20 August 1999
Source: Hardcopy of 61 pages. Thanks to Sten Linnarsson.

Find this story at 2000 part 1
Find this story at 2000 part 2
Find this story at 2000 part 3
Find this story at 2000 part 4
Campbell’s report: http://cryptome.org/jya/ic2000.zip (981KB)
http://www.fas.org/irp/program/process/docs/98-14-01-2en.pdf

This is part 1 of 4 of “Development of Surveillance Technology and Risk of Abuse of Economic Information (an appraisal of technologies of political control).”

Part 2: “The legality of the interception of electronic communications: A concise survey of the principal legal issues and instruments under international, European and national law,” by Prof. Chris Elliott: http://cryptome.org/dst-2.htm

Part 3: “Encryption and cryptosystems in electronic surveillance: a survey of the technology assessment issues,” by Dr. Franck Leprévost: http://cryptome.org/dst-3.htm

Part 4: “The state of the art in Communications Intelligence (COMINT) of automated processing for intelligence purposes of intercepted broadband multi-language leased or common carrier systems, and its applicability to COMINT targeting and selection, including speech recognition,” by Duncan Campbell: http://www.iptvreports.mcmail.com/stoa_cover.htm [dead]

Campbell’s report: http://cryptome.org/jya/ic2000.zip (981KB)

EUROPEAN PARLIAMENT

SCIENTIFIC AND TECHNOLOGICAL OPTIONS ASSESSMENT
STOA
DEVELOPMENT OF SURVEILLANCE
TECHNOLOGY AND RISK OF ABUSE
OF ECONOMIC INFORMATION
(An appraisal of technologies of political control)

Part 1/4

The perception of economic risks arising from the potential vulnerability
of electronic commercial media to interception

Survey of opinions of experts
Interim Study

Working document for the STOA Panel

Luxembourg, May 1999 PE 168.184/Int.St./part 1/4
Directorate General for Research

Cataloguing data:

Title:

Part 1/4 of:
DEVELOPMENT OF SURVEILLANCE TECHNOLOGY AND
RISK OF ABUSE OF ECONOMIC INFORMATION
(An appraisal of technologies of political control)

Workplan Ref.: EP/IV/B/STOA/98/1401

Publisher: European Parliament
Directorate General for Research
Directorate A
The STOA Programme

Author: Mr Nikos BOGONIKOLOS – ZEUS E.E.I.G.

Editor: Mr Dick HOLDSWORTH, Head of STOA Unit

Date: May 1999

PE number: PE 168. 184/Int.St./1/4

This document is a working Document for the ‘STOA Panel’. It is not an official publication of STOA.

This document does not necessarily represent the views of the European Parliament.

CONTENTS
PART A: OPTIONS
Introduction
General overview of the outcome of the survey (interim stage)
Views on privacy collected from the survey
General privacy issue
The market for privacy
The role of industry
The need for European legislation

Options for action on surveillance and privacy
PART B: ARGUMENTS AND EVIDENCE
General
Examples of Abuse of Economic Information
PART C: TECHNICAL FILE
1. INTRODUCTION
Surveillance and Privacy
Dataveillance Techniques
Risks Inherent in Data Surveillance
Controls

2. SURVEILLANCE: TOOLS AND TECHNIQUES – Current technologies
1. Visual Surveillance
2. Audio Surveillance
3. Phone Tapping and Encryption
4. Voice and Word Pattern Recognition
5. Proximity Smart Cards
6. Transmitter Location
7. E-mail at Workplace
8. Electronic Databases
9. The Internet

3. THE USE OF SURVEILLANCE TECHNOLOGY SYSTEMS FOR THE TRANSMISSION AND COLLECTION OF ECONOMIC INFORMATION
3.1 CALEA System
3.2 ECHELON Connection
3.3 Inhabitant identification Schemes

4. THE NATURE OF ECONOMIC INFORMATION SELECTED BY SURVEILLANCE TECHNOLOGY SYSTEMS
A. From telecommunication systems
B. From new information technologies (Internet)
C. Some examples of data collection on the Internet

5. PROTECTION FROM ELECTRONIC SURVEILLANCE
A. Encryption (Cryptography)
Private sector initiatives

B. Key – recovery
Encryption and the global information infrastructure
Key-Recovery: Requirements and proposals

6. SURVEILLANCE TECHNOLOGY SYSTEMS IN LEGAL AND REGULATORY CONTEXT
A. Privacy regulation
Multinational data protection measures
Data protection directive in Europe
Privacy regulation in the United States

B. Protection of Privacy in the telecommunications sector

C. Cryptography
Cryptography policy in USA
Cryptography policy guidelines from OECD
E. U. cryptography policy
Other national and international activities related to cryptography policy

D. Key recovery

E. European Initiatives
DLM-FORUM- Electronic Records
Promoting Safe Use of Internet
REFERENCES

PART A: OPTIONS

Introduction

The present study, ‘Development of surveillance technology and risk of abuse of economic information’ presents the interim results from a survey of the opinions of experts, together with additional research and analytical material by the authors. It has been conducted by ZEUS E.E.I.G. as part of a technology assessment project on this theme initiated by STOA in 1998 at the request of the Committee on Civil Liberties and Internal Affairs of the European Parliament. This STOA project is a follow-up to an earlier one entitled: “An appraisal of technologies of political control” conducted for the same Committee. The earlier project resulted in an Interim Study (PE 166.499) written by OMEGA Foundation, Manchester, and published by STOA on January 1998 and later updated (September 1998).

In the earlier study it was reported that within Europe all fax, e-mail and telephone messages are routinely intercepted by means of what is called the ECHELON global surveillance system. The monitoring was said to be “routine and indiscriminate”. The ECHELON system formed part of the UKUSA system, but unlike many of the electronic spy systems developed during the cold war, ECHELON was said to be designed for primarily non-military targets: governments, organisations and businesses in virtually every country.

In the present study the authors were requested to investigate the use of surveillance technology systems, for the collection and possible abuse of sensitive economic information.

The principal method selected was a procedure of data collection and processing based on a modified DELPHI method (to be referred to here as “the survey”). Under this method, a list of potential sources of data was prepared. These were some 49 experts from universities, industrial and commercial undertakings in the informations and telecommunications technology sector, as well as a smaller number of persons in international or governmental organisations. The experts were drawn from 11 Member States of the European Union, plus Cyprus, Norway and Switzerland.

The next step was the collection of the data. This was mostly achieved by direct interviews of the experts, with the use of a questionnaire. The views (data) were processed and a convergence examination performed. The convergence procedure was based on a recursive approach for the exclusion of the non-reliable data. The last step was the drawing of the analytical results.

General overview of the outcome of the survey

The predominant view among the experts was that since nowadays almost all economic information is exchanged through electronic means (telephone, fax, e-mail), and, in addition, all digital telecommunication devices and switches have enhanced wiretapping capabilities, for these reasons they suggested that we must focus on the protection of the data when transmitted (using encryption products), on the use of government-approved encryption products and on the adoption of common standards concerning encryption and key-recovery products. The position could be summed up in the statement that ‘since it is difficult to prove that economic information has been captured by ECHELON system and passed on by the NSA, we have to consider privacy protection in a global international networked society’.

In summary, therefore, we see that two perceptions of this question emerge: (1) a concern about the possible threat to privacy and economic and civil rights potentially posed by global clandestine electronic surveillance systems operated by large and powerful secret government agencies, and (2) anxiety about the problems of commercial and personal privacy which arise now that so much commercial and other communications traffic is conducted over the Internet. Managers of businesses engaged in electronic commerce may perhaps be concerned about global clandestine surveillance systems: what is certain is that they are worried in a more familiar way about threats to commercial security posed by the nature of the new electronic business media and their possible vulnerability to interception by competitors and fraudsters.

Reflecting the feedback from the survey, the present study tends to reflect Perception 2, whereas the earlier one of 1998 tended to reflect Perception 1.

Advances in information and communication technologies have fostered the development of complex national and international networks which enable thousands of geographically dispersed users to distribute, transmit, gather and exchange all kinds of data. Transborder electronic exchanges — private, professional, industrial and commercial — have proliferated on a global scale and are bound to intensify among businesses and between businesses and consumers, as electronic commerce develops.

At the same time developments in digital computing have increased the capacity for accessing, gathering, recording, processing, sorting, comparing and linking alphanumeric, voice and image data. This substantial growth in international networks and the increase in economic data processing have arisen the need at securing privacy protection in transborder data flows.

Today, it is not necessary to define new principles for the protection of data (and privacy) in an expanding global electronic environment. It is necessary to define the appropriate means of putting the established principles into practice, particularly on the information and communication networks.

An active education strategy may be one of the ways to help achieve on-line and privacy protection and to give all actors the opportunities to understand their common interests.

Common technological solutions can assist in implementing privacy and data protection guidelines in global information networks. The general optimism about technological solutions, the pressure to collect economic information and the need for political and social policy decisions to ensure privacy must be considered.

The growth in international networks and the increase in economic data processing have arisen the need at securing privacy protection in transborder data flows and especially the use of contractual solutions. Global E-Commerce has changed the nature of retailing. There were great cultural and legal differences between countries affecting attitudes to the use of sensitive data (economic or personal) and the issue of applicable law in global transaction had tope resolved. Contracts might bridge the gab between those with legislation and the others.

Since Internet symbolised global commerce, faced with a rapid expansion in the numbers of transactions, there is a need to define a stable lasting framework for business. Internet is changing profound the markets and adjusting new contracts. To that reality is a complex problem.

Views on privacy collected from the survey

In this section the experts’ views on the various privacy issues are reported. The information was mostly collected by direct interviews of the experts, based on a predefined questionnaire.

General privacy issues

Privacy can be a contentious subject because it means different things to different people. The definition given is: “Privacy is the claim of individuals, groups, or institutions to determine for themselves how, when and to what extent information about them is communicated to others”
A clear problem expressed is that in an electronic environment, it becomes hard to differentiate between a private and public place and therefore what should be protected and what should not.
It was argued that is unreasonable for the society to subsidise the cost of individuals to maintain their privacy, pointing out that most people will choose utility over security (and consequently privacy)
It was suggested that privacy in many ways sacrifices other goods (time, effort and energy among them) in order to obtain it.
Three basic tools necessary for privacy protection were outlined: notice (to the data supplier), consent (to the consumer), and accountability.
Although accountability may be essential to ensuring privacy, it unfortunately conflicts with the anonymity, privacy implies. For any commerce to take place on the Internet, therefore, some level of anonymity and therefore privacy must be sacrificed. The question to be answered is ” how much and who will decide”.

The market for privacy

When the European Commission adopted the privacy directive (95/46/EC), it stated that privacy protection is a central precondition to consumers’ acceptance of electronic commerce. Accordingly, a critical issue experts argued, was whether there was a “market failure’ in the electronic environment that required some sort of government intervention to ensure data privacy.
Some experts responded that data privacy is not purely a public good, and so at some point someone will have a market incentive to protect it. Some corporations that have tried to market their strong privacy protection have yet to see any results and have concluded that: “privacy doesn’t sell”. Other industries have marketed privacy successfully (such as the cellular telephone industry) which could mean that the public demands for privacy are forthcoming and will eventually be profitable.
They feel that a question to be answered is: Who governs the responsibility of the information collector, or does society have to impose a sense of responsibility?”

The role of industry

Most experts expressed the view that the information industry should be primarily self-regulated: the industry is changing too rapidly for government legislative solutions, and most corporations are not simply looking at National or European but at global markets, which national governments cannot regulate.
Indeed several experts expressed the fear that any European attempt to allow USA to oversee (via global surveillance systems) data would lead to abuses by the government or other competitive companies.
They noted that many companies (such as Citibank) already inform consumers and clients that, unless told otherwise, they will disclose information to their affiliates. They suggested that a simple seal on the home page of a Web site, declaring that a company adheres to certain industry privacy standards might cease the fears of the public and offer some level of accountability.
Alternatively, they suggested that the media could act as an effective watchdog, informing consumers and companies of what information is being collected about them and how that information is being used.
They also noted that multinational companies could better negotiate for themselves across national boundaries than governments can. Electronic commerce is unlikely to gain popularity until the issues of notice, consent and recourse have been resolved. The market will force companies wishing to participate in this medium to address and solve these concerns.

The need for European legislation

Experts took the view that the European Parliament must now ask how, in a world of the Internet, one reconciles the objectives of protecting both: privacy and free flow of information.
In recent years there have been disclosures that unauthorised individuals have examined financial information from the Internal Revenue Service in USA. Several experts pointed to the flap over the decision by the Social Security Administration in USA to provide companies account information on-line. Each of these examples suggests that protecting data privacy may be a great challenge for the European Parliament.
Experts agreed that the European Parliament should play a role in creating a standard for disclosure. Several experts went further and argued the need of a privacy agency within the European Union to act as an ombudsman and to represent privacy interests, so that in debates between European Union and USA there is someone whose responsibility would be to protect privacy.
Whatever several experts believe the appropriate role for national governments to be in ensuring privacy in an electronic environment, some “private regulation” is already occurring on the Internet by the computer engines, who write code and decide computer standards. In fact experts suggested that when encryption software becomes ubiquitous it will push Internet commerce because it allows for potentially anonymous transactions, which will solve privacy issues by default.
It was pointed out that a group of high-tech companies in co-operation with standardisation organisations should agree on a web-based standard that would allow companies and consumers to interact with data collectors and inform them of what information they would be comfortable having disclosed to other parties.

Options for action on surveillance and privacy

The policy options for consideration by the committee on Civil Liberties and Internal Affairs of the European Parliament which emerged from the survey are:

Authorities in the EU and Member States should:

engage in a dialogue involving the private sector and individual users of networks in order to learn about their needs for implementing the privacy guidelines in the global network;

undertake an examination of private sector technical initiatives;

encourage the development of applications within global networks, of technological solutions that implement the privacy principles and uphold the right of users, businesses and consumers for protection of their privacy in the electronic environment.
Drafting methods for enforcing codes of conduct and privacy statements ranging from standardisation, labelling and certification in the global environment through third-party audit to formal enforcement by a regulatory body.
Definitions of the transactions which must remain anonymous, and technical capabilities for providing anonymity need to be specified.
Enforcement for the adoption of adequate standards (cryptography and key encryption) from all E.U. member states. Multilateral agreements with other countries could then be negotiated.
Drafting of common guidelines of credit information use (in each member state of the E.U. different restriction policies exist). It must be dear how those restrictions could apply to a globally operating credit reference agency.
Drafting of common specifications for cryptography systems and government access key recovery systems, which must be compatible with large scale, economical, secure cryptographic systems.
Enforcement for the adoption of special authorisation schemes for Information Society Services and supervision of their activities by National Authorisation Bodies.
Drafting of a common responsibilities framework for on-line service providers, who transmit and store third party information. This could be drafted and supervised by National PTTs.
The European Parliament should examine critically proposals from the US for the elimination of cryptography and the adoption of encryption controls supervised by US Agencies.
Annual statistics and reporting on abuse of economic information by any means must be reported to the Parliament of each member state of the E.U.
Measures for encouraging the formal education systems of each member state of the E.U. or the appropriate European Training Institute/Organisation to take up the general task of educating users in the technology and their rights.

