Tag National Security

New article about Commercially Available Information and OSINT

jjoerlemans

Our article “Balancing National Security and Privacy: Examining the Use of Commercially Available Information in OSINT Practices”, co-authored by myself and Sander Langenhuijzen, is now published in open access in the International Journal of Intelligence and CounterIntelligence! Of course, a .pdf is also available. You can also listen to the automatically generated podcast below, which I created with Google’s Notebook LM.

Summary

In our article, we critically examine how intelligence and security services utilize commercially available information from OSINT tools and consider its impact on data protection rights. Our analysis builds on the work of the Dutch oversight committee on intelligence and security services and the U.S. Office of the Director of National Intelligence.

It was fascinating to discover that while this OSINT practice is seen as a national security threat in the United States, it is perceived more as a privacy threat in continental Europe (particularly in the Netherlands). Despite these differing perspectives, the recommendations from oversight authorities and existing legal provisions on lawful information processing are remarkably similar.

We propose the following four steps to ensure necessary safeguards are in place to prevent the abuse of personal information in modern OSINT practices:

  1. Prior to using OSINT tools or acquiring commercially available information, intelligence and security services must be aware: (a) how data are processed, (b) what data are processed, and (c) why the data are processed, in order to identify risks of abuse of these data. In other words, intelligence and security services should first assess their impact in a data protection impact assessment and take measures to mitigate risks.
  2. The intelligence community should set up standards and procedures and implement safeguards, such as identifying the need for and value of the use of these data (while balancing this with the impact on fundamental rights), analyze the vendor and data quality, apply acquisition mechanics (such as procurement procedures), and periodically evaluate these standards. Then, intelligence and security services should implement safeguards when processing commercially available information, such as data minimization approaches and techniques, as well as limits on retention, access, querying, other use, and the dissemination of commercially available information.
  3. OSINT practitioners must be appropriately educated and brought up to speed with the “do’s and don’ts” with OSINT tools. Intelligence and security services should periodically evaluate their policy and guidelines and review their practices.
  4. An independent and effective oversight authority should scrutinize whether legislation and internal policies are respected.

Finally, we suggest that the use of commercially available data in other contexts, especially in the cybersecurity and the financial sector, warrants further research.

The necessity of a new cyberlaw for dutch intelligence and security services 

jjoerlemans

Growing cyber threats to Dutch national security reveal an urgent need to amend current  powers of intelligence and security services. The proposed “Cyber Act” aims to address these challenges by granting bulk interception and hacking capabilities, and by allowing for greater flexibility in the oversight process. However, further clarification is needed on the scope of the Act.

In my opinion, there is an urgent need for a new bill that amends the bulk interception and hacking powers of Dutch intelligence and security services. In this blog post, I share the essential points that I presented during a ‘round table hearing’ at the Dutch parliament on 5 April 2023. My original contribution (in Dutch) can be found here.

The (cyber)threat

The cyberthreat the proposed legislation aims to address should be completely clear. The Dutch General Intelligence and Security Service (AIVD) first reported about ‘digital infringements on Dutch vital ICT infrastructures’ in 2007. This message highlighting the risks of digital espionage to our national security has been reiterated in every annual report since 2013. These reports explicitly mention various victims of digital espionage, including Dutch ministries, telecom providers, universities, educational institutions, think tanks, and biotechnology companies.

Our Military Intelligence and Security Services (MIVD), as well as the National Cyber Security Centre (NCSC), have echoed these concerns. In fact, the NCSC considers the threat posed by ‘state actors’ to cybersecurity as the most significant among all threats, surpassing even the threats posed by criminal actors. 

The problem

In 2021, the Dutch intelligence and security services raised concerns regarding challenges they encountered in their cyber operations. These issues primarily stem from the “legality review” process conducted by the newly established Investigatory Powers Commission (TIB). The TIB is responsible for granting or denying warrants for investigatory powers, including bulk interception and hacking.

