsmen to consider, and I await the outcome with interest. I add here that in addition to safeguarding the curious from prosecution, we must surely be vigilant to ensure that those who view material in disgust, shock and disapproval do not find themselves on the wrong side of the law. There will have to be very careful work on the definitional side of this expanded offence.

This brings us to the question whether further legislation is needed, specifically targeted at the internet and the relevant service providers. Again, I have spoken about this before. At the Terrorism and Social Media Conference held in Swansea University last year, my view was this:

There can be no doubt  that social media plays a pivotal role in communication between those intent on terrorism, just as it is pivotal in the daily lives of most of us as we go about our lawful business. In that simple truth lies the dilemma which we face. We all deplore the outbreaks of terrorist violence we have witnessed in vicious attacks since March 22^nd. And we all come together with renewed determination to face down the menace of modern terrorism. Where these awful crimes are facilitated by the use of social media, we want to close down the criminals ability to communicate. And yet, we must recognise that policing the internet, and controlling social media comes at a very high price if it interferes with the freedom of communication which every citizen enjoys, and which is also enshrined in Article 10 of the European Convention on Human Rights.

By the time I delivered the Tom Sargant Memorial lecture for JUSTICE in late October, I said this:

So let us all recognise that we enjoy a criminal justice system which enshrines fundamental freedoms we must uphold even in the face of terrorism, one of the most celebrated freedoms of course being freedom of speech, Article 10. I agree with the letter written to the Times during the summer,¹ signed by the leaders of the legal professions as well as by Liberty and JUSTICE, which includes this: ‘Suggestions made before the general election, that human rights prevented the police fighting terrorism, are misguided. …Human rights exist to protect us all. Weakening human rights laws will not make us safer. Terrorists cannot take away our freedoms – and we must not do so ourselves’.

So far so obviously correct. But, and here is the balance, we remind ourselves of the words of Article 10(2) of the ECHR: ‘The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime…’

The question is, how far is it ever necessary to go?

Legislative solutions are rarely straightforward. In France, the latest developments ares as follows:

By Loi no.2016-731 of 3 June 2016, Article 421-2-5-2 was added to the Penal Code:’The act of habitually accessing online public communication services that exhibit messages, images or representations that directly encourage the commission of terrorist acts, or defend these acts, when this service has the purpose of showing images or representations of these acts that consist of voluntary harm to life is punishable by two years of imprisonment and a fine of €30,000. This Article is not applicable when they are accessed in good faith from normal professional activity that has the objective of informing the public, conducting scientific research, or for use as evidence in court‘.  So far so good. However, this new French law was struck down by the Constitutional Council, Decision no. 2016-611 QPC of 10 February 2017. The problem was that ‘good faith’ in the French definition was found to lack certainty. In other words, the French law failed to indicate with sufficient clarity how a person might not be guilty of the offence, a fundamental principle which also applies in our jurisprudence.

The French experience does not end here, because an amended offence was reintroduced by Loi no.2017-258 of 28 February 2017, art. 24. This time, the offence refers to habitually accessing online material  accompanied by an expression of adherence to ideology, and the good faith excuse has been redefined in terms of  ‘the normal practice  of  a  profession  of  which  the  purpose  is  to  inform  the  public,  arising  in  the  context  of  scientific research or research carried out in order to serve as evidence in legal proceedings, or the fact that this visit is accompanied by a report of the content of this service to the competent public authorities’.

This second French attempt at new legislation reached the CONSTITUTIONAL COUNCIL  on 9 October 2017 by the Court of Cassation (Criminal Chamber, judgment no. 2518 of 4 October 2017), under the conditions provided for in Article 61-1 of the Constitution, of a priority question of constitutionality.

Some extracts from the decision:

3. Article 11 of the Declaration of 1789 states: “The free communication of thoughts and opinions is one of the most precious rights of man: every citizen can therefore speak, write, print freely”.

