The criminalisation of travel as a global paradigm of preventive (In)justice: Lessons from the EU response to ‘foreign terrorist fighters’

Introduction

The evolution of global counter-terrorism policy in the past twenty years has been marked by a shift towards prevention and pre-emption - with criminal law focusing not so much on the past (on the prosecution of offences which have already been committed), but rather on the future (aiming to prevent or pre-empt the occurrence of future risks and threats to security). ¹ This paradigm of what has been labelled ‘preventive justice’ ² takes flesh by the establishment of a number of new criminal offences, called ‘precursor crimes’, ³ or anticipatory offences, ⁴ which criminalise conduct which is removed from the commission of an actual terrorist offence. Rather than targeting the commission of actual terrorist offences, preventive precursor crimes target increasingly every day, ordinary, prima facie lawful behaviour which is significantly removed from the commission of such offences - representing a shift from criminalising acts to criminalising dangerousness. ⁵ This trend is also discerned in the second tenet of the preventive justice paradigm, namely the proliferation of mechanisms of preventive and pre-emptive large-scale surveillance - where the State collects in a generalised and indiscriminate manner personal data emanating from every day activities with the aim of using these data for pre-emptive risk analysis of all citizens, including those not directly linked with the commission of a criminal offence. ⁶

This article aims to evaluate critically the evolution of this preventive paradigm by focusing on the criminalisation and surveillance of mobility which has been labelled as ‘terrorist travel’. The article will highlight the impact of the political imperative of tackling the phenomenon of ‘foreign terrorist fighters’ on the emergence of a global preventive paradigm of criminalisation of travel. By building on work on the establishment of a model of preventive (in)justice at EU level, ⁷ the article will focus on the establishment of a preventive paradigm of criminalisation of travel in EU law, and its interactions with the global governance of counter-terrorism as renewed by the fight against ‘foreign terrorist fighters.’

The first part of the article (sections 2 and 3) will focus on the emergence of a multi-level paradigm of criminalisation of ‘terrorist travel’, while the second part (sections 4 and 5) will focus on the surveillance of travel through the collection, transfer and analysis of passenger name record (PNR) data. The article will cast light on the role of the political rhetoric on the fight against ‘foreign terrorist fighters’ in the evolution of this paradigm and highlight the challenges that this multi-faceted system of criminalisation and surveillance of travel pose for fundamental rights and the rule of law. A key challenge in this context is the extent to which the European Union is able to uphold its internal fundamental rights and rule of law safeguards in the evolution of a global paradigm of criminalisation of travel.

The Criminalisation of ‘Terrorist Travel’ as a paradigm of globalised preventive multi-level governance

The emergence of a global regime on the criminalisation and surveillance of travel and mobility must be viewed within the broader context of the evolution of a multi-level global counter-terrorism regime. One of the most representative features of the emergence of such a regime since 9/11 has been the adoption of key elements not by multilateral legislative instruments reflecting a global consensus, but by executive action of organisations with specific - and at times single - agendas and with very limited transparency, scrutiny and democratic accountability. This tendency has had a significant adverse impact on the transparency and deliberative and democratic scrutiny requirements of the rule of law, as standards adopted by executive and ad hoc bodies have trickled down and adopted in a legally binding form at the regional, supranational and national levels. Two instances of executive production of global norms are key in this context. The first one is the emergence of the UN Security Council as the main global actor introducing terrorist sanctions regimes post-9/11- sanctions regimes which have been copied by the European Union and its Member States. ⁸ A number of scholars have noted that in this manner an executive body such as the UNSC has assumed a legislative role. ⁹ The imposition of sanctions via a listing process by the UNSC can be theorised under the prism of ‘global administrative law’. ¹⁰ Kingsbury and Krisch note that underlying the emergence of global administrative law is the vast increase in the reach and forms of transgovernmental regulation and administration designed to address the consequences of globalized interdependence in such fields as security. Much in the detail and implementation of such regulation is determined by transnational administrative bodies – including international organizations and informal groups of officials that perform administrative functions but are not directly subject to control by national governments or domestic legal systems or, in the case of treaty-based regimes, the States parties to the treaty. ¹¹ Both the manner of the adoption of these standards - which largely excludes democratic deliberation and participation - ¹² and their content have significant human rights implications - but it is executive, and not legislative, action which has framed the global response in this field.

