Fwd: Prosecutor rails at Big Tech as EU prepares to unveil new police powers
Please don't forward this information, it's from a paid service! Sending this to you because it shows how legally challenging a prudent interpretation of the GDPR can become. Best, Erika
Subject: Fwd: Prosecutor rails at Big Tech as EU prepares to unveil new police powers
Subject: Prosecutor rails at Big Tech as EU prepares to unveil new police powers Reply-To: POLITICO Pro Article <proarticles@politico.eu<mailto:proarticles@politico.eu>>
Prosecutor rails at Big Tech as EU prepares to unveil new police powers
-- By Laurens Cerulus 2/27/18, 4:43 PM CET
MECHELEN, Belgium — Belgian investigative judge Philippe Van Linthout is tired of knocking heads with Big Tech while trying to solve crimes.
In his office near Brussels, the investigator in charge of serious crimes points to piles of unsolved cases on his desk which he says all have one thing in common: They won’t be solved unless firms like Facebook, Google and Apple start coughing up more data-based evidence.
“Pick a file, any file,” Van Linthout told POLITICO at his office in Mechelen, referring to open cases that range from terrorism to murder and organized drug smuggling. “Nine out of 10 cases can’t be solved without access to data.”
Van Linthout’s plea echoes growing frustration among EU investigators who find themselves increasingly at odds with Big Tech — and are cheering a European Commission push to introduce new legislation as early as the end of March that would grant them new powers to pry “e-evidence” from the world’s biggest tech companies.
Law enforcement officials point out that use of encrypted messaging is now standard among terrorists and criminal gangs. Thanks to competition among big and small tech companies<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, they can choose among half a dozen ultra-secure messaging systems, from Telegram to Facebook-owned WhatsApp.
Yet when Van Linthout asks those firms for information about suspects, he said the response from the companies was all too often “sorry, can’t help.” In the case of smaller firms, there was often no response at all.
Unless an investigator could prove imminent danger to human life — not easy in a murder case with a cooling corpse — tech firms were reluctant to provide clues that undermine their encryption sales pitch. “You’re left with the corpse, the suspect and no information,” he said.
Help from Jourová
Facebook representatives, speaking on condition of anonymity to discuss confidential interactions with law enforcement, said the obstacle to accessing messages on encrypted services was first and foremost technical.
It was not possible to access end-to-end encrypted messages on WhatsApp without breaking encryption for all users, they argued late last year, adding that investigators were aware of such constraints.
Facebook regularly assists law EU enforcement, without specifying any cases, one representative added. Big Tech also faces limits in U.S. law that require it to demonstrate immediate and urgent danger before sending bits of data to European legislators.
For Van Linthout, however, cooperation still falls short. What he wants is access to metadata — information about who is in contact with whom, not what’s inside the exchange. Too often, it’s denied.
Luckily for Van Linthout and his peers, a new legislative proposal from the Commission may soon give them greater leverage against the companies.
After years of pressure from law enforcement and national justice and home affairs representatives — which focused in particular on the role of encrypted messages in the planning of terrorist bombings in Brussels and Paris — the Commission is due to propose a cross-border European “production order” that would force IT providers to give data to law enforcement if they can demonstrate the data is linked to a crime.
The proposal is expected to be unveiled at the end of March or mid-April, according to two people close to the file.
“It is clear the Commission needs to act here and come with pan-European rules,” Justice Commissioner Vera Jourová said at the end of last year, adding that the proposal called for giving law enforcement “direct access” to the information they need.
A senior Commission official who asked not to be named said the proposal was “probably the boldest thing we can do on criminal law.”
Even the tech companies may find the proposal useful, as it aims to clarify their obligations before the law. Apple, Google, Facebook and Microsoft have all held meetings with Jourová<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...> in the past few months, with Google dispatching its General Counsel Kent Walker to Brussels to lobby her on the matter.
Europe’s data schizophrenia
But there’s another obstacle standing in Van Linthout’s way: Europe’s schizophrenic attitude toward data.
On one hand, lawmakers want to give police a free hand in fighting crime. On the other, citizens have increasingly pushed back against governments and big companies snooping through their personal data unrestricted, and will soon come under the sway of the strictest privacy regulations in the world, the General Data Protection Regulation.<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>
EU privacy rules have proved just as restrictive for Van Linthout as the resistance of big tech firms. He cites one example from 2015, when investigators were chasing a terrorist plotter in Brussels who was planning an attack on New Year’s Eve and left a trail of evidence on several web pages.
The problem was that some of it was too old. “We had him. His Internet Protocol address led to Belgium, but the data was older than two years, so data retention [meant] the data was thrown away,” he said, adding that the suspect could not be caught as a result.
Data retention is a common gripe among investigators, after two major rulings by the European Court of Justice that said countries cannot force firms to store their data for law enforcement purposes without setting strict limits and safeguards.
The Commission’s proposal is unlikely to clear up confusion over data retention, as the rulings are part of a broader push to strengthen privacy rules following Edward Snowden’s 2013 revelations on the extent of surveillance by the U.S. National Security Agency.
Which is why investigators like Van Linthout feel hostage to geopolitical considerations.
EU investigators Europe and the U.S. now find themselves engaged in a race to draw the lines of what law applies on the web. Microsoft is fighting a U.S. warrant<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...> in a key court case that has gone all the way to the U.S. Supreme Court.
The U.S. wants Microsoft to hand over data stored in Ireland. The Commission says Microsoft would risk violating the EU’s data protection laws if it complies.
Both sides would like the power to ask for data to solve crimes and stop terrorist networks. But current processes to get data for law enforcement purposes, through Mutual Legal Assistance Treaties<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, are too slow, lawmakers agree. Google estimates<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...> show it takes an average of 10 months of waiting time for the data to be processed legally.
The Commission’s proposal would suggest ways for prosecutors to ask for data stored outside of their jurisdiction, and even outside of Europe, too.
“We need to get the balance right … The tricky thing is that, if we’d do it only for the EU territory, we wouldn’t catch much,” the senior official said. “We’d address IT providers who are offering services here … They are making big profits here, they are building their client base here, but they also have to be responsible.”
Related stories on these topics: Big data (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Big data (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Cybercrime<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Cybersecurity (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Cybersecurity (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Data protection (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Data protection (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Encryption (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Encryption (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Facebook<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Hackers<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Information technology (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Information technology (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Law enforcement<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Platforms<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Privacy (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Privacy (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Regulation (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Regulation (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Article 29 Working Party (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, Article 29 Working Party (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, European Commission (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>, European Commission (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>
To update your POLITICO Pro notification preferences, visit www.politico.eu/notification<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>
** Tell us what you think: Was this Pro content helpful? Yes<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...> | No<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...> **
View the Pro calendar at www.politico.eu/calendar<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>. Submit an event here<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdbc...>.
Only POLITICO Pro subscribers have access to POLITICO Pro content. If you are interested in learning more about a POLITICO Pro subscription for your organization, please contact pro@politico.eu<mailto:pro@politico.eu>.
This email was sent to emann@cov.com<mailto:emann@cov.com> why did I get this?<https://politico.us8.list-manage.com/about?u=e26c1a1c392386a968d02fdbc&id=10...> unsubscribe from all POLITICO SPRL emails<https://politico.us8.list-manage.com/unsubscribe?u=e26c1a1c392386a968d02fdbc...> update subscription preferences<https://politico.us8.list-manage.com/profile?u=e26c1a1c392386a968d02fdbc&id=...> POLITICO SPRL · Rue de la Loi 62 · Brussels 1040 · Belgium
participants (1)
-
Erika Mann