1 Introduction

Presently, most, if not all, ordinary law-abiding citizens are subjected to various forms of surveillance in the interest of providing societal security inter alia.Footnote 1 This is one conclusion to draw from Edward Snowden’s leaked documents showing that e.g. NSA and GCHQ actively collect electronic communications sent by ordinary citizens. NSA’s so-called PRISM program and GCHQ’s TEMPORA program allow the capture and storage of huge amounts of data, gleaned from cables used in phone and internet communication between random users, for potential later use (Stahl 2016). Critics of such programs typically condemn them as morally wrong on the grounds that they are ‘disproportionate’ (Stahl 2016). For instance, Brown and Korff (2009, p. 120) submit that: ‘The proportionality of Internet surveillance touches on fundamental values of a democratic society’ and raises ‘serious constitutional questions’. Conversely, defenders of such programs tend to argue that they are ‘proportionate’ in view of the serious harm, e.g. from terrorist attacks, that they enable security services to prevent, and in view of the putatively minor interferences in the lives of ordinary citizens that such programs involve. Hence, there seems to be a consensus, which we shall not contest, among the general public, experts proposing ethical codes for intelligence services (i.e., British Home Office 2010) and philosophers working on the ethics of surveillance (Kleinig 2009; Macnish 2014, 2015, 2018; Marx 1998; Nathan 2017) that:

Surveillance is morally permissible only if the moral benefits are proportionate to the moral costs.

This condition – henceforth: the proportionality requirement – states a necessary condition for surveillance being morally permissible, not a sufficient one. Thus, there could be proportionate surveillance that is morally impermissible. For instance, there might be procedural requirements, e.g., approval by a democratically controlled body with the standing to approve such measures and involving public deliberations about guidelines for state surveillance of (non-)citizens, which surveillance must meet in addition to the proportionality requirement to be morally permissible (cp. Lazar 2016). Also, there might be requirements regarding the end for which proportionate surveillance is used by state agents that should be satisfied in addition to the proportionality requirement for surveillance to be morally permissible (Macnish 2014, pp.147–152). In the interests of focusing on the proportionality requirement (and not because we assume these other requirements are irrelevant), we will ignore other requirements whose non-satisfaction can render surveillance morally impermissible (but see the remarks on the necessity condition in Section 2).

Generally, the ethics of surveillance tends to undertheorize what exactly constitutes proportionate surveillance. Based on Jeff McMahan’s work on proportionality in the context of just war theory, this article makes two claims: 1) that the sort of proportionality required in the context of preventive surveillance e.g. mass surveillance – call it: wide proportionality+ − is very demanding; and 2) that, given certain plausible assumptions, there are strong prima facie reasons for doubting that coarse-grained mass surveillance programs like PRISM and TEMPORA satisfy wide proportionality+. The reasons for our not making an even stronger claim in relation to 2) – to wit, that any coarse-grained mass surveillance program violates wide proportionality+ − are explained later.

Section 2 briefly explains the general concept of proportionality. Section 3 submits that proportionality should be understood differently depending on the liability of the surveilled and the intentions of the surveillant. Section 4 applies these two aspects of the proportionality requirement to different cases of surveillance. In section 5, we focus on the intention of the surveillant, thereby addressing a lacuna in the important work by Macnish and Nathan, and on the liability of the surveilled drawing on McMahan’s distinction between wide and narrow proportionality. Section 6 uses the distinctions explained in the previous section to introduce the notion of wide proportionality+, which is, so we argue, that kind of proportionality requirement which almost always applies in the context of preventive surveillance, e.g. mass surveillance, where the relevant ‘bads’, e.g. violation of privacy, fall on non-liable bystanders and are intended. Section 7 concludes.

2 The Structure of the Proportionality Requirement

The logical form of judgments about proportionality has the form: “x is (not) proportional to y”. Hence, the proportionality requirement has three components: 1) the moral benefits deriving from the specific surveillance activity (i.e., “x”), 2) its moral costs (i.e., “y”) and 3) the appropriate balancing of the costs and the benefits of a specific surveillance activity (i.e., the relation that must obtain between “x” and “y”) (Hurka 2005, p. 38; Macnish 2015, p. 532; Uniacke 2011, p. 255). In what follows, we briefly comment on all three components.

First, the moral benefits of a specific surveillance activity comprise the acquisition of information that would contribute to detecting, preventing or disrupting a specific unjust threat. Accordingly, this side of the equation will reflect the severity of the threat in question as well as the likelihood of the threat being thwarted.Footnote 2 Though one should take a very broad view of what can count as a moral benefits and moral costs, the proportionality balance is often phrased in terms of harms on both sides of the equation since the benefits of surveillance include the foreseeable avoided harms connected to acquiring information (but see Uniacke 2011, p. 271). Thus, if a specific threat concerns a terrorist attack foreseeably resulting in the deaths of hundreds of individuals, avoidance of such harms would count heavily as a moral benefit of a specific surveillance activity conducive to foiling that attack. In contrast, the harms entailed in a case concerning parents’ falsely claiming they were resident in a specific school district in order to gain access to a popular school are significantly lower (Macnish 2015, p. 529). As a result, ‘the gravity and extent of the perceived crime or offence’ counts significantly on this side of the equation (Macnish 2015, p. 530).