The production of counter-terrorism norms at the level of the global executive and the infiltration of these norms into multiple legal orders at the regional, supranational and national levels has been ongoing. A key recent instance of such norm production involving a multi-level interaction of legal orders concerns the definition of terrorism via the criminalisation of conduct by ‘foreign fighters.’ The initial response has come again by the UN Security Council, which has adopted a Resolution calling for the adoption of a wide range of measures on ‘foreign fighters.’ ¹³ The prevention of travel through pre-emptive criminal law and border control and mobility surveillance were at the heart of the scheme of the Resolution. ¹⁴ The adoption of the latter was a US-led initiative, aiming to address via the UN Security Council the lack of global consensus in the field, and pushing for measures notwithstanding the scarcity of data on the phenomenon of foreign fighters. ¹⁵ It has been noted that, unlike Resolution 1373, Resolution 2178 did not reflect any instrument negotiated in a multilateral process. Hence other than in the Resolution, there was no basis in international law to criminalise travelling abroad with terrorist intent. ¹⁶ Norm-making on foreign fighters solely through the Security Council reflected an emergency global consensus at the time, ¹⁷ bypassing lengthier multilateral negotiation processes - ¹⁸ which would have cast light on the complexities and legal challenges in extending criminal law to the field of travel prevention.

In Resolution 2178 (2014), the UN Security Council called upon States to ensure that their domestic laws and regulations establish serious criminal offenses sufficient to provide the ability to prosecute and to penalize in a manner duly reflecting the seriousness of the offence: (a) their nationals who travel or attempt to travel to a State other than their States of residence or nationality, and other individuals who travel or attempt to travel from their territories to a State other than their States of residence or nationality, for the purpose of the perpetration, planning, or preparation of, or participation in, terrorist acts, or the providing or receiving of terrorist training; (b) the wilful provision or collection, by any means, directly or indirectly, of funds by their nationals or in their territories with the intention that the funds should be used, or in the knowledge that they are to be used, in order to finance the travel of individuals who travel to a State other than their States of residence or nationality for the purpose of the perpetration, planning, or preparation of, or participation in, terrorist acts or the providing or receiving of terrorist training; and, (c) the wilful organization, or other facilitation, including acts of recruitment, by their nationals or in their territories, of the travel of individuals who travel to a State other than their States of residence or nationality for the purpose of the perpetration, planning, or preparation of, or participation in, terrorist acts or the providing or receiving of terrorist training. ¹⁹

Resolution 2178 introduces a new dimension to the global regime of preventive justice. ²⁰ In addition to preparatory offences such as terrorist recruitment and funding, which raise fundamental challenges to freedom of expression, non-discrimination and the respect of political rights, ²¹ the focus is placed here primarily on the criminalisation of mobility and travel. As demonstrated in the case of Nada before the European Court of Human Rights dealing with travel bans as terrorist sanctions, ²² restrictions on mobility are likely to contravene European human rights norms, including the right to leave. A broad criminalisation of mobility also challenges the principle of legality in criminal offences and sanctions, as it is not clear exactly what is criminalized and why. The Resolution has been criticised for being unclear on key terms including who is a fighter and who is a terrorist and for challenging the right to freedom of movement enshrined in Article 12 ICCPR and Article 2 of protocol 4 of ECHR and the right to private and family life. ²³

