Control Orders to be Scrapped

From BBC News: The UK Prime Minister has announced that the controversial 'Control Order' measure needs to be replaced. The statement follows mounting speculation over an alleged 'power struggle' in the Coalition - an allegation that Deputy Prime Minister Nick Clegg has denied this morning.

The Coalition Government has received praise for is being widely reported as a progressive move. However, the question of what precisely they are to be replaced with remains unresolved - a fact reported with suspicion by liberals and hope by conservatives. The Telegraph's Benedict Brogan, a conservative journalist so close to Cameron some have identified him as a potential replacement for Andy Coulson, has taken to complementing Clegg's hardheaded realism in government:

As with tuition fees, spending cuts and much else, Mr Clegg has discovered with control orders that the realities of government appear much starker from the inside. What I find striking is the effort Mr Cameron is making already to ease his deputy past what will be a difficult moment when it becomes clear – as I believe it will – that control orders have survived the review largely unscathed. The Prime Minister has decreed that he will not accept a compromise that makes it easier for the eight currently held, and any others in future, to do harm. He wants to make it possible for Mr Clegg to agree.

Actually, the Deputy Prime Minister does. This is what we must start giving him credit for, and is perhaps the most significant development of the whole affair: we are learning more about Mr Clegg’s successful transformation from a politician of opposition to a politician of government. Mr Clegg can say that he has gone from
the easy life of an Opposition Liberal to a Government Liberal. He has been confronted with some nasty choices that have left some of his colleagues and many of his supporters weak at the knees, and he has compromised where necessary in the interest of taking the right decision. In government he has discovered the facts, and his views have changed accordingly. It may look painful now, but his bet is that voters will reward him for it in 2015.

Such generosity may be an indication that the government is anticipating another politically difficult compromise for Nick Clegg.

Schneier on Web Surveillance

Security specialist Bruce Schneier has published an opinion piece on CNN. The article comes in response to reports that the Obama administration is seeking to secure law enforcement access to web-based communications data through the enactment of new legislation. See also this related post on the LegaLIFT blog.

European Union Agency for Fundamental Rights: Document on Body Scanners

The European Union Agency for Fundamental Rights published a Q&A document on the use of full body scanners last month.

It addresses the following questions:

1. Which fundamental rights are at risk of being affected by the use of body scanners?

2. Is the use of a body scanner to be considered as processing personal data?

3. How could the requirements on the design and selection of body scanners best respect rules on data protection?

4. How can body scanners be assessed from a rule of law perspective?

5. Are there specific considerations to be taken into account when selecting people to be screened?

6. Should the person to be screened be given the choice between a body scanner and other screening methods?

7. Which information should be given to persons before they choose to be screened by a body scanner?

8. How intrusive are body scanners if compared to other screening methods?

9. Is the detection capability of body scanners an added value regarding security?

10. Which conditions should apply in order to address the concerns related to fundamental rights?

Swiss Intelligence Oversight Body Cites Problems with Database

Earlier this month, Swiss media announced that the oversight body for Swiss intelligence and national security activities, the “Geschäftsprüfungsdelegation” (GPDel), had produced a negative report on the state of the Federal Intelligence Service’s information system, the ISIS-NT. According to the report, the database held entries on 50,000 people in 2001 and grew to 60,000 entries in 2004 (p. 6). Since that time, however, the database has grown to contain primary entries on 120,000 individuals plus an additional 80,000 or so “third persons”. These third persons represent individuals who have some tie to the 120,000 individuals of primary concern or to some event recorded in the database.

The GPDel expressed concern about the overall quality of the data held in the database. Based on its inspection of various sample entries, the GPDel found instances where the individuals or incidents entered into the database were not serious enough to warrant inclusion as well as instances where data had expired but had not been deleted. The GPDel also opined that the database suffered from the systematic entry of incorrect data due to a flaw in internal entry guidelines. Additionally, it suspected that many of the 80,000 third person entries did not meet the legal requirements that warranted entry in the database.

According to an article in the Neue Zürcher Zeitung, only about 5% of the entries concern Swiss citizens and only 12.2% are Swiss residents. These facts have perhaps prompted the Federal Commission for Migration Issues to inquire whether the database has had any bearing on the issuance of resident permits, as reported by the NZZ (citing an interview on Swiss Radio DRS).