PART B: ARGUMENTS AND EVIDENCE

General

Nowadays almost all economic information is exchanged through electronic means (telephone, fax, e-mail). In addition, all digital telecommunication devices and switches have enhanced wiretapping capabilities. As a conclusion we have to consider privacy protection in a global international networked society. And when we speak about electronic protection and privacy in the exchange of economic information, we actually speak for electronic commerce over the Internet.

The information society promises economic and social benefits for all: citizens, companies and governments. Advances in information and communication technologies have fostered the proliferation of private, professional, industrial and commercial transborder electronic exchanges on a global scale which are bound to intensify among businesses and between businesses and consumers as electronic commerce develops. New methods for processing the vast accumulation of data -such as data mining techniques- make it possible, on the basis of demographic data, credit information, details of on-line transactions etc, to identify new kinds of purchasing patterns or unusual relationships.

Indeed, compliance with rules governing the protection of privacy and personal data is crucial to establishing confidence in electronic transactions, and particularly in Europe, which has traditionally been heavily regulated in this area. The development of the global information society makes the convergence of government policies, the transparency of rules and regulations and their effective implementation on economic and social life. In particular, in the context of electronic commerce, the development of on-line commercial activities hinges to a large extent, not only on the faith consumers have in business in terms of guaranteed product delivery or security payment systems, but also on the confidence that users and consumers will have in the ways that businesses handle their personal data.

To operate with confidence on the global networks, most consumers need assurance that their on-line activities and electronic transactions will not be collected or used without their knowledge or made available to parties other than their initial correspondents. Neither linked to other data about them in order to compile behavioural profiles without their consent.

The importance of information and communication systems for society and the global economy is intensifying with the increasing value and quantity of data that is transmitted and stored on those systems. At the same time those systems and data are also increasingly vulnerable to a variety of threats such as unauthorised access and use, misappropriation, alteration and destruction. Proliferation of computers, increased computing power, interconnectivity, decentralisation, growth of networks and the number of users, as well as the convergence of information and communication technologies, while enhancing the utility of these systems, also increase system invulnerability.

Cryptography is an important component of secure information and communication systems and a variety of application have been developed that incorporate cryptographic methods to provide data security.

Although there are legitimate governmental, commercial and individual needs and uses for cryptography, it may also be used by individuals or entities for illegal activities, which can affect public safety, national security, the enforcement of laws, business interests, consumers interests or privacy. Governments together with industry and the general public, are challenged to develop balanced policies to address these issues.

Cryptography uses an algorithm to transform data in order to render it unintelligible to anyone who does not possess certain secret information (the cryptographic “key”), necessary for decryption of the data. Within the new concept of cryptography, rather than sharing one secret key, the new design uses two mathematically related keys for each communication party: a “public key” that is disclosed to the public and a corresponding “private key”, that is kept secret. A message that is encrypted with a public key can only be decrypted by the corresponding private key.

An important application for public key cryptography is “digital signature”, which can be used to verify the integrity of data or the authenticity of the sender of data. In this case, the private key is used to “sign” a message, while the corresponding public key is used to verify a “signed” message.

Public key cryptography plays an important role in developing information infrastructure. Much of the interest in information and communication networks and technologies centres on their potential to accommodate electronic commerce; however open networks such as the Internet present significant challenges for making enforceable electronic contracts and secure payments.

Since Electronic Commerce on one hand is one of the key strategies of the European Union and the privacy protection on the other hand, one of its main principles, E.U. in 1998 released three “key” working documents:

Proposal for a European Parliament and Council Directive on certain legal aspects of Electronic Commerce in the internal market [ COM(1998) 586 final].
Proposal for a European Parliament and Council directive on a common framework for electronic signatures [COM (1998)297 final].
Ensuring security and trust in electronic communication: “Towards a European framework for digital signatures and Encryption” [COM(1997) 503 final].

Increasing the number of people with authorised access to the critical infrastructure and to business data, will increase the likelihood of attack, whether through technical means, by exploitation of mistakes or through corruption. Further “key-recovery” requirements to the extent that they made encryption can have the effect of discouraging or delaying the deployment of cryptography in increasingly vulnerable computing and communication networks.

As the Internet and other communications systems reach further into everyday lives, national security, law enforcement and individual privacy have become perilously intertwined. Governments want to restrict the free flow of information; software producers are seeking ways to ensure consumers are not bugged from the very moment of purchase. The US is behind a world-wide effort to limit individual privacy and enhance the capability of its intelligence services to eavesdrop on personal conversations. The campaign has had two legal strategies: the first made it mandatory for all digital telephone switches, cellular and satellite phones and all developing communication technologies to build in surveillance capabilities; the second sought to limit the dissemination of software that contains encryption, a technique which allows people to scramble their communications and files to prevent others from reading them. The first effort to heighten surveillance opportunities was to force telecommunications companies to use equipment designed to include enhanced wiretapping capabilities. The end goal was to ensure that the US and its allied intelligence services could easily eavesdrop on telephone networks anywhere in the world. In the late 1980s, in a programme known internally as ‘Operation Root Canal’, US law enforcement officials demanded that telephone companies alta their equipment to facilitate the interception of messages. The companies refused but, after several years of lobbying, Congress enacted the Communications Assistance for Law Enforcement Act (CALEA) in 1994.

CALEA requires that terrestrial carriers, cellular phone services and other entities ensure that all their ‘ equipment, facilities or services’ are capable of expeditiously. . . enabling the government…to intercept… all wire and oral communications carried by the carrier…concurrently with their transmission.’ Communications must be interceptable in such a form that they could be transmitted to a remote government facility.

Manufacturers must work with industry and law enforcement officials to ensure that their equipment meets federal standards. A court can fine a company US$10,000 per day for each product that does not comply.

The passage of CALEA has been controversial but its provisions have yet to be enforced due to FBI efforts to include even more rigorous regulations under the law. These include the requirement that cellular phones allow for location-tracking on demand and that telephone companies provide capacity for up to 50,000 simultaneous wiretaps.

While the FBI lobbied Congress and pressured US companies into accepting a tougher CALEA, it also leaned on US allies to adopt it as an international standard. In 1991, the FBI held a series of secret meetings with EU member states to persuade them to incorporate CALEA into European law. The plan, according to an EU report, was to ‘call for the Western World (EU, US and allies) to agree to norms and procedures and then sell their products to Third World countries. Even if they do not agree to interception orders, they will find their telecommunications monitored by the UK-USA signals intelligence network the minute they use the equipment.’ The FBI’s efforts resulted in an EU Council of Ministers resolution that was quietly adopted in January 1995, but not publicly released until 20 months later. The resolution’s text is almost word for word identical to the FBI’s demands at home. The US government is now pressuring the International Telecommunications Union (ITU) to adopt the standards globally.

The second part of the strategy was to ensure that intelligence and police agencies could understand every communication they intercepted. They attempted to impede the development of cryptography and other security measures, fearing that these technologies would reduce their ability to monitor the emissions of foreign governments and to investigate crime.

These latter efforts have not been successful. A survey by the Global Internet Liberty Campaign (GILC) found that most countries have either rejected domestic controls or not addressed the issue at all. The GILC found that ‘many countries, large and small, industrialised and developing, seem to be ambivalent about the need to control encryption technologies’.

The FBI and the National Security Agency (NSA) have instigated efforts to restrict the availability of encryption world-wide. In the early 1970s, the NSA’s pretext was that encryption technology was ‘born classified’ and, therefore, its dissemination fell into the same category as the diffusion of A-bomb materials. The debate went underground until 1993 when the US launched the Clipper Chip, an encryption device designed for inclusion in consumer products. The Clipper Chip offered the required privacy, but the government would retain a ‘pass-key’ – anything encrypted with the chip could be read by government agencies.

Behind the scenes, law enforcement and intelligence agencies were pushing hard for a ban on other forms of encryption. In a February 1993 document, obtained by the Electronic Privacy Information Center (EPIC), they recommended ‘Technical solutions, such as they are, will only work if they are incorporated into all encryption products’.

To ensure that this occurs, legislation mandating the use of government-approved encryption products, or adherence to government encryption criteria, is required.’ The Clipper Chip was widely criticised by industry, public interest groups, scientific societies and the public and, though it was officially adopted, only a few were ever sold or used.

From 1994 onwards, Washington began to woo private companies to develop an encryption system that would provide access to keys by government agencies. Under the proposals – variously known as ‘key escrow’, ‘key recovery’ or ‘trusted third parties’ – the keys would be held by a corporation, not a government agency, and would be designed by the private sector, not the NSA. The systems, however, still entailed the assumption of guaranteed access to the intelligence community and so proved as controversial as the Clipper Chip. The government used export incentives to encourage companies to adopt key escrow products: they could export stronger encryption, but only if they ensured that intelligence agencies had access to the keys.

Under US law, computer software and hardware cannot be exported if it contains encryption that the NSA cannot break. The regulations stymie the availability of encryption in the USA because companies are reluctant to develop two separate product lines — one, with strong encryption, for domestic use and another, with weak encryption, for the international market. Several cases are pending in the US courts on the constitutionality of export controls; a federal court recently ruled that they violate free speech rights under the First Amendment.
(… The NSA is one of the shadowiest of the US intelligence agencies. Until a few years ago, it existence was a secret and its charter and any mention of its duties are still classified. However, it does have a Web site (www.nsa.gov:8080) in which it describes itself as being responsible for the signals intelligence and communications security activities of the US government. One of its bases, Menwith Hill, was to become the biggest spy station in the world. Its ears — known as radomes — are capable of listening in to vast chunks of the communications spectrum throughout Europe and the old Soviet Union

In its first decade the base sucked data from cables and microwave links running through a nearby Post Office tower, but the communications revolutions of the Seventies and Eighties gave the base a capability that even its architects could scarcely have been able to imagine. With the creation of Intelsat and digital telecommunications, Menwith and other stations developed the capability to eavesdrop on an extensive scale on fax, telex and voice messages. Then, with the development of the Internet, electronic mail and electronic commerce, the listening posts were able to increase their monitoring capability to eavesdrop on an unprecedented spectrum of personal and business communications.

This activity has been all but ignored by the UK Parliament. When Labour MPs raised questions about the activities of the NSA, the Government invoked secrecy rules. It has been the same for 40years…. )

(Simon Davis report: http://www.telegraph.co.uk)

The FBI has not let up on efforts to ban products on which it cannot eavesdrop. In mid-1997, it introduced legislation to mandate that key-recovery systems be built into all computer systems. The amendment was adopted by several congressional Committees but the Senate preferred a weaker variant. A concerted campaign by computer, telephone and privacy groups finally stopped the proposal; it now appears that no legislation will be enacted in the current Congress.

While the key escrow approach was being pushed in the USA, Washington had approached foreign organisations and states. The linchpin for the campaign was David Aaron, US ambassador to the Organisation for Economic Co-operation and Development (OECD), who visited dozens of countries in what one analyst derided as a programme of ‘laundering failed US policy through international bodies to give it greater acceptance’.

Led by Germany and the Scandinavians, the EU has been generally distrustful of key escrow technology. In October 1997, the European Commission released a report which advised: ‘Restricting the use of encryption could well prevent law-abiding companies and citizens from protecting themselves against criminal attacks. It would not, however, totally prevent criminals from using these technologies.’ The report noted that ‘privacy considerations suggest limit the use of cryptography as a means to ensure data security and confidentiality’.

Some European countries have or are contemplating independent restrictions. France had a longstanding ban on the use of any cryptography to which the government does not have access. However, a 1996 law, modified the existing system, allowing a system of “tiers du confidence”, although it has not been implemented, because of EU opposition. In 1997, the Conservative government in the UK introduced a proposal creating a system of trusted third parties.

It was severely criticised at the time and by the new Labour government, which has not yet acted upon its predecessor’s recommendations. The debate over encryption and the conflicting demands of security and privacy are bound to continue. The commercial future of the Internet depends on a universally-accepted and foolproof method of on-line identification; as of now, the only means of providing it is through strong encryption. That put the US government and some of the world’s largest corporations, notably Microsoft, on a collision course. (Report of David Banisar, Deputy director of Privacy International and Simon Davies, Director General of Privacy International).

The issue of encryption divides the member states of the European Union. Last October the European Commission published a report entitled: “Ensuring security and Trust in Electronic Commerce”, which argued that the advantages of allowing law enforcement agencies access to encrypted messages are not clear and could cause considerable damage to the emerging electronic industry. It says that if citizens and companies “fear that their communications and transactions are being monitored with the help of key access or similar schemes unduly enlarging the general surveillance possibility of government agencies, they may prefer to remaining in the anonymous off-line world and electronic commerce will just not happen”.

However, Mr Straw said in Birmingham (JHA Informal JHA Ministers) that: “It would not be in the public interest to allow the improper use of encryption by criminals to be totally immune from the attention of law enforcement agencies”. The UK, along with France (which already has a law obliging individuals to use “crackable” software) and the USA, is out on a limb in the EU. “The UK presidency has a particular view and they are one of the access hard-liners. They want access: “them and the French”, commented an encryption expert. They are particularly about “confidential services” which ensure that a message can only be read by the person for whom it is intended who has a “key” to access it. The Commission’s report proposes “monitoring” Member States laws’ on “confidential services” to ensure they do not contravene the rules of the single market.

Examples of Abuse of Economic Information

In the course of collecting the data for and preparing this Interim Study various examples were cited of abuse of privacy via global surveillance telecommunication systems. A number of them is given in [54]. For the final version of the study, we shall see whether the experts have further comments to make on these examples, or whether they have new examples to suggest.

The consultation of experts in our survey so far yielded the following comments:

Since Internet has come to play a significant role in global commerce, then (as in Examples 1, 2, 3 and 4 cited below) Internet also became a tool of misleading information and a platform for deceitful advertisement.
On the positive side, Internet is a “golden highway” for those interested in the process of information.
However, apart from global surveillance technology systems, additional tools have been developed for surveillance. The additional tool used for information transferred via Internet or via Digital Global telecommunication systems is the capture of data with Taiga software. Taiga software has the possibility to capture, process and analyse multilingual information in a very short period of time (I billion characters per second), using key-words.

The examples given below are taken from the sources named:

Example 1

On January 15, 1990, the telephone network of AT&T company, in all the North-east part of USA faced serious difficulties. The network NuPrometheus had illegally owned and distributed the key-code of the operational system of AT&T Macintosh computer (Apple company).
J.P. Barlow: “A not terribly brief history of the Electronic Frontier Foundation,” 8 November 1990

Example 2

On January 24, 1990, the Electronic Frontier Foundation (EFF) in USA, accused a huge police operation under the encoded name “Sun Devil”, in which 40 computers and 23,000 diskettes were seized from teenagers, in 15 towns within USA. Teenager Craig Neidorf supported by EFF, not to be punished in 60 years prison and 120,000 USD penalty. Craig Neidorf had published in Phrack (a hackers magazine) part of the internal files of a telephone company.
M. Godwin: “The EFF and virtual communities,” 1991

Example 3

On June 25, 1998, in Absheim, an aircraft A-320 of the European Company “Airbus Industries” crashed during a demonstration flight. The accident was reportedly caused by dangerous manoeuvres. One person died and 20 were injured.