Second, the subsequent aspect of the proportionality requirement is the moral cost of the specific surveillance activity (cf. Bellaby 2012, 2014), where, again, “moral costs” should be interpreted in a very broad sense. According to Macnish, moral costs include all types of ‘reasonably foreseeable harms arising from surveillance’ (Macnish 2015, p. 537, p. 543). One crucial parameter here is the number of people harm. Another crucial parameter is the seriousness of the harms in question. In principle, surveillance could involve all sorts of moral costs, e.g. if misused by a dictatorial state, it can be used to inflict physical harms on innocents in ways that are similar to those terrorist harms prevented by surveillance which constitute the most often cited moral benefits of surveillance in democratic states. The moral costs of surveillance that are most often cited in the latter context are, however, loss of privacy or violations of privacy rights, although deception and manipulation are sometimes mentioned as well, e.g. in cases involving the use of false flags or bugging. In these cases, one might say that the moral costs of surveillance lie, not only in the causal consequences of surveillance, but also in the surveillance itself.Footnote 3

As stated by Marx (1998, p. 173), ‘privacy’ is ‘a vague catch-all phrase that includes a variety of concerns, such as respect for the personhood, dignity, and autonomy of the individual’. Despite this vagueness, clearly violating privacy is a different kind of cost than the moral costs involved in typical cases of self-defense, just wars, or omitting to engage in surveillance to prevent terrorist incidents, i.e. it does not take the form of physical harm or death. Indeed, on some standard accounts of well-being, if harm involves a set-back in terms of well-being, typical cases of mass surveillance will not involve harm (Parfit 1984, pp.493–502). Typically, the objects of surveillance are not aware that they are being surveilled and, thus, will not suffer any harm on a hedonist account of well-being. Moreover, on all standard accounts of well-being, it is possible that people being surveilled are not thereby harmed. For instance, to the extent that people have no preferences about being surveilled or not and surveilling them will not result in any interventions frustrating their aims, e.g. because they are not engaged in anything of interest to the surveilling agency, their being surveilled will not harm them on a preference-based account of well-being.Footnote 4

In response to these observations, some might press the point that the general public just being aware that programs like PRISM and TEMPORA are being used might be – and perhaps typically are – harmful on both mental state accounts – e.g. surveillance causes anxiety – and on preference-based accounts – e.g. most people prefer not to be the target of surveillance.Footnote 5 However, while correct, this observation might not support all of the conclusions sceptics of mass surveillance want to defend. On preference-based accounts, it would be just as good well-being-wise to school people out of their preferences not to be subjected to surveillance as to respect the present preferences of many people not to be the target of mass surveillance. Moreover, on mental state accounts it is true that for any individual object of surveillance, he or she will suffer the relevant harm, whether or not she is being surveilled, since it is the belief of surveillance in general that causes the harm. Thus, if people believed that they were being surveilled even if they were not, the relevant harm-based objection to surveillance would not apply. Accordingly, skeptics are likely to distinguish between the following two responses to the present observation: the interest reply or the wronging reply.

The interest reply states that people have interests in addition to their interest in not having their well-being reduced, e.g. they have an interest in having their right to privacy respected, even when not respecting it does not reduce their welfare (cf. Macnish 2015, p. 537).Footnote 6 In short, even when surveillance does not reduce the welfare of those being surveilled, it might set back their non-well-being related interests in ways that are morally relevant.

The wronging reply states that (mass) surveillance might involve wrongs even if it involves neither the reduction of people’s well-being, nor a set-back in terms of their other interests.Footnote 7 Consider a case in which Amy takes nude photos of Bruce and shares them with others without Bruce knowing and without the episode affecting Bruce’s subsequent life. Possibly, in this case, Bruce neither suffers any loss of well-being, nor has any other interest which is adversely affected (Bruce has no objection to seeing him naked per se).Footnote 8 Using a term from Feinberg (1990), we call such wrongs harmless wrongs. When assessing the moral costs of surveillance, it is necessary to consider loss of well-being and set-backs of non-well-being related interests, but also harmless wrongs.

The third element in the proportional principle of surveillance is the comparison of the moral benefits and costs of the specific surveillance activity. The proportionality requirement in itself is silent on what form that comparison should take. Suzanne Uniacke notes that proportionality is both a relational and a normative concept. It is relational in the sense that ‘it involves a ratio or comparison of scale between x and y’ in which the two variables should be suitable or adequate, and it is normative in the sense that proportionality requires an appropriate balance between the two elements (Uniacke 2011, p. 255). Generally, disproportionality implies that ‘x is either excessive or deficient on the relevant side’ (Uniacke 2011, p. 255). A tricky aspect of the proportionality principle is thus assessing the appropriateness of a specific balance between x and y and appeals to proportionality in the context of surveillance are rarely very explicit on this matter.Footnote 9 For example, British Home Office Guidelines for covert actions state that proportionality requires ‘balancing the size and scope of the proposed activity against the gravity and extent of the perceived crime or offence’ (Home Office 2010, p. 16). How exactly this should be done, however, is not specified. To take the least demanding view of this balance, one could say that the benefits should at least equal the costs (given a certain view about how moral benefits and costs are measured).Footnote 10 A slightly more demanding view is that the benefits should outweigh the costs (Macnish 2015, p. 532). A third and potentially much more demanding view is that the benefits should be much greater than the moral costs. While some version of the third view is probably the most common one, what a ‘great deal larger’ means remains somewhat vague, and for that reason, in addition to the pragmatic difficulties of assessing the relevant benefits gained and harms prevented, it is hard to tell if the proportionality requirement is met.Footnote 11 For our purposes, however, it suffices if there are cases where the proportionality requirement is clearly (un)met, and thus we set aside the issue of vagueness and the pragmatic difficulties of acquiring the relevant empirical information required to apply the proportionality requirement.Footnote 12