The report is available in French here and in German here.

Detecter Deliverable: Border Control and Internal Security in the European Union

Deliverable D14.1 was written by Audelina Ahumada as part of Work Package 05. You can read the whole thing here.

Executive summary

1. Since the New York terrorist attacks in September 2001, border control is increasingly shaped by security considerations. This paper concentrates on the implications of this trend for the enjoyment of human rights protection by third-country nationals that seek to enter or have already gained access to European Union territory. The integration in the common border policy of threat assessments and risk analyses together with information gathering and sharing through the use of advanced technology has contributed to the perception that cross-border movements, and, in particular (potential)irregular immigration are closely related to serious criminality, including terrorism.
2. In the development of a common border policy, the EU, together with its Member States, should ensure that control and surveillance over the external frontiers are implemented in full compliance with legally binding international and European human rights standards. This should include operations aimed at diverting “illegal immigration” when conducted beyond EU external borders and when carried out in cooperation with third countries.
3. The legal mandate of the EU Border Control Agency, Frontex, should be clearly defined, in particular as regards the Agency’s competencies and corresponding responsibilities. Any coordination of or other involvement in border control operations by Frontex should be governed by clear guidelines which ensure respect for the principle of non-refoulement, including chain-refoulement, and the right to a fair and effective asylum procedure for any person claiming an international protection need.
4. The integration of internal security aspects in EU border policy also affects the processing of personal data on third-country nationals. Such data are stored in centralised EU-operated databases and were originally collected for primarily immigration-related purposes. Promotion of access to sensitive personal immigration data, including fingerprints, by law enforcement authorities for purposes including the prevention of and fight against terrorism implies that non-EU citizens form a suspect category in itself. This raises serious questions concerning the legitimacy, including necessity and proportionality of the measure under data protection principles inherent in the right to privacy. It may, in addition, have serious implications for the principle of non-discrimination.
5. Trends towards “interoperability” between EU-operated databases should be accompanied by the establishment of a comprehensive, specific and legally binding data protection framework with adequate safeguards to cover risks related to the large scale storage and use of personal data. The more authorities have access to sensitive personal information, the greater the risks of abuse, misuse, leaks and loss of data. This may have serious consequences, including with regard to the prohibition of torture and the principle of non-refoulement, if data on refugees and asylum-seekers reach authorities in their countries of origin.
6. Applying systematically EU carrier sanctions regime on international carriers may obstruct refugees and asylum-seekers in seeking protection in the EU. Trends toward the extension of the carrier sanctions regime to include the transfer of passenger data to national authorities, including for counter-terrorism purposes, raise serious questions from the perspective of data protection principles. Refugee protection is further marginalilzed, while adding to the perception that cross-border movements are closely linked with criminality.
   

Detecter Deliverable: Unilateral Exceptions to International Law

Deliverable D06.1 was written by Mathias Vermeulen and Martin Scheinin as part of Work Package 04. You can read the whole thing here.

Executive Summary

This paper on unilateral exceptions to human rights and international law in the fight against terrorism prepares the ground for two further deliverables under the DETECTER project, namely a policy-oriented paper summarizing the results and applying them in respect of EU law and policies, and a study specifically addressing detection technologies. It is well known that many governments have resorted to a wide range of constructions to justify, under international law, their unilateral exceptions to human rights in the name of countering terrorism. This paper seeks to take stock of a whole range of arguments, doctrines or constructions that states may resort to when seeking to justify their unilateral exceptions to human rights norms in the fight against terrorism. Many of those constructions have a valid legal basis and a proper scope of application. However, they also have their limitations, to the effect that often they affect only a specific treaty, or the availability of a procedure, but do not affect the substantive obligations of the state in question under international law. In many cases this results from the overlap of treaty law and customary norms of international law. Some of the constructions are open to abuse, i.e. bad faith efforts to distort international law to the detriment of human rights. Because of the complexity of the combined effect of the various excuses and exceptions, there is a need for a holistic approach that seeks to address the combined effect of the various constructions of unilateral exception.