Very soon afterwards, and before the announcement of the official report, in the aerospace and transport Internet newsgroups there appeared many hostile messages against the Airbus undertaking and against the French company Aerospatiale as well, with which Airbus had close cooperation. Messages declared that the accident was to be expected because European engineers are not so highly qualified as American engineers. It was also clearly stated, that in the future similar accidents were to be expected.

Aerospatiale’s representatives took these hostile messages very seriously. They tried to discover the sources of messages and they finally realised that senders’ identification data, addresses and nodes were false. The source messages came from USA, from computers with misleading identification data and transferred from anonymous servers in Finland.
B. Martnet and Y.M. Marti: “L’intelligence econimique. Les yeux et les oreilles de 1′ enterprise, Editions d’organisation”. Paris 1995

Example 4

In October 31, 1994, in USA, an accident occurred to an ATR aircraft (of the European Consortium Aeritalia and Aerospatiale). Owing to this accident, a ban on ATR flights for two months was imposed. This decision became catastrophic on a commercial level for the company, because ATR was obliged to carry out test flights in fog conditions.

During this period, in Internet newsgroups (and especially in the AVSIG forum, supported by Compuserve), the exchange of messages was of vital significance. The messages supporting the European company were few, while the messages against ATR were many.

At the beginning of January 1995, there appeared a message from a journalist in this forum asking the following: “I have heard that ATR flights will begin soon. Can anybody confirm this information?” The answer came very soon. Three days after, unexpectedly, permission to continue ATR flights was given. The company learned this, as soon as the permission announced. But if they had actively participated in the newsgroups, they would have gained some days to inform their offices and their clients.
“Des langages pour analyser la poussiere d’ info”, Liberation, 9 June 1995

Example 5

The government of Brasil in 1994, announced its intention to assign an international contract (Amazonios). This procurement was of great interest since the total amount available for the contract was 1,4 billion USD. From Europe, the French companies Thomson and Alcatel expressed their interest and from USA, the huge weapon industry Raytheon. Although the offer of the French companies was technically excellent and allegedly better documented, the contract was eventually assigned to the USA company. It was reported in the press that this was achieved with a new offensive strategy used by USA. When the government of Brazil was about to assign the contract to the French companies, American Officials (allegedly with the personal involvement of President Bill Clinton) readjusted their offer, according to the offer of the European companies, and asserted that French companies influenced the committee, an accusation which was never proved. On the other hand, the European companies were reported to have indications that the intention of the government of Brazil to assign the contract to the European companies became known to Americans with the use of FBI’s surveillance technologies.
“La nouvelle machine de querre americaine”, LeMonde du reseingnement no 158, 16 February 1995

Example 6

In January 1994 Edouard Balladur, French Prime Minister, went to Ryadh (Saudi Arabia), feeling certain to bring back a historic contract for more than 30 million francs in sale of weapons and, especially, Airbus. He returned disappointed. The contract went to the McDonnell-Douglas American company, rival of Airbus. The French were report to believe that this was at least in part due to electronic surveillance by the ECHELON system, which had given to the Americans the financial conditions and incentives authorised by Airbus.

French press reports said the National Security Agency is the most secret and most significant of the thirteen secret agencies of the United States. It receives about a third of the appropriations allocated with clandestine intelligence: 8 of the 26,6 billion dollars (160 18 billion francs) registered appropriations in the 1997 budget. With its 20.000 employees in United States and some thousands of agents throughout the world, the NSA (which forms part of ministry for Defence since its creation in 1956) is more important than the CIA, even if the latter is better known to the public. Its site at Fort Meade contains, according to sources familiar with the place, the greatest concentration of data processing power and mathematicians in the world. They are employed to sort and analyse the flood of data acquired by ECHELON on the networks of international telecommunications.
“Echelon est au service des interets americains”, Liberation, 21 April 1998

PART C: TECHNICAL FILE
1. INTRODUCTION

Surveillance and Privacy

Surveillance is the systematic investigation or monitoring of the actions or communications of one or more persons. It has traditionally been undertaken by physical means (e.g. prison guards on towers). In recent decades it has been enhanced through image amplification devices such as binoculars and high-resolution satellite cameras.

The basic born [sic] physical surveillance comprises watching (visual surveillance) and listening (aural surveillance). Monitoring may be undertaken remotely in space, with the aid of image amplification devices like field glasses, infrared binoculars, light amplifiers and satellite cameras and sound amplification devices like directional microphones; and remotely in time with the aid of image and sound recording devices.

Electronic devices have been developed to augment physical surveillance and offer new possibilities such as closed-circuit TV (CCTV), VCR, telephone bugging, Proximity cards, Electronic Database, etc.

In addition to physical surveillance, several kinds of communications surveillance are practiced, including mail covers and telephone interception.

The popular term electronic surveillance refers to both augmentations to physical surveillance (such as directional microphones and audio bugs) and to communication surveillance, particularly telephone taps.

The recent years have seen the emergence and refinement of a new form of surveillance no longer of the real person, but of the person’s data shadow or digital persona. Data surveillance or Dataveillance is the systematic use of personal data systems in the investigation or monitoring of the actions or communications of one or more persons. Dataveillance is significantly lees expensive than physical and electronic surveillance, because it can be automated. As a result, the economic constraints on surveillance are diminished and more individuals and larger populations are capable of being monitored. Like surveillance, more generally, Dataveillance is of two kinds: “personal Dataveillance”, where a particular person has been previously identified as being of interest, “mass Dataveillance”, where a group or large population is monitored, in order to detect individuals of interest, and / or to deter people from stepping out of line.

Surveillance technology systems are mechanisms, which can identify, monitor and track movements and data. During the last few decades since information technology has become immensely sophisticated real benefits have been achieved in the development of surveillance technology systems.

On the other hand, negative impacts have been considerable:
The application of IT to the surveillance of people through their data.

IT technology may have substantial implications in privacy.

People often think of privacy as some kind of right. Unfortunately, the concept of a “right” is a problematic way to start, became a right seems to be some kind of absolute standard. What’s worse, is very easy to get confused between legal rights on one hand and natural or moral rights on the other. It turns out to be much more useful to think about privacy as one kind of thing (among many kinds of things) that people like to have lots of.

Privacy the interest that individuals have in sustaining a “personal space” free from interference by other people and organizations.

To a deeper level privacy turns out not to be a single interest but rather has several dimensions:

privacy of the person
privacy of personal behavior
privacy of personal communications
privacy of personal data

With the close coupling that has occurred between computing and communications, particularly since the 1980’s the last two aspects have become closely linked, and are commonly referred as information privacy.

Information privacy is the interest an individual has in controlling, or at least significantly influencing the handling of data about themselves.

The term ‘data privacy’ is sometimes used in the same way. ‘Data’ refers to inert numbers, where information implies the use of data by humans to extract meaning; hence ‘information privacy’ is arguably the more descriptive way of the two alternatives.

‘Confidentiality’ is an incidental and wholly inadequate substitute for proper information privacy, protection, where:
‘Confidentiality is the legal duty of individuals who come into the procession of information about others, especially in the course of particular kinds of relationships with them’.

Dataveillance Techniques

A variety of Dataveillnce techniques exists. Front-end verification (FEV), for example, comprises the checking of data supplied by an applicant (e.g. for a loan or government benefit) against data from a variety of additional sources, in order to identify discrepancies.

FEV may be applied as a person dataveillance tool where responsible grounds exist for suspecting that the information the person has provided may be unreliable; where, on the other hand, it is applied to every applicant, mass dataveillance is being undertaken. Data matching is a facilitative mechanism of particular value in mass dataveillance. It involves trawling through large volumes of data collected for different purposes, searching for discrepancies and drawing influences from them.
Personal dataveillance of previously identified individuals

integration of data hitherto stored in various locations within a single organization
screening or authentication of transactions against internal norms
front-end verification of transactions that appear to be exceptional, against data relevant to the matter at hand. and sought from other databases or from third parties.
front-end audit of individuals who appear to be exceptional against data related to other databases or from third parties.
cross-system enforcement against individuals, where a third party reports that the individual has committed a transgression in his or her relationship with the third party.

Mass dataveillance of groups of people.

screening or authentication of all transactions, where or not they appear to be exceptional, against internal norms
front-end verification of all transactions, whether or not they appear to be exceptional against data relevant to the matter at hand, as sought from other internal databases or from third parties.
front-end audit of individuals, whether or not they appear to be exceptional against data relevant to the matter at hand, as sought from other internal databases or from third parties.
single-factor file analysis of all data held or able to be acquired, whether or not they appear to be exceptional, variously involving transaction data compared against a norm, permanent data or other transaction data.
profiling or multi-factor file analysis of all data held or able to acquire, whether or not they appear to be exceptional, variously involving singular profiling of data held at a point in time, or aggregative profiling of transaction trails over time.

Facilitative mechanisms could be:

computer data matching, in which personal data records relating to many people are compared in order to identify cases of interest
data concentration, homely the combination of personal data interchange networks and hub systems.

Risks inherent in Data Surveillance

Data surveillance’s broader social impacts can be grouped as follows:
In personal dataveillance

low data quickly decisions [sic]
lack of subject knowledge of, and consent to, data flows
blacklisting
denial of redemsion [sic]

In mass surveillance
a. Risks to the individuals:

arbitrariness
a contextual data merger
complexity and incomprehensibility of data
witch hunts
ex-ante discrimination and guilt prediction
selective advertising
inversion of the onus of proof
covert operations
unknown accusations and accusers
denial of due process

b. Risks to society:

prevailing climate of suspicion
adversarial relationships
focus of law enforcement on easily detectable and provable offences
inequitable application of the law
decreased respect for the law and low enforcers
reduction in the meaningfulness of individual actions
reduction in self-reliance and self-determination
stultification of originality
increased tendency to opt out of the official level of society
weakening of society’s moral fibre and cohesion
destabilization of the strategic balance of
power repressive potential for the totalitarian government.

By way of example, individuals can suffer as a result of misunderstandings about the meaning of data on the file, or because the file contains erroneous data, which the individual does not understand and against which he / she has little or not chance of arguing without the help of a specialized lawyer.

Such seemingly small, but potentially very frustrating and infuriating personal problems can escalate into widespread distrust by people of government agencies and the legal system as a whole

Of course, many of the risks referred are diffuse. On the other hand, there is a critical economic difference between conventional forms of surveillance and Dataveillance.

Physical surveillance is expensive because it requires the application of considerable resources. Although (with few exceptions), this expense has been sufficient to restrict the use of surveillance. Admittedly the selection criteria used by the surveillance agencies have not always accorded with what the citizenry might have preferred, but at least its extent was limited. The effect was that in most countries the abuses affected particular individuals who had attracted the attention of the state, but were not so pervasive that artistic and potential freedoms were widely constrained.

Dataveillance changes all that. Dataveillance is relatively very cheap and getting cheaper all the time, thanks to progress in information technology. The economic limitations are overcome and the digital persona can be monitored with thoroughness and frequency and surveillance extended to whole populations. Nowadays, a number of particular populations have attracted the bulk of the attention, because the state already processed substantial data – holdings about them. There are social welfare recipients and employers of the state. Now that techniques have been refined, they are being pressed into more general usage, in the private as well in the public sector.

Controls

If dataveillance is burgeoning, controls are needed to ensure that its use is not excessive or unfair. There is a variety of natural or intrinsic controls, such as self-restraint and morality. Unfortunately morality has been shown many times to be an entirely inadequate influence over people’s behaviour. There is also the economic constraint, whereby work that isn’t worth doing tends not to get done, because people perceive better things to do with the same scarce resources. Regrettably this too is largely ineffective. Cost/benefit analysis of dataveillance measures is seldom performed, and when it has been the quality has generally been appalling. This reflects the dominance of political over economic considerations — both politicians and public servants want action to be seen to be being taken, and are less concerned about its effectiveness than its visibility.

If intrinsic controls are inadequate, extrinsic measures are vital. For example, the codes of ethics of professional bodies and industry associations could be of assistance. Regrettably, these are generally years behind the problems, and largely statements of aspiration rather than operational guidelines and actionable statements of what is and is not acceptable behaviour. Over twenty years after the information privacy movement gathered steam, there are few and very limited laws which make dataveillance activities illegal, or which enable regulatory agencies or the public to sue transgressing organisations. A (limited) statute exists at national level, but none at all at the level of State Governments. In any case, statutory regimes are often weak due to the power of data-using lobbies, the lack of organisation of the public, and the lack of comprehension and interest by politicians. The public has demonstrated itself as being unable to focus on complex issues; public apathy is only overcome when a proposal is presented simply and starkly, such as ‘the State is proposing to issue you with a plastic card. You will need to produce it whenever anyone asks you to demonstrate that you have Permission to breathe’.

There is a tendency for dataveillance tools to be developed in advanced nations, which have democratic traditions and processes (however imperfect). There is a further tendency for the technology to be exported to less developed countries.

Many of these have less well-developed democratic traditions, more authoritarian and even repressive regimes. The control mechanisms in advanced western democracies are inadequate to cope with sophisticated dataveillance technologies; in third world countries there is very little chance indeed of new extrinsic controls being established to ensure balance in their application. It appears that some third-world countries may be being used as test-beds for new dataveillance technologies.

2. SURVEILLANCE: TOOLS AND TECHNIQUES – Current technologies

Surveillance is using some of the most advanced and sophisticated technology to keep track of individuals; where they go, what they do and even what they say.

Visual and audio surveillance are almost everywhere, and, modern electronic technology gives the possibility of keeping track of individual’s moments without cameras or microphones, just with surveillance of their data (Dataveillance )

1. Visual Surveillance

Closed-circuit TV (CCTV) is the most common electronic visual surveillance technique.

Recording can be in two modes: real-time or time-lapse. Real-time is regular TV (at 30 frames (second) showing full motion). Time-lapse selects only a few frames per time period, perhaps one or two per second, to record. The advantage of time-lapse is that it allows one tape to record for a much longer time than real time recording

Video electronics can be very sophisticated indeed and the recent trend is digital video. This allows using the QUAD recording system, a method of compressing four separate camera images into a single frame, so that the guard could see all four views on the monitor screen and record them on a VCR (Video Cassette Recorder) at the same time. These systems allow detailed surveillance and plant monitoring, so that responsibles can observe everything happening within the facility.

In the previous years may be, only the entrance (or specific spaces) would be under video surveillance. Now it is possible to have surveillance everywhere. Using hard disks instead of videotape allows keeping a record of several month’s worth of time-lapse video.

Cameras also are much more sophisticated today than years ago. New circuits allow the camera to ignore bright, light-emitting objects within their fields of view. Miniaturization allows easier concealment, infra-red cameras allow surveillance in darkness. Video surveillance is portable as well. The old days of concealing a camcorder in a briefcase or duffel bag have given way to subminiature cameras concealed in neckties and other items. Decoy items (items containing the surveillance equipment) include baseball caps, belt buckles, briefcases, eyeglasses and wristwatches.

