Category: 9.2 Intelligence – National security

EP Study : Big Data and smart devices and their impact on privacy

FULL STUDY ACCESSIBLE HERE
AUTHORS : Dr  Gloria  González Fuster, (Research  Professor  at  the Vrije Universiteit  Brussel  (VUB), Dr Amandine Scherrer, (European Studies Coordinator and Associate Researcher at the Centre d’Etudes sur les  Conflits,  Liberté  et  Sécurité -CCLS)

EXECUTIVE SUMMARY

EU citizens and residents and, more generally, all individuals deserving protection as ‘data subjects’ by EU law, are directly impacted by EU strategies in the field of Big Data. Indeed, the data-driven economy poses significant challenges to the EU Charter of Fundamental Rights, notably  in  the fields of  privacy and  personal data protection.

Big Data refers to the exponential growth both in the availability and automated use of information. Big Data comes from gigantic digital datasets held by corporations, governments and other large organisations; these are extensively analysed (hence the name ‘data analytics’) through computer algorithms. There are numerous applications of Big Data in various sectors, including healthcare, mobile communications, smart grids, traffic management, fraud detection, or marketing and retail (both on- and offline). The notion, primarily driven by economic concerns, has been largely promoted through market-led strategies and policies. Presented as an enabler of powerful analytical and predictive tools, the concept of Big Data has also raised numerous criticisms emphasising such risks as biased information, spurious correlations (associations that are statistically robust but happen only by chance), and statistical discrimination. Moreover, the promotion of Big Data as an economic driver raises significant challenges for privacy and digital rights in general. These challenges are even greater in a digital ecosystem with a proliferation of cheap sensors, numerous apps on mobile devices and an increasingly connected world that sometimes does not even require human intervention (as shown in the increasing development of the Internet of Things [IoT]). The flows of information on- and off line, shared and multiplied across computers, mobile devices, watches, SmartBands, glasses, etc., have dramatically increased the availability, storage, extraction and processing of data on a large scale. It has become increasingly difficult to track what is made of our data. This situation is complicated further by the wide variety of actors  engaged  in  data  collection  and  processing.

The numerous debates triggered by the increased collection and processing of personal data for various – and often unaccountable – purposes are particularly vivid at the EU level. Two interlinked, and to some extent conflicting, initiatives are relevant here: the development of EU strategies promoting a data-driven economy and the current reform of the EU personal data protection legal framework, in the context of the adoption of a General   Data  Protection  Regulation  (GDPR).

In order to address the issues at stake, the present Study provides an overview of Big Data and smart devices, outlining their technical components and uses (section 2). This section shows that many contemporary data processing activities are characterised by a high degree of opacity. This opacity directly affects the ability of individuals to know how data collected about them is used; it also hinders their capacity to assess and trust the manner in which choices are (automatically) made – whether, in other words, these choices are appropriate or fair. As regards smart devices, cheap sensors or the IoT, the pervasiveness of sensors and extensive routine data production might not be fully understood by individuals, who may be unaware of the presence of sensors and of the full spectrum of data they produce, as well as the data processing operations treating this diverse data. If Big Data, smart devices and IoT are often promoted as key enablers of market predictions and economic/social dynamics, data processing raises the question of who  controls one’s  data.

In this perspective, Section 3 presents the different EU approaches on the digital economy and the questions raised in terms of privacy and personal data protection (Section 3). This section argues that in the current context of the development of a Digital Single Market for Europe (DSM), the European Commission’s perspective is very much commercially and economically driven, with little attention to the key legal and social challenges regarding privacy and personal data protection. Even though the European Commission points out some of the key challenges of processing data for economic and market purposes (i.e., anonymisation, compatibility, minimisation), the complexity of these challenges is somehow under-estimated. These challenges can be grouped around the following questions any digital citizen may ask her/himself under EU law: which data about me are collected and for what purposes? Are data protected from unauthorised access and to  what  extent  is  control  exercised  upon  the processing  of my  personal   data?

Section 4 then considers these questions in the specific context of the Data Protection Reform package. Arguing that the digital citizen’s rights should be the main focus of the current debates around the GDPR, this Section underlines that Big Data, smart devices and the IoT reveal a series of potential gaps in the EU legal framework, in the following areas in particular: transparency and information obligations of data controllers; consent (including consent in case of repurposing); the need to balance public interest and the interests of data subjects for legitimising personal data processing; the regulation of profiling; and proper safeguarding of digital rights in case of data transfers to  third  parties and  third  countries.

In light of these findings, the Study concludes with key recommendations for the European Parliament and, in particular, the LIBE Committee responsible for the protection of natural persons with regards to the processing of personal data. These recommendations aim at ensuring that negotiations around the GDPR promote a strong and sustainable framework  of  transparency  and  responsibility  in which  the data  subject’s rights  are  central.

In particular, the guiding principle of any exploitation of personal data should be driven by the requirement of guaranteeing respect for the Fundamental Rights (privacy  and  personal  data protection) laid  down  in EU primary  and secondary  law (recommendations 1 & 2).

The role of data controllers in this perspective is central as they are legally required to observe a number of principles when they process personal data, compliance of which must be reinforced. The degree of information and awareness of data subjects must be of prime concern whenever personal data processing takes places, and the responsibility for protecting Fundamental Rights should be promoted along the data production chain and gather various stakeholders. Furthermore, the GDPR should ensure that individuals are granted complete and effective protection in the face of current   and   upcoming   technological   developments   of   Big   Data   and   smart   devices (recommendation 3).

The GDPR currently under discussion should in any case not offer less protection and guarantees than the 1995 Data Protection Directive, and users should remain in complete control of their personal data throughout the data lifecycle.

