FC: Europe weighs recording all phone calls, Net traffic for 7 yrs

[Declan McCullagh <declan@well.com>]

---
News coverage:
http://www.theregister.co.uk/content/5/19003.html
The Council of the European Union, which represents the 15 member 
governments, will discuss implementing a policy originally designed with 
the FBI six years ago. It calls for the retention of "every phone call, 
every mobile phone call, every fax, every e-mail, every website's contents, 
all internet usage, from anywhere, by everyone, to be recorded, archived 
and be accessible for at least seven years," notes the journal.
---

Date: Thu, 17 May 2001 01:48:42 +0100
To: declan@well.com
From: Tim Dedopulos <tim@midnight.demon.co.uk>
Subject: Any interest -- EU to open 7yrs full data retention to police
In-Reply-To: <20010515174103.B20430@cluebot.com>

Hi Declan.

Is the following Statewatch report of any interest to you for Politech? It 
basically details European Union plans to (a) mandate the recording and 
storage of all telecoms data within the EU for seven years and (b) to give 
law enforcement agencies more or less free access to that data... (quote: 
"The EU governments are, in effect, to tell the European Commission (and 
European Parliament) that the demands of the law enforcement agencies take 
precedence over the privacy and freedoms of people.")

Very worrying for those of us on this side of the pond.

Tim.

---


http://www.statewatch.org/news/2001/may/03Benfopol.htm

investigation, full report: EU-FBI telecommunications surveillance system

EU governments to give law enforcement agencies access to all 
communications data


The new initiative by the EU governments to back the demands of their law 
enforcement agencies (LEAs) only came to light when Statewatch "acquired" a 
series of EU documents which it had been refused access to. The documents 
in question were refused on the grounds that:

"the matter was still under discussion..[and] disclosure of these document 
could impede the efficiency of the ongoing deliberations."

The demands of the law enforcement agencies centre on the issue of "data 
retention", that is the recording and storage of all telecommunications data:

- every phone call, every mobile phone call, every fax, every e-mail, every 
website's contents, all internet usage, from anywhere, by everyone, to be 
recorded, archived and be accessible for at least seven years

The move by the EU governments (the Council of the European Union) has been 
sparked by a draft proposal put forward by the European Commission on "the 
processing of personal data and the protection of privacy in the electronic 
communications sector" (COM(2000)385 final, 12.7.00). The proposal would 
update Directive 97/55/EC but is not "intended to create major changes to 
the substance of the existing Directive", merely to "update the existing 
provisions". The proposal thus builds on the principles of the 1997 law and 
data protection rules established in EU community law.

Also under discussion is a related Communication from the Commission on 
"Creating a Safer Information Society by improving the security of 
information infrastructures and combating computer-related crime 
(COM(2000)890 final) (see Statewatch, vol 11 no 1). Here the Commission, in 
line with community law, emphasises that: "interceptions are illegal unless 
they are authorised by law when necessary in specific cases for limited 
purposes".

The EU-FBI surveillance plan comes home

The EU adopted the "Requirements" developed by the FBI on 17 January 1995 - 
the "Requirements" set out demands on network and service providers to 
provide the law enforcement agencies with both data from intercepted 
communications and real-time access to transmissions (see Statewatch, vol 7 
no 1 & 4 and 5; vol 8 no 5 & 6; vol 9 no 6; vol 11 no 1).

In September 1998 the EU's Police Cooperation Working Party proposed that 
the "Requirements" be extended to cope with internet and satellite phone 
telecommunications. The initial report (ENFOPOL 98) went through several 
drafts and ended up as ENFOPOL 19 (15 March 1999) which gathered dust. It 
transpired that because of the "negative press" surrounding ENFOPOL 98, 
which coincided with exposures on the ECHELON spying system, there was a 
lack of "political support" to move forward on the issue (report on the 
Police Cooperation Working Party meeting on 13-14 October 1999 by the 
European Commission).

