Normalization Of Mass Surveillance Continues: Ireland And Georgia Join The Snoopers Club

from the in-camera dept

One of the consequences of the Snowden leaks of mass surveillance around the world is that a number of governments have been bringing in new laws in order to provide a legal framework for the snooping they have previously been carrying out illegally, when they obviously thought that no one would ever find out. Here's a story in The Irish Times about recent moves in Ireland:

Foreign law enforcement agencies will be allowed to tap Irish phone calls and intercept emails under a statutory instrument signed into law by Minister for Justice Frances Fitzgerald.

Companies that object or refuse to comply with an intercept order could be brought before a private "in camera" court.

The legislation, which took effect on Monday, was signed into law without fanfare on November 26th, the day after documents emerged in a German newspaper indicating the British spy agency General Communications Headquarters (GCHQ) had directly tapped undersea communications cables between Ireland and Britain for years.

As that reports, there's also a troubling new secret court for enforcing such intercept orders -- something that is extremely unusual in Ireland:

"Even with very sensitive cases in Ireland they’re not prosecuted in camera," said TJ McIntyre, lecturer at University College Dublin’s school of law and chairman of advocacy group Digital Rights Ireland. "It's worrying because it means telecommunications companies might be pressured into doing things that aren’t entirely legal."

The companies would be prosecuted in secret, and would be unable to disclose their objections publicly – or even the fact that they were being prosecuted.

Ireland's move is a further example of how enshrining the ability to spy at home and abroad is taking precedence over basic rights -- in this case, to an open trial. Another country making worrying moves to normalize snooping on its citizens is Georgia, whose Parliament gave a first reading to new laws covering this area, as reported by Civil.ge:

The government-backed package of bills allows the Interior Ministry to retain its direct access to telecom operators' networks, but also empowers the office of personal data protection inspector to electronically monitor if the security agencies are carrying out surveillance lawfully, based on court warrant.

But the opponents, which also include civil society groups who have long been campaigning for reining in security agencies' unrestricted direct access to telecom operators’ networks, argue that actual wording of the bill, full of complex technical terms about lawful interception management system, hash codes and log files, is far from what its sponsors are trying to portray and leaves room for the Interior Ministry to bypass personal data protection inspector for carrying out illegal monitoring of mobile phone and internet communication.

Unfortunately, the more these laws are passed, the more other countries are likely to follow suit, until legalized mass snooping becomes the norm. That's all the more reason to challenge these early examples in any way possible, as is happening in the UK, for example, before the idea spreads everywhere.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bulk surveillance, georgia, ireland, mass surveillance, surveillance

Senator Harry Reid Going To Try To Push Through USA Freedom Act Before GOP Takes Over Senate

from the here-we-go dept

There were some rumors that, with the GOP about to take over the Senate, the Democratic leadership might try to finally move forward with the USA Freedom Act. The Senate bill has been languishing, despite it being considered a "compromise" bill that was widely acceptable to both intelligence community folks and many in the civil liberties community. Over the last few months, civil liberties and consumer activists groups have been growing less pleased with the bill, as the deeper they've explored it, the more worried they've become about some of how it might be abused. However, it's still considered by many to be a good start, if not (in any way) a perfect bill.

And, now, Senator Harry Reid has made the move to push forward with the bill in the lame duck session before control of the Senate flips.

Reid filed for cloture on the measure late Wednesday, a surprising move intended to address the National Security Agency's mass surveillance practices before Republicans take over the Senate next year. To advance further, the legislation would need 60 votes to end debate on the measure, and then a majority vote to pass it through the chamber.

It will be interesting to see if they actually have the 60 votes. Part of the delay has been that they weren't sure that there really were enough votes. And there were still pressures by intelligence community supporters to water down the bill (despite James Clapper saying the bill is okay as is) and by Senators Wyden and Udall to add more privacy and civil liberties protections. If they're moving for cloture, it may mean that Reid is confident that they have the votes... or it's a recognition that it's now or never given the change in control that will happen in January. We'll find out soon enough if this means there's enough support, or if Reid just threw a Hail Mary as a final ploy.