CCTV is very quickly becoming an internal part of crime control policy, social control theory and Community consciousness. It is promoted by police and politicians as primary solution for urban dysfunction.

They are now used in many areas, including roads, trains, railway platforms, car parks, loading docks, shopping centers, individual retail stores, banks, automatic teller machines, petrol stations, lifts, lobby areas, cash handling and storage areas and employee recreation rooms.

Within the aims of the contract, this study looks at its usage in five main industrial contexts: retail stores, financial services, manufacturing, warehousing and distribution, larger office buildings and leisure and entertainment complexes.

Video surveillance is used in these industries for several reasons:

to minimize the risk of theft, especially in the retail industry for purposes of deterring and detecting crime
protect premises from threats to property such as sabotage, arson and vandalism
to monitor individual employee work performance
to improve customer service by observing peak periods and planning the allocation of staff throughout the day
to assist in staff training
to enhance health and safety standards
to ensure that employees comply with legal obligations
to protect employers from liability claims
to monitor production processes.

Most surveillance systems are being installed to prevent theft, either by outsiders or employees, but, video surveillance systems often are used for a range of purposes beyond what was originally intended. Surveillance systems which are initially installed for the purpose of protecting property against an external security threat can be used for other purposes, such as to monitor employees’ productivity and work behavior.

The routine use of video surveillance has the potential to undermine employees’ sense of privacy and dignity in the workplace. Surveillance is associated with increased levels of stress, undermining morale and creating distrust and suspicion between employees and management. While it may be an effective instrument to protect an employer from external security threats, it is not appropriate as a means of monitoring individual employee performance.

Covert surveillance with a smaller number of hidden cameras may in fact be a much popular and at the same time cheaper option than a general security system.

Some of the justifications offered for covert video surveillance are:

employers have a right to protect their business interests
covert surveillance affect fewer employees than overt surveillance and is much cheaper
if employees are unaware of surveillance, there is less risk of individual disputation
covert surveillance is often the most effective means of detecting unlawful activity.

2. Audio Surveillance

Audio surveillance is no longer merely an arcane art practiced by spies and private detectives. Today, it’s common place and spreading. Tape recorders are a fact of life, and they’re often used to document a transaction. Trying to telephone some companies and some government agencies there is a recording sign says: “This transaction is being recorded to help us assure …”.

In some companies the real purpose of tape recording conversation is to check how may the handle an hour, and to have evidence in case the customer says something that can used against him.

In prisons, officials often use electronic equipment to record all telephone conversations. Some of these are between lawyer and client, but all they go onto tape. It depends on the ethics of the guards whether they listen or not.

They are “high tech voice recorders” that put every conversation on a CD disk. A model made for correctional use is the “Laser voice”, using optional disk voice recording.

“Tube mike” is an electric device for “bugging” a room, motor vehicle, or other premises. It is a plastic tube passed through a small hole in a wall to conduct sound from the room to a small microphone at the other end.

This could be characterized as “non- access surveillance”.

“Tube microphones” come in all sizes. Some are relatively large plastic tubes (about 1/2” in diameter), but for tight spaces or maximum concealment there are “needle microphones” pressed against a wall to hear sounds in the next room.

If there is access to a room, a bug could be planted almost anywhere, even in the subject’s clothing. “Radio mikes” transmit whatever they pick up to a nearby receiver eliminating the need for tell-tale wires. Their only drawback, if they’re totally self-contained, is battery life. Other models fit into wall plugs, and take their power from the house current

One type of portable radio mike is the size and shape of a credit card, with a range of several hundred feet and a 30-hour battery life. Placed into the beast pocket of the subjects jacket, it permits monitoring a conversation held outdoors. The value of this is that many people think its possible to overhear a conversation held on the street or in a park, and that walking will defeat any prospect of a bug planted nearby.

In the open market there are several models of “gimmicked telephones” that use in the built in microphone to pick up any conversation in the room even when the telephone is not in use.

All the types of audio surveillance with miscellaneous bugging devices described before, are used today mainly in police and internal security agencies (such as FBI, NSA etc) or in companies security departments.

Telephone tapping still exists, but with today’s Electronic Switching System (ESS) its no longer necessary to go out and physically tap a person’s telephone line.

3. Phone Tapping and Encryption

Whenever a telephone line is tapped the privacy of the persons at both ends of the line is invaded and all conversations between them upon any subject and although proper, confidential and privileged ma be overheard.

The phone tapping normally used for surveillance of communications to combat “serious crime” and to protect “national security”.

On the other hand often companies keep records of phone numbers calls and the duration of such calls. In some companies these records are used to gauge job performance, while in others it simply allows employees to review calls and reimburse the employer for calls of a purely personal nature.

4. Voice and Word Pattern Recognition

Since it is no possible for an Agency or organization to employ a staff large enough to listen to all telephone conversations, read all faxes, etc, word recognition has to be computerized.

In this case a central computer could monitor all (or a group) of telephone conversations and recognize those in which the agency had an interest by using voice patterns and key words.

A wide variety of techniques are used to perform speech recognition. Typically speech recognition starts with the digital sampling of speech. The next stage is acoustic signal processing. Most techniques include spectral analysis e.g. LPC (Linear Predictive Coding), MFCC (Mel Frequency Cepstral Coefficients) cochlea modeling and many more.

The next stage is recognition of phonemes, groups of phonemes and words. This stage can be achieved by many processes such as DTW (Dynamic Time Warping), HMM (Hidden Markov modeling), expert systems and combination of techniques.

Most systems utilize some knowledge of the language to aid the recognition process. Some systems try to “understand” speech. That is try to convert the words into a representation of what the speaker intended to mean or achieve by what they said.

Voice and pattern recognition used as an advanced tool and a helpful technique (thanks to the IT) for surveillance of communications to combat “serious crime” or to protect “national security”

5. Proximity Smart Cards

Originally, electronic cards were substitutes for keys, which were too easy to reproduce. A metal key blank and a file where all that were necessary to duplicate a key, but more sophisticated equipment is necessary to duplicate even the simplest sort of electronic card.

The first type of electronic card used barium ferrite as magnetic dots embedded in the magnetic layer. This was a significant advance over punched cards, that were relatively easy to duplicate.

In the early 1970s, magnetic stripe cards were produced (by IBM), which are still used in credit cards and are somewhat more secure. However, they’re still too easy to forge and should pass through a magnetic stripe reader.

In the early 1980s, the advent of Application Specific Integrated Circuit (ASIC) technology, resulted in what quickly become known as “smart card” which could hold a variety of codes and information to make misuse or duplication almost impossible. This was the first “proximity card”, which did not require direct contact through a card recorder.

The proximity card is basically a “transponder” an electronic device that replies to a radio signal that “interrogates” it. The extended range model doesn’t require even placing it near the card reader, as it transmits to a receiver several feet away.

Use of proximity smart card as Transport card / E-purse

Transportation companies use the proximity smart cards to replace metro, bus, train tickets and boarding cards, etc.
The proximity smart card results in considerable time saving by greatly increasing passenger flow without diminishing security
With the contact part of the card, the proximity smart card is perfectly suited to financial transactions involving small amounts of money: automatic vending cafeterias, local shops, parking fees, cinemas, recreation / amusement parks, cultural and sports centers etc.

Use of proximity smart card as Access control / ID card

The company Proximity smart card contains data used to identify cardholders, as well as his own different access rights. The contactless part of the card is used to access building and other protected areas.
The contact portion can be used for network access, such as the Internet. With the electronic purse function it can be used in the company restaurant, at automatic vending machines, just like a traditional multi-service card.

One application, although, extends the proximity card’s usefulness by turning it into a tracking device. Proximity readers installed along the walls of a building allow tracking each card within the facility. If somebody is carrying one of these cards within a building so equipped, the central computer can sense exactly where he (she is at all times). There is a record of which area the employee (or visitor) is in, when he leaves, and where else within the building he may go. If the employee goes to the cafeteria, the computer will log when he lefts his work station, how long it took him to get to the cafeteria, which root he took, how long he remained in the cafeteria, when he started back and by which route, and when he arrived back in his work area. Likewise if he went to the bathroom. The computer can record whether he/she went to the men’s room or the ladies’ room.

Many countries are actively considering adopting national ID cards for the variety of functions. These include the United States, United Kingdom and Canada.

There are ID cards (credit cards) used for digital cash service which is supposed to be “anonymous”. But, it appears that the bank and the merchants could find the identity of the users.

The customer is identified to the trader and ultimate to the bank by the 300 previous transactions. Each of these will soon be superseded by further transactions and drop off end of the list.

These can be monitored by the bank and could be used for marketing purposes. This is the audit trail and could be sold to business users for third party marketing.

6. Transmitter Location

When a telephone or mobile phone used, the location of the user could be identified. The science of location radio uses three methods of finding a transmitter. The oldest is triangulation, in which several receiving stations with directional antennas take bearing on a transmission and communicate the bearing to a central plotting room.

Technicians trace each bearing on a map of the area and the intersection of the bearing pinpoints the location of the transmitter.

The second method requires several receives as well, and works by measuring the relative strengths of signals received. A computer analyses the strengths and determines the location of the transmitter

The third method also requires a computer-controlled chain of receives and measures the minute differences in the time the signal arrives at each receiver.

Formerly classified, these techniques are now available on the civilian market for law enforcement and private security. One application is locating stolen cars by pinpointing radio transmitters installed in the vehicle for this purpose.

Location of cellular phones in another application. Police today are using (in some countries) this application to pinpoint the location of cellphone users. Purportedly, this is to speed emergency response when a citizen calls for help (at home or in the road). Once the equipment is in place, it can, and must, serve other purposes. Criminal investigators will be able to pinpoint a specific cellphone each time the caller uses it, this will help an investigation into a stolen cellphone, or help locate wanted persons unwise enough to use cellphone or mobile phone.

Another device, sold only to police, is the “cellphone ESN Reader”, which reads the numbers of the targeted cellphone. This detects and records the cellular phone number, called number and ESN of the target phone of a ranges of up to two miles.

Theoretically, the technology can locate every cellphone and every mobile phone in the country every time someone makes a call on it (for cellphones) or just open it (for mobile phones).

7. E-mail at workplace

Personal messages the employee sent over his company’s e-mail are not private. They are not, and court decisions have held that they’re not.

It is a safe assumption that companies will keep an increasingly watchful eye on their internal email, and scrutinize what employees are saying to each other. It is easy to see that some companies may find that scrutinising staff e-mail can have more than one advantage for a company management. Originally instigated to avoid liability, reading employee’s e-mail can also serve to alert management of dishonesty, disloyalty or even matters like union activity.

8. Electronic Databases

The computer age has brought surveillance into a new era in which information about almost anybody is available to almost anybody.

Databases from Human Identification

There are a lot of government databases containing information about almost every resident in United States and in many European Countries as well.

A variety of person identification techniques are available, which can assist in associating data with them. Important examples of these techniques are:

names (what the person is called by other people)
codes (what the person is called by the organization)
knowledge (what the person knows)
biometrics (what the person is, does, or looks like e.g. appearance, natural physiography, etc.)

Data bases for financial surveillance

Financial records are gathered privately by several giant companies that specialize in this sort of information. These “credit reporting bureaus” purportedly maintain credit records, but in fact keep far more than credit information in their databases.

Other databases for human identification

There exist specialized databases available mainly to private investigators. These call information from telephone directories, city directories, voter registration records and many other public and private records to provide a profile of the person being investigated.

9. The Internet

The Internet, which began as a Computer communication network between Universities and laboratories decades ago, has turned into a vast public forum accessible to anyone with a computer.

International organizations, Public authorities, Companies, Universities, Research centers and individuals have access and exploit the Internet.

On the other hand Internet became:

an entertainment tool
a huge Information source
an important marketing tool
a big virtual electronic market with a considerable number of economic transactions every second

IT technology at the same time, restricted the individuals’ right to privacy since they could be identified through their ID number or through their records or transactions.

The growing rift between the needs of Internet Commerce and the individual’s right to privacy gave rise to the development of new tools.

In January 1999 Intel announced its plans for the development of a microchip containing embedded electronic serial numbers that allow individual computers to be readily identified.

The identities, similar to the unique vehicle identification numbers on cars and trucks would be a caller ID technology for computer.

But critics see it is on an ominous development, ushering in a new period of electronic surveillance. Privacy experts fear the new Intel chip could mean the death of anonymity on the Internet.

But this would appear to really variously endanger privacy on the Internet by creating a permanent ID number for every Intel user on the Net.

3. THE USE OF SURVEILLANCE TECHNOLOGY SYSTEMS FOR THE TRANSMISSION AND COLLECTION OF ECONOMIC INFORMATION

As the Internet and other communication systems reach further into the everyday lives, national security, low enforcement and individual privacy have become perilously intertwined. Governments want to restrict the free flow of information and software producers are seeking ways to ensure consumers are not bugged from the moment of purchases.

All developing communication technologies, digital telephone switches cellular and satellite phones HAVE SURVEILLANCE CAPABILITIES. On the other hand the development of software that contains encryption, a telephone which allows people to scramble their communications and files to prevent others from reading them gourd earth [sic].

3.1 CALEA system

The first effort to heighten surveillance opportunities (made by USA) was to force telecommunication companies to use equipment desired to include enhanced wiretapping capabilities.

In the late 1980s in a program known internally as “Operation Root Canal” US low enforcement officials demanded that telephone companies alter their equipment to facilitate the interception of messages. The companies refused but, after several years of lobbying, Congress enacted the Communications Assistance for Law Enforcement ACT (CALEA) in 1994.

CALEA requires that terrestrial cellular phone services and other entities ensure that all their equipment, facilities or services are capable of expeditiously, enabling the government to intercept all wire and oral communications varied by the carrier concurrently with their transmission.

Communications must be interceptable in such a form that they could be transmitted to a remote government facility. Manufactures must work with industry and low enforcement officials to ensure that their equipment meets federal standards.

The passage of CALEA has been controversial, but its provisions have yet to be enforced due to FBI efforts to include even more rigorous regulations under the law. These include: the requirement, the cell phones allow for location – tracking on demand and that telephone companies provide capacity for up to 50.000 simultaneous wiretaps.

CALEA finally has been accepted as an International standard in US. In 1991 the FBI contacted EU member states in order to propose to them do incorporate CALEA into European Law. This plan according to an EU report, was to call for the Western World (EU, US and allies) to agree to norms and procedures and then sell their products to Third World countries. There is a council resolution that was adopted on 17 January 1997 on the lawful interception of communications (961C329/a). The US government is now in negotiations with the International Telecommunications Unit (ITU) to adopt the standards globally.

3.2 ECHELON Connection

The previous STOA Interim Study (PE 166.499) entitled “An Appraisal of technologies of political control” made certain statements concerning the ECHELON global surveillance system. This is reported to be a world-wide surveillance system designed and coordinated by the US NSA (National Security Agency) that intercepts e-mail, fax, telex and international telephone communications carried via satellites and has been operating since the early 1980s – it is part of the post Cold War developments based on the UK-USA agreement signed between the UK, USA, Canada, Australia and New Zealand in 1948.