Some of the main conclusions of the paper are highlighted in this executive summary. To start with:

• None of the constructions discussed affects a state's obligations under peremptory norms of international law (jus cogens).
• Outside that realm of peremptory norms, some of the constructions discussed have an impact upon both treaty law and customary international law, hence affecting the substantive human rights obligations of a state. This would be the case for the lex specialis effect of international humanitarian law during armed conflict but only when lex specialis is properly construed as an interpretive effect upon the scope or content of a particular human right.
• Counter-terrorism measures may qualify as permissible limitations on human rights, again when properly construed. This conclusion calls for a rigorous test for permissible limitations, rather than an all-encompassing act of 'balancing'.
• Most constructions discussed in this paper pertain merely to human rights treaties and do not affect the state's obligations under customary international law. As there is a high degree of substantive overlap between human rights treaties and customary norms of international law, resorting to these excuses therefore usually only has procedural consequences. It does not affect the substantive obligations of the state under international law, but precludes the competence of an international (or regional) human rights court or treaty body to address the breach of international law through its regular monitoring mechanisms.
• The most relevant constructions of unilateral exceptions to human rights treaty obligations are the power of a state to declare a state of emergency and to derogate from some but not all of its human rights treaty obligations, reduction of the scope of a state's human rights obligations when it acts outside its own territory, the right to enter permissible reservations upon the signature or ratification of a treaty and, in some cases, withdrawal from a treaty.
• There is some state practice of declaring a state of emergency because of acts of or a threat of terrorism. When applied under the fairly strict requirements for derogation enshrined in the treaties in question and when subject to international monitoring through the procedures available under the treaties in question, derogation is a permissible and even recommended mechanism for reacting to situations of a genuine threat to the life of the nation.
• Although the European Court of Human Rights has in some cases implied that a state is not subject to exactly the same obligations when it is, through its agents, acting outside its own territory, caution is required when resorting to this excuse. Other human rights treaties and customary norms of human rights law may remain applicable, and even the position of the European Court of Human Rights appears to be shifting (or inconsistent).
• Somewhat surprisingly, states have not resorted to reservations under human rights treaties with express reference to terrorism. However, a very small number of existing reservations, including in respect of the right to a fair trial, may have a bearing upon the treatment of terrorism suspects.
• Some, primarily regional, human rights treaties would allow for a state's unilateral withdrawal from the treaty. In practice, the option of withdrawal has figured in the political discourse, for instance after a government has received a ruling by a regional human rights court but no state has actually resorted to withdrawal from human rights treaties as a response to terrorism.

Detecter Deliverable: Privacy, Secret Detention Centres and Overflights

Deliverable 16.1 was written by Geir Ulfstein as part of Work Package 08. You can read the whole thing here.

Executive Summary

1. Article 17 of the International Covenant on Civil and Political Rights (ICCPR) establishes the right to privacy. The implementation of this right is monitored by the Human Rights Committee. The Committee has emphasized that interference in the right to privacy must be foreseeable; mechanisms should be established to prevent abuse of collected information and to ensure review, supervision and redress; and vulnerable groups should be protected. The Committee has, however, not established clear guidance about which substantive measures would be considered a violation of the right of privacy.
2. News media and NGOs reported in 2005 about secret detention centres and overflights in Europe as part of US counter-terrorism strategy. Such activities gave rise to several human rights concerns. The Parliamentary Assembly of the Council of Europe initiated an inquiry into these matters. The Secretary General requested member states to provide relevant information. The European Commission for Democracy through Law (Venice Commission) prepared an opinion on the human rights aspects. Cooperation was also established with the European Parliament of the European Union. This cooperation uncovered suspicious patterns of military and civilian aircraft and indications of secret detention centres. They were also able to put political pressure on the respective international organs and on national governments. The Committee of Ministers of the Council of Europe, however, failed to follow up strongly, and the European Parliament deplored the lack of follow up by the Council of the European Union, and by member states.
3. Several UN organs have been involved in the issues of secret detention and overflights, including the Human Rights Committee, the Committee Against Torture, the Special Rapporteur on the promotion and protection of human rights while countering terrorism, the Special Rapporteur on torture and other cruel, inhuman or degrading treatment or punishment, the Working Group on Arbitrary Detention and the Working Group on Enforced or Involuntary Disappearances. The UN organs have generally been more reactive than what was the case of the European Parliament and the Parliamentary Assembly. But all the bodies have, within their mandates, addressed these matters. They have helped to uncover certain facts, but have not been able to establish ‘hard facts’ about the relevant activities. These bodies have, however, the benefit of being able to have a more continuous focus on such cases. Furthermore, they have a global focus, and may thus engage in activities beyond the European context.