Filed Under: bulk collection, congress, harry reid, mass surveillance, nsa, patrick leahy, senate, surveillance, usa freedom act

Research Shows Mass Surveillance Fails 'Drastically' In Striking Balance Between Costs And Benefits To Society

from the case-not-made dept

One of the many problems with the debate on mass surveillance is that it is largely driven by emotions, on both sides. Facts are few and far between -- much is secret, for obvious reasons -- which makes objective discussion hard. What is needed is some rigorous research into this area. Surprisingly, it turns out the European Union has been funding just such a project, called "Surveille," a name derived from "Surveillance: Ethical Issues, Legal Limitations, and Efficiency." Here are the project's aims:

1. To provide a comprehensive survey of the types of surveillance technology deployed in Europe.

2. To assess the benefits and costs of surveillance technology. 'Benefits' refers to the delivery of improved security; 'costs' to the economic costs, negative public perceptions, negative effects on behaviour and infringement of fundamental rights.

3. To identify, elaborate and assess the whole range of legal and ethical issues raised by the use of surveillance technology in the prevention, investigation and prosecution of terrorism and other crime -- including those related to fundamental rights.

4. To communicate continuously the results of the research to a representative sample of stakeholders: European decision-makers, law enforcement professionals, local authorities, and technology developers, and to receive feedback to inform continuing research.

A post on the Just Security site by Professor Martin Scheinin, the coordinator of the Surveille project, gives a good summary of the latest results of the research, which have been released as a 50-page paper entitled "Assessing Surveillance in the Context of Preventing a Terrorist Act" (pdf). Here's what he writes:

Electronic mass surveillance -- including the mass trawling of both metadata and content by the US National Security Agency -- fails drastically in striking the correct balance between security and privacy that American officials and other proponents of surveillance insist they are maintaining.

We arrived at this conclusion by subjecting a wide-range of surveillance technologies to three separate assessments by three parallel expert teams representing engineers, ethicists, and lawyers. Each team conducted assessments of surveillance technologies, looking at ethical issues they raise; the legal constraints on their use – or those that should exist – on the basis of privacy and other fundamental rights; and, finally, their technical usability and cost-efficiency. This work was fed into and commented upon by two end-user panels, one consisting of law enforcement officials and the other of representatives of cities and municipalities.

The main academic paper is not at all dry; that's because it consists largely of a detailed analysis of real-life surveillance techniques of the kind frequently discussed here on Techdirt. It subjects them to assessments from very different viewpoints -- technical, ethical and legal. Interesting as these are, it's the final conclusions that are most important, because they give the lie to the oft-expressed view that mass surveillance is somehow "justified" by the results it produces:

Various kinds of Internet monitoring techniques are applied side by side with more traditional surveillance techniques. We find most of the Internet monitoring applications both ethically and legally impermissible, assessing them poorly in comparison with traditional, non-technology based surveillance methods. Furthermore, the Internet monitoring techniques compare poorly with the traditional techniques also in terms of usability.

...

Internet monitoring techniques, with the exception of targeted social networking analysis, represent an unacceptable interference with fundamental rights to privacy and data protection, the deepest ethical risks of chill and damage to trust, intrusion and discrimination, while also violating moral norms of proportionality of methods and consent of the policed. Meanwhile these high moral and legal costs reflect a mostly middling to poor usability benefit, performing worse with regard to cost, efficiency and privacy-by-design than lower tech alternatives. The case for a mass Internet monitoring system is found wanting.