The five agencies said to be involved are: the US National Security Agency (NSA), the Government Communications Security Bureau (GCSB) in New Zealand, Government Communications Headquarters Signals Directorate (DSD) in Australia. The system was brought to light by the author Nicky Hager in his 1996 book Secret Power: New Zealand’s role in the International Spy Network. For this, he interviewed more than 50 people who work or have worked in intelligence who are concerned at the uses of ECHELON. It is said that “The ECHELON system is not designed to eavesdrop on a particular individual’s e-mail or fax link. Rather, the system works by indiscriminately intercepting very large quantities of communications and using computers to identify and extract messages from the mass of unwanted ones”.

According to Interim Study (PE 166.499) of 1998, there are reported to be three components to ECHELON:
1. The monitoring of Intelsats, international telecommunications satellites used by phone companies In most countries. A key ECHELON station is at Morwenstow in Cornwall monitoring Europe, the Atlantic and the Indian Ocean.

2. ECHELON interception of non-Intelsat regional communication satellites. Key monitoring stations are Menwith Hill in Yorkshire and Bad Aibling in Germany.

3. The final element of the ECHELON system is the surveillance of land-based or under-sea systems, which use cables or microwave tower networks.

At present it is thought ECHELON’s effort is primarily directed at the “written form” (e-mails, fixes, and telexes) but new satellite telephones system which take over from old land-based ones will be as vulnerable as the “written word”.

Each of the five centres supply to the other four “Dictionaries” of keywords, phrases, people and places to ‘stag” and tagged intercept is forwarded straight to the requesting country.

It is the interface of the ECHELON system and its potential development on phone calls combined with the standardisation of”tappable” telecommunications centres and equipment being sponsored by the EU and the USA which presents a truly global threat over which there are no legal or democratic controls.

The earlier study (PE 166.499) identified a number of options for the European Union, centred round the proposition that:
“All surveillance technologies, operations and practices should be subject to procedures to ensure democratic accountability and there should be proper codes of practice to ensure redress if malpractice or abuse takes place. Explicit criteria should be agreed for deciding who should be targeted for surveillance and who should not, how such data is stored, processed and shared. Such criteria and associated codes of practice should be made publicly available.”

Other points included:
– All requisite codes of practice should ensure that new surveillance technologies are brought within the appropriate data protection legislation.

– Given that data from most digital monitoring systems can be seamlessly edited, new guidance should be provided on what constitutes admissible evidence. This concern is particularly relevant to automatic identification systems which will need to take cognizance of the provisions of Article 15, of the 1995 European Directive on the Protection of Individuals and Processing of Personal Data.

– Regulations should be developed covering the provision of electronic bugging and tapping devices to private citizens and companies, so that their sale is governed by legal permission rather than self regulation.

– Use of telephone interception by Member states should be subject to procedures of public accountability referred to in (1) above. Before any telephone interception takes place a warrant should be obtained in a manna prescribed by the relevant parliament. In most cases, law enforcement agencies will not be permitted to self-authorise interception except in the most unusual of circumstances which should be reported back to the authorising authority at the earliest opportunity.

– Annual statistics on interception should be reported to each member states’ parliament. These statistics should provide comprehensive details of the actual number of communication devices intercepted and data should be not be aggregated. (This is to avoid the statistics only identifying the number of warrants, issued whereas organisations under surveillance may have many hundreds of members, all of whose phones may be subject to interception).

– Technologies facilitating the automatic profiling and pattern analysis of telephone calls to establish friendship and contact networks should be subject to the same legal requirements as those for telephone interception and reported to the relevant member state parliament.

– The European Parliament should reject proposals from the United States for making private messages via the global communications network (Internet) accessible to US Intelligence Agencies. Nor should the Parliament agree to new expensive encryption controls without a wide ranging debate within the EU on the implications of such measures. These encompass the civil and human rights of European citizens and the commercial rights of companies to operate within the law, without unwarranted surveillance by intelligence agencies operating in conjunction with multinational competitors.

3. Inhabitant identification Schemes

Inhabitant identification schemes are schemes, which provide all, or most people in the country with a unique code and a token (generally a card) containing the code.

Such schemes are used in many European Countries for a defined set of purposes, typically the administration of taxation, natural superannuation and health insurance. In some countries, they are used for multiple additional purposes.

4. THE NATURE OF ECONOMIC INFORMATION SELECTED BY SURVEILLANCE TECHNOLOGY SYSTEMS

A. From telecommunication systems

Concerning public authorities and organizations:

secret telephone conversations, fax messages and electronic mail
sensitive information concerning taxation
information concerning various fund transfers especially from one service to the other and financial transactions
data used in the critical banking infrastructure systems

Concerning business:

private business communication, including telephone conversations, fax messages and electronic mail
order from fund transfers and other financial transactions (e.g. payments by credit cards by fax)
sensitive business information and trade secrets

Concerning individuals:

private conversations, fax messages, e-mail
payments by credit cards
secret information concerning taxation

B. From new information technologies (Internet)

Concerning public authorities and organizations:

sensitive information and state secrets
tele-banking
tax records and other financial information
data used in the operation of critical infrastructure systems
public contracts received by electronic mail

Concerning business:

contracts
invoices and other official documents
secret electronic transactions
risk of international property and license in secret transactions
payment orders by credit cards
payments received on-line

Concerning consumers and individuals:

payment by credit cards
payment on-line
contracts and agreements
electronic financial transactions (e.g. tele-banking).

C. Some examples of data collection on tSe Internet

Data can be collected over the Internet either directly or indirectly; in other words, it can be collected either at the time of contact with a correspondent or without the knowledge of the person concerned, often automatically. The nature of the data collected varies according to the protocol used on the network i.e. according to the type of service. In practice, different protocols are very often used in combination to augment the profitability or quality of exchanges. For example, a Web page may propose an exchange of correspondence or a transfer of documents via links with the e-mail protocol and the protocol used for transferring files, which is more powerful.

When electronic messaging is used (Simple Mail Transfer Protocol — SMTP, and Network News Transfer Protocol — NNTP), communication is established from one personal mailbox to another, or between a personal mailbox and a mailbox common to a number of correspondents. The information transmitted consists of the name and e-mail address, the server address and the signature file (sig.file) if created by the user of the machine. If a communication is addressed to a joint mailbox, this information is given out to an indeterminate number of correspondents, participation in a discussion group being theoretically free. As a result, any person listed on a distribution list can at the very least obtain the e-mail addresses of all other listed parties, since this information is provided automatically for purposes of communication on a given topic.

While most downloading (File Transfer Protocol — FTP) is done anonymously, with only the network’s Internet Protocol — IP — address being revealed, the same cannot be said for document presentation (World Wide Web — WWW, Hyper Text Transfer Protocol — HTTP). The minimum information revealed at each step in the Web is the name of the network machine making the request and the type of browser being used. Browsers contain an identification — ID — file which, is configured by the user or at the user’s request, stores various personal data such as the user’s name or e-mail address. If a Web server requests this information, it can be automatically given out.

A Web server can also send out information, which is stored by the user’s navigator (so-called ‘cookies’) and retrieved at a subsequent connection to the server. This system indicates that a visitor has been there before, but without revealing his identity: identification requires matching with other information. As a result, when linked to the ID file incorporated into the browser and transmitted to a server, the information recorded in cookies c-an yield valuable user profiles. It can be noted, however, that some navigations — to a varying and often inadequate extent — allow use of these cookies to be blocked.

5. PROTECTION FROM ELECTRONIC SURVEILLANCE

A. Encryption (Cryptography)

Finally, new information technologies include the privacy of individuals, the security of data in the computer or on the network, and the availability of encryption software to protect data in the event they are intercepted. In this context, privacy refers to controlling the dissemination and use of data, including information that are unintentionally revealed as a by-product of the use of the information technologies themselves.

Security refers to the integrity of the data storage, processing, and transmitting systems and includes concerns about the reliability of the hardware and software, the protections against intrusion into the theft of the computer equipment, and the resistance of computer systems to infiltration by unpermitted users, that is, “hacking”. Encryption is the practice of encoding data so that even if a computer or network is compromised, the data’s content will remain secret. Security and encryption issues are important because they are central to public confidence in networks and to the use of the systems for the sensitive or secret data, such as the processing of information touching on national security. These issues are surpassingly controversial because of governments’ interest in preventing digital information from being impervious to official interception and decoding for low enforcement and other purposes.

Private sector initiatives

A large number of private sector interests, in the United States in particular, are attempting, a view to fostering electronic commerce, to promote technological solutions that will provide a a1 practical response to consumers concerns while still preserving business interests. In other words, they are starting to explore ways and means of making privacy work in communication networks. These initiatives go in the right direction and it would be worthwhile for governments to engage in a dialogue on the basis.

As an example, Netscape joined by Microsoft, is leading an industry initiative (40 companies) to cope with privacy issues and proposes standard software intended to enable computer users to control what personal information is obtained when they visit Internet sites and how the information is used, as well as avoid unwanted e-mail. The proposal, called the OPS — Open Profiling Standard –, which has been submitted to the World Wide Web Consortium — W3C, provides the users with a way to pre-package the personal registration information Web sites may require. At the same time, OPS lets users control when and how much of their personal profiles can be passed to a third party. OPS would have users fill out profiles and preference information in a standard that could be identified by a digital certificate (that would give a guarantee from a trusted third party that the person is really who they say they are). The standardized format and brand names associated with the profile forms would be incorporated, in the case of Netscape, into the Communicator browser. According to some specialists, OPS is an addition to rather than replacement for the intrusive cookie method of tracking user information.

Another project is the new W3C Platform for Privacy Preferences (P3) Project developed by the W3C. The P3 Project is a platform on which other technological, market and regulatory solutions can interoperate and build. The P3 prototype allows Web sites to easily describe their privacy practices as well as users to set policies about the collection and use of their personal data. A flexible ‘negotiation’ between the Web site’s practices and the user’s preferences allows service to offer the preferred level of service and data protection to the user. If there is a match, access to the site is seamless; otherwise the user is notified of the difference and is offered other access options to proceed. With P3, users can download ‘recommended’ settings established by organizations such as industry associations and consumer advocacy groups. According to some privacy specialists, P3 requires users to disclose privacy preferences when good privacy policies should provide meaningful information for users about Web site practices and not require users to disclose personal information.

Techniques to provide users with more information about privacy practices are also being developed. For instance, a number of companies and service operators have a privacy Icon which appears either when the user enters a site, or when the user starts to provide information. The Icon can either lead by hyper-link to a sophisticated service providing details of the company’s (service operator) data protection policies and a tick box(es) allowing the user to opt out of having his/her data used foe specific purposes, or the icon can lead to page referring the user, for example, to an address from which further details are available.

Another example is the development of services and branding techniques, which intend to provide, dear meaningful designations for privacy practices such as TRUSTe, formerly eTRUST.

The TRUSTe program will focus on addressing privacy issues concerning data collection on the Internet. With an emphasis on analysing consumer fears surrounding electronic commerce, the program will utilise Web site icons (trustmarks) to alert online consumers to the uses of their personal information.

To further consumer privacy the TRUSTe program will utilise a standardised method of informed consent. A branded system of ‘trustmarks’ or logos, representing the Web site’s information privacy policy for users’ personal information, will alert consumers to how the information they reveal online will be used.

The three trustmarks will be:

No Exchange – no personally identifiable information is used by the site.
One-to-one Exchange is collected only for the site owner’s use.
Third Party Exchange – data is collected and provided to specified third parties but only with the user’s knowledge and consent.

The TRUSTe initiative was launched in July 1996 by the Electronic Frontier Foundation (EFF) and a group of pioneering Internet companies. CommerceNet and the EFF then partnered in October 1996 to move forward in implementing the initiative.

TRUSTe is a global, non-profit initiative to establish trust and confidence in electronic communication by creating an infrastructure to address online privacy issues. Comprised of premier members from the electronic commerce industry, the program assures consumer privacy through a progressive policy of informed consent utilising a branded system of ‘trustmarks’, which represent a company’s online information privacy policy.

Finally, systems for implementing on-line E-mail Preference Services (EPS) or ‘E-mail Robinson Lists’ are also under consideration (EPS allow consumers who do not wish to receive e-mails to be excluded from lists, the common database used to register opt out demands being then used to clean marketing lists). As an example, a software package is being developed in the USA which would allow consumers to register on-line; would be secure from intruders, and yet user-friendly for industry to clean their E-mail marketing lists; and which could be serviced easily by the operator (the Direct Marketing Association (DMA-US)). A similar system will be developed in the United Kingdom, and it is planned that these two countries would then spearhead a Global Convention on EPS inviting other DMSs to join. Another proposal, which has yet to be fully considered by industry, comes from the UK data protection Registrar, which has suggested a mechanism enabling the consumers to indicate if they do not wish to be contacted be e-mail in their e-mail address. A universally agreed character (a marker) would indicate that the user does not want to receive any marketing solicitations. The user would also be free to make different choices: i.e. to use the marker when visiting one site and not to use it when visiting another. This system should be combined with others, such as the proposed E-mail Preference Service.

B. Key-recovery

Cryptography is a complex area, with scientific, technical, political, social, business, and economic dimensions.

For the purpose of this report, ‘key recovery’ systems are characterized by the presence of some mechanism for obtaining exceptional access to the plain text of encrypted traffic. Key recovery might serve a wide spectrum of access requirements, from a backup mechanism that ensures a business’ continued access to its own encrypted archive in the event keys are lost, to providing covert law enforcement access to wiretapped encrypted telephone conversations. Many of the costs, risks, and complexities inherent in the design, implementation, and operation of key recovery systems depend on the access requirements around which the system is designed.

We focus specifically on key recovery systems designed to meet government access specifications. These specifications diverge in important ways from the needs of commercial or individual encryption users:

Access without end-user knowledge or consent — Few commercial users need (or want) covert mechanisms to recover keys or plain text data they protect. On the contrary, business access rules are usually well known, and audit is a very important safeguard against fraud and error. Government specifications require mechanisms that circumvent this important security practice.

Ubiquitous adoption — Government seeks the use of key recovery for all encryption, regardless of whether there is benefit to the end-user or whether it makes sense in context. In fact, there is little or no demand for key recovery for many applications and users. For example, the commercial demand for recovery of encrypted communications is extremely limited, and the design and analysis of key recovery for certain kinds of communications protocols is especially difficult.

Fast paths to plain text — Law enforcement demands fast (near real-time), 24-hour-a-day, 365-day-a-year access to plain text, making it impossible to employ the full range of safeguards that could ameliorate some of the risks inherent in commercial key recovery systems.

Encryption and the global information infrastructure

The Global Information Infrastructure promises to revolutionize electronic commerce, reinvigorate government, and provide new and open access to the information society. Yet this promise cannot be achieved without information security and privacy. Without a secure and trusted infrastructure, companies and individuals will become increasingly reluctant to move their private business or personal information online.