4. According to article 34 of the Constitution: “The law lays down rules concerning … civil rights and fundamental guarantees granted to citizens for the exercise of public freedoms”. On this basis, it is open to the legislator to lay down rules to reconcile the pursuit of the objective of combating incitement and provocation to terrorism on online public communication services..

12. ..since the entry into force of the contested provisions, the legislator has supplemented the powers of the administration by adopting, by the Act of 30 October 2017, new individual administrative control and supervision to prevent the commission of terrorist acts.

13. Therefore, in view of the requirement of the infringement of the freedom of communication, the administrative and judicial authorities have, independently of the contested article, many prerogatives, not only to control the communication services to the online public, inciting or repressing terrorists or repressing their perpetrators, but also to supervise a person who consults such services and to question and punish them when this consultation is accompanied by behavior revealing a terrorist intent.

14. ..the contested provisions do not require the author (be) willing to commit terrorist acts. … The impugned provisions thus punish with a two-year prison sentence the sole fact of consulting several times a service of communication to the public on line, without .. the terrorist intention of the author  as  (an) element .. of the offense.

15. .. a person adhering to the ideology conveyed by the sites in question seems likely to fall within one of the examples of legitimate grounds stated by the legislator. Therefore, the contested provisions raise uncertainty as to the lawfulness of the consultation of certain online public communication services and, consequently, of the use of the Internet to search for information.

16. It follows from all the foregoing that the contested provisions infringe the exercise of the freedom of communication which is not necessary, appropriate and proportionate. Article 421-2-5-2 of the Penal Code must therefore, without having to rule on the other complaints, be declared unconstitutional.

Unsuccessful attempts to legislate in this area, then; albeit this is France, a country which has just emerged from a 2-year state of emergency, at the end of which it has normalised many of the supposedly interim, emergency powers.

So, we return to  the question of ever greater liaison and cooperation, including between the tech companies and the Police who work in this vital area:

I firmly believe that tech companies should strain every muscle to stem the flow of extreme material online. I have sat next to Metropolitan Police specialist officers in the CTIRU who spend every day searching the net to find extreme material, and who then systematically apply hash values and other algorithms to identify each and every posting of that material with a view to writing to every web host requesting the take down of that material. It is laborious work, and it is important.

What is happening as we enter 2018?

There are improvements in the time it takes from referral to removal of online content.  However, this leaves the  problem of identification and prevention of prohibited content at source, by the ISPs working in conjunction with the Global Internet Forum for Countering Terrorism (GIFCT). More needs to be done here.

Meanwhile, there is now a generally good service from the bigger ISPs and material the Police flag up to them is removed within about 20 minutes or so.

However, each company is different and the smaller companies in particular can be quite slow to remove content, or do not remove content at all. There are a number of reasons for this and there is engagement with these companies to help them understand the risks and to work with law enforcement to voluntarily remove material (where appropriate) that breaches their own terms and conditions – or UK legislation. Often the problem is either a lack of resources to assist quickly; or they do not agree with an assessment of the material (they sometimes view the material as journalistic); or the material is not considered a breach of legislation in the country they are based. There are also companies who actively promote themselves as being anti-establishment.

In addition, some companies still do not search for material themselves and generally would not remove content unless it has been reported to them and is clearly a breach of their terms and conditions. However, they will apply a hashtag to any identified files to prevent them popping up elsewhere or being uploaded at a later date. Anything they identify internally is reported to international or domestic law enforcement in accordance with their own internal policies.

From the point of view of obtaining Communications Data (by which I mean billing data, cell site and subscriber information) – again, this varies from company to company. The bigger companies are generally good at assisting the Police and following last year’s attacks they were quite proactive. But smaller companies may be start-ups and do not have the resources to assist quickly or sometimes at all. They also struggle to manage their own data and may not store it in a way that makes it easy for the Police or others to lawfully apply for access.

Progress has been and continues to be made. I see little if anything in the way of new legislation that might help, at least without hindering fundamental freedoms. But liaison and cooperation within the existing law is very important.