News: Germany Expresses Concern over Apple's iPhone users Database

From Privacy Digest: The German minister of justice, Sabine Leutheusser-Schnarrenberger, has spoken out over Apple's compilation of data on iPhone users, requesting the company to provide state data protection officials with details of what information on German iPhone users was being gathered, how long it was being stored, and for what purpose.

The case is being cited as further proof of Germany's tough line on privacy after previous tensions with Google Street View this year. However, a speedy resolution seems likely:

Stefan Köpsell, an instructor in data protection at the Technical University in Dresden, said that Apple could probably settle the controversy surrounding the iPhone 4 by having German users give their consent prior to the data being forwarded.

“I think there is probably a fundamental conflict between some Internet business models and German privacy law,” Mr. Köpsell said. “But in general, evidence shows that most Germans are willing to participate if there’s a benefit.” For example, 60 percent of households in Germany use a retail bonus card called Payback, owned by Loyalty Partner of Munich, which gives them points that can be used toward future purchases. By participating, consumers have given the company the right to collect and market data on their purchasing habits, as well as target them with advertising. “I would think the same would be possible for Apple,” Mr. Köpsell said.

DETECTER: The Human Rights Risks of Selected Detection Technologies

DETECTER Deliverable 17.1 was written by Rozemarijn van der Hilst as part of Work Package 9. You can read the whole thing here:

Executive Summary

1. Intelligence is a vital element in successful counter-terrorism. There is rapid development in detection technologies that aid in the gathering of information. However, there are concerns over the privacy intrusion these detection technologies cause.
2. Privacy is important for individual well-being, as well as the proper functioning of a democratic society. The right to privacy is vested in different national, European and International laws, which prescribe that the right to privacy may only be limited by measures that have a sound legal basis and are necessary in a democratic society for the protection of national security.
3. From the legal and moral framework around privacy it emerges that detection technologies used in counter-terrorism should take account of: legitimacy, proportionality, necessity, transparency, factors concerning the person targeted, the sensitivity of the data sought, the effectiveness, the possibility of function creep and the extent to which PET’s are implemented.
4. Privacy concerns arise with the widespread and indiscriminate use of communication surveillance; the covert use of CCTV technology; the sensitivity of biometric data; and the ineffectiveness (and therefore disproportionateness) of data mining and analysis and decision support technologies.
5. There are also risks inherent to the use of detection technologies in general. The use of detection technologies can have a ‘chilling effect’ and can be ineffective due to the huge amount of gathered data. However, positive effects of the use of detection technologies are the ability to detect and therefore prevent terrorist attacks and the deterrent effect they have.
6. Detection technologies should be used, provided that their authorization is based on legislation that protects against abuse and presents fair consideration to the proportionality and necessity of the aim pursued. The ultimate assessment of the threat detection technologies pose to privacy depends on the actual usage of the technologies.

News: Negotiations Reopen on US Access to SWIFT Bank Data

From the Lift: The EU and US have begun talks on a new agreement to enable transfers of European bank transfer information held on the SWIFT database to US authorities. Talks are taking place between the European Commission and United States Treasury and it is hoped an agreement can be reached by the end of June:

A Commission source told Euractiv.Com that “in the coming months little will be known about the substance of the actual negotiations”

The agreement will be concluded only after the adoption by the member states of the EU at qualified majority voting and the approval of the European Parliament. The Parliament introduced two weeks ago theconditions on the content of a future agreement, including for bulk transfers of personal data to the USA to be avoided, if necessary by processing them within the EU, and for Europe’s citizens to be guaranteed the right of appeal to the US authorities.

News: European Parliament Says No to US Bank Access

From BBC News: By 378-196 with 31 abstentions, the European Parliament has voted down the agreement to continue allowing the United States' counter-terrorism authorities access to the SWIFT database of European banking transactions, citing concerns at the 'inadequate privacy safeguards'. The deal, agreed by EU governments, would have granted US access for another nine months and follows intensive lobbying on the part of the American government:

Last week the Greens' home affairs expert, Jan Philipp Albrecht MEP, said that in backing the new deal the European Commission and EU governments had "not respected the fundamental criticism about the lack of sufficient protections with regard to privacy and the rule of law".