Finally, effective protection of individuals cannot be guaranteed solely by the adoption of a sound GDPR. It will also require a consistent review of the e-Privacy Directive (recommendation 4), an instrument that not only pursues the safeguarding of personal data protection but, more generally, aims to ensure this right and the right to respect for private life.

A quest for accountability? EU and Member State inquiries into the CIA Rendition and Secret Detention Programme

EXCERPTS FROM A STUDY FOR THE EP LIBE COMMITTEE 

Authors: Prof. Didier Bigo, Dr Sergio Carrera, Prof. Elspeth Guild, and Dr Raluca Radescu.

At the request of the LIBE Committee, this study assesses the extent to which EU Member States have delivered accountability for their complicity in the US CIA-led extraordinary rendition and secret detention programme and its serious human rights violations. It offers a scoreboard of political inquiries and judicial investigations in supranational and national arenas in relation to Italy, Lithuania, Poland, Romania and the United Kingdom. The study takes as a starting point two recent and far-reaching developments in delivering accountability and establishing the truth: the publication of the executive summary of the US Senate Intelligence Committee (Feinstein) Report and new European Court of Human Rights judgments regarding EU Member States’ complicity with the CIA. The study identifies significant obstacles to further accountability in the five EU Member States under investigation: notably the lack of independent and effective official investigations and the use of the ‘state secrets doctrine’ to prevent disclosure of the facts, evade responsibility and hinder redress to the victims. The study puts forward a set of policy recommendations for the European Parliament to address these obstacles to effective accountability.

EXECUTIVE SUMMARY

Although much has been done over the last ten years to overcome major obstacles to ensuring democratic and judicial accountability in respect of EU Member States’ complicity in the unlawful US CIA-led extraordinary rendition and secret detention programme, much remains to be done to uncover the truth and hold those responsible accountable for their actions.

This study takes as a starting point two recent and highly significant developments that have helped to shed light on, and establish accountability for, the actions of EU Member States engaged in the Central Intelligence Agency (CIA) rendition and detention programme. The first is the U.S. Senate Intelligence Committee “Study of the Central Intelligence Agency’s Detention and Interrogation Program” (also known as the Feinstein Report) published in December 2014, which provided further evidence of the nature of the relationship between the CIA and several European state authorities and their wrongdoing. The second is the collection of recent judgments of the European Court of Human Rights (ECtHR), particularly in the Al Nashiri and Abu Zubaydah cases, which have helped to provide substantive rule of law standards against which to measure national political inquiries and judicial investigations.

Through the prism of these two important recent developments, this study builds on the 2012 European Parliament study on “The results of inquiries into the CIA’s programme of extraordinary rendition and secret prisons in European states in light of the new legal framework following the Lisbon treaty”. First (section 2), it pinpoints the critical findings of the Feinstein Report and their relevance for EU Member State inquiries, in particular the new revelations that: the CIA was isolated both nationally and internationally; European states that collaborated with the CIA were quick to withdraw assistance when scrutiny increased, leaving the CIA on the run; the UK failed to refute unfounded CIA claims about the intelligence value of information extracted by torture; and the CIA paid large sums of money to cooperative Member States. The study also examines the media controversy provoked by the release of the Feinstein Report and the efforts made by certain actors to undermine its findings.

The study then (section 3) offers an up-to-date account of political inquiries and judicial investigations in five Member States (Italy, Lithuania, Poland, Romania and the United Kingdom). It argues that, while political inquiries and domestic judicial investigations have been or are being conducted in all five Member States and there have been ECtHR cases regarding all but the UK, they have all been beset by obstacles to accountability. The response of the EU institutions is also analysed. While it is acknowledged that the European Commission has taken tentative steps to encouraging accountability (notably in sending letters to Member States in 2013 to request information on investigations underway), it is found that neither the Commission nor the Council have properly followed up on the European Parliament’s recommendations.

After providing a detailed analysis of the recent ECtHR judgments in the Al Nashiri and Abu Zubaydah cases (section 4) and detailing the rule of law benchmarks against which the effectiveness of national investigations can be tested, the study then measures the national political inquiries and judicial investigations and finds them wanting, either because of a lack of independence or because national security or state secrets have been invoked to prevent disclosure of the facts (section 5).

Finally, the study examines what has prevented EU institutions from taking effective action in response to the CIA programme (section 6). It finds a general lack of political will exacerbated by an absence of a clear enforcement mechanism to ensure compliance with the rule of law as laid down in Article 2 TEU, meaning that the important step taken by the Commission to send letters to Member States is bereft of a clear legal framework.

In light of the above considerations, the Study formulates the following policy recommendations to the European Parliament:

Recommendation 1: The Parliament, particularly the LIBE Committee, should establish regular structured dialogue with relevant counterparts in the U.S. Congress and Senate, which would provide a new framework for sharing information and cooperating more closely on interrelated inquiries in the expanding policy field of Justice and Home Affairs.

Recommendation 2: The Parliament should use the recent LIBE Committee decision to draw up a Legislative Own-Initiative Report on an EU mechanism on democracy, the rule of law and fundamental rights to develop and bring further legal certainty to the activation phases preceding the use of Article 7 TEU. Parliament should also insist that the Commission periodically evaluate Member States’ compliance with fundamental rights and the rule of law under a new ‘Copenhagen Mechanism’ to feed into a new EU Policy Cycle on fundamental rights and rule of law in the Union.

Recommendation 3: The Parliament should adopt a Professional Code for the transnational management and accountability of data in the EU. The Code would outline where ‘national security’ and ‘state secrets’ cannot be invoked (i.e. define what national security is not). It would additionally lay down clear rules aimed at preventing the use and processing of information originating from torture or any related human rights violations.