This tri-partite structure is well-known from other contexts in which theorists analyze the permissibility of harm. Indeed, scholars discussing proportionality in surveillance explicitly draw on just war theory and the theory of permissible self-defense. This has led some theorists to resist thinking of the permissibility of surveillance in proportionality terms on the grounds that, in their view, this falsely implies or will result in the militarization of surveillance programs (Stoddart 2014; Diderichsen and Rønn 2017). If the latter is the case, however, in our view that would rest on a misunderstanding. The mere fact that the ethics of surveillance can draw on principles and distinctions drawn in other areas does not imply that there are no significant differences between them (Macnish 2014, pp. 146–147; Nathan 2017, p. 377). One such important difference is the following: in just war theory and in theories of self-defense, it is common and often appropriate to distinguish between an identified aggressor and an identified defender. After all, in the case of almost everybody subjected to mass surveillance, there is no identified unjust threat. Even so, typically in the literature on the ethics of surveillance, the role of the aggressor is occupied by the surveilled, and the role of the defender is occupied by the surveillant (Macnish 2014, 2015; Nathan 2017). We will make a similar assumption, although we note that it is far from satisfied in all cases, e.g. when illiberal states use surveillance for the purposes of political oppression.

3 Liability and Intentions in Surveillance

Having introduced the tripartite structure of proportionality, we now move on to consider the roles played by the nature of the threat (3.a), liability (3.b) and intentions (3.c) when applying the concept of proportionality in surveillance.

3.1 Moral Benefits and the Nature of the Threat Averted through Surveillance

Consider first the moral benefits involved in surveillance, i.e. the first component in the proportionality requirement. Often the nature of the threat in surveillance is somewhat different than in either warfare and self-defense, where threats are often manifest and immediate (e.g. aggressor points a loaded gun at victim) (Frowe 2011).Footnote 13 In surveillance, typically a threat is best understood as a proxy for the probability that an unjust event will occur. Consider again the case of counterterrorism and the application of surveillance based on knowing about the internet behavior of specific individuals who visit extremist websites. The internet behavior itself constitutes no threat. However, the frequent visits to extremist websites, together with other risk factors, indicate a specific probability of a future unjust threat that has not yet materialized.

Nathan (2017, pp. 378-379) recognizes that liability in the context of covert police work involves a difference in ‘urgency’ from the context of permissible self-defense. He highlights this difference in order to emphasize that the police often have more time available to consider and analyze the situation before acting, which is not typical in cases of self-defense, in which a person must act immediately to avert the threat. This point does not, however, capture the distinct difference in the nature of the threat in cases of self-defense and cases of surveillance. Means of surveillance are thus sometimes applied to enhance the epistemic situation of the authorities in order to enable their identification of potential unjust threats, e.g. in the case of some types of surveillance of social media profiles. Some surveillance activities thus constitute a means of identifying (future) unjust threats, creating an epistemic challenge for justifying specific surveillance activity, since knowledge about the threat is needed in order to be able to determine liability and moral permissibility (Diderichsen and Rønn 2017, p. 482). In other cases, the authorities’ epistemic situation is better, and surveillance is initiated on the basis of evidence that somebody in fact poses (or is likely to pose) an unjust threat. It is thus useful to distinguish between offensive (preventive) and defensive surveillance activities in order to denote the specific nature of the unjust threat entailed in each case. The literature on surveillance ethics has this far primarily addressed cases of defensive surveillance in which government authorities have identified agents of manifested, unjust threats.Footnote 14 For now, we assume that identifying liability of surveillance is possible in cases where the epistemic requirements for identifying unjust threats have been fulfilled.

3.2 Moral Costs and Liability

Consider next the second component in proportionality. Prominent theorists working on the ethics of surveillance agree that the liability of the surveilled matters in determining whether surveillance is proportionate, because the moral costs involved in surveilling non-liable persons are significantly greater than otherwise comparable surveillance of liable persons, all things being equal (Macnish 2015; Nathan 2017). Generally, the question of liability in the case of surveillance is under-researched.

Drawing on just war theory, we might say that for a person to be a liable subject of surveillance, two conditions must be satisfied: 1) the surveillance in question must be instrumental in pursuing some valuable goal, e.g. preventing serious crime (McMahan 2009a, p. 19), and 2) the person being surveilled is unjustly causing the threat that the surveillance will help to prevent (or disrupt) (McMahan 2009a, p. 157), i.e. the person ‘is implicated in the existence of a problem in such a way that harming him in a certain way in the course of solving the problem would not wrong him’ (McMahan 2009a, p. 19 – our emphasis).