In the spring of 2000 the EU's Police Cooperation Working Party decided 
that issues previously discussed under the title of "interception of 
telecommunications" would now be called "advanced technologies". A report 
by the same working party (ENFOPOL 52, 12 July 2000) spelled out that "an 
informal inter-pillar link" should be created between their work and that 
being carried out under the "first pillar" on the "global Information 
Society". The purpose was to bring to the attention of the 
Telecommunications Council and the Internal Market Council, working on 
technical and commercial decisions, the need to: "safeguard the possibility 
of lawful interception".

On 29 May 2000 the Convention on Mutual Assistance in criminal matters was 
agreed by EU Justice and Home Affairs Council and is now out for 
ratification by each of the 15 EU national parliaments. This includes 
provisions for the interception and exchange of telecommunications data 
based on specific requests but makes no provision for the retention of data 
(except in individual, authorised, instances).

This Convention and the work of intergovernmental groups, like ILETS 
(International Law Enforcement Telecommunications Seminar) and the G8 Sub 
group on High-Tec Crime, and the adopted 1995 "Requirements" provide the 
basis for provisions in new national laws on the interception of 
telecommunications across the EU - for example the UK's Regulation of 
Investigatory Powers Act (R.I.P. Act) which came into force on 28 July 2000.

All of these new legal powers and demands on the network and services 
providers under the "Requirements" do not, however, give the law 
enforcement agencies everything they need as they only cover the exchange 
and interception of data on the production of an "interception order" (eg: 
warrants under national laws). None of them provide for the wholesale 
retention of data and access to it by law enforcement agencies except in 
specific authorised cases.

EU Data Protection officials come out against data retention

Data Protection Commissioners in the EU and their officials, who attend a 
multitude of working parties, have long been aware that the "law 
enforcement agencies" in quasi-secret international fora have been arguing 
not for data to be retained for 30 days or 90 days (as it is currently for 
billing purposes) but for much longer - for up to seven years at least. In 
her annual report for 2000 the UK Data Protection Commissioner, Elizabeth 
France, said: "The routine long-term preservation of data by ISPs [internet 
service providers] for law enforcement purposes would be disproportionate 
general surveillance of communications".
The spring Conference of European Data Protection Commissioners in 
Stockholm, 6-7 April 2000, issued a declaration on the "Retention of 
Traffic Data by Internet Service Providers" saying:

"such retention would be an improper invasion of the fundamental rights 
guaranteed to individuals by Article 8 of the European Convention on Human 
Rights. Where traffic data are to be retained in specific cases, there must 
be a demonstrable need, the period of retention must be as short as 
possible and the practice must be clearly regulated by law."

The meeting of the International Working Group on Data Protection in 
Telecommunications in Berlin on 13-14 September 2000 adopted a common 
position on the Council of Europe draft Convention on "cyber-crime" (see 
Statewatch vol 10 no 6). This said that the storing of "data on all 
telecommunications and Internet traffic for extended periods" is:

"disproportionate and therefore unacceptable. The Working Party underlines 
that traffic data are protected by the principle of confidentiality to the 
same extent as content data (Article 8 of the European Convention on Human 
Rights)."

The European Commission lent weight to the Data Protection officials' 
arguments in its draft proposal, put out at the end of last year (and 
agreed on 26.1.01), on "Creating a Safer Information Society by improving 
the security of information infrastructures and combating computer-related 
crime". This says that laws in EU member states have to be in line with 
community law on data protection and privacy:

"safeguards for the protection of the individual's fundamental rights of 
privacy, such as limiting the use of interception to investigations of 
serious crime, requiring that interception in individual investigations 
should be necessary and proportionate, or ensuring that the individual is 
informed about the interception as soon as it will no longer hamper the 
investigation" (p16)

On 22 March 2001 EU Data Protection Working Party also published a strong 
opinion on the Council of Europe's Draft Convention on cyber-crime. It said 
that the provision in the draft proposal which does "not oblige signatories 
to compel providers to retain traffic data of all communications should in 
no way be revised". The EU has already indicated that it will adopt this 
Convention.

The Data Protection Commissioners and others in the field have, together, 
made formidable arguments for maintaining rights and protections put into 
place in the EU during the 1990s on data protection and privacy.