Recommendation 4: The Parliament should demand that the Commission properly follow up on its resolutions and recommendations.

Recommendation 5: The Parliament should call on the President of the European Council to issue an official statement on the rendition programme to the Plenary, stating clearly the degree of Member States’ complicity and detailing obstacles to proper accountability and justice for the victims.

Recommendation 6: The Parliament should call for effective judicial investigations into the Feinstein Report’s findings that the CIA paid large sums of money to Member States for their complicity in the rendition programme, which amount to allegations of corruption.

The EU-US Umbrella agreement on Data Protection just presented to the European Parliament. All people apparently happy, but….

ORIGINAL PUBLISHED BY EU-LOGOS

by Paola Tavola (EU LOGOS Trainee)

“For the first time ever, the EU citizens will be able to know, by looking at one single set of rules, which minimum rights and protection they are entitled to, with regards to data share with the US in the law enforcement sector”. These are the words of P. Michou, chief negotiator in charge of the negotiation process of the so called EU-US “Umbrella Agreement”, who gave a public overview on the lately finalized transatlantic data protection framework in the field of law enforcement cooperation. The speech, delivered during the last meeting of the LIBE committee of the European Parliament, has met a warm welcome by the MEPs. Great congratulations have been expressed by all the political groups, for the work done by the negotiating team of the Commission that, from its side, has thanked the LIBE committee for its strong support and pressures. As Mrs. Michou said, they “helped us to be stronger in our negotiations”. Negotiations that were dealt with a partner that is far from being an easy one. The words of Michou, however, have not completely reassured all the MEPs, who have called for a legal opinion on the text of the agreement to be delivered by the legal department of the European Parliament. Legal certainties about the potential benefits or detrimental effects that this agreement could have on the existing EU data protection rules, as well as on past and future agreements, have been asked by the majority of the deputies, as a necessary precondition for the vote.

Historical context

An EU-US agreement in the field of protection of personal data was already called by the European Parliament in the year 2009. At that time, in a resolution on the state of transatlantic relation, the Parliament underlined the necessity of a “proper legal framework, ensuring adequate protection of civil liberties, including the right to privacy”, to be agreed on the base of a binding international agreement. The Commission then, on the invitation of the European Council, proposed a draft mandate for starting the negotiations with the United States, on a high standard system of data protection. The final mandate, being adopted by the Council in December 2010, opened the negotiation procedure among the two partners, that formally started on March 2011.

The negotiations have been though, mainly because of a great cultural difference existing among the two partners in terms of data protection, but after four years of work, the agreement has been initialed in Luxembourg, last September 8th. The final text, that can be signed only with the authorization of the Council and the consent of the Parliament, represents a huge step forward: “if we look back to some years ago, it was clear that some of the issues that have been now achieved in the text, couldn’t even have been theoretically possible”, Jan Philippe Albrecht (Greens/EFA) said, by opening the debate after Mrs. Michou speech.

The european Commissioner for Justice, Consumers and Gender Equality, Věra Juorová, by declaring full satisfaction for the conclusion of the discussions, affirmed: “robust cooperation between the EU and the US to fight crime and terrorism is crucial to keep Europeans safe. But all exchanges of personal data, such as criminal records, names or address, need to be governed by strong data protection rules. This is what the Umbrella Agreement will ensure.”

Terrorism or organized crime are phenomena that definitely constitute serious threats to security. However, leaving aside the narrow concept of security, as many theories and authors consider nowadays, a threat to security can be identified as any threat to the “cherished values” of our society: thus also to those values such as the right of privacy and the data protection.

The issue concerns how security and law enforcement are able to positively and constructively interact with new technology, but also to clash with it.

On one side, the information and data sharing is now a fundamental and crucial aspect of policy and judicial inter-state cooperation, since major threats and criminal phenomena have assumed a transnational connotation. On the other side however, it is necessary to ensure the protection and the fair and limited treatment of information, that is transferred as part of the transatlantic cooperation in criminal matters, in order to avoid abuses and the setting up of mass surveillance systems.

The two transatlantic partner, have already settled a substantial framework of data transfer rules. In 2010 they signed an agreement on the processing and transfer of financial messaging data from the EU to the US, for the purposes of the Terrorist Finance Tracking Program (TFTP); while in 2012 they concluded a bilateral agreement for the exchange of PNR (Passenger Name Records) data.

“Data protection is a fundamental right of particular importance in the digital age. In addition to swiftly finalizing the legislative work on common data protection rules within the European Union, we also need to uphold this right in our external relations.” This principle was included by Jean-Claude Juncker in the political priorities of the European Commission agenda, presented in July 2014.

A look inside the “Umbrella Agreement” Continue reading “The EU-US Umbrella agreement on Data Protection just presented to the European Parliament. All people apparently happy, but….”

EU-USA “UMBRELLA” AGREEMENT ON DATA PROTECTION: A …LEAKY UMBRELLA ?

Posted HERE on 18. September 2015

by

Leave a comment 

On 8 September 2015, the European Commission announced the successful completion of the negotiations with the US on a framework agreement („Umbrella Agreement“), that shall apply to the co-operation between law enforcement authorities. „Once in force, this agreement will guarantee a high level of protection of all personal data when transferred between law enforcement authorities across the Atlantic. It will in particular guarantee that all EU citizens have the right to enforce their data protection rights in US courts“, said the competent EU Commissioner Věra Jourová. Prerequisite for the signing of the agreement will be, however, that the US Congress will have approved the necessary legislative changes („Judicial Redress Bill“).

Although the Commission initially did not want to publish the agreement, the text – however – has found it’s way into the Internet, enabling the assessment.