The UNSC standards have since formed the basis of the adoption by the Council of Europe of its Additional Protocol to the Convention on the Prevention of Terrorism adopted by the Council of Europe, ²⁴ which has amplified the provisions of the UNSC Resolution and given them legally binding force via a multilateral regional treaty. The main objective of the Protocol was to supplement the Council of Europe Convention with a series of provisions aimed at implementing the criminal law aspects of UNSCR 2178. ²⁵ In addition to widening the categories of preparatory offences ²⁶ the Protocol introduced a series of provisions expressly criminalizing mobility and travel. States are called to adopt such measures as may be necessary to establish “travelling abroad for the purpose of terrorism” from its territory or by its nationals, when committed unlawfully and intentionally, as a criminal offence under their domestic law. ²⁷ Attempt is also criminalized. ²⁸ Travelling abroad for the purpose of terrorism is defined as travelling to a State, which is not that of the traveller’s nationality or residence, for the purpose of the commission of, contribution to or participation in a terrorist offence, or the providing or receiving of training for terrorism. ²⁹ The Protocol also criminalises funding travelling abroad for the purpose of terrorism ³⁰ and organising or otherwise facilitating travelling abroad for the purpose of terrorism. ³¹

The Additional Protocol has now been ratified by the European Union, ³² which has also revised its internal legislation on the criminalisation of terrorism by adopting a new Directive to align EU law with UNSC and Council of Europe standards. ³³ According to the Commission’s Explanatory Memorandum to the proposal, existing EU law needs to be reviewed ‘to implement new international standards and obligations taken by the EU and to tackle the evolving terrorist threat in a more effective way’ ³⁴ – with express reference being made not only to the Council of Europe Convention and the UNSC Resolution in the field, but also to relevant Financial Action Task Force (FATF) standards. ³⁵ It is worth noting here that the Commission refers to the revision of an Interpretative Note by a non-legislative body (the FATF) to take into account the standards set out by another non-legislative body (the UNSC) in order to shape the EU legislative response on the criminalisation of ‘foreign fighters.’ ³⁶ In this manner, global executive standards adopted with limited scrutiny and transparency have exerted significant influence to the significant extension of the criminalisation of terrorism in the EU and its Member States via a four step process: the adoption of standards by the global executive (UNSC); their influence on the output of other global executive actors (the FATF); the transformation of global executive standards into legally binding standards in a regional multilateral treaty (in the Council of Europe); and the subsequent mirroring of these standards in supranational EU law via the adoption of the EU counter-terrorism Directive. ³⁷ Although we still do not have a global, international treaty on the criminalisation of terrorism at UN level, the criminalisation of terrorism is being extended by other means.

Criminalising Terrorist Travel at EU level: The Rule of Law Challenges of the Preventive Paradigm

Criminal law on foreign terrorist fighters can be found in the 2017 EU Directive on terrorism. ³⁸ The Preamble to the Directive outlines in very broad terms perceived threats by ‘foreign terrorist fighters’, both travelling abroad and returnees, who are deemed to pose a ‘heightened security threat’ to all Member States – with the Preamble noting additionally the increased threats from individuals who are inspired or instructed by terrorist groups abroad but who remain within Europe. ³⁹ As seen above, UNSC and Council of Europe standards have been influential in the adoption of the Directive, ⁴⁰ whose incorporation in EU law as a matter of urgency has been used by the Commission to justify the non-production of an impact assessment accompanying the proposal. ⁴¹ Then preventive framing of the Directive is clear from the Preamble. The criminalisation of a number of offences related to terrorist activities is justified as these offences are deemed to be of a very serious nature and have the potential to lead to the commission of terrorist offences and enable terrorists and terrorist groups to maintain and further develop their criminal activities. ⁴²