Generally, surveillance ethicists think liability makes a difference to the most costs component in proportionality. For instance, Macnish emphasizes the importance of distinguishing between liable and non-liable agents of surveillance and focuses his attention on surveillance of liable agents: ‘the harms properly relevant to the proportionality principle in surveillance are the harms occurring to the liable subject of surveillance, rather than to non-liable people’. (Macnish 2015, p. 541). However, he neither provides a specific account of what it takes to become liable to surveillance (Macnish 2015, p. 542), nor does he account for how legitimate targets of surveillance should be identified (Macnish 2015, pp. 542–543).

Similarly, in his discussion of the permissibility of covert police work, Nathan (2017, p. 375 – our emphasis) submits that ‘proportionality in self-defense involves not only the harm threatened and the harm used to avert the threat, but also the attacker’s culpability for the threat’. Thus, in Nathan’s ‘liability model’, emphasis is not just placed on ‘implication’ in a problem, as stated by McMahan, but on culpability for a specific threat. Furthermore, Nathan argues that culpability means that an individual is ‘blameworthy for a threat that is unjustified’ (Nathan 2017, p. 374). The fact that the target of covert police action is ‘culpable for a possible harm’ will ‘cancel the moral complaints’ against surveillance etc. that the violation of her rights would otherwise entail (Nathan 2017, pp. 373–5). Nathan thus favors an epistemic approach to culpability in which emphasis is placed on whether a police officer has a reasonable belief that somebody is posing an unjust threat (Nathan 2017, p. 378). As a result, actions that cause government authorities to believe that someone is responsible for creating an unjust threat are important for a moral principle of proportionality of surveillance activities in that it reduces the moral costs involved in surveillance. Nathan further specifies that if a person A has acted in a way that makes others believe that A is posing an unjust threat even though in fact A is not a threat (exemplified by a case in which someone dresses up as a bank robber and walks out of a bank with a bag full of her own money as part of an art project), then A is not wronged if the police reasonably but falsely believe she poses an unjust threat (Nathan 2017, 375).

One might question whether this is so if A is morally justified in doing what he does. Suppose a researcher, Mary, is exploring anti-radicalization strategies in the interest of preventing terrorist incidents and frequently visits websites with content reflecting extremist views. Mary subsequently undergoes government surveillance as a result of the counterterrorism strategy. According to Nathan’s liability model, Mary would be liable to the surveillance. Accordingly, Mary will not be wronged by the surveillance since she is liable to the surveillance. We think this implication of Nathan’s view is implausible; rather, it speaks in favor of McMahan’s understanding of liability where involvement in a specific unjust threat is crucial. Hence, on McMahan’s account of liability preventive surveillance, mass surveillance, for example, is almost always surveillance of people who are not implicated in specific threats of the relevant sort, and so any moral cost involved in surveillance will only rarely be discounted for liability-related reasons. Even if, unlike us, one embraces Nathan’s view of liability, the same point still applies with almost the same force, since, plausibly, mass surveillance is almost always surveillance of people who have not done anything that they should reasonably expect would lead others to see them as a threat.Footnote 15

To belabor this point from a McMahanian perspective, we introduce McMahan’s distinction between narrow and wide proportionality. This distinction captures precisely the difference between the respective harms aimed at individuals who are liable and at those who are not liable to defensive harms. Narrow proportionality is a relationship between a specific threatener and a specific defender and is therefore phrased as an agent-based condition based on a liability justification. The crucial element here is whether the threatener is liable to suffer harms potentially inflicted on him by the defender, meaning that the threatener is not wronged by the inflicted harm (McMahan 2009a, p. 20). The nature and degree of the harm inflicted by the threatener, together with his degree of involvement in the threat, defines an upper limit for the harm that may be inflicted upon the threatener by the defender. Inflicting more harm is then disproportionate ‘since he is only potentially liable to lesser harm’ (Uniacke 2011, p. 270). As a result, narrow proportionality does not suggest a specific degree of harm to which the threatener is liable but suggests only an upper limit. Inflicting less harm on the threatener than the upper limit dictates would not be a case of disproportionality.

Wide proportionality is articulated as inflicted harms upon non-liable agents. Such harms are aggressive harms, in contrast to the defensive harms inflicted in the case of narrow proportionality, in which the agent is liable to suffer from defensive harm due to his involvement in the problem (McMahan 2009a, p. 21). Determining wide proportionality depends upon the specific context and entails the assumption that harming non-liable individuals creates a better situation than the projected alternative, which is prevented by inflicting harm on those individuals. Wide proportionality is thus judged in accordance with lesser evil justifications. As a result, wide proportionality rests on the assumption that if one must choose between 1) a scenario in which some smaller harm is inflicted upon non-liable individuals in order to avoid a greater degree of harm for the non-liable individuals and 2) a scenario in which the minor harm for the non-liable individuals is not inflicted and the greater harm occurs, then the first scenario should be preferred (Uniacke 2011, p. 266).

3.3 Moral Costs and Intentions

The intentions of the defender or surveillant, i.e. whether the harm or wrong in question is intended or unintended, constitutes a second component of the McMahanian proportionality requirement. Generally, the idea is that if the harm or wrong in question is intended, then the maximum costs that may permissibly be imposed on others, notably aggressors, in personal self-defense, war or surveillance are greater than if the harm or wrong is not intended, other things being equal. Admittedly, there are alternatives to this relatively simple view of the moral significance of intention. For instance, some people might think that if an aggressor is liable to a certain amount of harm, it is not a morally bad thing that this harm is imposed on the aggressor and, thus, makes no moral difference whether this harm is intended or merely foreseen (Nathan 2017). Whether we accept the simple view on intention or other more complicated views on the moral significance of intention makes no difference to our arguments below, and, accordingly, we shall assume the simple view.