First the good news: The agreement contains, in fact, substantial concessions from the US side. It has to be highlighted, that the US shall even provide EU citizens with a right to seek judicial redress if they are of the opinion that their privacy rights have been violated in the context of processing information the respective US authorities have received from the EU. Over years, the US government insisted on granting EU citizens only administrative redress. For Europe such limited redress – ultimately depending on the goodwill of the US administration – would not have provided an adequate level of data protection.

Another positive aspect is that both sides have agreed to commit to the principles of proportionality, necessity and purpose limitation and that they have to determine the use and duration of storage of personal information in accordance with these principles. The concrete purposes of data processing and the retention periods have to be determined by the specific legal acts.

However, although the agreement improves the legal status of EU citizens whose data are transferred to the US, it would be a misperception that the agreement provides EU citizens with the same privacy rights as US persons. If this would have been intended, the rights provided by US Privacy Act of 1974 and other laws, currently limited to US citizens and residents, could have been extended to EU citizens. Instead, the agreement text contains complicated rules, which do not ensure equality in the result. EU citizens have first to seek administrative redress. They may call a US court only after administrative redress definitely was exhausted. In addition, administrative and judicial redress are limited to those privacy rights explicitly specified in the Agreement, as the right to access and correction of the personal information. The agreement will not grant EU citizens – unlike US citizens – further rights to challenge the lawfulness of the entire process of data processing before a US court.

Furthermore, it should be noted that the agreement shall apply only to judicial and police authorities, but not to authorities with the task to guarantee the „national security“. US intelligence agencies like the NSA and the CIA share personal data with law enforcement agencies, even if they have received these information from their European partners. The provisions of the umbrella agreement would not apply in these cases. Last but not least the agreement does not cover data US and European authorities collect on the basis of national laws, i.e. the Foreign Intelligence Surveillance Act (FISA) or similar European legislation.

Another limitation of the umbrella: While according to the European data protection law, all personal data will be protected regardless of the nationality of the persons concerned, the agreement should apply only to data on EU citizens which have been transferred to the US by European authorities or companies based on bilateral or multilateral agreements. So data relating to citizens of third countries remain unprotected.

Finally, the agreement (Art. 21) falls short, however, with regard to the data protection oversight. It lacks an explicit commitment of both parties to ensure an independent data protection supervision. While the European Union commits that the independent data protection authorities shall be competent to check the provisions, the agreement refers with respect to the United States on a variety of oversight institutions, some of them not independent, which are to exercise the supervision of data protection „cumulatively“.

Given these shortcomings, to me the exultation of the agreement seem premature. The European legal bodies which need to approve the ratification of the agreement, in particular the European Parliament and the parliaments of the Member States are called upon to thoroughly examine the agreement, in particular, its compatibility with the provisions of the EU Charter of Fundamental Rights. Depending on the results of such assessment it might be necessary to renegotiating and caulking the umbrella.

 

Passenger Name Records, data mining & data protection: the need for strong safeguards

EXCERPTS FROM EXPERTS’ OPINION SUBMITTED TO THE COUNCIL OF EUROPE (PUBLISHED ON THE STATEWATCH SITE)

by Douwe KORFF and Marie GEORGES (FREE-Group Members)

Introduction

Much has been said and written about Passenger Name Records (PNR) in the last decade and a half. When we were asked to write a short report for the Consultative Committee about PNR, “in the wider contexts”, we therefore thought we could confine ourselves to a relatively straightforward overview of the literature and arguments.

However, the task turned out to be more complex than anticipated. In particular, the context has changed as a result of the Snowden revelations. Much of what was said and written about PNR before his exposés had looked at the issues narrowly, as only related to the “identification” of “known or [clearly ‘identified’] suspected terrorists” (and perhaps other major international criminals). However, the most recent details of what US and European authorities are doing, or plan to do, with PNR data show that they are part of the global surveillance operations we now know about.

More specifically, it became clear to us that there is a (partly deliberate?) semantic confusion about this “identification”; that the whole surveillance schemes are not only to do with finding previously-identified individuals, but also (and perhaps even mainly) with “mining” the vast amounts of disparate data to create “profiles” that are used to single out from the vast data stores people “identified” as statistically more likely to be (or even to become?) a terrorist (or other serious criminal), or to be “involved” in some way in terrorism or major crime. That is a different kind of “identification” from the previous one, as we discuss in this report.

We show this relatively recent (although predicted) development with reference to the most recent developments in the USA, which we believe provide the model for what is being planned (or perhaps already begun to be implemented) also in Europe. In the USA, PNR data are now expressly permitted to be added to and combined with other data, to create the kinds of profiles just mentioned – and our analysis of Article 4 of the proposed EU PNR Directive shows that, on a close reading, exactly the same will be allowed in the EU if the proposal is adopted.

Snowden has revealed much. But it is clear that his knowledge about what the “intelligence” agencies of the USA and the UK (and their allies) are really up to was and is still limited. He clearly had an astonishing amount of access to the data collection side of their operations, especially in relation to Internet and e-communications data (much more than any sensible secret service should ever have allowed a relatively junior contractor, although we must all be grateful for that “error”). However, it would appear that he had and has very little knowledge of what was and is being done with the vast data collections he exposed.

Yet it is obvious (indeed, even from the information about PNR use that we describe) that these are used not only to “identify” known terrorists or people identified as suspects in the traditional sense, but that these data mountains are also being “mined” to label people as “suspected terrorist” on the basis of profiles and algorithms. We believe that that in fact is the more insidious aspect of the operations.