A crucial point made there, so often ignored in debates about mass surveillance, is that low-tech approaches are generally better. In other words, there is no need to trade off fundamental rights for safety by spying on the entire Internet: greater security can be provided by adopting traditional, well-regulated, non-technology-based surveillance methods that do not require everyone to give up their privacy online. Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: benefits, costs, eu, europe, mass surveillance, surveillance

Departing GCHQ Boss Insists GCHQ Isn't Engaged In Mass Surveillance... If You Define 'Mass' And 'Surveillance' The Way He Does

from the but-not-the-way-the-rest-of-us-do dept

With the UN declaring mass surveillance a violation of human rights, the proper thing for the world's biggest intelligence agencies -- who regularly engage in mass surveillance -- to do, might be to cut back on the practice and go back to targeted surveillance projects that most people find acceptable. Or, you know, they can do what the outgoing head of the GCHQ (the UK's equivalent of the NSA), Sir Iain Lobban, did and just redefine the English language. That's easier.

“The people who work at GCHQ would sooner walk out the door than be involved in anything remotely resembling ‘mass surveillance,”

Of course, this basically contradicts everything that we've learned about the GCHQ recently. In fact, it's abundantly clear that the GCHQ regularly engages in programs of mass surveillance. It has a whole program, called TEMPORA, that is entirely focused on tapping into fiber optic cables and snarfing up pretty much everything that goes over them.

Just like the folks at the NSA, the GCHQ likes to have its own dictionary on these things. To them, it's not "surveillance" if no one actually looks at the data or if they don't store it all in a particular database (but rather keep it in another database). The NSA and GCHQ insist that they're just doing all of this for safekeeping, and the surveillance part doesn't start until someone actually looks at the data collected. And, it's not "mass" surveillance, even though it collects data on everyone, because they only think the people who someone took the time to directly snoop on count in the equation.

The end result, though, is that for everyone else, we recognize that the GCHQ is one of the leaders in mass surveillance, and having Lobban pretend otherwise doesn't make anyone feel safer. It just makes them think that there's another liar in charge of an intelligence agency.

Filed Under: gchq, iain lobban, mass surveillance, surveillance

UN Says Mass Surveillance Violates Human Rights

from the because-it-does dept

Over the summer, the United Nations commissioner for human rights, Navi Pillay, had said that mass surveillance likely violates human rights. At the time, she said:

‟International human rights law provides a clear and universal framework for the promotion and protection of the right to privacy, including in the context of domestic and extraterritorial surveillance, the interception of digital communications and the collection of personal data. Practices in many [s]tates have, however, revealed a lack of adequate national legislation and/or enforcement, weak procedural safeguards, and ineffective oversight. All of these have contributed to a lack of accountability for arbitrary or unlawful interference in the right to privacy.”

Now a new report from a different UN official, issued to the UN General Assembly, backs that up and appears to go further:

International human rights law requires States to provide an articulable and evidence-based justification for any interference with the right to privacy, whether on an individual or mass scale. It is a central axiom of proportionality that the greater the interference with protected human rights, the more compelling the justification must be if it is to meet the requirements of the Covenant. The hard truth is that the use of mass surveillance technology effectively does away with the right to privacy of communications on the Internet altogether. By permitting bulk access to all digital communications traffic, this technology eradicates the possibility of any individualized proportionality analysis. It permits intrusion on private communications without independent (or any) prior authorization based on suspicion directed at a particular individual or organization.

The report is clear that it's not talking about just any surveillance -- but mass surveillance. It notes that preventing terrorism is a legitimate reason for targeted surveillance, but that since there's no proof that mass surveillance actually helps stop terrorism, it's in violation:

Article 17 of the Covenant provides that any interference with private communications must be prescribed by law, and must be a necessary and proportionate means of achieving a legitimate public policy objective. The prevention of terrorism is plainly a legitimate aim for this purpose, but the activities of intelligence and law enforcement agencies in this field must still comply with international human rights law. Merely to assert — without particularization — that mass surveillance technology can contribute to the suppression and prosecution of acts of terrorism does not provide an adequate human rights law justification for its use. The fact that something is technically feasible, and that it may sometimes yield useful intelligence, does not by itself mean that it is either reasonable or lawful (in terms of international or domestic law)