The distinctions between liable/non-liable and intended/non-intended harm (or wrong) cuts across one another such that we have four possibilities: 1) intentionally harming the liable, 2) unintentionally but foreseeably harming the liable, 3) intentionally harming the non-liable and 4) unintentionally but foreseeably harming the non-liable (McMahan 2009a, pp. 19–20). According to McMahan, narrow proportionality applies to the first two types of cases involving liable agents, whereas wide proportionality applies to the third and the fourth cases, in which the harm is inflicted upon non-liable individuals. Both Nathan and Macnish primarily consider cases of type 1) (Macnish 2015, p. 542; Nathan 2017, p. 372). Type 1) cases are the sort of cases that philosophical discussions regarding self-defense focus on. Type 4) cases are most often referred to in discussions on disproportionality in warfare in connection to ‘collateral damage’, when innocent bystanders are foreseeably but unintentionally harmed as a result of military action.

4 The Proportionality Requirement and Surveillance

In the previous section, we introduced three factors which have a bearing on the moral benefits and costs in the proportionality requirement. In relation to the latter, we introduced two distinctions: liable/non-liable and intended/non-intended.Footnote 16 We noted that these two distinctions cut across one another. In the interest of exploring the proportionality of surveillance further, we now illustrate how this is also the case with surveillance.

4.1 Intentional Intrusion upon Liable Individuals

Consider a man who takes part in an online child pornography distribution ring and whom we wish to target with some covert police action, e.g. by surveilling his online communication (Nathan 2017, p. 374), but not by, say, reading his diary from when he was a teenager. The latter would not help us prevent any present threat or wrong of his and, thus, would not be an intrusion via defensive surveillance to which he was liable. In this case, the relevant intrusion is intentionally inflicted upon an individual who is liable to suffer from first- as well as third-party defensive harms due to his involvement in online child pornography distribution. The relevant proportionality requirement that surveillance would have to satisfy in this case is narrow proportionality. Thus, greater harms or prima facie wrongs can be permissibly imposed on this man to prevent or disrupt the relevant threat than may be imposed on mere bystanders. Even if the intrusion or the setback to the man’s interests in privacy is intentionally imposed on him, intuitively, surveillance would seem proportionate in this case.

4.2 Unintentional but Foreseeable Intrusion upon Liable Individuals

Consider next a case in which the police intend to catch the ringleader, and only the ringleader, of a child pornography distribution ring. (For some reason the others cannot be convicted.) To do so, they surveil all his online communication with other members of the ring, thus, foreseeably but also unintentionally reading the communication of other individuals, who are only ‘peripherally’ involved. Arguably, in this case only liable individuals are surveilled – even being peripherally involved in the distribution of child pornography makes one liable to a certain amount of surveillance – but the surveillance in question is unintentional. In this case, a narrow proportionality requirement would have to be satisfied, and other things being equal, it would be easier to satisfy this requirement than in the first case, since the intrusion in the peripheral person’s privacy is unintended though foreseen.

4.3 Intentional Intrusion upon Non-liable Individuals

Consider a variation of the third case. The police intend to monitor all the electronic communication of the ringleader, since all of it is potentially relevant to stopping the man’s illegal activities. The police know that the ringleader’s wife is not engaged in any wrongdoing and that, say, in reading the wife’s message about where to meet for a romantic evening in town, they will intrude on her personal space. However, they also monitor all her communications, because they think that doing so might provide them with valuable information about her husband’s whereabouts or his financial transactions (neither of which his wife has any reason to believe involves wrongdoing). This would be a case of surveillance that is significantly harder to justify than the two previous cases, especially the second one. For not only does the case involve surveillance of non-liable individuals such that we move from narrow proportionality to the more demanding wide proportionality requirement, but the intrusion in the wife’s private sphere is also intended as a means of obtaining information about her husband. Hence, to the extent that such surveillance is justified, the justification is a lesser evil justification. Typical cases of mass surveillance are of this type. Below, we question further whether wide proportionality would be the correct way of assessing the proportionality of such cases. Note also that the comparative judgment that this kind of intrusion is harder to justify than 1) and 2) is compatible with instances of this kind of surveillance being morally permissible nevertheless, e.g., because of its deterrence effects, because the surveillance is generally known to take place – CCTV on busy streets – or because people tacitly consent to being surveilled in this way. (We take no stand on this possibility.)

4.4 Unintentional but Foreseeable Intrusion upon Non-liable Individuals

Consider finally a case in which a very likeable undercover police officer cultivates a fake friendship with a threatener with the aim of obtaining information about him. Unavoidably, cultivating that fake friendship will involve spending time together with the friends of the liable threatener and thereby obtaining substantial, private information concerning the lives of those individuals as well. Obtaining this information is a foreseeable but unintended by-product of the officer interacting with the threatener. In this case, the target of the intruding actions is liable, yet the threatener’s friends who are affected will be non-liable to the intrusion, which is unintentionally but foreseeably inflicted upon them.Footnote 17 It takes fewer moral benefits for surveillance of the relatives being proportional in this case than in the previous case, since the cases are similar except for the intrusion being intended in 3) and not in 4). The same applies to the first case – it takes fewer moral benefits for 4) to be proportional than in 1), since, even if the intrusion is intended in 1), the villain is liable to intrusion and there seems to be nothing wrong about intending an intrusion which an individual is liable to with the aim of preventing the relevant threat to which the individual is liable.Footnote 18 In addition, it takes greater moral benefits for surveillance to be proportional in 4) than in 2), since in both case the intrusion is unintended, but in 2) the individual intruded upon is liable.