This is why this report has become much longer than we had planned, and why it focusses on this wider issue rather than on the narrower concerns about PNR data expressed in most previous reports and studies.

The report is structured as follows. After preliminary remarks about the main topic of the report, PNR data (and related data) (further specified in the Attachment), Part I discusses the wider contexts within which we have analyzed the use of PNR data. We look at both the widest context: the change, over the last fifteen years or so, from reactive to “proactive” and “preventive” law enforcement, and the blurring of the lines between law enforcement and “national security” activities (and between the agencies involved), in particular in relation to terrorism (section I.i); and at the historical (immediately post-“9/11”) and more recent developments relating to the use of PNR data in data mining/profiling operations the USA, in the “CAPPS” and (now) the “Secure Flight” programmes (section I.ii).

In section I.iii, we discuss the limitations and dangers inherent in such data mining and “profiling”.

Only then do we turn to PNR and Europe by describing, in Part II. both the links between the EU and the US systems (section II.1), and then the question of “strategic surveillance” in Europe (II.ii).

In Part III, we discuss the law, i.e., the general ECHR standards (I); the ECHR standards applied to surveillance in practice (II, with a chart with an overview of the ECtHR considerations); other summaries of the law by the Venice Commission and the FRA (III); and further relevant case-law (IV).

In Part IV, we first apply the standards to EU-third country PNR agreements (IV.i), with reference to the by-passing of the existing agreements by the USA (IV.ii) and to the spreading of demands for PNR to other countries (IV.iii). We then look at the human rights and data protection-legal issues raised by the proposal for an EU PNR scheme. We conclude that part with a summary of the four core issues identified: purpose-specification and –limitation; the problem with remedies; “respect for human identity”; and the question of whether the processing we identify as our main concern – “dynamic”-algorithm-based data mining and profiling – actually works.

Part V contains a Summary of our findings; our Conclusions (with our overall conclusions set out in a box on p. 109); and tentative, draft Recommendations. (…)

Conclusions Continue reading “Passenger Name Records, data mining & data protection: the need for strong safeguards”

Les lourdes chaînes de Prométhée, réflexions critiques sur la Stratégie européenne de sécurité intérieure 2015 – 2020

ORIGINAL PUBLISHED HERE ON  23 JUIN 2015

par Pierre Berthelet, CDRE

Le Professeur Panayotis Soldatos comparait il y a peu l’Union européenne à Prométhée enchaîné par les Etats membres. Ces réflexions mettant en évidence une construction européenne dépendante des États, « dont les élites politiques, écrit-il, se refusent à admettre la réalité de l’obsolescence de la souveraineté nationale », s’illustrent parfaitement avec l’adoption par le Conseil de la stratégie européenne de sécurité intérieure pour la période 2015-2020.

À première vue, la sécurité intérieure vient de franchir un pas supplémentaire dans l’intégration avec l’approbation par le Conseil le 16 juin 2015, de conclusions renouvelant et modernisant pour cinq années à venir la stratégie 2010-2014. Pour autant, il semble bien que les chaînes soient pesantes, car les États conservent la main, et de main ferme pourrait-on dire, le processus d’intégration dans ce domaine.

Ces conclusions entraînent une série de réflexions critiques quant aux conséquences institutionnelles et quant à la manière dont les États décident d’œuvrer dans la construction européenne en matière de sécurité intérieure.

Elles suscitent d’emblée des interrogations concernant l’inclusion du Parlement européen dans le processus décisionnel lié au déroulement du cycle, ainsi que sur la préservation accrue des droits fondamentaux (1).
Continue reading “Les lourdes chaînes de Prométhée, réflexions critiques sur la Stratégie européenne de sécurité intérieure 2015 – 2020”

Les lourdes chaînes de Prométhée, réflexions critiques sur la Stratégie européenne de sécurité intérieure 2015 – 2020

ORIGINAL PUBLISHED HERE ON 23 JUIN 2015

par Pierre Berthelet, CDRE

Le Professeur Panayotis Soldatos comparait il y a peu l’Union européenne à Prométhée enchaîné par les Etats membres. Ces réflexions mettant en évidence une construction européenne dépendante des États, « dont les élites politiques, écrit-il, se refusent à admettre la réalité de l’obsolescence de la souveraineté nationale », s’illustrent parfaitement avec l’adoption par le Conseil de la stratégie européenne de sécurité intérieure pour la période 2015-2020.

À première vue, la sécurité intérieure vient de franchir un pas supplémentaire dans l’intégration avec l’approbation par le Conseil le 16 juin 2015, de conclusions renouvelant et modernisant pour cinq années à venir la stratégie 2010-2014. Pour autant, il semble bien que les chaînes soient pesantes, car les États conservent la main, et de main ferme pourrait-on dire, le processus d’intégration dans ce domaine.

Ces conclusions entraînent une série de réflexions critiques quant aux conséquences institutionnelles et quant à la manière dont les États décident d’œuvrer dans la construction européenne en matière de sécurité intérieure.