Law enforcement agencies fight back

In the face this substantial opposition to the automatic retention and 
storage of content and traffic data for long periods (for longer than 
allowed under EU law, around 30 days) the law enforcement agencies needed 
heavy-weight "political support", denied earlier, from the governments of 
the EU (the Council).

A far-reaching report sent by the UK National Criminal Intelligence Service 
(NCIS) to the Home Office on 21 August 2000 set out the demands of the 
agencies which reflect the conclusions of discussions in international fora 
in which the UK plays a prominent role, such as in G8 (see Statewatch, vol 
10 no 6). The report called for the retention of all content and traffic 
data from all forms of telecommunications (phone-calls, mobile phone-calls, 
faxes, websites and internet usage) to be recorded and kept for at least 
seven years. What was of particular note is that this report was presented 
on behalf of all the UK law enforcement agencies and all the UK's security 
and intelligence agencies (MI5, MI6 and GCHQ). This suggests that while the 
primary demand is coming from the former the latter have a major stake too. 
This report was not in the public domain until December 2000.

Confirmation of a counter-attack by the law enforcement agencies emerging 
in the EU came in July 2000. As noted earlier, ENFOPOL 52 (12.7.00) from 
the Working Party on Police Cooperation had called for "an informal 
inter-pillar link" to be created between their work and that being carried 
out under the "first pillar" on the "global Information Society". This was 
the very same day, 12 July 2000, that the Commission put out its proposal 
on personal data and the protection of privacy (COM(2000)385).

The minutes of the Council's Working Party on Police Cooperation for the 
meeting on 19/20 July note a lengthy "exchange of views" with the French 
Presidency on the "relations between the first and third pillars in the 
field of advanced technologies". It also noted the Commission's proposal 
and "decided to come back to this item regularly during the next six months".

It was a report from the working party to the Article 36 Committee (senior 
interior ministry officials from the 15 EU member states) dated 31 October 
2000 which began to express the need for urgent action. This report 
(ENFOPOL 71) said six countries - Belgium, Germany, France, Netherlands, 
Spain and the UK - had "grave misgivings" about the effect of Article 6 
which effectively states traffic data "must be erased or made anonymous 
upon completion of the transmission" (emphasis in original). The provision 
would "render it impossible to trace "historical" data and seriously reduce 
the investigation services' chances of identifying perpetrators.." The 
report then tries to justify its demands by reference to: i) the 17 January 
1995 "Requirements" which it do not cover the retention of data 
indefinitely; ii) the Council of Europe draft Convention on cyber crime 
which in the latest version excludes general data retention and iii) the 
Convention on Mutual Assistance in criminal matters where data retention is 
"implied".

The report concludes by noting that the Commission's proposed measure "is 
already well advanced" and the Working Party urges the Article 36 Committee to:

"examine these observations so that it may use every available channel to 
bring this problem to the attention of the authors of the draft Directive 
concerned."

The minutes of the Article 36 Committee on 6 November 2000 state that the 
government delegations be asked to contact their colleagues working on 
"first pillar working parties to coordinate:
"the first and third pillar work in the field of advanced technologies, 
notably the telecommunications sector. It should be avoided that first 
pillar data protection measures hinder unduly thrid pillar attempts to 
monitor telecommunications connections."
The Working Party on Police Cooperation updated its report in ENFOPOL 71 
REV 1 (27.11.00) (see Statewatch, vol 11 no 1). This report states the 
demands of the law enforcement agencies starkly. While noting that their 
demands:

"would probably not be considered proportionate, as it would call into 
question the very aim of the draft Directive"

namely the protection of personal data and privacy, but it still goes on to 
argue that:

"It is impossible for investigation services to know in advance which 
traffic data will prove useful in a criminal investigation. The only 
effective national legislative measure would therefore be to prohibit the 
erasure or anonymity of traffic data."

This report urged the Article 36 Committee to "take into account the 
serious consequences the Directive would have for criminal investigations, 
public security and justice."

At a meeting on 14 December the Article 36 Committee some delegations 
(representing their governments) "advocated harmonising the period for 
storing data." The Committee decided to wait and see "how much account" the 
Commission took of delegations' (government) comments before deciding 
"whether to alert COREPER and the Council to the issue."