The proposed Cyber Act  

To address these challenges, a bill has been introduced, which I refer to as the ‘Cyber Act’. This proposed legislation specifically addresses bulk interception and hacking capabilities and proposes significant changes to the oversight system in the Netherlands. It is crucial to emphasise that the scope of the bill is limited to operations conducted by Dutch intelligence and security services that target the gathering of intelligence related to “offensive cyber operations of foreign states”. 

The aim of the proposed bill is to amend and partially shift the oversight of bulk interception and hacking as investigatory powers from the Investigatory Powers Commission (TIB) to the Dutch Review Committee on Intelligence and Security Services, allowing for greater flexibility for intelligence and security services. It seeks to establish a more dynamic oversight process that aligns with the technical realities of these powers. 

It is also noteworthy that the proposal grants the Dutch Review Committee on Intelligence and Security Services the (binding) power to halt an operation and (ultimately) order the deletion of unlawfully processed data when specific investigatory powers are employed. Currently, this oversight body lacks any binding authority in its task of overseeing intelligence and security services. Additionally, the proposed legislation introduces an appeals procedure for decisions made by the Dutch oversight bodies, enabling a judge to make the final determination regarding the legality of actions and decisions. 

Bulk interception 

Bulk interception serves as a notable example that illustrates how investigatory powers are amended in the Cyber Act. One significant challenge in the current application of bulk interception as an investigatory power is the disagreement between the intelligence and security services (and their responsible ministers who authorise these powers) and the Investigatory Powers Commission (TIB) regarding the level of focus that should be applied to bulk interception.

It is important to clarify that bulk interception is inherently non-targeted in nature. It involves the interception of large volumes of data (bulk) after it is collected at a specific location. This process differs from, for instance, wiretapping. With wiretapping, data associated with a particular identifying number, such as a telephone number or IP address is intercepted. Bulk interception captures a greater volume of data, including unidentified numbers that may be connected to potential national security threats. In a cybersecurity context, bulk interception can be used to collect intelligence about the IT infrastructure utilised by foreign actors engaging in covert activities on Dutch infrastructure.

The Cyber Act aims to do more justice to the untargeted nature of bulk interception, but solely within the context of gathering intelligence related to the threat of offensive cyber operations conducted by state actors that pose a risk to national security. While the bill includes numerous detailed provisions, which I will not delve into here, I believe the arguments put forth in support of the proposals are compelling. Therefore, it is in my view necessary to amend the law. In fact, I think we should consider an even more substantial role for intelligence and security services in combating cybersecurity threats.

Addressing the threat of cybercrime to national security

The issue of cybercrime posing a threat to national security deserves attention. I emphasised that the Dutch National Security Centre identified ransomware as a national security threat. I agree with this assessment, insofar ransomware attacks have severe economic consequences or disrupt vital infrastructures. Regrettably, we have already witnessed ransomware incidents targeting the Port of Rotterdam, hospitals, and municipalities in the Netherlands.

In the Netherlands, there is a strict separation between the investigation of criminal activities and the investigation of national security threats. It is evident to me that the Dutch Intelligence and Security Services should investigate ransomware attacks that pose a risk to national security. However, it remains unclear whether such investigations are currently being carried out. While the Dutch Cyber Act appears to primarily focus on state actors, I would appreciate clarification on whether it also encompasses ransomware activities conducted by criminal organisations.

This is a cross-post from my blog post on aboutintel.eu. It is part of a discussion prompt about the ‘Dutch Temporary Cyber Act‘, with contributions of Lotte Houwing and Bert Hubert.

National security and the processing of personal data

jjoerlemans

On 10 October 2018, ‘Convention 108’ of the Council of Europe regarding the ‘automatic processing of personal data’ (1985) was updated. Convention 108+ now explicitly incorporates the processing of personal data in a national securitycontext. The Netherlands signed Convention 108+ on 10 October 2018 and is now in the ratification process.

Surprisingly, Convention 108+ did not gain much attention yet. For the Netherlands, the treaty may bring changes to current legislation, because it provides more stringent regulations for the processing of data in a national security context and possibly provides for broader powers for oversight authorities.