Elles suscitent d’emblée des interrogations concernant l’inclusion du Parlement européen dans le processus décisionnel lié au déroulement du cycle, ainsi que sur la préservation accrue des droits fondamentaux (1). La stratégie ne fait pas véritablement l’impasse sur ces deux questions, car elle les mentionne en soulignant l’importance de ces problématiques. Cependant, l’observateur ne peut que demeurer sur sa faim quant aux modes d’inclusion du Parlement européen, et à la manière dont les droits fondamentaux ont vocation à être davantage pris en compte, alors que le Conseil semble précisément se focaliser davantage sur la sécurité que sur la liberté. Cette stratégie pour la période 2015-2020, justifiée par la permanence des menaces, voire leur accroissement, en premier lieu, le terrorisme et la grande criminalité organisée (p. 2 des conclusions du Conseil du 16 juin), est qualifiée par le Conseil de « globale et réaliste » (p. 5). Son adoption mérite d’être saluée à ce titre, car elle confère une certaine cohérence à une action qui dépasse les frontières de l’espace de liberté, de sécurité et de justice, pour comprendre des thématiques telles que la gestion de crise, la protection des infrastructures critiques et la cybersécurité. Pour autant, en l’examinant de plus près, cette stratégie pour la période 2015-2020 n’apparaît pas exempte de toutes critiques. Il est vrai qu’elle est bien plus précise concernant les priorités fixées par la stratégie précédente qui avait, par exemple, érigé la « lutte contre la violence en elle-même » en un objectif de sécurité de l’Union.

En revanche, elle l’est moins que le plan d’action venant compléter cette stratégie de 2010 et ce, en raison de l’ambiguïté des objectifs fixés par la stratégie européenne pour la période 2015-2020 (2). Il est même possible de considérer que la stratégie de 2015 est de moins bonne facture que la précédente, car il s’agit à la fois d’un document opérationnel, mais qui n’en est pas réellement un, et d’un document stratégique, mais qui n’en est pas réellement un non plus. De prime abord, elle se positionne à mi-chemin entre d’une part, des conclusions des 4 et 5 décembre 2014 qui énoncent les grands principes, et d’autre part, un plan d’action destiné à lister des mesures concrètes. Néanmoins, sa portée se révèle être bien plus opérationnelle que stratégique, car le plan d’action à venir, visant à mettre en œuvre cette stratégie censée, comme son nom le laisse supposer, être un document de nature stratégique, est réduit à la portion congrue (3).

Si le positionnement de la stratégie est complexe sur le plan normatif, il l’est beaucoup moins sur le plan conceptuel dans la mesure où la stratégie de 2015 demeure, comme celle de 2010, très empreinte d’une idéologie de la sécurité globale (4). Elle révèle certes, le peu d’audace de la part du Conseil concernant les avancées en matière de sécurité, reflétant le double discours habituel des États, très volontaires dans les déclarations d’intention, mais beaucoup moins dans la concrétisation de celles-ci. En revanche, elle suscite des interrogations quant aux relations qu’entretiennent la sécurité intérieure et l’espace pénal européen et ce, en raison de la place faite à la doctrine relative à la sécurité globale (5). L’un et l’autre se construisent de manière séparée et même dans l’ignorance mutuelle. La stratégie révèleà ce propos un monde de la sécurité (police, douane, garde-frontières) dont l’horizon d’action est davantage marqué par une collaboration avec celui de la sécurité et de la défense, qu’avec celui de la justice.

1. Une impasse sur le Parlement européen et sur les droits fondamentaux ?

Continue reading “Les lourdes chaînes de Prométhée, réflexions critiques sur la Stratégie européenne de sécurité intérieure 2015 – 2020”

Privacy and Data Protection Implications of the Civil Use of Drones

IN DEPTH ANALYSIS FOR THE EP CIVIL LIBERTIES COMMITTEE (LIBE)

by Ottavio MARZOCCHI  (Policy Department  C: Citizens’ Rights and  Constitutional  Affairs European  Parliament )

EXECUTIVE SUMMARY

Drones (also called RPAS, Remotely Piloted Aircraft Systems, or UAV, unmanned aerial vehicles)  are  aircraft   without  a  human  pilot on board,  which are  guided  by a  remote pilot.
Drones have been developed for military use but are now increasingly used for civil purposes. Currently drones are employed for critical infrastructure and civil protection, disaster management and search and rescue, environmental protection, law enforcement and surveillance, journalism, commercial activities and leisure, while it is foreseen that in the future they will also be employed for other missions, such as agriculture, energy, transport  of goods  and  cargo  – and  even  of people.

States plan to increase their use of drones, while industry, small and medium enterprises and private companies have a growing interest in the manufacturing, selling and use of drones to monitor their activities or provide goods and services to clients. Being currently available on the market at affordable prices, their use by private individuals has  increased   exponentially.

The current and prospective development of drones has a series of positive impacts, notably for employment, SMEs and industrial development, and has a potential to generate growth and jobs. Drones can carry out operations in emergency situations, where human intervention is either impossible or difficult (drones could help save lives in operations of humanitarian relief, search and rescue at sea, when nuclear accidents or natural  disasters  occur,  etc).
As with any technology, there are also risks to be taken into serious account by stakeholders, regulators, institutions and citizens in order to prevent, minimize and counter the potential negative impacts of some applications of drone technology. This is especially the case in the absence of proper regulation or/and when drones are used in illegal,  unsafe or irresponsible  ways.

In terms of risks for privacy and data protection, drones normally carry video-cameras to allow pilots to fly them. These images can be easily recorded and stored, and are often uploaded onto the internet. The privacy of private life and property can be interfered with and violated when drones capture images of people in their houses or gardens. A series of other applications and payloads can also be installed on drones, allowing the gathering and processing of personal data and seriously interfering with and potentially violating citizens’ rights to privacy and data  protection1.

In terms of security and safety, drones pose a series of considerable and serious risks. As reported by the media, drones have been spotted over airports or close to them, disrupting or/and threatening civil aviation; have crashed on the ground; have been flown over critical infrastructure, embassies or tourist attractions; have injured people. The prospective increase in the number of drones flying at different heights (including in the space currently reserved for civil aviation), in different directions (drones normally change    direction    multiple    times,    on    the    basis    of    pilots’    orders)    and    areas,    with    different weights and speeds, over people and private properties, poses serious challenges. The technological environment to ensure the secure and safe integration of drones in the civil aviation system does not yet seem ripe, as communications can be easily lost or hijacked, the detect and avoid systems are not by default installed on drones and systems to block their access into no-fly zones (geo-fencing) are not in place. Responsibility and liability for drones’ use is not yet guaranteed, as identification of the owners or pilots is not required in most EU MS, making transparency or law enforcement action almost impossible.

