Surveillance, Monitoring and Human Rights

Introduction and Context

Digital communication has transformed both public administration and private life. Governments use surveillance to prevent terrorism, investigate crime, protect national security and manage borders. Employers monitor systems to protect confidential information, investigate misconduct and maintain operational security. Service providers collect extensive records about users, devices, locations and interactions. These practices can support safety and accountability, but they can also interfere with privacy, freedom of expression, association, equality and due process.

The central legal challenge is therefore not simply whether surveillance is useful. It is whether surveillance is authorised by law, directed toward a legitimate objective, necessary in a democratic society, proportionate to the objective, independently supervised and subject to effective remedies. Cybersecurity professionals increasingly influence these questions because they design logging systems, respond to lawful requests, preserve evidence, configure monitoring tools and advise organisations about data governance.

This chapter examines the relationship between surveillance powers and human rights. It focuses on public-sector surveillance, workplace monitoring, communications interception, encryption and intelligence activities. The discussion uses broadly recognised principles from international human rights law, while recognising that precise rules differ between jurisdictions. A cybersecurity practitioner must always consult the applicable constitution, statutes, regulations, court decisions and regulatory guidance in the relevant country.

Learning Objectives

By the end of this chapter, a student should be able to:

1. Explain surveillance, monitoring, interception, metadata and related concepts.
2. Apply legality, legitimate purpose, necessity, proportionality and accountability principles.
3. Distinguish content interception from access to metadata and stored data.
4. Evaluate workplace monitoring policies from legal, technical and ethical perspectives.
5. Explain how encryption creates both security benefits and investigative challenges.
6. Identify safeguards for intelligence activities and law-enforcement access.
7. Recommend a rights-respecting monitoring design for an organisation.

1. Important Concepts and Terminology

Surveillance is the systematic observation, collection, analysis or retention of information about individuals, groups, systems or activities. It may be overt or covert, targeted or general, manual or automated.

Monitoring generally refers to ongoing observation of activity. In an enterprise it may include security-event logging, access monitoring, endpoint telemetry, email filtering and network-traffic analysis.

Interception is the acquisition of communications while they are being transmitted. Depending on national law, interception may include listening to a telephone call, capturing message content or obtaining communications-related information in real time.

Content data concerns what was communicated: the words of an email, the audio of a call or the text of a message.

Metadata describes information about a communication or activity rather than its substantive content. Examples include sender, recipient, time, duration, IP address, device identifier and approximate location. Metadata can nevertheless reveal sensitive relationships, habits and beliefs.

Stored data is information held on a device, server, cloud platform or backup system. Accessing stored data is often legally distinct from intercepting data in transit.

Traffic or communications data is a legal term used in some jurisdictions for routing, addressing, timing and similar information. Its precise meaning varies.

Targeted surveillance focuses on a specified person, account, device, location or investigation.

Bulk or general surveillance collects information relating to a large population or significant class of communications, often for later filtering or intelligence analysis.

Encryption is the transformation of readable data into ciphertext using an algorithm and key so that unauthorised parties cannot understand it. Encryption protects confidentiality and integrity for ordinary users, businesses, journalists, hospitals and governments.

Decryption key is information that permits ciphertext to be transformed back into readable form. A key may be held by the user, a service provider, an organisation or several parties through a key-management arrangement.

Data minimisation means collecting and retaining only information reasonably necessary for a defined purpose.

Function creep occurs when data collected for one purpose is later used for an unrelated purpose without adequate legal authority, notice or safeguards.

Chilling effect describes the deterrence of lawful speech, association, journalism or research because people fear surveillance or identification.

2. The Human Rights Framework

2.1 Privacy and related freedoms

Privacy is not limited to secrecy. It includes personal autonomy, family life, home, correspondence, identity, location and control over personal information. International instruments such as Article 12 of the Universal Declaration of Human Rights and Article 17 of the International Covenant on Civil and Political Rights protect individuals against arbitrary or unlawful interference with privacy, family, home and correspondence. Regional instruments provide related protections, including the European Convention on Human Rights and the American Convention on Human Rights.

Surveillance may also affect other rights:

• Freedom of expression: people may avoid controversial opinions, whistleblowing or investigative journalism if communications are monitored.
• Freedom of association and assembly: records of contacts, meetings or memberships may expose lawful groups.
• Equality and non-discrimination: automated risk systems may disproportionately monitor particular ethnic, religious, political or social groups.
• Due process and an effective remedy: secret surveillance can make it difficult for a person to discover, challenge or correct unlawful collection.
• Freedom of movement: location tracking may reveal journeys and associations.
• Privilege and confidentiality: monitoring may affect lawyer-client, medical, journalistic or counselling relationships.

