Georgia’s perpetual system of illegal surveillance

The Georgian government has shown no enthusiasm for changing its long-condemned secret surveillance system, which grants the authorities direct access to mobile operators, leading to illegal surveillance. Their reluctance to give up on this defective approach has led rights organisations to boycott the working group on a new bill in parliament.

Until 2014, Georgian investigative bodies had direct access to phone lines and metadata (the time, location, and duration calls) without any kind of oversight. This meant that they did not need approval (either from the courts or any other official body) to undertake secret surveillance over any individual.

Georgian lawmakers have long debated the country’s surveillance system. For many years, the main question has remained unanswered: who would have the ‘key’ and therefore direct access to secret surveillance.

In Georgian legislation, secret surveillance is defined as eavesdropping and recording phone conversations; gaining information from communications service operators, computer networks, and installing clandestine applications on suspects’ PCs; postal and telegraphic transfer control; and physical surveillance via audio/video recording, photography, and the use of electronic tracking devices.

After the constitutional court struck down the country’s surveillance laws in April 2016 as unconstitutional. In November 2014, legislative amendments were made to introduce a ‘two-key’ system for secret surveillance, although President Giorgi Margvelashvili vetoed the bill.  After the parliament overrode President’s veto twice, the two-key system came into force on 31 March 2015.

The two-key system gives the Personal Data Protection Inspector of Georgia control over secret surveillance throughout the country. According to this law, law enforcement agencies must obtain permission from the Personal Data Protection Inspector, in addition to gaining a court order, prior to conducting surveillance. Investigative bodies who apply to undertake surveillance (e.g. the State Security Service), are given consent electronically by the Inspector, and only then can secret investigative actions be started.

The Inspector is obliged to check whether the court’s decision (or in urgent cases, the decision of the Prosecutor’s Office) to conduct surveillance is valid.

However, according to the Institute for Development of Freedom of Information (IDFI), — an organisation working to promote open and democratic governance — the two-key control mechanism is only used for telephone surveillance, and not for the collection of metadata or internet traffic (including the content of communications).

According to statistics from the Supreme Court of Georgia, in 2016, law enforcement agencies asked the courts for authorisation to undertake secret surveillance 4150 times, and were given permission 3822 times. The number of requests submitted to the court in 2016 rose by 50% compared to 2015 (2719). The percentage of requests approved by the courts also increased, from 77% to 92%. However, the Inspector was asked for permission only 401 times (10% of the total).

‘The Inspectors Office claimed that due to particularities of interception of Internet traffic, the Personal Data Protection Inspector is incapable of electronic control of each computer. Most importantly, it was revealed that due to insufficient control mechanisms over wiretapping, secret surveillance could be conducted bypassing the Personal Data Protection Inspector and without a court order’, the IDFI states.

The issue of illegal surveillance entered the spotlight in recent years following the revelation that thousands of secret video recordings were kept by the former government. Rights groups have recently claimed that citizens of Georgia ‘are still being eavesdropped on’. A number of rallies have been organised by an alliance of organisations, Es Shen Gekheba (this affects you) in Tbilisi in 2015–2016, as new secret recordings of leading politicians and media figures kept appearing online (investigations of each of these cases is still ongoing).

In the Constitutional Court’s decision outlawing Georgia’s surveillance regulations, the court ruled that official investigative bodies interested in gaining personal information must not be granted unrestrained access to any data, as this represents an excessive threat to privacy.

According to the constitutional court’s decision, new laws must be implemented by 31 March 2017. The previous parliament failed to introduce this legislation, and the current one has started working on a bill with help from several leading organisations. A working group was was created in January 2017, including several MPs, the Personal Data Protection Inspector, the State Security Service, and representatives of non-government organisations (NGOs).

The group held a few sessions, however, on 31 January, the participating NGOs announced that they are leaving the group, as they find authorities’ latest bill to be again unconstitutional.

As an alternative to the two-key system, the government intends to establish a legal entity of public law (LEPL) in the state security service of Georgia (SSG). It will be accountable only to the parliament, government and supreme court of Georgia. However, NGOs objected to the initiative.

‘The body will be created by the SSG; the head of this office will be recommended by the SSG, and will be appointed by the Prime Minister… It’s unclear, how it will stay independent. In fact, it does not comply with the decision of the constitutional court at all’, Netgazeti quoted Ana Natsvilishvili, head of the Georgian Young Lawyers’ Association, one of the NGOs which left the working group as saying.

The Georgian Young Lawyers’ Association (GYLA), Transparency International Georgia, the Human Rights Education and Monitoring Centre, Open Society Georgia Foundation, and others also argue that government’s plan to create a LEPL inside the SSG does not comply with the decision of the constitutional court. The ‘key’ stays with the security services, and it does not adhere to the court’s decision, they claim.

As an alternative, NGOs had suggested a new, completely independent, separate agency, accountable to the Parliament, Personal Data Protection Inspector, and the courts. According to Giorgi Gotsiridze, a lawyer working for GYLA, a similar body was originally mentioned in the decision of the constitutional court itself. But the working group, which now consists solely of law enforcement officials and MPs, has decided to follow its own path, to keep the key in the hands of law enforcement agencies.