The report also takes on the whole "but it's the internet, you have no privacy anyway" argument pretty clearly:

Some argue that users of the Internet have no reasonable expectation of privacy in the first place, and must assume that their communications are available to be monitored by corporate and State entities alike. The classic analogy drawn by those who support this view is between sending an unencrypted email and sending a postcard. Whatever the merits of this comparison, it does not answer the key questions of legality, necessity and proportionality. The very purpose of the Covenant’s requirement for explicit and publicly accessible legislation governing State interference with communications is to enable individuals to know the extent of the privacy rights they actually enjoy and to foresee the circumstances in which their communications may be subjected to surveillance. Yet the value of this technology as a counter-terrorism and law enforcement tool rests in the fact that users of the Internet assume their communications to be confidential (otherwise there would be no purpose in intruding upon them). This is reflected in the assertions made by members of the intelligence communities of the United States of America and the United Kingdom of Great Britain and Northern Ireland following the disclosure of mass surveillance programmes operated by these two States, in which the disclosures were said to have damaged national security by alerting potential terrorists to the fact that their communications were under surveillance.

[....] The suggestion that users have voluntarily forfeited their right to privacy is plainly unwarranted. It is a general principle of international human rights law that individuals can be regarded as having given up a protected human right only through an express and unequivocal waiver, voluntarily given on an informed basis. In the modern digital world, merely using the Internet as a means of private communication cannot conceivably constitute an informed waiver of the right to privacy under article 17 of the Covenant.

The Internet is not a purely public space. It is composed of many layers of private as well as social and public realms. Those making informed use of social media platforms in which messages are posted in full public view obviously have no reasonable expectation of privacy. The postcard analogy is entirely apposite for the dissemination of information through the public dimensions of Twitter and Facebook, for example, or postings on public websites. But reading a postcard is not an apposite analogy for intercepting private messages sent by e-mail, whether they are encrypted or unencrypted.

From there, the report notes that if states wish to impede on this privacy in the name of preventing terrorism, they must show tangible benefits from such surveillance -- and, so far, no government has done so. Furthermore, the report warns of:

...an ever present danger of “purpose creep”, by which measures justified on counter-terrorism grounds are made available for use by public authorities for much less weighty public interest purposes.

It's good to see such a clear condemnation of the problems of bulk/mass surveillance efforts -- almost always conducted with no evidence of benefit. Of course, the reality is that this report is unlikely to lead the intelligence community to change its stance on these programs, but it further highlights just how out of step with basic human rights these programs remain.

Filed Under: human rights, mass surveillance, nsa, privacy, surveillance, un

UN Report Says Mass Surveillance May Violate International Law

from the good-to-see dept

The good folks over at the EFF have a detailed overview of a new report from the UN, which has basically found that mass surveillance, similar to that which is carried out by the NSA and GCHQ can often violate international law. The full report is just 16 pages, but the EFF version highlights some of the key lines. The biggest is the report's rejection of the whole "collect the haystack" approach to mass surveillance. The UN report makes it clear that this is not a reasonable approach, especially when it is not shown to be "necessary and proportionate."

Where there is a legitimate aim and appropriate safeguards are in place, a State might be allowed to engage in quite intrusive surveillance; however, the onus is on the Government to demonstrate that interference is both necessary and proportionate to the specific risk being addressed. Mass or “bulk” surveillance programmes may thus be deemed to be arbitrary, even if they serve a legitimate aim and have been adopted on the basis of an accessible legal regime. In other words, it will not be enough that the measures are targeted to find certain needles in a haystack; the proper measure is the impact of the measures on the haystack, relative to the harm threatened; namely, whether the measure is necessary and proportionate.