The leader of the Socialist group, Martin Schulz MEP, said: "We want a new and better deal with proper safeguards for people's privacy."

News: UK Introducing Compulsory Body Scans

From BBC News: Under new security rules passengers selected for screening by the Millimetre Wave 'Naked Body Scanners' will be forced to consent to the scanning on pain of not being allowed on the flight. The machines are in place at Heathrow and Manchester airport and will be installed at Birmingham airport later this month:

Transport Secretary Lord Adonis said in the immediate future only a small proportion of airline passengers would be selected for scanning.

In a written statement to the House of Commons, he said: "If a passenger is selected for scanning, and declines, they will not be permitted to fly."

News: Florence DETECTER Programme Announced

The second DETECTER Project Meeting will take place in Florence on Thursday the 18th of February 2010. The Programme will run as follows:

9.00 – 9.15 Introduction by Prof. Martin Scheinin, Professor of International Law at the European University Institute and United Nations Special Rapporteur on the protection of human rights while countering terrorism

9.15 – 11.00 Identification of terrorist suspects through detection technologies: risks and opportunities
Chair: Martin Scheinin (European University Institute, Italy)

• Ehud Givon (WECU-technologies, Israel) – Security through intent detection
• Jacques Verraes (Europan Commission, Belgium) – Data protection issues related to identification of terrorist suspects
• Ben Hayes (Statewatch, United Kingdom) – Respondent to presentations of Commission and WeCU technologies

11.00 – 11.30 Coffee break

11.30 – 13.30 Human rights aspects of the use of detection technologies

Chair: Daniel Moeckli (University of Zurich, Switzerland)

• Roos van der hilst (University of Oslo, Norway) – Human rights risks of selected detection technologies - sample uses by governments
• Emilio Mordini (HIDE, Italy) - Biometrics, Body, Identity
• R. Leenes (University of Tilburg, the Netherlands) – Location based surveillance – why planes, trains and automobiles are the new castles

13.30 – 15.00 Lunch

15.00-17.00 Martin Scheinin presenting WP4 Deliverable on "Developments in the Declarations of Exceptions, Claims of Inapplicability, or Unilateral Modifications in Respect of Internation Law for the Sake of Counter-Terrorism"

Limited Places - To register, please e-mail mathias.vermeulen@eui.eu

Martin Scheinin on Body Scanners and Profiling

DETECTER Partner Martin Scheinin has a piece in the Guardian. He argues against the idea that the aim of preventing acts of terrorism always trumps privacy or other fundamental rights and that any restrictions of such rights ought to be specifically provided for in clear law ensuring their effectiveness, necessity and proportionality. A few select quotes:

...The current generation of body scanners entail an unnecessary and therefore disproportionate intrusion into privacy, by showing a graphic image of a naked human person to one or more observers. It would be technologically easy to avoid this, by securing that no images are ever stored, and by using an algorithm to replace on the observer's screen the image of a real person with a standard animation figure but places any suspicious items on that image...

What is worse, body scanners are ineffective. They are unlikely to detect 80 grams of PETN explosives hidden in the underware of a person. And once it is known that body scanners are in use, they are easy to avoid by hiding this type of explosives in a body cavity or in a commercial item in one's hand luggage...

There are better ways than body scanners and group-related profiling to improve security at airports and elsewhere. The technology already exists for detecting from distance most explosive substances, including PETN. Together with professional observation of behavioral patterns this provides a prospect of respecting privacy while at the same time doing a better job in preventing acts of terrorism. It seems to be the unwarranted obsession to know more about the perceived bad person that has slowed down work to detect explosives....

The article also features a link to his latest report written in his capacity as UN Special Rapporteur on Human Rights and Counterterrorism, highlighting the erosion of the right to privacy in the fight against terrorism.

News: UK Equality and Human Rights Commission Say Body Scanners Breach Privacy

From the Times: Trevor Phillips, head of the UK watchdog created under the Equality Act (2006) in order to uphold nondiscrimination, has declared them a violation of privacy law established by the Human Rights Act.

They are calling on the UK Home Secretary Alan Johnson to explain in detail how the government will ensure that implementation of body scanning is compliant with the right to privacy. In particular they have raised privacy concerns with the use of body scanners on the disabled, the elderly, preoperative transsexuals and those with potentially embarrassing medical aids.