Processing data in a national security context within the EU
Convention 108+ contains basic principles and provisions for processing personal data, as well as standards regarding oversight mechanisms and the international transfer of data. Many provisions are similar to the General Data Protection Regulation (GDPR).

However, the GDPR does not apply to national security and intelligence agencies. The European Union (EU) has no competence to regulate national security law for EU Member States. As a result, regulations for processing data in a national security context differ across the EU.

Convention 108+ may bring more harmonisation of the regulations for processing personal data and oversight mechanisms. The treaty enters into force on 11 October 2023 if there are 38 Parties to the Protocol amending Convention 108. So far, 36 States have signed the new Convention but only six have ratified.

Stricter regulations for processing data
Convention 108+ encompasses many basic principles of data processing, such as the principle of processing data (a) for specified and legitimate purposes; (b) adequate, relevant and not excessive in relation to the purposes for which they are stored; (c) accurate and, where necessary, kept up to date; and (d) no longer stored than necessary (see article 5 of Convention 108+). In addition, categories of sensitive data are identified (and updated in the new protocol) and data subjects gain certain rights (such as the right to be informed and the right to request rectification when informed).

In a national security context (similar to a law enforcement context) some principles do not apply or apply differently, such as the right to be informed of data processing and limitations to the notification principle. It is understandable, that some limitations to the notification principle apply. For instance, when so-called ‘targets’ (in a national security context) or ‘suspects’ (in a law enforcement context) are informed about the processing of their data, they know they are of interest to these national authorities and may then change their behaviour to continue their harmful activities without being detected.

The updated Convention 108+ strengthens the data processing regulations in a national security context. For example, the new Convention does not differentiate levels of protection afforded to a State’s own citizens or foreigners with regard to transborder flows of personal data (adjusted in article 14 of Convention 108+). Some States do apply this differentiation in their national security legislation. In addition, compared to Dutch legislation for national security and intelligence services, the Convention entails a broader definition of ‘sensitive data’, for which stricter regulations apply to process this type of data.

Oversight powers
Convention 108+ may bolster supervision of data processing activities in a national security context. Some oversight bodies for national security and intelligence agencies have access to data located at these agencies and some can even halt unlawful data processing activities. Convention 108+ demands that oversight bodies for data processing activities are independent (similar to the judiciary or a judicial body) and effective. Based on article 15 and 16 of the Convention, to be effective an oversight body must have the power to intervene, such as the possibility to halt data processing activities or even order that unlawfully processed data be deleted.

The new Convention allows for limitations to these far reaching powers in the field of national security and defense, provided that it is done ‘by law and only to the extent that it constitutes a necessary and proportionate measure in a democratic society to fulfill such an aim’. Granting oversight bodies such far reaching powers is a big step, because the fear of States may be that their security and intelligence services will no longer have pieces of information that may be relevant in the future to secure national security (for example to prevent a terrorist attack). However, from the perspective of protecting human rights, it can be argued that this step is part of the requirement of effective review and supervision of intelligence and security services, as interpreted in the jurisprudence of the European Court of Human Rights (ECHR) and pursued by the new Convention 108+.

Now what?
What does this mean for processing personal data for the purpose of national security? For the Netherlands, it means the provisions of Convention 108+ must be implemented in national law. This requires some changes, for example with regard to the aforementioned category of ‘sensitive data’. In addition, the Dutch oversight body for intelligence and security services does not have the binding power to intervene in unlawful data processing activities. The Dutch government must address this issue and decide which changes to law are desirable.

We welcome Convention 108+ because it brings more harmonisation to the regulations for processing data in a national security context and may strengthen oversight bodies for national security and intelligence agencies for States that ratify Convention 108+. It protects the individuals involved in the processing of personal data and provides more legal certainty with regard to the applicable rights and regulations. We look forward to contributing and monitoring the implementation of the treaty throughout the world.

Jan-Jaap Oerlemans & Mireille Hagens

This is cross post from the Montaigne Centre Blog.