Framed within this preventive logic, the text of the Directive introduces a number of offences related to foreign terrorist fighters leading to extensive criminalisation. These include recruitment, ⁴³ providing and receiving training for terrorism ⁴⁴ , terrorist financing, ⁴⁵ and, importantly, travelling for the purpose of terrorism and organising or otherwise facilitating travelling for the purpose of terrorism. ⁴⁶ The criminal offence of terrorist travel covers travelling to a country other than the criminalising Member State for the purpose of committing, or contributing to the commission of, a terrorist offence, for the purpose of the participation in the activities of a terrorist group with knowledge of the fact that such participation will contribute to the criminal activities of such a group or for the purpose of the providing or receiving of training for terrorism when committed intentionally. ⁴⁷ Terrorist travel is criminalised regardless of whether the destination country is located inside or outside the EU or the Schengen area. Member States are also called to criminalise terrorist travel towards their own territory ⁴⁸ as well as preparatory acts undertaken by a person entering that Member State with the intention to commit, or contribute to the commission of, a terrorist offence. ⁴⁹ Attempt at terrorist travel, recruitment, providing training for terrorism and terrorist financing is also criminalized. ⁵⁰ Importantly, for the offences prescribed in the Directive to occur, it is not necessary that a terrorist offence is actually committed, nor is it necessary, for the majority of these offences (including the training, travel and organization of travel offences, but also for the offences of directing or participating in a terrorist organisation), to establish a link to another specific offence laid down in the Directive. ⁵¹

The criminalisation of terrorist travel in the Directive is problematic from a rule of law perspective and challenges the principle of legality. The Directive introduces extremely broad criminal offences of travel, and criminalises their attempt, without even requiring a link to the commission of concrete terrorist offences. The Directive criminalises conduct which is remote to the harm caused by a future terrorist offence - which may not even be committed - and criminalises prime facie ordinary, lawful activities, with criminalisation being dependent on the challenging task of proving terrorist intent. ⁵² As is noted by the EU Fundamental Rights Agency, terrorist travel is defined as a preparatory offence distinguished from ordinary travel by the presence of terrorist intent; ⁵³ with intent becoming the determining factor ⁵⁴ But as has been further noted, intent is here uncommonly overgrown and relies ^{55 56} and which is not necessary to be committed at all for the criminalisation of terrorist travel to occur. Broad criminalisation and remoteneness from harm thus target ⁵⁷ The FRA Report highlighted respondents’ view on the matter as follows:

‘the prohibited conduct in these cases is too distant from a potential future terrorist act - as a result, at the time of the travel itself, some of the elements required to constitute a crime might not be sufficiently formulated or clear. This increases the risk of prosecuting lawful travel and raises serious questions about respecting the principle of legality and the presumption of innocence. That is particularly grave when authorities presume that such travel has a terrorist purpose and act preventively, before the actual travel starts. A prosecutor therefore questions if terrorist travel is at all viable as a separate offence given that, in practice, sufficient evidence of the purpose usually only becomes available after the travel takes place.’ ⁵⁸

Remoteness is further extended in the Directive’s choice to target the facilitation of travel by criminal law ⁵⁹ - where a third person may be prosecuted for the travel of another person, who in turn may or may not commit a terrorist offence. The lack of legal certainty inherent in the broad criminalisation of terrorist travel is compounded by the practical difficulties in ascertaining intent. The FRA Report highlighted the challenge of establishing intent objectively and not arbitrarily, ⁶⁰ noting that intent is the only factor differentiating travelling for the purpose of terrorism from regular travel with particular challenges arising when there is no evidence of a link to a terrorist organisation or another specific terrorist offence. ⁶¹ This broad criminalisation may lead to a ‘chilling effect’ towards the provision of lawful activities including humanitarian assistance and journalism. ⁶²

Another problematic element in the criminalisation of terrorist travel to tackle the phenomenon of ‘foreign terrorist fighters’ is the extended criminalisation of mobility and the challenges it poses for free movement, the right to move and citizenship more broadly. The term ‘foreign’ is a misnomer as it clearly covers citizens of the State of departure and subsequent return - with the Directive criminalising travel broadly, including travel into their territory. The criminalisation of terrorist travel blurs the boundaries between immigration and criminal law, as immigration-type measures are used to regulate the conduct of citizens; and, conversely, criminal law measures are used to regulate mobility, a conduct which has been traditionally the domain of immigration law. ⁶³ Criminalisation of terrorist travel challenges a number of fundamental rights, including the right to leave and to return into one’s own country; ⁶⁴ and it undermines the relationship of trust between the citizen and the State by effectively creating different classes and categories of citizens - with citizens here becoming foreigners, or rather ‘foreign fighters.’ ⁶⁵ These challenges become more acute at the level of the European Union constitutional order, which is premised upon the fundamental principle of free movement. ⁶⁶