The need for information security is widespread and touches all of us, whether users of information technology or not. Sensitive information of all kinds is increasingly finding its way into electronic form. Examples include:

Private personal and business communications, including telephone conversations, fax messages, and electronic mail;
Electronic funds and other financial transactions;
Sensitive business information and trade secrets;
Data used in the operation of critical infrastructure systems such as air traffic control, the telephone network or the power grid; and
Health records, personnel files, and other personal information.

Electronically managed information touches almost every aspect of daily life in modern society. This rising tide of important yet unsecured electronic data leaves our society increasingly vulnerable to curious neighbors, industrial spies, rogue nations, organized crime, and terrorist organizations.

Paradoxically, although the technology for managing and communicating electronic information is improving at a remarkable rate, this progress generally comes at the expense of intrinsic security. In general, as information technology improves and becomes faster, cheaper, and easier to use, it becomes less possible to control (or even identify) where sensitive data flows, where documents originated, or who is at the other end of the telephone. The basic communication infrastructure of our techniques more and more frequently will become the only visible approach to assuring the privacy and safety of sensitive information as these trends continue.

Encryption is an essential tool in providing security in the information age. Encryption is based on the use of mathematical procedures to scramble data so that it is extremely difficult — if not virtually impossible — for anyone other than authorized recipients to recover the original ‘plain text’. Properly implemented encryption allows sensitive information to be stored on insecure computers or transmitted across insecure networks. Only parties with the correct decryption ‘key’ (or keys) are able to recover the plain text information.

Highly secure encryption can be deployed relatively cheaply, and it is widely believed that encryption will be broad}y adopted and embedded in most electronic and communications products and applications for handling potentially valuable data. Applications of cryptography include protecting files from theft or unauthorized access, securing communications from interception, and enabling secure business transactions. Other cryptographic techniques can be used to guarantee that the contents of a file or message have not been altered (integrity), to establish the identity of a party (authentication), or to make legal commitments (non-repudiation).

In making information secure from unwanted eavesdropping, interception, and theft, strong encryption has an ancillary effect: it becomes more difficult for law enforcement to conduct certain kinds of surreptitious electronic surveillance (particularly wiretapping) against suspected criminals without the knowledge and assistance of the target. This difficulty is at the core of the debate over key recovery.

Key-Recovery: Requirements and proposals

The United States and other national governments have sought to prevent widespread use of cryptography unless ‘key recovery’ mechanisms guaranteeing law enforcement access to plain text are built into these systems. The requirements imposed by such government-driven key recovery systems are different from the features sought by encryption users, and ultimately impose substantial new risks and costs.

Key recovery encryption systems provide some form of access to plain text outside of the normal channel of encryption and decryption. Key recovery is sometimes also called ‘key escrow’. The term ‘escrow’ became popular in connection with the U.S. government’s Clipper Chip initiative, in which a master key to each encryption device was held ‘in escrow’ for release to law enforcement. Today the term ‘key recovery’ is used as generic term for these systems, encompassing the various ‘key escrow’, ‘trusted third party’, ‘exceptional access’, ‘data recovery’, and ‘key recovery’ encryption systems introduced in recent years. Although there are differences between these systems, the distinctions are not critical for our purposes. In this report, the general term ‘key recovery’ is used in a broad sense, to refer to any system for assuring third-party (government) access to encrypted data.

Key recovery encryption systems work in a variety of ways. Early ‘key escrow’ proposals relied on the storage of private keys by the U. S. government, and more recently by designated private entities .

Other systems have ‘escrow agents’ or ‘key recovery agents’ that maintain the ability to recover the keys for a particular encrypted communication session or stored file; these systems require that such ‘session keys’ be encrypted with the key known by a recovery agent and included with the data. Some systems split the ability to recover keys among several agents.

Many interested parties have sought to draw sharp distinctions among the various key recovery proposals. It is certainly true that several new key recovery systems have emerged that they can be distinguished from the original ‘Clipper’ proposal by their methods of storing and recovering keys. However, our discussion takes a higher-level view of the basic requirements of the problem rather than the details of any particular scheme; it does not require a distinction between ‘key escrow’, ‘trusted third-party’, and ‘key recovery’. All these systems share the essential elements that concern us for the purposes of this study:

A mechanism, external to the primary means of encryption and decryption, by which a third party can obtain covert access to the plain text of encrypted data.
The existence of a highly sensitive secret key (or collection of keys) that must be secured for an extended period of time.

Taken together, these elements encompass a system of ‘ubiquitous key recovery’ designed to meet law enforcement specifications. While some specific details may change, the basic requirements most likely will not: they are the essential requirements for any system that meets the stated objective of guaranteeing law enforcement agencies timely access, without user notice, to the plain text of encrypted communications traffic.

6. SURVEILLANCE TECHNOLOGY SYSTEMS IN LEGAL AND REGULATORY CONTEXT

As a conclusion from this present Interim Study is the principle that WE HAVE TO CONSIDER PRIVACY PROTECTION IN THE CONTEXT OF A GLOBAL NETWORKED SOCIETY. And when we speak about electronic privacy in the exchange of economic information, we are speaking about one single thing above all others: Electronic Commerce over the Internet.

A. Privacy regulation

Multinational data protection measures

Enactment of data protection laws by individual European nations has been paralleled and, in some cases anticipated, by multinational actions. In 1980 the Committee of Ministers of the Organization for Economic Cooperation and Development (OECD) issued Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (guidelines). The guidelines outline basic principles for both data protection and the free flow of information among countries that have laws conforming with the protection principles. The guidelines, however, have no blinding force and permit broad variation in national implementation.

One year after the OECD issued its guidelines, the Council of Europe promulgated a convention, For the Protection of Individuals with Regard to Automatic Processing of Personal Data. The convention, which took effect in 1985, is similar to the guidelines, although it focuses more on the importance of data protection to protect personal privacy. The convention specifies that data must be obtained and processed fairly; used and stored only for legal purposes; adequate, relevant, and not excessive in relation to the purpose for which they are processed; accurate and up-to-date; and stored no longer than necessary. The document gives individuals the right to inquire about the existence of data files concerning them; obtain a copy of that data; and have false or improperly processed data corrected or erased.

The convention requires each of the member countries (now twenty-six) to enact conforming national laws. By 1992, however, when debate over the more detailed European Union data protection directive, discussed below, overtook the convention, only ten countries — Austria, Denmark France, Germany, Ireland, Luxembourg, Norway, Spain Sweden and the United Kingdom — had ratified the convention, while eight — Belgium, Cyprus, Greece, Island, Italy, Netherlands, Portugal and Turkey — had signed without ratification. The Council of Europe subsequently urged all European Union member states to ratify and implement the convention when it endorsed the European Commission’s proposal for a data protection directive. By 1997, all of the fifteen EU member states (except Greece, which is currently considering a privacy bill) and Switzerland have national legislation consistent with the convention.

Nevertheless, the resulting protection for personal privacy is far from uniform, for at least three reasons. First, some of the national data protection legislation existed before the adoption of the convention. Second, the convention was not self-executing and therefore permitted each country to implement its national laws conforming to the government’s terms in very different ways. Finally, the convention did not include definitions for important terms, such as what constitutes an ‘adequate’ level of data protection; as result, member countries were left free to adopt their own, inconsistent definitions in their national legislation.

Data protection directive in Europe

Although, legal protection for a ‘right of privacy’ originated in the United States, Europe was the site of the first privacy legislation and has been the source of most comprehensive privacy regulation.

Europe is the site of the first privacy legislation, the earliest national privacy statute, and now the most comprehensive protection for information privacy in the world. That protection reflects on apparent consensus within Europe that privacy is a fundamental human right which few in any other rights equal. In the context of European history and civil law culture, that consensus makes possible extensive, detailed regulation of virtually all activities concerning ‘any information relating to an identified or identifiable natural person’. It is difficult to imagine a regulatory regime offering any greater protection to information privacy, or greater contrast to U.S. law.

As a result of the variation and uneven application among national laws permitted by both the guidelines and the convention, in July 1990 the commission of the then-European Community (EC) published a draft Council Directive on the Protection of Individuals with Regard to the Processing of Personal Data and on Free Movement of Such Data The draft directive was part of the ambitious program by the countries of the European Union to create not merely the ‘common market’ and ‘economic and monetary union’ contemplated by the Treaty of Rome, but also the potential union embodied in the Treaty on European Union signed in 1992 in Maastricht.

The shift from economic to broad-based political union brought with it new attention to the protection of information privacy. On March 1 1, 1992, the European Parliament amended the commission’s proposal to eliminate the distinction in the 1990 draft between public and private sector data protection and then overwhelmingly approved the draft directive. On October 15, 1992, the commission issued its amended proposal; on February 20, 1995, the Council of Ministers adopted a Common Position with a View to Adopting Directive 95/46/EC of the European Parliament and of the Council on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data. The directive was formally approved on October 24, 1995, and took effect three years later.

Privacy regulation in the United States

The protection for the information privacy in the United States is disjoined, inconsistent, and limited by conflicting interests. There is no explicit constitutional guarantee of a right to privacy in the United States. Although the Supreme Court has fashioned a variety of rights out of the Bill of Rights and the Fourteenth Amendment, ‘information privacy’ has received little protection, primarily based on the Fourth and Fourteenth Amendments. In the Fourth Amendment arena, the Court has found constitutional violations when the police have searched for or seized records without a warrant or meeting one of the exceptions to the warrant requirement. The Court, however, has written that the Fourth Amendment privacy right has little application outside of the context of the investigation and prosecution of criminal activity. Moreover, this protection against such searches does not extend to information controlled by a third person. Under the Fourteenth Amendment, the Court has recognized a constitutional right restricting the government from compelling individuals to disclose certain personal information. This right protects only the interest of an individual in not disclosing certain information, and that right is evaluated under intermediate scrutiny, as opposed to the strict scrutiny required when fundamental rights are at stake

As with all constitutional rights, these apply only against the government, not private actors. The requirement for state action and the ‘negative’ nature of constitutional rights require only that the government refrain from taking actions that impermissibly invaded individuals’ information privacy rights, not that the government take steps to affirmatively protect those rights. The Constitution also requires, however, that the government avoid actions that infringe other rights enumerated therein, such as the protection for expression in the Fifth Amendment, the government cannot take private property, whether by physical occupation or extensive regulation, without according due process and paying just compensation to the owner.

Outside of the constitutional arena, protection for information privacy relies on hundreds of federal and state laws and regulations, each of which applies only to a specific category of information user (such as the government or retailers of videotapes), context (applying for credit or subscribing to cable television), type of information (criminal records or financial information), or use for that information (computer matching or impermissible discrimination). PrivacY laws in 49 the United States most often prohibit certain disclosures, rather than collection, use, or storage, of personal information. When those protections extend to the use of personal information, it is often as a by-product of legislative commitment to another goal, such as eliminating discrimination. And the role provided for the government in most U. S. privacy laws is often limited to providing a judicial form for resolving disputes.

Passage of the privacy provisions in the Cable Communications Policy Act, and recent passage of the Consumer Credit Reporting Reform Act and the CPNI provision of the Telecommunications Act, demonstrate that Congress can enact serious privacy protection, even if limited to narrow sectoral environments. The later two acts and the expanding debate in Washington over the privacy evince the growing attention to the development of laws and regulations to protect privacy.

However, as the limits and exceptions within existing privacy laws indicate, privacy protection in the United States is fundamentally in tension with other cherished values. The legal regulation of privacy is significantly influenced by the importance placed by society on the prevention of crime and prosecution of criminals, free expression and an investigatory press, the acquisition and use of property, and a limited role for government involvement in daily life. A comparison of the legal regimes of the EU and the United States suggests that the Europe privacy is more valued and less in conflict with other widely shared values.

B. Protection of Privacy in the telecommunications sector

Directive 97/66/EC of the European Parliament and the Council of the 15 December 1997 concerns the processing of personal data and the protection of privacy in the telecommunications sector.

This directive provides for the harmonisation of the provisions of the member states required to ensure an equivalent level of protection of fundamental rights and freedom, and in particular the right to privacy, with respect to the processing of personal data in the telecommunications sector and to ensure the free movement of such data and telecommunications equipment and services in the Community.

The provision of this directive particularises and complements the directive 95/46/EC for the purpose mentioned above. Moreover they provide for protection and legitimate interests of subscribers who are legal persons.

This directive shall not apply to the activities which fall outside the scope of Community law, such as those provided for by titles V and VI of the treaty on European Union, and in any case to activities concerning public security, defence, state security (including the economic well being of the state when the activities relate to state security matters) and the activities of the state in areas of criminal law.

C. Cryptography

Cryptography policy in USA

It is part of the strategy to ensure that police and intelligence agencies could understand every communication they intercepted.

They attempted to impede the development of cryptography and other security measures, fearing that these technologies would reduce their ability to monitor the emissions of foreign governments and to investigate crime.

A survey by the Global Internet Liberty Campaign (GILC) found that most countries either rejected domestic controls or not addressed the issue at all. The GILC found that many countries, large and small, industrialised and developing, seem to be ambivalent about the need to control encryption technology.

The FBI and the National Security Agency (NSA) have instigated efforts to restrict the availability of encryption world-wide, in the early 1970s, the NSA’s pretext was that encryption technology was ‘born classified’ and, therefore, it dissemination fell into the same category as the diffusion of A-bomb materials. The debate went underground until 1993 when the US launched the Clipper Chip, an encryption device designed for inclusion in consumer products. The Clipper Chip offered the required privacy, but the government would remain a ‘pass- key’ — anything encrypted with the chip could be read by government agencies.

Behind the scenes, law enforcement and intelligence agencies were pushing hard for a ban on other forms of encryption. In a February 1993 document, obtained by the Electronic Privacy Information Centre (EPIC), recommended ‘Technical solutions, such as they are, will only work if they are incorporated into all encryption products. To ensure that this occurs, legislation mandating the use of government-approved encryption products, or adherence to government encryption criteria’. The Clipper Chip was widely criticised by industry, public interest groups, scientific societies and the public and, though it was officially adopted, only a few were ever sold or used.

From 1994 onwards, USA began to woo private companies to develop an encryption system that would provide access to keys by government agencies. Under the proposals — variously known as ‘key recovery’ or ‘trusted third parties’ — the key would be held by a corporation, not a government agency, and would be designed by the private sector, not the NSA. The systems, however, still entitled the assumption of guaranteed access to the intelligence community and so proved as controversial used export incentives to encourage companies to adopt key escrow products: they could export stronger encryptions but only if they ensured that intelligence agencies had access to the keys.

Under US law, computer software and hardware cannot be exported if it contains encryption that the NSA cannot break. The regulations stymie the availability of encryption in the USA because companies are reluctant to develop two separate product lines – one, with strong encryption, for domestic use and another, with weak encryption, for the international market. Several cases are pending in the US courts on the constitutionality of export controls; a federal court recently ruled that they violate free speech rights under the First Amendment.

The FBI has not let up on efforts to ban products on which it cannot eavesdrop. In mid-1997, it introduced legislation to mandate that key-recovery systems be built into all computer systems. Several congressional committees adopted the amendment but the Senate preferred a weaker variant. A concerted campaign by computer, telephone and privacy groups finally stopped the proposal; it now appears that no legislation will be enacted in the current Congress.