The overall message of this section is that assessing whether surveillance is proportional is quite complex and that different conceptions of proportionality are in play depending on the details of the case in question.

5 Differentiating between Foreseeable and Intentional Intrusion upon Non-liable Individuals

We now return to type 3) cases and emphasize the relevance of distinguishing between foreseeing and intending the intrusion entailed in a specific surveillance activity affecting non-liable individuals. This is the type of surveillance at stake in common cases of preventive surveillance, where no crime has yet been committed and maybe not even suspected. Like Macnish, Nathan distinguishes between harms imposed upon the liable individuals and harms inflicted as a result of so-called ‘collateral intrusion’ of covert police work:

Even where there are no grounds for suspicion of involvement in wrongdoing, or even positive evidence of innocence, it is still possible that deception and manipulation are useful and justified, but this justification will need to cross the high bar of the kind that is analogous to a justification of harming an innocent bystander for the sake of some very significant benefits (Nathan 2017, pp. 383-384 – our emphasis).

Nathan therefore believes that collateral intrusion on bystanders can be permissible, though neither Nathan nor Macnish distinguish between the unintended but foreseeable intrusion upon non-liable individuals and the intentional intrusion upon non-liable individuals in the course of a surveillance activity. Their sole focus is on the unintentional, but foreseeable harming of innocent bystanders in the course of some activity serving a significant good.Footnote 19 However, this is an important distinction to draw, since preventive/offensive surveillance activities are very often characterized by intruding intentionally upon non-liable individuals, e.g. the PRISM mass surveillance program and the preventive use of more traditional surveillance means such as wiretapping and audio surveillance ‘applied before any crime has taken place, based on a prediction that this could happen in the future’ (Bruce 2017, p. 83; see also Lyon 2014 and Stahl 2016 on the coarse-grained nature of mass surveillance techniques). In order to illustrate our claim that there is a distinction between intending and barely foreseeing intrusion upon the non-liable individuals, consider the following pair of examples of mass surveillance:

  • Unintended: Imagine a surveillance program is initiated in order to acquire information about the online behavior of an identified threatener, whom we believe is engaged in planning an act of terrorism. These pieces of information will help guide the security agency when initiating counteractions aimed at thwarting the planned aggression.Footnote 20 In the course of obtaining the relevant pieces of information, as an unavoidable by-product the agency will also collect information containing the personal details of 10,000 individuals who are not involved in the criminal act. This is so because the surveillance techniques – perhaps unlike some surveillance techniques typically employed, e.g., PRISM and TEMPORA (see section 1) – are rather coarse-grained and cannot filter out the information about the non-liable individuals.Footnote 21 The personal lives of the 10,000 individuals are thus intruded upon as a consequence of collecting information on the threatener, but the collected information about the non-liable individuals is of no interest to the agency.

  • Intended: Now imagine a different surveillance program, which is initiated in order to acquire information on risk factors leading to radicalization and subsequently on the risk of an act of terrorism being carried out. The program is designed to collect electronic information on the online behavior of 10,000 individuals, including communication via social media platforms, without any prior knowledge on whether the affected individuals are in fact considered radicalized. In other words, such a surveillance program would systematically collect personal details with the aim of gaining information about some of the factors potentially leading to radicalized behavior. In this case, intrusion is intentionally inflicted upon non-liable individuals in order to potentially prevent some future crimes.

The overall level of intrusion upon the non-liable individuals is equal in these two cases. Yet, other things being equal, Intended must involve greater moral benefits in order to be proportionate than Unintended, because Intended involves the intentional intrusion upon the personal lives of non-liable individuals, whereas Unintended involves the intentional intrusion upon known threateners but where intrusion upon non-liable people constitutes an unintentional but foreseeable side effect of the surveillance program.

The next question is whether wide proportionality would be an appropriate means of assessing cases of surveillance in which non-liable agents are wronged. McMahan (2009a, p. 21) specifies that narrow proportionality usually concerns harms that are inflicted intentionally, whereas ‘issues of wide proportionality usually concern harms inflicted foreseeably but unintentionally’. Thus, as already stated, as far as wide proportionality is concerned, interventions are proportionate ‘if the expected good would outweigh the unintended harms to civilians’ (McMahan 2009a, p. 20). Yet if wide proportionality applies to cases of intentional surveillance of non-liable individuals, then the specific surveillance should enable the avoidance of greater intrusions or other bads e.g. physical harms upon the non-liable than if they were not surveilled. As argued above, this lesser evil justification is intuitively appealing in cases in which the intrusion upon the non-liable is unintended but foreseeable. The relevant question is, however, whether the same proportion of benefits to harms is proportionate if the intrusions are intentionally inflicted upon innocent individuals than when such intrusions are merely foreseen. Intuitively, the answer is negative, since it takes more for the intended intrusion upon the non-liable people to be justified than foreseeable but unintended intrusion to be so.