Rights are not always absolute. A state may restrict some rights to protect public safety or the rights of others. However, a restriction must satisfy legal and institutional safeguards rather than rely on general claims of convenience or technological capability.

2.2 The legality–necessity–proportionality framework

A practical rights assessment usually asks five connected questions:

1. Legal basis: Is the activity authorised by accessible, foreseeable and sufficiently precise law? Does the law identify who may authorise it, for what purposes, against whom and subject to what limits?
2. Legitimate aim: Does the activity pursue a recognised aim such as preventing serious crime, protecting national security or securing organisational systems?
3. Suitability: Can the proposed measure contribute meaningfully to that aim?
4. Necessity: Is there a less intrusive measure that could achieve the objective with comparable effectiveness?
5. Proportionality: Does the security or investigative benefit justify the interference, considering its scale, duration, sensitivity and effects on innocent people?

A sixth requirement, accountability, is essential in practice. It includes records, auditability, independent review, complaint mechanisms, judicial remedies and consequences for misuse.

A useful qualitative decision model is:

This is not a legal formula and should not be treated as a numerical test. It is a structured thinking aid. “Intrusion” concerns how deeply the activity enters private life; “scale” concerns the number of people or records affected; “sensitivity” concerns information such as health or political beliefs; “duration” concerns persistence; and “uncertainty” concerns the lack of transparency or reliable oversight. A high result indicates the need for stronger safeguards and more demanding authorisation.

2.3 Safeguards for surveillance

Rights-respecting surveillance normally requires:

• prior judicial or independent authorisation for intrusive targeted measures;
• a written factual basis and defined objective;
• limits on duration, persons, devices, locations and data categories;
• special protection for privileged or journalistic material;
• secure handling and restricted access;
• retention and deletion schedules;
• independent inspection and parliamentary or regulatory oversight;
• notification where it can occur without defeating the investigation;
• disclosure or exclusion rules for unlawfully obtained evidence; and
• accessible remedies, including correction, compensation or disciplinary action where appropriate.

Oversight must be capable of challenging the executive or an organisation. An internal compliance officer is useful but cannot always replace an independent authority, particularly where the organisation has a strong incentive to approve its own conduct.

3. Law-Enforcement Surveillance and Communications Interception

3.1 A hierarchy of intrusiveness

Different forms of access create different risks. A basic public web search may be relatively low-intrusion, while covert access to a phone microphone or continuous location tracking is highly intrusive. The legal distinction is not always simple: metadata collected in bulk can create a detailed behavioural profile even without content.

3.2 Emergency powers

Many legal systems permit urgent action where delay would create a serious and imminent threat. Emergency authority should not become a permanent substitute for ordinary authorisation. It should be limited by a clear threshold, documented reasons, short duration, rapid independent review and mandatory deletion or remedial action if approval is refused.

3.3 Cross-border access and cloud services

Cloud systems distribute data across providers, countries and legal entities. A domestic authority may seek data stored abroad, while a foreign authority may request data from a local provider. Conflicts can arise between a production order, privacy law, professional secrecy and data-transfer restrictions.

Organisations should verify the requester, determine the legal instrument, preserve only relevant data, record the disclosure and avoid disclosing more than legally required. Mutual legal assistance procedures and international agreements may provide more reliable safeguards than informal requests. Cybersecurity staff should not make independent legal judgments about foreign orders; they should escalate them to authorised legal and compliance personnel.

4. Workplace Monitoring

4.1 Legitimate organisational purposes

Employers may need monitoring to detect malware, investigate unauthorised access, protect trade secrets, manage capacity, comply with sector regulation and investigate serious misconduct. Security logging is also essential for incident response and forensic reconstruction.

However, employment is not a surrender of privacy. Employees retain rights and may have heightened expectations in locations such as rest areas, changing rooms, private communications and personal devices. Workplace monitoring should distinguish security telemetry from surveillance of behaviour unrelated to work.

4.2 A rights-respecting monitoring lifecycle

A professional monitoring programme should follow this sequence:

1. Define the objective. State the specific security, legal or operational problem.
2. Identify the minimum data. Decide whether event records, rather than full content, are sufficient.
3. Assess alternatives. Consider access controls, training, network segmentation or targeted investigation.
4. Conduct an impact assessment. Evaluate privacy, discrimination, labour-law and data-protection consequences.
5. Provide notice. Policies should describe categories of data, purposes, access, retention and employee rights in clear language.
6. Control access. Use role-based permissions, separation of duties and strong authentication.
7. Set retention limits. Retain logs for a documented period based on risk, legal obligations and investigative needs.
8. Audit and review. Test whether the system is accurate, necessary and used only for approved purposes.
9. Provide challenge mechanisms. Employees should have a route to question inaccurate or abusive monitoring.