Cryptography policy guidelines from OECD

The organisation for Economic Co-operation and Development in 1997 issued a report on cryptography policy entitled: CRYPTOGRAPHY POLICY: THE GUIDELINES AND THE ISSUES (OCOE / GD (97) 204). The basic principles (each of which addresses an important policy concern) are independent and should be considered as a whole so as to balance the various interests. The principles are:

Trust in cryptographic methods: Users should be trustworthy in order to generate confidence in the use of information and commercial data.
Choice of Cryptographic methods: Users should have a right to choose any cryptographic method, subject to applicable law.
Market driven development of cryptographic methods: Cryptographic methods should be developed in response to the needs, demands and responsibilities of individuals, business and governments.
Standards for cryptographic methods: Technical standards, criteria and protocols for cryptographic methods should be developed and promulgated at the national and international law.
Protection of privacy and Personal data: the fundamental rights of individuals, to privacy, including secrecy of communications and protection of personal data, should be respected in national cryptography policies and in the implementation and use of cryptographic methods.
Lawful access: National cryptography policies may allow lawful access to plain text, or cryptographic keys, of encrypted data. These policies must respect the other principles contained in the guidelines to the greatest extent possible.
Liability: whether established by contract on legislation, the liability of individuals and entities that offer cryptographic services or hold or access cryptographic keys should be clearly stated.
International co-operation: Governments should cooperate to coordinate cryptography policies. As part of this effort, governments should remove, or avoid creating in the name of cryptography policy, unjustified obstacles to trade.

Given the role of cryptography in the information and communications infrastructure and in developing electronic commerce, cryptography policy has the broader perspective to overlap with economic, legal and political aspects of a number of information systems, protection of privacy and personal data and intellectual property protection.

E.U. cryptography policy

Led by the Germany and the Scandinavians, the EU has been generally distrustful of key escrow technology. In October 1997, the European Commission released a report entitled: ‘Towards a European Framework of Digital Signatures and Encryption’, ensuring security and trust in electronic communications (COM (97)503 final) which advised: ‘Restricting the use of encryption could well prevent law-abiding companies and citizens from protecting themselves against criminal attacks. It would not, however, totally prevent criminals from using these technologies’. The report noted that ‘privacy considerations suggest limit the use of cryptography as a means to ensure data security and confidentiality’.

Some European countries have or are contemplating independent restrictions. France had a longstanding ban on the use of any cryptography to which the government does not have access. However, a 1996 law, modifying the existing system, allows a system of tiers du confidence, although it has not been implemented because of EU opposition. In 1997, the Conservative government in the UK introduced a proposal creating a system of trusted third parties. It was severely criticised at the time and by the new Labour government, which has not yet acted upon its predecessor’s recommendations.

0 The debate over encryption and the conflicting demands of security and privacy are bound to continue. The commercial future of the Internet depends on a universally-accepted and foolproof method of on-line identifications; as of now, the only means of providing it is through strong encryption. This put the US government and some of the world’s largest corporations, notably Microsoft, on a collision course.

Other national and international activities related to cryptography policy

Cryptographic products and technologies have historically been subject to export controls. The current basis for export controls in the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies (agreed on 13 July 1996), which includes cryptography products on its control lists for export. The Agreement is implemented in national regulations. Regulation [(EC) 3381/94] and Decision [94/942/PESC] of the Council of the European Union of 19 December 1994 on the control of the export of dual-use goods are also applicable to the export of cryptographic products.

The Council of Europe has developed considerable resources to studying the subject of computer-related crime, issuing the Recommendation [R(95)13] of the Council of Europe of 11 September 1995 concerning problems of criminal procedural law connected with information technology, and is considering suggesting an international convention to address the issue. Such a convention could address matters such as exchange of information among government agencies in case involving the use of cryptography.

At the G7 Summit meeting on anti-terrorism in July 1996, G7 governments announced that consultations would be accelerated, ‘in appropriate bilateral or multilateral for a, on the use of encryption that allows, when necessary, lawful government access to data and communication in order, inter alia, to prevent or investigate acts of terrorism, while protecting the privacy of legitimate communications’.

In May 1996 the US National Research Council’s Computer Science and Telecommunications Board published the report ‘Cryptography’s Role in Securing the Information Society’. This interagency study assesses the effect of cryptographic technologies on US national security, law enforcement, commercial and privacy interests, and reviews the impact of export controls on cryptographic technologies. This authoritative report provides a comprehensive review of the cryptography policy issues faced by the US Government.

C. Key recovery

As of mid-1998 a wide range of government, industry, and academic efforts toward specifying, prototyping, and standardising key recovery system that meet government specifications have been implemented. Some of industry’s efforts were stimulated by U.S. government policies that offer more favorable export treatment to companies that commit to designing key recovery features into the future products, and by U.K. government moves to link the licensing of certification authorities to the use of key recovery software.

Yet despite these incentives, and the intense interest and effort by research and development teams, neither industry nor government has yet produced a key recovery architecture that universally satisfies both the demands of government and the security and cost requirements of encryption users.

The commercial key recovery products in existence today do not reconcile the conflict between commercial requirements and government specifications. In the absence of government pressure, commercial key recovery features are by their nature of interest primarily to business operations willing to pay a significant premium to ensure continued access to stored data maintained only in applications of encryption (such as communication traffic) are known in advance not to require recoverability and therefore would not be designed to use a key recovery system.

Another problem is that the most secure and economical commercial key recovery do not support the real-time, third-party, covert access sought by governments in order to support surveillance. In particular, ‘self-escrow’ by an individual does not meet government access demands. The third-party nature and global reach implied by these government demands make key recovery systems a much more difficult, expensive, and risky proposition than a facility for internal, off-line recovery in business enterprise. For example, most organizations keep backups in the form of plain text on magnetic media in physically protected premises. Similarly, organizations that keep encrypted data might naturally be best served by storing backup keys in a bank safe deposit box. A requirement for near-real-time access would preclude this approach, however prudent or appropriate.

Any access-time requirement carries with it special risks. In particular, some sort of network technology will generally be required. Such a network, which must link a large number of law enforcement agencies with different key recovery centers, would be extraordinarily difficult to secure. The current attention in the U.S. on the problem of securing critical infrastructure, such as telephone networks, power grids, national banking networks and air traffic control systems, underscores the problem of managing risk in key recovery. The system that support critical infrastructure, which are increasingly reliant on open networks and information systems, are among the most important current and future applications of cryptography. The complexity and increased risk introduced with key recovery would make critical infrastructure protected by cryptography more vulnerable to the kinds of sophisticated attackers that pose the most serious threats to these systems.

Government specifications for key recovery systems for export approval are focused on the easier problem of ensuring that keys are recoverable when authorized. They do not address or give techniques for the far harder problem of ensuring against unauthorized disclosure of data. The design and construction of prototype key recovery systems that satisfy government specifications for export, therefore, are not sufficient to demonstrate that these systems can be operated securely, in an economical manner, on a large scale, or without introducing unacceptable new risks. Any assessment of a proposed system must take into account a broad range of design, implementation, operation, and policy considerations.

As of mid-1998, we are aware of no key recovery proposals that have undergone analysis of the kind required. On the other hand, as our report notes, there are compelling reasons to believe that, given the state of the art in cryptography and secure systems engineering, government-access key recovery is not compatible with large scale, economical, secure cryptography systems.

D. European Initiatives

DLM-FORUM — Electronic Records

The first multidisciplinary European DLM-Forum (DLM-Forum’96) on electronic records which took place in Brussels between the 18th and 20th December 1996 was a major event in the investigation of possibilities for wider co-operation in this area both between Member States and at Community level. It was initiated by the experts’ report Archives in the European Union (Report of the Group of Experts on the Coordination of Archives. Brussels – Luxembourg: OPOCE 1994) and confirmed by the EU-Council Conclusions of June 1994 (94/C 235/03).

Organised by the European Commission in close co-operation with the EU member states it hosted more than 300 experts and decision-makers from public administration, archives, industry (hard- and software suppliers) and research. The multidisciplinary approach and the aim to publish guidelines on machine readable data as a concrete result as well as the high quality of the presentations were the attractions that turned this inaugural event into a European forum of international interest in the field of electronic records administration and storage. Participants came from all the EU member states, from other European countries (including the Russian Federation and Poland), as well as from Canada and the USA.

First reviews that have been published by specialised journals are unanimously enthusiastic. The forum’s success owed a lot to the Programme Committee’s preparations and should also be attributed to the undivided and continuous support of the Irish and Dutch presidencies of the EU-Council.

The forum was opened by the Secretary General of the European Commission, David Williamson who emphasised that archives, including increasingly electronic documents, are our collective memory and how important it is to retain that memory and to insure that it remains accessible in the future. In their keynote addresses the Deputy Director General of the Directorate General for Science, Research and Development, Hendrik Tent and the Permanent Representative of Ireland to the European Union, H.E. Ambassador Denis O’Leary laid out the political and technical framework of the DLM-Forum’96. Mr Tent described the importance of the forum with respect to innovation in the digital era and the Commission’s approach towards this challenge. Mr O’Leary stressed the role of archives in our society and the citizens’ right of access to information. In his closing speech the Head of Commissioner Bangemann’s Cabinet, Paul Weissenberg, pointed to the importance of electronic archives in the European Union’s concept of the Information Society as set out in the Bangemann report and subsequent documents. He stressed the necessity of concrete measures as an immediate consequence to the DLM-Forum.

The ‘life-cycle’-concept of electronic records guided the three parallel sessions. Thus the speakers in those sessions reflected on electronic documents in the different phases of their administrative life. The multitude of topics ranged from discussions of norms and standards for data interchange to the presentation of new electronic storage material. Surveys on the ‘state of the art’ in Europe completed this first interdisciplinary approach to retaining the collective memory of the Information Society.

It was the balance between working sessions and spontaneous and informal discussions outside those sessions that produced a most agreeable working atmosphere in which experts’ debates led to the kind of mutual understanding and the establishment of personal ties and relations needed to solve problems that concern all the disciplines represented at the forum. Thus the catalyst effect, which was hoped for, was achieved: experts from industry and research became sensitive to the concerns of archives and administrations.

The forum will lead, as foreseen, to amendments to the first draft of multidisciplinary guidelines Best practices for using Machine Readable Data which had been distributed to the participants.

Furthermore a document for follow-up measures, the so-called ’10 points’, was agreed on by the participants. One major topic for follow-up activities is the establishment of national focal points to improve co-ordination and networking and to establish functional requirements for electronic records management in the public and private sectors. Another topic concerns the urge for establishing training programmes for archivists and administrators.

In a world of continuous and rapid change modern archives services are an element of continuity, stability and a solid base for essential information and indispensable records. Modern management in public and private institutions has to be dynamic, active and innovative, and above all has to cover the entire continuum of the life of documents. ‘The DLM-Forum’96 demonstrated that the issues posed by the preservation and re-use of electronic records are central not only to the work of archivists, but also form the cornerstone of future economic growth and development within the European Union.’ as Seamus Ross points out in his presentation. In short: the problem of preserving electronic records concerns even more people and areas than have been covered by the forum’s participants. Further activities should include among others legal advisors, system designers and application developers, auditors and insurance providers. Contacts with existing working groups (e.g. the European Commission’s Legal Advisory Board for the information market) have to be established or intensified. A first step to co-ordinate these activities is the installation of the DLM-Monitoring Committee in April 1997.

Promoting safe Use of Internet

To prevent illegal and harmful content being distributed on the Internet the European Commission is promoting initiatives which are aimed at increasing the general awareness among parents, teachers, public sector and the information industry about how to deal with the issue in practical terms.

This action accompanies the Green Paper on Protection of Minors and Human Dignity in Audiovisual and Information Services, the Communication on Illegal and Harmful Content on the Internet, and the Action plan on promoting safe use of the Internet.

REFERENCES

1. STOA, PE 166499: “An appraisal of technologies of political control”, 1998.

2. R. Clarke: Dataveillance: Delivering “1984”, Xamax Consultancy Pty Ltd, February 1993.

3. R. Clarke: Introduction to Dataveillance and Information Privacy and Definitions of Terms, Xamax Consultancy Pty Ltd, October 1998.

4. R. Clarke: A Future Trace on Dataveillance: Trends in the Anti-Utopial Science Fiction Genre, Xamax Consultancy Pty Ltd. March 1993.

5. T. Dixon: Workplace video surveillance – controls sought, Privacy law and Policy Reporter, 2 PLPR 141, l995.

6. T. Dixon: Privacy charter sets new benchmark in privacy protection, Privacy law and Policy Reporter, 2 PLPR 41. 1995.

7. D. Banisar and S. Davies: The code war, Index online, News Analysis, issue 1998.

8. T. Lesce: They’re Watching You! The Age of Surveillance, Breakout Productions, 1998.

9. W.G. Staples: The Culture of Surveillance, St. Martin’s Press, 1997.

10. D. Lyon and E. Zureik: Computers, Surveillance and privacy, University of Minnesota Press, 1996.

11. D. Lyon: The Electronic Eye – The rise of Surveillance Society, University of Minnesota Press. 1994.

12. F.H. Cate: privacy in the Information Age, Brookings Institution Press, 1997.

13. P. Brookes: Electronic Surveillance Devices, Newnes, 1998.

14. O.E.C.D.: Privacy Protection in a Global Networked Society, DSTI/ICCPAREG(98)5/FINAL, July 1998.

15. O.E.C.D.: Implementing the OECD “Privacy Guidelines” in the Electronic Environment: Focus on the Internet, DSTI/ICCP/REG(97)6/FINAL, September 1998.

16. O.E.C.D.: Cryptography policy: The Guidelines and the issues, OCDE/GD(97)204, 1997.

17. Report By an Ad Hoc Group of Cryptographers and Computer Scientists: The Risks of Key Recovery, Key Escrow, and Trusted Third Party Encryption, 1998.

18. COM(98) 586 final: Legal framework for the Development of electronic Commerce.

19. COM(98) 297 final: Proposal for a European Parliament and Council Directive on a common framework for electronic signatures, OJ C325, 23/10/98.

20. A. Troye-Walker, European Commission: Electronic Commerce: EU policies and SMEs, August 1998.

21. COM(97) 503 final: Ensuring security and trust in electronic communications – Towards a European Framework for Digital Signatures and Encryption.

22. Directive 97/7/EC of the European Parliament and the Council of May 1997 on the protection of Consumers in respect of Distance Contracts. OJ L 144. 14/6/1997.