Potentially, the positive applications of drones (e.g. for fire-fighting; or nuclear plan inspection) can be nullified by negative applications (e.g. private drones flying around and impeding quick fire-fighter intervention, as happened in Norway; or private drones flying over the nuclear power plant, or even crashing on it). These elements show that drones pose a series of challenges and concrete risks for safety, security and the fundamental rights of persons, which are to be addressed seriously.

The exponential development and spread of drones challenges policy makers to regulate them and their use by balancing the will to support drones’ positive potential for the economy while preventing, minimizing and countering the negative impacts and the risks illustrated above. A series of initiatives at international, European and national level are currently underway to respond to this challenge.

The European Commission has worked in recent years to promote RPAS integration into the European civil aviation airspace (“non-segregated air traffic management environments”). The next steps in the process will be the development of safety rules by EASA during 2015. Based on this, the Commission will issue a package containing a revision of the basic European Civil Aviation Safety Regulation (currently under impact assessment) possibly in 2015 to allow the integration of drones from 2016 onwards.

The Commission has identified priority areas where the EU could play a leading or coordinating role, notably by developing a regulatory framework to guarantee safety; fostering enabling technologies; security; protecting citizens’ fundamental rights (privacy and data protection); guaranteeing third party liability and insurance; supporting market development and emergence and promoting the European RPAS industry and its competitiveness. EASA and the Council, as well as MS regulations, seem to go broadly in the same direction.

This research finds that:

  • In order to ensure that the EU can regulate drones regardless of their weight, it is necessary to modify EC Regulation 216/2008 and notably its Annex 2, which currently limits the scope of EU action to RPAS weighting more than 150 kg. Once this has been done, the current regulations and laws adopted at national level will have to be modified on the basis of the future EU regulatory regime, which might be based on a new “proportionate to the risk” approach;

. Notwithstanding the fact that interferences to privacy and data protection can be particularly serious when drones are used to collect personal data for law enforcement purposes and surveillance activities, EU data protection law does not currently cover this area (except when such data is exchanged amongst Member States). Activities by private individuals are excluded from the application of the DP Directive due to the “household” exception, but it seems likely that the capturing and processing of personal data carried out by drones in public spaces could be subject to EU data protection law, following the ECJ jurisprudence on CCTV. In these areas, it is primarily for Member States to ensure that privacy and data protection guarantees apply; looking forward, the approval of the Data Protection Regulation and Directive will bring a positive contribution in terms of impact assessments, privacy by design and privacy  by default,  as  these  will  become mandatory;

Citizens’ right to security and safety of citizens does not seem to be fully guaranteed across the EU and by all MS in relation to drones and their use, while enabling technologies are still in development; law enforcement action is virtually impossible as rules on identification of drones and of their operations, responsibility and liability are not  yet  in  place everywhere;

The whole “drones’ chain” should be more closely examined in terms of current and future EU and/or MS regulation needed to minimize or counter risks for citizens and to their rights, from manufacturing and trade (production, selling, buying, internal and international trade, notice for buyers on risks and hazards and applicable rules or legislation for flying drones), to safety (airworthiness, pilot licences, operation authorisation, identification and monitoring of drones and of their flights, establishment of no-fly zones such as critical infrastructures, airports, cities and villages, gatherings, rules that should be followed when operating a drone, for instance visual line of sight, private properties, etc), privacy and data protection rules, as well as laws related to criminal behaviour, intellectual property, aviation, environmental law that are to be respected by drones, security (regulations and measures to ensure that law enforcement action against illegal and unsafe use of drones is possible, responsibility and liability for damage to persons or property as a result of an incident caused by an RPA).

The debate on the future regulatory regime for drones, which has been mainly carried out up to now between industry, stakeholders, technical regulators and working groups (be it at the national, European and international level), should involve more closely both citizens and legislators. Consultations on future options should be carried out, so to take into account citizens’ views and concerns, while legislators should be the ones to take decisions on regulation, given the risks posed by drones. This is the only way to ensure that “public acceptance” of, or “societal concerns” in relation to, drones are addressed and resolved, though the open and democratic debate and  scrutiny.

In order to achieve these objectives at the EU level and ensure a more transparent and democratic debate on the future policy on drones, the EP could ask the Commission report in detail and in straightforward terms, for instance in its upcoming impact assessment, about which actions it plans to undertake in the “drones’ chain” to ensure that the objectives of safety, security, respect of fundamental rights, namely privacy and data protection, environment, responsibility and liability, law enforcement action, insurance, identification and transparency, technological development, can be achieved, with recommendations for MS and/or EU action, and possible options. A description of the regulatory approaches in MS should also be provided, so to allow a comparison and to identify best practices. It should also report about the past, present and future use of EU funds for drones development, and on how funds for civilian uses and military/defence uses of drones interact. A yearly reporting mechanism would also be useful, and could also address the causes and possible remedies to deal with drones’ incidents.

1 For instance: high power zoom, facial recognition, behaviour profiling, movement detection, number plate recognition, thermal sensors, night vision, radar, see-through imaging, Wi-fi sensors, microphones and audio-recording systems, biometric sensors to process biometric data, GPS systems processing the location of the persons filmed, systems to read IP addresses and track RFID devices, systems to intercept electronic communications.