The challenges that the criminalisation of travel in EU law pose to the principle of legality, to a number of fundamental rights and to citizenship must be viewed from the perspective of the vagueness and remoteness of harm in the scheme of criminal law on foreign fighters and the lack of clarity as to what criminal law in this field is for. As has been demonstrated, outbound travel may be too far removed from the commission of an actual terrorist offence - questioning thus the proximity of criminalisation to actual harm. In this paradigm of preventive (in)justice, the logic of prevention extends beyond criminalising conduct which may lead to the commission of a further specific criminal offence - as it is not a requirement for conduct to lead to the commission of a terrorist offence - and therefore it is unclear whether conducts will actually result in a specific harm or will increase the risk of harm. ⁶⁷ The link between conduct and harm is also tenuous in terms of returnees - it is not clear in this context what the criminal law is trying to address here. It is not trying to address the commission of future terrorist acts - as with the case of criminalisation of outbound travel - nor does it address the commission of past terrorist offences in the States where mobility is originating from. In both cases, and in the absence of a concrete link to criminal offences, we are witnessing the emergence of a paradigm of preventive (in)justice where criminal law targets not specific acts, but dangerousness as such. ⁶⁸

Criminalisation on the basis of dangerousness is reminiscent of Jakobs’ construction of Feindstrafrecht, or enemy criminal law, reflecting a tendency towards subjective criminalization on the basis of the character and culpability of the actor rather than on her externally visible conduct - with the actor becoming a threat and thus treated as an enemy and not a citizen. ⁶⁹ The difficulties in implementing these offences on the ground have further transformed this preventive criminal law into symbolic criminal law ⁷⁰ - with offences of terrorist travel not being used in practice, with prosecutors opting to use other, broader offences, such as participation in a criminal organization, challenging thus legal certainty. ⁷¹ Uncertainty is also created by the lack of policy clarity regarding the usefulness of using criminal law as a best way to deal with the phenomenon of ‘foreign terrorist fighters’ and in particular returnees. ⁷²

The Emergence of a Global Paradigm of PNR Travel Surveillance – from unilateralism to internalisation to globalisation

The pre-emptive surveillance of travel has been a key component of the US post-9/11 counter-terrorism strategy. The extension of surveillance to all air passengers in advance of travel was deemed necessary to stop events in the form of the 9/11 attacks to occur in the future. ⁷³ To prevent potentially dangerous mobility to the United States on a global scale, the US passed legislation in November 2001 requiring air carriers operating flights to, from, or through the US to provide US Customs with electronic access to data contained in their automatic reservation and departure control systems. ⁷⁴ The unilateral US demands for in advance transfer of passenger name records (PNR) data, a wide range of data on lawful, every day activity, enabling the risk assessment and profiling of passengers, has led to the need for EU institutions to respond in order to ensure the EU airlines would not be in breach of EU law (and in particular of data protection law) when complying with US demands. This move has led to the conclusion of a series of transatlantic agreements on the transfer of PNR data, ⁷⁵ the latest of which was concluded and took effect on June 1, 2012. ⁷⁶ The Agreement establishes an obligation for carriers to provide a wide range PNR data contained in their reservation systems to the US Department of Homeland Security (DHS) ⁷⁷ - the Annex to the Agreement contains nineteen categories of PNR data, including frequent fly. ⁷⁸