At the Justice and Home Affairs Council on 15 March this year, Commissioner 
Vittorino reported that at a hearing which took place on 7 March "the 
central question of the retention of traffic data dominated discussions".

However, it is clear that the Commission was not taking "much account" of 
the Council's view so that by 30 March the Swedish Presidency felt obliged 
to draw up draft Council Conclusions on the issue of data retention. The 
report recommending draft Conclusions on access by the law enforcement 
agencies to traffic data was discussed at the meeting of the Working Party 
on Police Cooperation on 6 April. The minutes of this meeting say that it:

"took note of the reservation by the representative of the Commission 
concerning the procedure followed within the Council"

Clearly the Commission was concerned that the Council was, unusually, 
considering adopting "Conclusions" which would fundamentally undermine its 
proposed Directive. The two new reports, dated 30 March (see below) were 
discussed at the Article 36 Committee meetings on 10 April and 3 May.

The key reports

The first new crucial report is ENFOPOL 29 (30.3.01) which reintroduces the 
highly criticised new definition of the "Requirements" to be laid on 
network and service providers in "ENFOPOL 98". It is intended that this 
report and an accompanying Council Resolution will go through the Justice 
and Home Affairs Council on 28-29 May.
The report looks at the "operational needs" of the LEAs as applied to the 
"Requirements" (IURs) adopted on 17 January 1995 (by the EU under "written 
procedure" and not made public until November 1996). It gives much more 
detail on their expectations than the bland "Requirements". As such it is 
an attempt to re-introduce the highly-controversial ENFOPOL 98 (and later 
drafts) which led to much adverse comment in the media (as a result of 
which it has been held up since March 1999).

The report looks at: "Applicable services" and makes clear that 
interception will cover all forms of telecommunications eg: ISDN (e-mail 
and internet usage), mobile phones and satellite phones. On IUR 
("International User Requirement") no.1 it says, like ENFOPOL 98, that the 
law enforcement agencies expect to have access not just to the call content 
but also to:

"user addresses, equipment identities, user name/passwords, port 
identities, mail addresses etc"

plus IP addresses, account numbers, logon ID/passwords, PIN numbers and 
e-mail addresses. They also want access to the "transmitted" and "received" 
data and "any telecommunications associated with.. the subject of 
interception". A redefined "IUR 1.4" states that "associated data" includes 
"conference calls, call forwarding, mobile calls, network calls, call back 
services etc" must also be provided on the intercepted subject. An ominous 
"NB" says it also includes data "where it has been retained by providers in 
accordance with the requirements of their national legislation". "IUR 1.5" 
extends the meaning of "geographical location" to "geographical, physical 
or logical" location and "IUR 1.3" again refers to "national jurisdictions" 
in the context of excluding data which is not "within the scope of the 
interception authorisation", ie: some national laws might allow the 
inclusion of "excluded" data. "IUR 6" is another direct inclusion of a 
controversial proposal taken from ENFOPOL 98. It says that the LEAs are to 
be provided with:

a. full name of the person (company)
b. the residential address and
c. credit card details

This report extends the remit for interception to: all forms of 
telecommunications (including e-mails and internet usage) and requires 
personal details on the interception subject. It also contains a number of 
references to "national jurisdictions" where, by implication, powers may be 
greater than the norm.

Some EU governments see ENFOPOL 29 ("ENFOPOL 98") as simply "technical" 
changes to the "Requirements". However, they fail to understand that it is 
precisely the details of how the "Requirements" will be used that signals 
the enormity of the threat to data protection, individual privacy and 
fundamental freedoms.

A greater, and complementary, danger is the battle between the Data 
Protection officials and the law enforcement agencies over the retention of 
data (content and traffic details) for long periods (seven years or more) 
and the right of the law enforcement agencies to access this archived data 
at will for purposes of investigating any crime however minor or for the 
purpose of intelligence-gathering - so-called "fishing expeditions".