4.3 Bring-your-own-device and remote work

A personal device may contain both corporate and private data. Full-device inspection can expose family photographs, health information, banking records or communications unrelated to employment. Safer approaches include mobile-device management containers, separate corporate accounts, remote deletion limited to organisational data and clear consent or contractual terms.

Location monitoring should be disabled outside defined working or emergency contexts unless a compelling, documented justification exists. “Always-on” monitoring is difficult to justify merely because a worker has access to a corporate application.

4.4 Automated employee monitoring

Productivity scores, keystroke tracking, facial recognition and behavioural analytics can produce false positives and discriminatory outcomes. A high number of keystrokes is not a reliable measure of professional value, and absence of keyboard activity does not prove inactivity. Automated outputs should therefore be treated as indicators requiring human review, not as conclusive evidence of misconduct.

5. Encryption, Lawful Access and Security

Encryption is a human-rights technology as well as a cybersecurity control. It protects journalists, victims of abuse, activists, businesses, patients and ordinary citizens from criminals and unauthorised surveillance. Weakening encryption for one investigative purpose can create vulnerabilities exploitable by many others.

5.1 Competing policy positions

Law-enforcement agencies may argue that serious crimes become harder to investigate when communications are end-to-end encrypted. Industry and civil-society organisations respond that backdoors, universal key escrow or weakened algorithms create systemic risk and undermine trust.

The technical problem is fundamental: an access mechanism available to an authorised party may be discovered, compelled or stolen by an unauthorised party. A system that reliably protects everyone except a selected investigative target is difficult to implement, especially when targets can use alternative software or physical devices.

5.2 Rights-respecting alternatives

Governments may pursue targeted, legally authorised methods that do not weaken security for all users, such as:

• obtaining data from a lawfully accessible endpoint;
• using metadata only when necessary and proportionate;
• requesting user-held data under valid legal authority;
• exploiting a specific vulnerability only under strict authorisation, disclosure and minimisation rules; and
• improving traditional investigative methods and international cooperation.

These methods still require oversight. “Technical possibility” does not itself establish legal authority, necessity or proportionality.

5.3 Organisational encryption governance

A company should classify information, encrypt sensitive data in transit and at rest, separate key-management duties, rotate keys, protect backups and document lawful-access procedures. A lawful request should not be handled by silently weakening production security. Instead, the organisation should preserve relevant data, authenticate the request, involve legal counsel and disclose the minimum required material.

6. Intelligence Activities and Democratic Oversight

Intelligence agencies often operate under secrecy because disclosure can reveal sources, methods or ongoing operations. Secrecy, however, increases the risk that affected people cannot detect abuse. Democratic oversight must therefore operate through trusted institutions capable of reviewing classified information.

Effective intelligence governance commonly includes:

• a clear statutory mandate;
• limits on collection categories and purposes;
• ministerial responsibility combined with independent review;
• specialist judicial or quasi-judicial authorisation;
• inspectors with access to systems and records;
• parliamentary committees with security-cleared members;
• technical audits of selectors, databases and analyst access;
• rules for sharing intelligence with domestic and foreign partners;
• safeguards for sensitive professions and vulnerable groups; and
• public transparency reports containing aggregate information.

Oversight should examine not only whether an operation was authorised, but also whether analysts searched the resulting data lawfully, whether retention rules were followed and whether intelligence was used for a purpose that was not originally approved.

7. A Practical Governance Model for Cybersecurity Professionals

Cybersecurity professionals should treat monitoring as a controlled system rather than an unlimited technical capability. A governance model can be organised around four questions:

Purpose: What defined risk or legal obligation justifies collection?

Scope: Which systems, people, data fields and time periods are included?

Safeguards: What technical, organisational and legal controls limit misuse?

Accountability: Who approves, reviews, audits and remedies the activity?

A monitoring register should record the system owner, purpose, data categories, legal basis, access roles, retention period, vendors, cross-border transfers, impact assessment and review date. Security teams should maintain immutable audit logs for access to monitoring data, but audit logs themselves contain sensitive information and require protection.

A simplified decision tree is:

Figure: A practical decision process for evaluating proposed surveillance.