The difference between Intended and Unintended is the same as the one examined in the tactical bomber versus terror bomber cases from discussions about the doctrine of double effect (McMahan 2009b, p. 347). The latter pair of cases is commonly used to explain why it is sometimes permissible to inflict harms upon non-liable individuals thereby bringing about a good end and why sometimes it is not (McMahan 2009a, pp. 173, 232; 2009b, p. 346; cf. Kamm 1991; McIntyre 2018; Quinn 1989; Scanlon 2008; Thomson 1999). The terror bomber will detonate a bomb to intentionally inflict harm upon non-liable individuals in order to terrorize the enemy and thus end the war, whereas the tactical bomber aims to bomb a munitions factory, which produces weapons for the enemy, and thereby end the war. However, in so doing, the tactical bomber will harm both liable and non-liable individuals. It seems plausible to extend the scope of the doctrine such that it applies to harmless wrongs too and, thus, to most cases of surveillance. Hence, the first case should be assessed more harshly than the latter in terms of proportionality, since, according to just war theory, given the same moral benefits in the two cases (ending the war), it might be that terror bombing is disproportionate and, thus, impermissible even if the corresponding case of tactical bombing is permissible (because merely foreseeably killing civilians is a lesser moral cost than killing them intentionally). Arguably, the same reasoning applies to Intended and Unintended. The intention of the security agency influences proportionality in the context of surveillance too and, thereby also its moral permissibility. Intentional intrusion upon the non-liable might be impermissible even if an otherwise comparable but merely foreseen intrusion is permissible, as in the case of the tactical and the terror bomber.

McMahan appeals to the commonsense notion that a stricter principle of proportionality should count in such cases concerning warfare simply because the harms are inflicted intentionally. He does not, however, elaborate upon this apparent logic (McMahan 2009a, p. 22). Following just war theory, cases of intentionally harming non-liable individuals would not meet the criteria of discrimination of targets, since only so-called combatants are liable targets. Yet most scholars working with just war theory, McMahan included, are not absolutists in the sense that they would never permit intentional harms of non-liable individuals.Footnote 22 For example, Michael Walzer would allow such actions in cases of ‘supreme emergency’ with reference to the claim that ‘it is a matter of how much worse the effect of obeying it [the requirements of discrimination] would be than the effect of violating it’ (Walzer 1977, pp. 250–257; cp. McMahan 2009a, p. 22). Extrapolating this view to surveillance, it is indeed doubtful whether this type of preventive surveillance would meet the conditions of a case characterized by ‘supreme emergency’, since such surveillance activities most often take the form of obtaining pieces of information that are potentially useful or, as they put it, ‘in order to find a potential needle in the haystack, they need access to the whole haystack’. Hence, the information is ‘nice to know’ rather than being urgent or emergent. Would this then mean that preventive surveillance measures are per se disproportionate, indiscriminate, and morally impermissible? This would be an appealing consequence of extrapolating from just war theory and from the philosophical literature on self-defense to the case of surveillance. However, let us consider a different conclusion in view of the fact that almost always the harms involve in just wars are much more serious than the harms involved in surveillance.

6 A Stricter Notion of Wide Proportionality?

A good place to start when elaborating upon the initial concept of wide proportionality could be to restrict the use of intentional surveillance of non-liable individuals by introducing a concept of wide proportionality+. To define wide proportionality+, we need to first define standard wide proportionality:

A policy of surveillance involving unintended harms or wrongs to non-liable individuals satisfies a requirement of standard wide proportionality if, and only if, the ratio of moral benefits to moral costs is at least equal to or greater than c.

As previously noted, c can be 1, it can be slightly greater than 1, or it can be a number much greater than 1. We are now in a position to define wide proportionality+. First, we define:

N=the ratio between the moral costs of intended harms or wrongs to non-liable individuals to the moral costs of in all other respects identical but merely foreseen harms or wrongs to non-liable individuals.

N expresses how much intention boosts the moral objectionableness of harms and wrongs to non-liable individuals. Next, we define wide proportionality+ as follows:

A policy of surveillance involving intended harms or wrongs to non-liable individuals satisfies a requirement of wide proportionality+ if, and only if, the ratio of moral benefits to the moral costs involved had these been unintended multiplied with N is at least equal to or greater than c

If N is small, then wide proportionality+ is not much more demanding than standard wide proportionality, whereas if N is large, then the former is much more demanding than the latter. Suppose that, in the course of eliminating a particular threat, it would be proportionate to unintentionally, but foreseeably, impose a particular level of intrusion upon non-liable individuals (standard wide proportionality). In this case, if N is large, the harm avoided through surveillance would have to be much greater for the intentional imposition of intrusion upon non-liable individuals to be proportionate (wide proportionality+).