This is the enormous significance of the "Council Conclusions" in ENFOPOL 
23 (30.3.01). The EU governments are, in effect, to tell the European 
Commission (and European Parliament) that the demands of the law 
enforcement agencies take precedence over the privacy and freedoms of 
people. Council officials will "spin" the usual line that "Conclusions" are 
not binding, but the timing of the decision and the enormity of its effect 
will brush this aside.

The draft proposal says that:

1. The obligation for operators to erase and make traffic data anonymous 
"seriously obstructs" criminal investigations;

2. It is the "utmost importance" that "access" be "guaranteed" for criminal 
investigations;

3. It calls on the European Commission to:

a) to take "immediate action" to ensure that law enforcement agencies can 
have access now and "in the future" in order to "investigate crimes where 
electronic communications systems are or have been used" (emphasis added);

b) the "action" should be "a review of the provisions that oblige operators 
to erase traffic data or to make them anonymous".

The "Conclusions" say that the Council:

1. "considers it important that the law enforcement authorities be not 
obstructed or hampered in their efforts to investigate crime, such as 
dissemination of child pornography or agitation against an ethnic group via 
the Internet"

This blatantly cynical use of "child pornography" and racism has become a 
standard justification for the extension of EU surveillance powers not just 
for these offences - but for all and any offence. These phrases have 
replaced "organised crime" and "illegal immigration", used for many years 
in a similar way.

2. "understands that on this issue.. it is important to find a solution 
that is well founded, proportionate and well-balanced"

It is not possible to "balance" the different interests. There is no need 
under EU law for commerce to keep data except for very limited periods (eg: 
30 days to check billing). The existing "Requirements" and most national 
laws allow for the gathering of data for criminal investigation in specific 
instances subject to proper authorisation and legal safeguards.

3. "emphasises the opinion of the Council that the obligation for operators 
to erase and make traffic data anonymous, besides obstructing seriously 
crime investigations, also can lead to a decreasing confidence in, 
particularly, the electronic commerce..."

The EU governments fail to understand that is precisely the erasure of data 
and anonymity which creates "confidence in electronic commerce" by 
citizens. A wholesale reversal of this policy as envisaged would indeed 
create a "crisis of confidence".

4. "invites.. the European Commission to take immediate action with the 
purpose of ensuring that the law enforcement authorities also in the future 
will have the opportunity to investigate crimes where electronic 
communications systems are or have been used.. the action to be taken 
should comprise a review of the provisions that oblige operators to erase 
traffic data or to make them anonymous; the object of the action should be 
to ensure that the purpose of limitations regarding the personal data do 
not come into conflict with the law enforcement authorities' needs of data 
for crime investigation purposes."

In effect the Council is telling the European Commission (and the European 
Parliament) that the proposed Directive on the table has to be changed and 
that all existing EU data protection and privacy laws have to be reviewed. 
It is calling for an end to the obligation, under current EU law, of 
commerce to erase data and to end anonymity and to ensure that law 
enforcement agencies have the "opportunity" to access all data held.

The next legislative steps

The urgency on the part of the law enforcement agencies is due to the fact 
that the first proposal they want changed is the Commission's proposed 
Directive on personal data and privacy in electronic communications is 
already before European Parliament committees under the co-decision 
procedure - Citizens' Freedoms and Rights (lead committee), Environment, 
Industry and Legal Affairs. These committees are due to put a report to the 
parliament's plenary session on 3 September. However, the Council is likely 
to adopt a common position at the Telecommunications Council on 27 June. 
Co-decision means all three institutions (Commission, Council and European 
Parliament) have to agree on the new measure. The Council is trying to 
pre-empt the parliament's opinion by putting forward radical changes on the 
retention of content and traffic data.

Summary: Summary
Documentation, full-text documents: Documents


back to Statewatch News online


--
                   Imagine there were two of you. Which one would win?

                                tim@midnight.demon.co.uk





-------------------------------------------------------------------------
POLITECH -- Declan McCullagh's politics and technology mailing list
You may redistribute this message freely if it remains intact.
To subscribe, visit http://www.politechbot.com/info/subscribe.html
This message is archived at http://www.politechbot.com/
-------------------------------------------------------------------------