It further finds that many countries do not effectively limit who has access to such bulk data collections, which exacerbates the problem:

One factor that must be considered in determining proportionality is what is done with bulk data and who may have access to them once collected. Many national frameworks lack “use limitations”, instead allowing the collection of data for one legitimate aim, but subsequent use for others. The absence of effective use limitations has been exacerbated since 11 September 2001, with the line between criminal justice and protection of national security blurring significantly. The resulting sharing of data between law enforcement agencies, intelligence bodies and other State organs risks violating article 17 of the Covenant, because surveillance measures that may be necessary and proportionate for one legitimate aim may not be so for the purposes of another

It also finds requirements for data retention to be problematic:

Concerns about whether access to and use of data are tailored to specific legitimate aims also raise questions about the increasing reliance of Governments on private sector actors to retain data “just in case” it is needed for government purposes. Mandatory third-party data retention -- a recurring feature of surveillance regimes in many States, where Governments require telephone companies and Internet service providers to store metadata about their customers’ communications and location for subsequent law enforcement and intelligence agency access – appears neither necessary nor proportionate.

The report condemns the pernicious use of "secret interpretations" of the law, something that has become all too common in the US:

Consequently, secret rules and secret interpretations – even secret judicial interpretations – of law do not have the necessary qualities of “law”. Neither do laws or rules that give the executive authorities, such as security and intelligence services, excessive discretion; the scope and manner of exercise of authoritative discretion granted must be indicated (in the law itself, or in binding, published guidelines) with reasonable clarity. A law that is accessible, but that does not have foreseeable effects, will not be adequate. The secret nature of specific surveillance powers brings with it a greater risk of arbitrary exercise of discretion which, in turn, demands greater precision in the rule governing the exercise of discretion, and additional oversight.

While reports like this may not directly impact the US's practices, it adds to the growing understanding and recognition both of what the NSA (and others) does, but also why it's totally unacceptable.

Filed Under: human rights, mass surveillance, necessary and proportionate, un

Snowden Asks Putin Live On TV If Russia Carries Out Mass Surveillance; But Why?

from the what-on-earth-was-he-thinking? dept

Edward Snowden has generally been staying out of the limelight so that the NSA story is about the surveillance not the whistleblower. He's given occasional interviews and delivered a few short speeches via videolink, but usually of a fairly low-key nature. That makes his unexpected appearance today on a marathon televised question-and-answer session with Vladimir Putin -- again by videolink -- extremely odd. Here's his question, as reported by The Guardian:

Snowden asked: "Does Russia intercept or store or analyse the communication of millions of individuals?" He went on to ask whether increasing the effectiveness of internal security systems could ever justify such actions.

To which Putin replied:

"Mr Snowden you are a former agent, a spy, I used to work for a intelligence service, we are going to talk the same language."

He said Russia did not have a comparable programme, stating: "Our agents are controlled by law. You have to get court permission to put an individual under surveillance. We don't have mass permission, and our law makes it impossible for that kind of mass permission to exist."

He said he was aware that "criminals and terrorists" relied on this kind of [technology], and that their actions demanded a response from the security services. "We have to use technical means to respond to their crimes, including those of a terrorist nature, we do have some efforts like that. We don't have a mass control. I hope we [w]on't do that," he said.

It's really hard to know why Snowden asked this question. Perhaps he wanted to emphasize the disproportionate nature of NSA spying by contrasting it with Russia's approach; perhaps he thought his appearance would jolt a jaded public and focus renewed attention on the key issues. But surely he must have guessed that Putin would answer as he did -- whether or not it is true -- that Russia uses surveillance strictly according to the law, that there is no massive, disproportionate spying of the kind practiced by the NSA, etc. etc. He must have known that Putin would easily turn Snowden's question into a wonderful opportunity to score points against the US.

Inevitably, then, this appearance will be leapt on by those who have maintained that Snowden is some kind of Russian spy, and that he has been working for Putin all along. As Techdirt has noted, that story doesn't stand up, but this unexpected intervention by Snowden certainly doesn't do anything to dispel it. For someone who until now has judged when and how to make public statements so skilfully and effectively, this seems like an incredible misstep. It really makes you wonder what might lie behind it.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: ed snowden, fsb, mass surveillance, nsa, russia, surveillance, vladimir putin