EU battle lines drawn as security challenge to data privacy grows

The European Parliament is advising citizens and businesses to use encryption regularly to protect against snooping from a powerful…

The European Parliament is advising citizens and businesses to use encryption regularly to protect against snooping from a powerful American and British electronic surveillance system called Echelon.

Conceived in the Cold War era, Echelon is a satellite- and land -based spying network that can reportedly monitor billions of phone calls, e-mails and faxes and search for specific words. The parliamentary report on Echelon, released this week, is the first official government document to acknowledge the existence of the system, which has been denied for decades by the US and Britain.

After extensive hearings on Echelon, in which security experts and former intelligence service members testified to the European Parliament, MEPs have concluded that the primary purpose of Echelon is to "intercept private and commercial communications and military communications".

At the same time, the European Union's strong privacy protections are under siege by a secret Council of Europe recommendation that member-states should make communications data available to law enforcement agencies. The recommendation suggests member-states should require Internet service providers and network operators to copy and archive all communications data from phone calls, e-mails, faxes, Internet usage and websites for at least a year in case security agencies want to search them.

READ MORE

The recommendation comes at the request of security agencies, which claim they cannot combat cyber-crime without the provisions being included in all future EU legislation. The proposal is contained in EU documents obtained by British privacy advocate group Statewatch (www.statewatch.ort), which leaked an early draft version of Echelon report.

Similar provisions have been included in past draft versions of proposals entitled ENFOPOL and have been strongly opposed by Europe's data protection commissioners and privacy and civil rights organisations.

"All the protections for personal freedom and privacy put in place through international data protection rules and privacy Directives would be fatally undermined at a stroke," said a report on the matter by Statewatch.

"Authoritarian and totalitarian states would be condemned for violating human rights and civil liberties if they initiated such practices. The fact that it is being proposed in the `democratic' EU does not make it any less authoritarian or totalitarian," said Mr Tony Bunyan, Statewatch editor, in a statement.

According to Irish Data Protection Commissioner Mr Joe Meade, security agencies initially proposed that all data be held for seven years and that they be given "unfettered access" to all stored information. "What was being proposed was basically to overturn all the data protection provisions," said Mr Meade. "Every police force could snoop at will. For the 2 per cent of people committing crimes, the other 98 per cent were in effect being targeted."

Opponents feared law enforcement could use the data to go on "fishing expeditions" for incriminating evidence. Under existing data protection law, data may be held for four to six months but only for billing purposes. Law enforcement can gain access to stored data but only for a specific criminal investigation and with proper warrants, said Mr Meade.

The seven-year proposal was watered down in later drafts, but privacy advocates such as Statewatch, Privacy International and the American Civil Liberties Union believe the EU could attempt to expand the 12-month time frame once data protection provisions are thrown out.

Already, Belgium is recommending that data be held for "at least" 12 months and, along with Britain and France, has put in motion plans to approve a 12-month holding period, according to Statewatch.

At the same time, an EU parliamentary report notes that most EU countries do not have adequate supervision of their intelligence services and acknowledges that the privacy of Europeans could be severely compromised. The report notes that Ireland has only the occasional supervision of Dail standing committees and no permanent, independent body to monitor intelligence services.

"The situation for European citizens in Europe is unsatisfactory. The powers of national intelligence services in the sphere of telecommunications surveillance differ very substantially in scope, and the same applies to the powers of the monitoring committees," according to the report.

"Not all those member states which operate an intelligence service have also set up independent parliamentary monitoring bodies endowed with the appropriate supervisory powers. A uniform level of protection is still a distant objective."

Karlin Lillington

Karlin Lillington

Karlin Lillington, a contributor to The Irish Times, writes about technology