Is N big or small? Discussions of proportionality – and for that matter many other moral issues – rarely take precise numerical forms, and if this is not a reason to dismiss those discussions altogether, it would be unreasonable to expect that a numerical value is assigned to N (cf. Hurka 2005, p. 57; Macnish 2015, p. 531, 539; Uniacke 2011, p. 257). Fortunately, for our purposes – on the assumption that, given widespread views about the value of privacy and proportionality, mass surveillance programs like PRISM and TEMPORA do not satisfy the relevant proportionality requirement – this may not be necessary. We can offer a strong informal argument in support of this clam by defending two claims: first, that in contexts other than surveillance N is large and, second, that mass surveillance programs typically involve intended harms or wrongs, notably intrusion on the privacy of non-liable individuals.Footnote 23

In defense of the first claim, we return to the case of terror bombing versus tactical bombing. Discussions of this pair of cases strongly suggest that N is very large. That is, among those who believe that the former is harder to justify than the latter, many believe that while acts of war that predictably involve collateral harms to civilians are often permissible, intentionally killing civilians is rarely if ever justified. This is so, even if the moral benefits of defending oneself against an unjust aggressor are huge and the number of civilians intentionally killed in effective terror bombing pales in comparison with the number of civilians who will be killed if the unjust war is not stopped. A similar conclusion arises if we consider police work in general. While most people would approve of police tactics that sometimes foreseeably, but unintentionally, result in harm to law-abiding citizens, e.g. if police return fire when shot upon, very few approve of police tactics involving intentionally harming law-abiding citizens, e.g. shooting bystanders when doing so prevents criminals from shooting at the police, even when the number of lives saved in this way is very large. This suggests that in this case N is a very large number. Since we see no reason why the typical harms and wrongs in surveillance are relevantly different when it comes to moral requirements pertaining to N, we infer that N is also very large when it comes to surveillance. Of course, this is not to deny that the intended harms or wrongs to non-liable individuals in surveillance typically is of a much less serious nature than the intended harms and wrongs in wars.

In defense of the second claim, we note that existing mass surveillance programs, e.g. PRISM and TEMPORA, designed to intentionally collect comprehensive pieces of potentially useful personal electronic information about non-liable individuals in the name of general crime and terrorism prevention, would seem to fall under wide proportionality+ and fail to satisfy it.Footnote 24 This is so for two reasons. First, they involve serious harms and wrongs. In support of the former claim, we note that, according to many observers, programs involving widespread intentional intrusions into the lives of non-liable individuals ‘lead to the loss of a sense of security’ (Macnish 2018, p. 429).Footnote 25 In support of the latter claim, we note that most people would consider it a serious violation of privacy if security agencies were to open people’s private (paper)letters and photocopy them without necessarily reading them, or make old-style tape-recordings of phone conversations without officers necessarily listening to the recordings. We do not see why the use of computers, sophisticated software and modern surveillance techniques should make surveillance any less of a violation of privacy rights (see Macnish 2018 for a further discussion on this). Second, there are reasons to doubt that electronic mass surveillance involves great benefits (Haggerty and Gaszo 2005; Maras 2010; Monahan 2012), inter alia because of adaptive tactics adopted by terrorists etc., e.g., the adoption of ‘lone wolf’ tactics, and because of the general climate of mistrust, resistance and radicalization that mass surveillance contributes to in relatively open and liberal societies.Footnote 26 In the wake of Snowden’s revelations, disputes about the effectiveness of mass surveillance led the deputy director of NSA, John Inglis, to state that ‘at most, one plot [which he did not specify] might have been disrupted by the bulk phone records program alone’ (Macaskill and Dance 2013). Arguably, in light of the (alleged) fact that such programs intrude intentionally on a huge number of non-liable individuals, ‘at most, one plot’ averted does not look decisive.Footnote 27

7 Concluding Remarks

The existing literature on ethical surveillance addresses surveillance involving intentional intrusion upon liable individuals. As a result, surveillance of non-liable individuals and the moral significance of the distinction between foreseeing and intending intrusion upon non-liable individuals in the course of surveillance has not received specific attention. This focus is, however, increasingly important, given that a precautionary principle is generally considered an important instrument with regard to the anticipation of criminal acts before they are committed as well as preventive surveillance of non-liable actors, e.g. some cases of mass surveillance (McCulloch and Wilson 2016; Innes and Sheptycki 2004). This general endorsement of prevention and disruption of potential criminal acts not only moves crime prevention, which has previously mainly been conducted via ‘soft’ means (e.g. information and dialogue), into the ‘hard’ intelligence context using surveillance technologies preventively and offensively. This is important, also because the ‘pre-crime and pre-emptive logic that has entered the preventive realm is part of the pursuit of security as opposed to the pursuit of justice’ (Lomell 2017, p. 44). Hence, restriction on what can be imposed on non-liable individuals is increasingly important.

In this article, we have addressed the proportionality requirement in relation to surveillance. We have focused on specifying which conditions should prevail if a person is liable to suffer from intentional intrusion as a result of specific surveillance measures. We have applied and modified McMahan’s distinction between narrow and wide proportionality in the context of surveillance. In particular, we have argued that much preventive/offensive surveillance takes the form of intentional intrusion on non-liable individuals and that the form of proportionality relevant to assessing these forms of surveillance – wide proportionality+ − is a form of proportionality which is more demanding than even McMahan’s notion of wide proportionality. Accordingly, many mass surveillance programs like PRISM and TEMPORA appear to fail to satisfy the proportionality requirement and are for that reason impermissible, although, in principle, such programs might be proportionate under circumstances of extreme emergency, i.e. conditions presumably quite different from those we live under now. At least, the former aspect of this claim is true if there is a weighty moral concern to respect people’s privacy. We have not shown that there is such a concern, but, in liberal societies at least, the view that there is, is widespread and fundamental (Rössler 2005).