The conclusion of the EU-US PNR Agreements, whereby in essence the EU has accepted a far-reaching system of pre-emptive surveillance imposed by the US, and the subsequent conclusion of similar PNR Agreements with other third States, ⁷⁹ poses two inextricably linked challenges to EU law: the first challenge concerns the compatibility of PNR schemes as such with EU fundamental rights law; and the second challenge concerns the extent to which the EU can conclude, as part of its external action, agreements with third countries on PNR when these agreements would in effect undermine its internal benchmarks and acquis on fundamental rights. The Court of Justice was called to give some answers in its ruling on the compatibility of another PNR agreement, the one between the EU and Canada, with EU law. ⁸⁰ In Opinion 1/15, the Court of Justice found that aspects of the Agreement were incompatible with the rights to privacy and data protection. ⁸¹ The Court acknowledged that the agreement permits the systematic and continuous transfer of PNR data of all air passengers flying between the European Union and Canada ⁸² and the use of this data as a preventive intelligence tool. ⁸³ The Court found that the EU-Canada PNR Agreement was incompatible with EU law in providing for the transfer of sensitive data. For the Agreement to become compatible with EU law improvements are needed in a number of specific respects, including greater clarity and precision regarding the categories of PNR data to be transferred, safeguarding purpose limitation to terrorism and serious crime, ensuring that the criteria for automated searches are specific, reliable and non-discriminatory, setting limits to the subsequent use of PNR data, to their retention and to their transfer in third countries and providing with the right to individual notification for passengers and for oversight mechanisms.

Notwithstanding the existence of significant concerns regarding the compatibility of agreements on the transfer of PNR data between the Union and third countries with fundamental rights, the Union has since pressed ahead with the internalisation of this model and the introduction of ‘internal’ EU PNR legislation requiring the transfer of personal data by airlines flying into (and within) the Union. Attempts to internalise US-style PNR systems are not new and their adoption on EU law has been long-running and contested. The European Commission tabled a proposal for a Framework Decision on an EU PNR system as early as 2007. ⁸⁴ The Commission explained that the proposal was a result of the “policy learning” from inter alia the existing EU PNR Agreements with the United States and Canada. ⁸⁵ Agreement on the proposal was not reached before the entry into force of the Lisbon Treaty, a fact which led the Commission to table new legislation post-Lisbon, this time in the form of a Directive. ⁸⁶ The Commission justified the establishment of a European system of PNR transfer as necessary for law enforcement purposes due to its potential for risk assessment of passengers and proposed a system which is very similar to the US PNR system, at least as regards the categories of transferred data ⁸⁷ and the emphasis on risk assessment. ⁸⁸ This initiative was rejected by the European Parliament but proposals for an EU PNR Directive were rekindled following subsequent terrorist incidents in Europe which have provided renewed impetus and political justification for the eventual adoption of an ‘internal’ PNR Directive. ⁸⁹ In the aftermath of the terrorist attacks in Paris, the European Council called for the urgent adoption of a strong and effective European Passenger Name Records directive with solid data protection safeguards. ⁹⁰ Addressing the phenomenon of foreign terrorist fighters has been a catalyst towards the renaissance of proposals for an EU PNR system - it has been noted that PNR is necessary to know in advance when/where known foreign fighters will arrive and to detect unknown foreign fighters. ⁹¹ The EU PNR Directive was eventually adopted in 2016. ⁹² The preventive framing of the Directive is confirmed from the outset: according to the Preamble,

‘Assessment of PNR data allows identification of persons who were unsuspected of involvement in terrorist offences or serious crime prior to such an assessment and who should be subject to further examination by the competent authorities. By using PNR data it is possible to address the threat of terrorist offences and serious crime from a different perspective than through the processing of other categories of personal data. However, to ensure that the processing of PNR data remains limited to what is necessary, the creation and application of assessment criteria should be limited to terrorist offences and serious crime for which the use of such criteria is relevant. Furthermore, the assessment criteria should be defined in a manner which keeps to a minimum the number of innocent people wrongly identified by the system.’ ⁹³