An EHRC spokesman said the use of profiling was “discriminatory, contrary to domestic legislation and international standards, and is harmful to community relations”.

A source at the watchdog added: “Scanners have a negative impact on people’s right to privacy, particularly the disabled, older people and children. Transsexuals and transgender people would be particularly vulnerable.

“We are talking about very intimate pictures. To be blunt, one could imagine a bunch of loutish security guards seeing some attractive women in the queue and all rushing into the office saying, ‘Let’s have a look’.”

News: European Court of Human Rights Renders Judgement concerning UK's Terrorism Act 2000

The ECHR has held that the expanded search powers granted to police under section 44 of the Terrorism Act 2000 violate Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms.

Story from the Telegraph
Note on the case on the Legalift Blog

The judgement is currently available on the ECHR's HUDOC service under "List of recent judgments."

Comment: Christmas Day Plot, Part I (Update)

The Telegraph has published a story today claiming that US Customs and Border Protection had singled out Umar Farouk Abdulmutallab based on the human intelligence submitted by the State Department and were waiting to bring him in for interrogation in Detroit. This claim seems to take some steam out of the argument that US intelligence failed to “connect the dots.” This raises the question whether, under the circumstances, some other operative action should have been taken while the flight was in the air. Given what was known, would it have been appropriate to order the flight to turn back around to Amsterdam? Suppose Abdulmutallab caught on to what was happening and decided to detonate over Amsterdam upon the return. Would it have been appropriate to order the flight crew to restrain him? Think of the standards that would apply if the “suspect” were simply someone standing on a public street. Should different standards apply on airplanes?

The article also features an interesting quote from a “senior Homeland Security official” who indicated that “in-depth vetting only begins once the flight manifest has been generated, a few hours before takeoff.” This statement suggests that passenger name records are not submitted on a rolling basis as reservations are made but only once the list of passengers on any one flight has been relatively solidified.

News: US SWIFT Access Granted

From the Lift: The EU has agreed a nine month interim deal to allow the US non reciprocal access to SWIFT banking data. Germany and Austria, reported as threatening a veto over the privacy implications of such a deal, abstained. A unanimous vote was required, not counting abstentions as votes against. The agreement can be annulled in the Spring, when the European Parliament will have to give their assent to the plan.

The Register quotes an EU official as saying that "The truth is that we in Europe don’t have the technical ability to interpret this stuff," and that this is the reason why "We rely on the Americans to process it and pass it on as intelligence." Many European intelligence agencies end up as beneficiaries in the arrangement as they are not permitted by their home countries to gather such information themselves. In the event, delegates were apparantly put under huge pressure from US representatives to pass the deal:

The pressure from the Americans was "massive," say diplomats in Brussels. U.S. Secretary of State Hillary Clinton apparently told her European counterparts that the fate of the West hung in the balance. And in the capital cities of Europe, American ambassadors stormed governments like door-to-door salespeople. As one EU foreign minister put it, "they pulled out all the moral and political stops."

News: SWIFT Update

The Legalift reported last week that 4 Countries remain opposed to the draft agreement granting US access to SWIFT banking transfers records. Germany's justice minister says that Berlin is uncomfortable with the plan and France, Austria and Finland have also signalled discontent with the scheme.

The draft plan is significantly different from the resolution issued by the European Parliament on the issue. 'Terrorism' is left undefined, requirements for judicial oversight are nowhere to be seen and the restriction of access to the specific issue of 'terrorism financing' is loosened to "prevention, investigation, detection, or prosecution of terrorism or terrorist financing". Ralf Bendrath has a round up of all these issues and many more.

If a decision is not reached by November 30th, then, as the Lisbon Treaty kicks in on December the 1st, the European Parliament may have much more say in the process (and it is likely to take another 6 months). Germany and Austria are reported to be under pressure to drop their opposition.

News: IMP Still Budgetted for 2016 Release

After mention was left out of the Queen's Speech, there was a lot of speculation that, in response to political pressure, plans for the Interception Modernisation Programme to monitor all electronic communications had been abandoned.

The Register reveals that the £2Bn remains in the Home Office's financial plans, scheduled for completion in 2016.