8. Illustrative Case: The Continuous Productivity Platform

Background

A fictional company, Northbridge Services, introduces software that records application use, screenshots employee screens every five minutes and assigns a daily productivity score. Management argues that remote work has reduced visibility and that monitoring will protect confidential information.

Problem

Employees were not clearly informed that screenshots included personal messages displayed accidentally on work devices. The system also flagged customer-support staff as unproductive when they were handling telephone calls. A manager used scores to deny promotion without checking the underlying data.

Analysis

The company had a legitimate security and management interest, but the design collected more information than necessary. Continuous screenshots created a high privacy risk, and the scoring model was not validated for different job roles. The absence of meaningful notice undermined fairness. The use of a score as a final employment decision created due-process and discrimination concerns.

Approach and solution

Northbridge replaced routine screenshots with event-based security alerts, access logs and data-loss-prevention controls. Screenshots were permitted only during a documented incident and required approval. The company published a clear monitoring notice, established role-specific metrics, limited retention, encrypted records and restricted access to the security team. Employees could challenge inaccurate records, and managers were prohibited from relying on automated scores alone.

Outcome

The revised system detected unauthorised file transfers while substantially reducing collection of personal material. Employee complaints declined, and the organisation could explain its monitoring practices to regulators and staff.

Learning points

The case demonstrates that a legitimate objective does not justify every technically available measure. Purpose limitation, data minimisation, human review and transparency can improve both rights protection and the reliability of security decisions.

9. Challenges and Contemporary Developments

Artificial intelligence and predictive surveillance

AI systems can correlate large datasets, identify anomalies and prioritise investigations. They may also reproduce historical bias, infer sensitive characteristics and generate confident but inaccurate conclusions. Organisations should document training data, test error rates across relevant groups, preserve human accountability and prohibit uses that lack a clear legal basis. Inferences can be as intrusive as directly collected facts.

Commercial spyware

Commercial spyware can obtain messages, files, microphone input and location data from targeted devices. Its use raises exceptional concerns because it may defeat ordinary security controls and affect journalists, lawyers or political opponents. Strong authorisation, vulnerability-management policies, independent investigation and remedy are necessary safeguards.

Facial recognition and biometrics

Biometric monitoring is persistent because a face or fingerprint cannot easily be replaced. False matches can cause arrest, exclusion or workplace harm. Deployment should require a compelling purpose, accuracy testing, strict retention rules, alternatives and human review.

Data breaches involving surveillance systems

A surveillance database is itself a high-value target. A breach can expose victims, informants, employees, patients or political associations. Security controls must therefore include encryption, segmentation, least privilege, tamper-evident logs, secure deletion, incident response and tested recovery procedures.

Best-Practice Checklist

Before implementing or approving a surveillance capability, ask:

• Is the objective specific and legitimate?
• Is there a clear legal or organisational authority?
• Is collection limited to what is necessary?
• Have less intrusive alternatives been assessed?
• Are content, metadata and inferred information distinguished?
• Are people adequately informed where lawful and practicable?
• Are privileged, journalistic and vulnerable communications protected?
• Are access, retention, deletion and sharing controlled?
• Is automated analysis tested for error and bias?
• Is independent oversight available?
• Can affected people challenge misuse or inaccurate information?
• Can the organisation demonstrate compliance through reliable records?

Chapter Summary

Surveillance and monitoring can support cybersecurity, public safety and legitimate organisational purposes, but they also affect privacy, expression, association, equality and due process. The legality–legitimate purpose–necessity–proportionality framework provides a disciplined method for assessing proposed measures. Content interception, metadata collection, stored-data access, device intrusion and bulk collection carry different levels of risk and require appropriately strong safeguards.

Workplace monitoring should be transparent, limited, secure and related to defined objectives. Encryption protects society broadly and should not be weakened casually to obtain investigative access. Intelligence activities require independent authorisation, technical auditing, classified oversight and effective remedies. Cybersecurity professionals play a direct role in turning legal principles into system design through minimisation, access control, retention limits, auditability and human review.

Key Terms

Surveillance: Systematic observation or collection of information about people, activities or systems.

Monitoring: Ongoing observation of activity for security, operational or investigative purposes.

Interception: Acquisition of communications while they are being transmitted.

Content data: The substantive meaning or material communicated.

Metadata: Information describing a communication or activity rather than its substantive content.

Stored data: Information held on a device, server, cloud system or backup.

Targeted surveillance: Surveillance directed at a specified person, account, device or location.

Bulk surveillance: Collection involving a large population or substantial class of communications.

Encryption: Transformation of readable information into protected ciphertext using an algorithm and key.