The internalisation of a contested preventive paradigm of large-scale surveillance of travel in EU law poses profound challenges to EU fundamental rights benchmarks. The adoption of the EU PNR Directive poses significant challenges to Charter benchmarks on privacy and data protection, including serious concerns regarding automated data processing ⁹⁴ and profiling, ⁹⁵ as it internalises in EU secondary law a system of large-scale pre-emptive surveillance signifying a shift from immigration control based on checks to third-country nationals to a border security/counter-terrorism approach consisting of the generalised, and increasingly global, surveillance of mobility. In addition to the serious privacy concerns this system of pre-emptive surveillance of every day legitimate activity entails, the EU PNR Directive poses significant challenges to free movement and EU citizenship law, by extending the targets of surveillance from third-country nationals to EU citizens, and by extending surveillance to travel within the EU. This signifies a paradigm change to what can be seen as ‘the Borders Paradox’ ⁹⁶ , whereby measures on the surveillance of mobility are now used also for the surveillance and monitoring of the movement of EU nationals. This paradox is accentuated bearing in mind that the EU PNR Directive applies, as far as the majority of EU Member States are concerned, to flights into the EU and may apply to intra-EU flights. ⁹⁷ In this manner, pre-emptive surveillance of mobility challenges not only the relationship between the individual and the State at national level, but also EU citizenship based on free movement as such.

The compatibility of the internal PNR regime with EU law will be contested in courts, ⁹⁸ and the internalisation of this preventive paradigm on the justification of an effective fight against foreign terrorist fighters’ poses additional challenges in terms of the interaction of EU law with the emerging global framework of PNR-based surveillance of travel and the compatibility of global rules with EU law. The past two decades have witnessed the emergence of a multi-level system of governance of PNR transfers - and a shift from unilateral, to bilateral, to global standards. Early on, the Commission developed what it called a ‘global’ EU PNR approach, ⁹⁹ privileging the role of the International Civil Aviation Organisation (ICAO) in developing global PNR standards. ¹⁰⁰ ICAO has since developed a series of Guidelines on PNR data, increasingly influenced by the entry of the UN Security Council in the PNR norm-making landscape. The intervention of the UN Security Council in the field is linked with the fight against foreign fighters and can be tracked in a series of Resolutions focusing on the surveillance of mobility. ¹⁰¹ The development of subsequent ICAO standards ¹⁰² has taken the UNSC approach into account, ¹⁰³ in what constitutes another example of the development of a multi-level system of global administrative law. This consists of a paradigm of governance where executive, single-agenda agencies drive via what is mislabelled as ‘soft law’ or technical standards ¹⁰⁴ the process for the adoption of global standards which have profound fundamental rights implications. ¹⁰⁵ The EU PNR Directive contains an express reference to ICAO standards in this context ¹⁰⁶ but the Commission has expressed the view that EU law provides higher standards than the latest iteration of ICAO PNR standards. ¹⁰⁷

EU Law as a Global Benchmark for Preventive PNR Surveillance? Lessons from the CJEU Ruling in Ligue des droits humains

The challenges to citizenship and fundamental rights of the paradigm of pre-emptive surveillance of mobility introduced by the EU PNR Directive were tested recently before the Court of Justice of the EU (CJEU). In its ruling in Ligue des Droits Humains, ¹⁰⁸ the CJEU highlighted these challenges but opted in favour of not striking down the Directive but rather providing guidance on its interpretation in conformity with EU law. ¹⁰⁹ From the outset the CJEU recognised the extensive system of pre-emptive surveillance based on advance assessment of passengers introduced by the PNR Directive - noting that the assessment is carried out by State authorities (the so-called Passenger Information Units - PIUs):

‘systematically and by automated means, that is to say continuously and regardless of whether there is any indication that there is a risk that the person concerned is involved in terrorist offences or serious crime…to that end, those provisions provide that PNR data may be compared against ‘relevant databases’ and be processed against ‘pre-determined’ criteria.’ ¹¹⁰

The CJEU noted further that the comparison of PNR data against ‘relevant databases’ may provide additional information on the private lives of air passengers and may allow very precise conclusions to be drawn in that regard. ¹¹¹ The Court further built upon its Opinion on the EU-Canada PNR Agreement where it held that, since automated analyses of PNR data are carried out on the basis of unverified personal data and are based on pre-determined models and criteria, they necessarily present some margin of error ¹¹² and noted that the number of ‘false positives’ (of positive matches from automated processing under Article 6(3)(a) and (b) of that directive which prove to be incorrect following individual review by non-automated means) is fairly substantial. ¹¹³ The Court noted further the particularly long period of retention of PNR data ¹¹⁴ and noted that:

‘[G]iven how common use of air transport services is, the effect of a retention period that long is that a very large part of the population of the European Union is liable to have its PNR data retained, repeatedly, under the system established by the PNR Directive and, accordingly, be accessible for analyses carried out in the context of advance and subsequent assessments by the PIU and competent authorities over a considerable – even indefinite – period of time, in the case of persons who travel by air more than once every five years.’ ¹¹⁵

In view of the above considerations, the CJEU held unequivocally that the PNR Directive entails undeniably serious interferences with the rights guaranteed in Articles 7 and 8 of the Charter, in so far, inter alia, as it seeks to introduce a surveillance regime that is continuous, untargeted and systematic, including the automated assessment of the personal data of everyone using air transport services. ¹¹⁶ Yet the Court refrained from holding that the EU PNR Directive breaches the essence of the rights to privacy and data protection ¹¹⁷ and put forward a series of requirements of necessity, proportionality and purpose limitation ¹¹⁸ for the Directive to be compatible with EU law. It is thus for the Member States to ensure that the application of the system established by the PNR Directive is effectively limited to combating serious crime and that that system does not extend to offences that amount to ordinary crime. ¹¹⁹ In terms of purpose limitation, the Court required a link, which may also be indirect reflecting the preparatory nature of the offences, between the offences and the carriage of passengers by air. ¹²⁰

Conclusion

The above analysis has demonstrated the use of the political imperative to address the phenomenon of foreign terrorist fighters for the emergence of a global preventive paradigm of the criminalisation and surveillance of travel and highlighted the position of the European Union within this paradigm and the challenges the latter poses for EU law. The normalisation of criminalisation and surveillance of travel has occurred through a process of multi-level governance, and through the interaction of various sources of law and normative production at many different levels. The emergence of a global paradigm of the criminalisation of terrorist travel has been made possible through the leadership of the global executive - the UN Security Council - whose Resolutions have been implemented at regional international law level - by the Council of Europe - and subsequently by the EU, whose Member States and institutions in turn played a leading role in the development of a global consensus in the field. This process has left much to be desired in terms of democratic scrutiny of the measures in question, and resulted in legislation which reflects an emergency response, is far-reaching and not easy to implement. The second aspect of the preventive paradigm of criminalisation of travel, namely the surveillance of mobility through the transfer of PNR data from airlines to State authorities, was also the outcome of a process of multi-level governance. Unilateral and highly contested from a fundamental rights perspective US standards have become eventually internalised in EU law. The EU has emerged in turn as an actor in the globalisation of a PNR regime through the work of ad hoc, single-agenda organisations such as ICAO and following again the executive impetus of the UN Security Council.

Through the dominance of the executive and an emergency and technical agenda, we have seen thus the emergence of a preventive regime of criminalisation of travel which poses profound fundamental rights challenges. The criminal law on terrorist travel challenges the principle of legality and resembles, in its breath and vagueness of concepts and normative foundations, symbolic criminal law or the criminal law of the enemy. It targets ordinary every day prima facie lawful activity of a growing circle of individuals. It poses a direct challenge to freedom of movement, which is exacerbated in EU law in view of the central position of freedom of movement and borderless travel in European integration. The surveillance of travel through the normalisation of the collection of PNR data poses similar freedom of movement challenges, highlighted by the Court of Justice in its recent case-law. The model of pre-emptive surveillance further challenges profoundly privacy and data protection, but also generates a chilling effect on citizenship through its profiling potential. The use of technology, including AI, renders these challenges more acute and brings into the fore issues of discrimination and equality. For EU law, the challenge for the future is to ensure internal compliance of this paradigm with EU fundamental rights, while at the same time ensuring full respect of EU benchmarks in the development of a global regime of the criminalisation and surveillance of travel.