CONTINUE READING THE FULL REPORT HERE
 

US CONGRESSIONAL RESEARCH SERVICE: Overview of Constitutional Challenges to NSA Collection Activities

FULL REPORT ACCESSIBLE HERE (May 21, 2015)

by Edward C. Liu Legislative Attorney, Andrew Nolan Legislative Attorney and  Richard M. Thompson II Legislative Attorney

Summary

Beginning in summer 2013, media reports of foreign intelligence activities conducted by the National Security Agency (NSA) have been widely published. The reports have focused on two main NSA collection activities approved by the Foreign Intelligence Surveillance Court (FISC) established under the Foreign Intelligence Surveillance Act (FISA) of 1978. The first is the bulk collection of telephony metadata for domestic and international telephone calls. The second involves the interception of Internet-based communications and is targeted at foreigners who are not within the United States, but may also inadvertently acquire the communications of U.S. persons. As public awareness of these programs grew, questions about the constitutionality of these programs were increasingly raised by Members of Congress and others. This report provides a brief overview of these two programs and the various constitutional challenges that have arisen in judicial forums with respect to each.

A handful of federal courts have addressed the Fourth Amendment issues raised by the NSA telephony metadata program. FISC opinions declassified in the wake of the public’s awareness of the NSA telephony metadata program have found that the program does not violate the Fourth Amendment. Similarly, in ACLU v. Clapper, the federal District Court for the Southern District of New York held that a constitutional challenge to the telephony metadata program was not likely to be successful on the merits. On appeal, the United States Court of Appeals for the Second Circuit refrained from reaching the merits of this Fourth Amendment challenge, but instead resolved the case on statutory grounds, holding that the metadata program exceeded statutory authorization under Section 215 of the PATRIOT Act. However, the panel did engage in a general discussion about the Fourth Amendment principles implicated by this program, including the effect of modern technology on American’s expectations of privacy. Both the district courts for the Southern District of California and the District of Idaho have found the bulk metadata program constitutional under existing Supreme Court precedent. In Klayman v. Obama, the federal District Court for the District of Columbia held that there is a significant likelihood that a challenge to the constitutionality of the NSA telephony metadata program would be successful.

Constitutional challenges to the NSA’s acquisition of Internet communications of overseas targets under FISA have arisen in a number of different contexts. First, such challenges have arisen in both the FISC and the Foreign Intelligence Surveillance Court of Review as part of those courts’ roles in approving the parameters of these collection activities. Secondly, constitutional challenges have been brought in traditional federal courts as civil actions by plaintiffs asserting an injury or in criminal proceedings by defendants who have been notified that evidence against them was obtained or derived from collection under Section 702. While the FISA courts have at times curbed the government’s ability to engage in surveillance activity to ensure compliance with the Fourth Amendment, the one federal court to address the issue has upheld the program against constitutional challenge.

CONTINUE READING HERE

 

 

COE Human Rights Commissioneer : Reinforcing democratic oversight of security services cannot be further delayed

Strasbourg, 5 June 2015 – “The current systems of oversight of national security services in Europe remain largely ineffective. Revelations over the last years about security operations which have violated human rights should have prompted reforms in this field, but progress has been disappointingly slow. European countries must now ensure more democratic and effective oversight of what their security services do and avoid future operations leading to new human rights violations,” said today Nils Muižnieks, Commissioner for Human Rights, while presenting a report on this topic.

The report intends to provide guidance to strengthen human rights protection in the field of security services. It sets forth a number of measures necessary for making national oversight systems more effective and the security services accountable and fully compliant with human rights standards.  “Security service activities impact a variety of human rights, including the right to life, to personal liberty and security, and the prohibition of torture or inhuman, cruel and degrading treatment. They also impinge on the right to privacy and family life, as well as the rights to freedom of expression, association and assembly, and fair trial. It is therefore crucial that security services uphold the rule of law and human rights in undertaking their tasks.”

Council of Europe member states have taken diverse approaches to oversight, which include parliamentary committees, independent oversight bodies, institutions with broader jurisdictions such as ombudspersons, data commissioners and judicial bodies. However, none abides fully to internationally established norms. Drawing upon international and European standards and national practices, the paper sets out the most significant objectives and overriding principles that can enable more effective oversight of security services. “It is necessary to keep oversight democratic, primarily through the involvement of parliaments. It is also crucial to ensure prior authorisation of the most intrusive measures, including surveillance, and to establish a body able to issue legally binding decisions over complaints by individuals affected by security activities, as well as to access all intelligence-related information,” said the Commissioner.

“Security services exist to protect our democracies. Their work is fundamental to ensure that we all can live in security. This paper intends to show how their activities can be best sustained by policies which ensure their lawfulness and accountability. Ensuring that security agencies operate under independent scrutiny and judicial review does not reduce their effectiveness. On the contrary, governments would increase their credibility among the public and weaken support for anti-democratic causes if they show as much resolve in safeguarding human rights as in fighting terrorism.”

The executive summary and the Commissioner’s recommendations are also available in French and German. Translations into Turkish and Russian are under way.

To read more about the Commissioner’s work on counter-terrorism and human rights, please visit this page.

Press contact in the Commissioner’s Office:
Stefano Montanari, + 33 (0)6 61 14 70 37; stefano.montanari@coe.int
www.commissioner.coe.int; Twitter: @CommissionerHR; Facebook; youtube
 
The Commissioner for Human Rights is an independent, non-judicial institution within the Council of Europe, mandated to promote awareness of, and respect for, human rights in the 47 member states of the Organisation. Elected by the Parliamentary Assembly of the Council of Europe, the present Commissioner, Mr Nils Muižnieks, took up his function on 1 April 2012