Data minimisation: Collection and retention of only information necessary for a defined purpose.

Function creep: Use of collected information for a later, unrelated purpose.

Chilling effect: Deterrence of lawful conduct because people fear observation or identification.

Legality: Requirement that interference has a clear, accessible and foreseeable legal basis.

Necessity: Requirement that a measure is needed because less intrusive alternatives are inadequate.

Proportionality: Requirement that interference is justified by the importance of the objective and limited in scope.

Oversight: Independent or accountable review of surveillance authority and conduct.

Device intrusion: Covert technical access to a device, its files, sensors or communications.

Function creep: Expansion of data use beyond the original authorised purpose.

Review Questions

Short Answer Questions

1. Distinguish content data from metadata and give one example of each.
2. What is meant by the legality, necessity and proportionality framework?
3. Why can encryption be considered a human-rights technology?
4. Identify two safeguards for workplace monitoring.
5. What is a chilling effect in the context of surveillance?

Long Answer Questions

1. Explain how surveillance can interfere with privacy, expression, association and equality.
2. Compare targeted surveillance with bulk surveillance, including their principal risks and safeguards.
3. Discuss the legal and ethical challenges of monitoring employees who use personal devices for work.
4. Explain why weakening end-to-end encryption may create systemic cybersecurity risks.
5. Describe the institutional features required for effective oversight of intelligence activities.

Analytical / Application Questions

1. A university proposes recording all student network traffic and retaining it indefinitely to investigate possible misconduct. Apply legality, necessity, proportionality, minimisation and accountability principles to evaluate the proposal.
2. A security team receives an urgent request from a foreign agency for a customer’s cloud-stored messages. Identify the legal, technical and human-rights checks that should occur before disclosure.
3. An AI system assigns high-risk scores to employees based on access times, typing patterns and communication networks. Design a rights-respecting governance approach addressing accuracy, bias, transparency, human review and retention.

Multiple Choice Questions with Answers

Question 1

Which principle asks whether a less intrusive measure could achieve the same objective?

A. Necessity

B. Secrecy

C. Attribution

D. Interoperability

Correct Answer: A. Necessity

Question 2

Which item is generally an example of metadata?

A. The words spoken in a call

B. The time and recipient of a message

C. The plaintext contents of a document

D. A decryption algorithm

Correct Answer: B. The time and recipient of a message

Question 3

What is a principal risk of bulk surveillance?

A. It eliminates all useful evidence

B. It prevents encryption from working

C. It enables large-scale profiling and chilling effects

D. It guarantees judicial review

Correct Answer: C. It enables large-scale profiling and chilling effects

Question 4

Which workplace practice best reflects data minimisation?

A. Recording every screen continuously

B. Retaining all logs permanently

C. Collecting only security events relevant to a defined risk

D. Monitoring personal devices without notice

Correct Answer: C. Collecting only security events relevant to a defined risk

Question 5

Why is weakening encryption for exceptional access controversial?

A. It makes all data public immediately

B. The access mechanism may create vulnerabilities for unauthorised parties

C. It prevents organisations from using passwords

D. It removes the need for legal authority

Correct Answer: B. The access mechanism may create vulnerabilities for unauthorised parties

Question 6

Which safeguard is especially important for covert, highly intrusive surveillance?

A. Prior independent or judicial authorisation

B. Public disclosure of operational methods

C. Unlimited retention

D. Automatic approval by the system administrator

Correct Answer: A. Prior independent or judicial authorisation

Question 7

What does function creep mean?

A. Deleting data earlier than required

B. Using data for a later purpose unrelated to its original justification

C. Encrypting data at rest

D. Separating administrative duties

Correct Answer: B. Using data for a later purpose unrelated to its original justification

Question 8

Why should an automated employee productivity score not normally be treated as conclusive evidence?

A. Automated systems cannot store data

B. Scores may be inaccurate, biased or unsuitable for different roles

C. Employees cannot be monitored legally in any circumstance

D. Security logs have no evidential value

Correct Answer: B. Scores may be inaccurate, biased or unsuitable for different roles

Question 9

Which control helps limit misuse of surveillance records?

A. Role-based access and audit logging

B. Shared administrator passwords

C. Indefinite unrestricted retention

D. Disabling all access records

Correct Answer: A. Role-based access and audit logging

Question 10

What is a chilling effect?

A. Cooling a data centre after an incident

B. Deterring lawful speech or association because of fear of surveillance

C. Removing malware from a device

D. Reducing network latency

Correct Answer: B. Deterring lawful speech or association because of fear of surveillance