23. ISPO: Electronic Commerce – Legal Aspects. http://www.ispo.cec.be .

24. Privacy International: http://www.privacy.org .

25. Newton and Mike: Picturing the future of CCTV, Security Management, November 1994.

26. Gips and A. Michael: Tie Spy, Security Management, November 1996.

27. Clarke and Barry: Get Carded With Confidence, Security Management, November 1994.

28. Horowitz and Richard: The Low Down on Dirty Money, Security Management, October 1997.

29. Cellular E-911 Technology Gets Passing Grade in NJ Tests, Law Enforcement News, July – August 1997.

30. Shannon and Elaine: Reach Out and Waste Someone, Time Digital, July August 1997.

31. Thompson, Army, Harowitz, and Sherry: Taking a Reading on E-mail Policy, Security Management, November 1996.

32. Trickey and L. Fried: E-mail Policy by the Letter, Security Management, April 1996.

33. Net Proceeds, Law Enforcement News, January 1997.

34. Burrell, and Cassandra: Lawmen Seek Key to Computer Criminals, Associated Press, July 10, 1997, Albuquerque Journal.

35. Gips and A. Michael: Security Anchors CNN, Security Management, September 1996.

36. Bowman and J. Eric: Security Tools up for the Future, Security Management, January 1996.

37. E. Alderman and C. Kennedy: The right to Privacy, Knopf 1995.

38. Bennet and J. Colin: Regulating Privacy — Data protection and public Policy in Europe and the United States, Cornell University Press, 1992

39. BeVier and R Lillian: Information about Individuals in the Hands of Government — Some reflections on Mechanisms for Privacy Protection, William and Mary Bill of Rights Journal 4, Winter 1995.

40. Branscomb and A. Well: Who owns Information? From Privacy to Public Access, Basic Books 1994

41. Branscomp: Global Governance of Global Networks, Indiana Journal of Global Legal studies, Spring 1994.

42. Network Wizards, Internet Domain Survey, January 1997, http://www.nw.com/zone/WWW/report.html .

43. Network Wizards, Internet Domain Survey, January 1997, http://nw.com/zone/WWW/lisybynum.html .

44. Simon Davis: report, December 1997, http://www.telegraph.co.uk .

45. Francis S. Chlapowski: The Constitutional Protection of Information Privacy: Boston University Law Review, January 1991.

46. Ibid., p. 35.

47. Ibid., p. 45.

48. Ibid., p. 48.

49. Ibid., p. 57

50. Ibid., p. 82.

51. Ibid., p. 276.

52. Ibid., p. 267.

53. J. Guisnel: Guerres dans le cyberspace, Editions la decouverte, 1995.

54. http://www.dis.org .

55. http://www.telegraph.co.uk .

STOA PROGRAMME

European Parliament
Directorate-General for Research
Directorate A
SCH 4/61

L-2929 Luxembourg

Tel: +352 4300 22511
Fax:+352 4300 22418
rholdsworth@europarl.eu.int

LEO 6 D46
Rue Wiertz 60
B-1047 Bruxelles

Tel: +32 2 284 3962
Fax:+32 2 284 9059
msosa@europarl.eu.int

Digitization and HTML by JYA/Urban Deadline.

SPEAKER: JAMES WOOLSEY, FORMER DIRECTOR, CIA

(+)

WOOLSEY: Let me just informally say one or two things.

First of all, I am five years out of office, and so much of what I say is — indeed virtually all of it is heavily governed by my views and practices when I was DCI. I do continue to hold security clearances and confer with the government from time to time, but I am not up to speed on things like current intelligence operations, and if I were, I wouldn’t talk to you about them anyway.

I do have, however, a set of views about this set of issues and they were ones that I expressed in rather substantially the same terms when I was DCI that I’m going to express today. But in the context of the [European Parliament, Duncan] Campbell report and the current European interest, particularly in the overall subject of alleged American industrial espionage, I thought it was a perfectly reasonable thing to respond to the State Department’s request that I be available to answer your questions.

If you look at the Aspin-Brown Commission report of some four years ago, chaired by the late former secretary of defense and chairman of the House Armed Services Committee, Les Aspin, it states quite clearly that the United States does not engage in industrial espionage in the sense of collecting or even sorting intelligence that it collects overseas for the benefit of and to be given to American corporations. And although he does so with a double negative, Mr. Campbell essentially confirms that in his report.

In the Campbell report there are only two cases mentioned in which, allegedly, American intelligence some years — several years ago obtained information — secret information regarding foreign corporations. One deals with Thomson-CSF in Brazil, one deals with Airbus in Saudi Arabia.

Mr. Campbell’s summation of those issues in one case is five lines long, in the other case it’s six lines long, and he is intellectually honest enough that in both cases he devotes one line in each to the fact that the subject of American intelligence collection was bribery. That’s correct. Not technological capabilities, not how to design wing struts, but bribery. And it is impossible to understand American intelligence collection, for my period of time anyway, with respect to foreign corporations and foreign government who sometimes assist them without realizing that that issue is front and center.

Now, the Aspin-Brown Commission also said that approximately 95 percent of U.S. intelligence collection with respect to economic matters, which itself is only one of a reasonable number of U.S. intelligence targets — but with respect to economic matters, 95 percent of our intelligence collection is from open sources. Five percent is essentially secrets that we steal. We steal secrets with espionage, with communications, with reconnaissance satellites.

Why do we focus, even to that 5 percent degree, on foreign corporations and foreign governments’ assistance to them in the economic area? It is not to provide secrets — technological secrets to American industry.

In the first place, in a number of these areas, if I may be blunt, American industry is technologically the world leader. It is not universally true. There are some ares of technology where American industry is behind those of companies in other countries. But by and large American companies have no need nor interest in stealing foreign technology in order to stay ahead.

Why then do we or have we in the past from time to time targeted foreign corporations and government assistance to them?

WOOLSEY: There are really three main areas. One is that, with respect to countries that are under sanctions — Libya, Serbia, Iraq and the rest — important economic activity is sometimes hidden and it is important for the U.S. government to understand how sanctions are functioning, if they’re functioning successfully, whether Iraq is able to smuggle oil out and if so how much, how Mr. Milosevic does his country’s banking and so on.

Those types of sanctions-related subjects and economics are the subject of efforts by the United States to steal secrets by various methods — have been in the past.

Second, with respect to dual-use technology, there are some legitimate products, a number of types of chemicals that are useful in pharmaceuticals and in fertilizers and the like, super-computers are useful for predicting the weather and other purposes, that also have use in designing or producing weapons of mass destruction. So particularly where there are efforts around the world to hide the transportation and sale of certain types of materiel and products that can be used in the production of weapons of mass destruction, yes, there is a big incentive and an important reason why the United States government has in the past felt it important to steal secrets.

The third area is bribery. We have the Foreign Corrupt Practices Act. It is a statute under which I have practiced as a lawyer. I have done investigations of major American companies on behalf of their boards of directors to detect Foreign Corrupt Practices Act violations. I have sat as a board member of American publicly owned corporations and questioned management about whether there had been any foreign corrupt practices.

It is a vigorously enforced statute and an important one. And as a result of it, American industry is again not perfect, but as a general proposition it does not try and certainly does not succeed in winning contracts and international commerce by bribery.

This is not true of the practices of some of our friends and allies and some of our adversaries around the world. Some of our oldest friends and allies have a national culture and a national practice such that bribery is an important part of the way they try to do business in international commerce.

We have spied on that in the past. I hope, although I have no immediate verification, that the United States government continues to spy on bribery.

But whether it does or not, it seems to me that it should be understandable to anyone who reads the Campbell report, to anyone who thinks at all about whether American corporations need to steal technological secrets from foreign corporations, and anyone who is at all sophisticated about the way international trade and commerce works, that bribery is — or should be in any case and certainly was in my time at the heart of U.S. intelligence’s need to collect secret intelligence regarding foreign corporations and foreign governments’ assistance to them.

And with that I’m prepared to take your questions.

MODERATOR: OK, it’s fairly crowded today. Please wait for the microphone, identify yourself and your news organization. We will go right up here in the front.

Yes, we might as well start.

QUESTION: Then I take it that all the hubbub from Brussels and the European parliament with accusations that the NSA is being fed this information, all that is false?

WOOLSEY: Well, in far as the hubbub in Europe and in Brussels doesn’t mention that if there is any targeting of European corporations, if the past is any guide, it’s likely to be about bribery, then the journalists who are reporting it are hiding the ball. Because Mr. Campbell himself makes it quite clear, in both of the cases he mentions, that bribery is the issue.

So if people are inventing out of whole cloth in spite of what’s said in the Aspin-Brown report, in spite of what I said when I was DCI, as far as I know, I believe what is being said publicly and officially on the record by the U.S. government today, that the United States does not conduct industrial espionage, it doesn’t steal secrets of foreign companies to give them to American companies for purposes of competitions and so forth — if the hubbub in Brussels ignores that, then those who are creating the hubbub are intentionally looking away from the major issue.

WOOLSEY: If this were Shakespeare’s “Hamlet,” to discuss the issue without talking about bribery, is like talking about it without talking about the prince of Denmark. It’s the central thing.

QUESTION: Mr. Woolsey, in spite of all that you said, it seems to me that espionage per se was two kinds — the Cold War kind, which you do against your political and ideological adversaries, and the industrial kind that you’re talking about.

Now there’s a general feeling throughout the world, that this industrial espionage is sort of open house, and everybody does it to everybody else. And there have been some reports of American agents being expelled from Germany, or France, or somewhere.

So in spite of all that, you’re saying except for bribery, the United States is not doing it at all.

WOOLSEY: The other two areas — at least in my time — that we thought were quite important to follow, I did mention. One has to do with sanctions. If companies in countries that are friends and allies of the United States are busting sanctions by what they’re selling to a country like Libya or Iraq, that might be the subject of secret collection. If there are efforts to hide the sales of dual-use technology that can be used with respect to weapons of mass destruction.

But I generally — and I think most of us who talk about this issue — reserve the term industrial espionage to mean espionage for the direct benefit of an industry. That is, I don’t call it industrial espionage if the United States spies on a European corporation to find out if it is bribing its way to contracts in Asia or Latin America that it can’t win honestly.

I would — and especially when it is not the practice of the U.S. government — it certainly didn’t occur in my time, and I’m not aware that it ever has — that the U.S. government gives this information about bribery, when we find it, to an American company. That’s not what happens. The information about bribery is not given to the American corporation that may be the victim.

What happens is that the State Department is informed, and then an ambassador, or in some substantial cases perhaps a very senior official in the State Department, goes to the country where the government official is being bribed, and says, You know, we really don’t — we know about this, and we really don’t think this is the way you ought to make decisions about awarding contracts.

Now what then typically happens, is that the contract award either is made on the merits — sometimes an American company wins, sometimes not. Or sometimes the host government will split the contract. And the American company, if it wins all or a share of it, doesn’t know that the reason it won was because the U.S. government uncovered bribery and went to the host government, and said, We don’t think you should be engaged in awarding contracts this way. But I don’t call that industrial espionage.

So in the post-Cold War era, how big a focus is this sort of thing for the United States? I’d say it’s rather modest, in the overall model — at least in my time as DCI — of our intelligence — of our secret intelligence collection.

Economic intelligence is important, but as I said, it’s about 95 percent from open sources. What our major focus is, is on rogue states, weapons of mass destruction, whether Russia is going to turn into a non-democratic country. We focus on major issues that could directly affect the security of the whole country.

But there is some increased emphasis on economics — 95 percent of it from open sources. The part that’s from covert sources is as I described.

QUESTION: You answered part of my question with your statement just now that, if in fact, U.S. intelligence were to uncover attempts at bribery by a corporation from another country, they would not inform the U.S. corporation.

But while we’re on, sort of the issue of process, presumably U.S. intelligence inadvertently perhaps, runs across technologically interesting information — technologically valuable information — even in the course of investigations predicated on the three areas that you laid out — technologically valuable information that would be commercially useful. What happens to that information? Does it sit mouldering on a shelf, or is there a means by which that information does wind up in the hands, either of U.S. government corporations, or U.S. corporations?

WOOLSEY: I don’t think so, realistically. Given the fact that the problem for the U.S. intelligence community is that there’s a great deal of data that goes unanalyzed — the problem is sorting through all this material. It is a substantial commitment of time and effort to devote an able analyst to sorting something out. And in the important high-tech areas — computers, telecommunications, software, and the like — these are areas — again, I don’t want to sound nationalistic about this. But bluntly, these are areas in which the United States is the world leader.

And it is — it would be a substantial misuse, I think, of the time of valuable analysts to go through technological analysis of material from other trading countries, you know, that we have cordial relations with, and deal with all the time, and where there’s a great deal out in the open anyway, in order to do an analytical piece that can’t be given to anybody. I mean, it could not be given to an American corporation.

There’s a separate problem here, which is, what’s an American corporation? Is it a company that’s headquartered in New York, but does most of its manufacturing in Canada — an American corporation? Is it a Canadian corporation that manufactures largely in Kentucky? Who knows. We have a terrible time sorting this sort of thing out in trade issues, generally. And it’s just a morass that the U.S. intelligence community has no particular instinct or reason to get into.

And so, can one absolutely guarantee that nothing is ever leaked, that shouldn’t have leaked? I suppose one can never absolutely guarantee anything. But would, in the normal routine business, somebody do a technological analysis of something from a friendly country, which had no importance, other than a commercial use, and then let it sit on the shelf because it couldn’t be given to the American company? I think that would be a misuse of the community’s resources. I don’t think it would be done.

QUESTION: There was a specific case which involved a radar system that was installed in Brazil, and involving a European company and an American company. Both companies found out what the government had found out, that the European company was trying to bribe the Brazilian companies…

WOOLSEY: Is this the Thompsen C.S.F. case…

QUESTION: Yes.

WOOLSEY: … in the report?

QUESTION: Yes. I have two questions on that. One is, if you are spying on a company because you think it might be bribing its way to a contract, you can — in this case for example, everyone knew exactly what technology was being sold. So, it isn’t like that you have to get a special analyst to analyze the system, because everyone knew exactly it was radar system.

So going back to Paul’s question. In the case — knowing that you’re analyzing radars, if you did have some information that, let’s say the European company had a special system, or something, would that just sit on a shelf? That’s one thing.

And the other thing is, could you use that — if you pass some information to the State Department, but it could be used in commercial negotiations, like let’s say you’re spying on companies or something.

QUESTION: And then you find out that in a WTO negotiation or a WTO panel something will come up related to that that still is information that can be used by the government commercially or not.

WOOLSEY: I can’t exclude the possibility that at times in the past, information that would come to the attention of the U.S. intelligence community would be used in a circumstance like the second one you mentioned, for U.S. government purpose. Something like that would not be the focus of collection or the focus of even the sorting of intelligence. But it’s just too far down the food chain of interests, frankly.

But I think the — you can’t exclude the possibility that if a report including information about something technological were disseminated inside the United States government, it would be used for a government-wide purpose by someone who knew about it in the State Department or elsewhere.

What wouldn’t be done, is that it wouldn’t be given to the American company in question. But intelligence community’s main problem over the course of the last several years has been that as the Cold War has ended, it’s relatively speaking, its resources are insufficient in its eyes and in mine to do a lot of what is necessary. I’ve often said that it’s as if we were fighting with a dragon for some 45 years and slew the dragon and then found ourselves in a jungle full of a number of poisonous snakes. And that in many ways, the snakes are a lot harder to keep track of than the dragon ever was. The snakes are rogue states and terrorists and the like. We have now six or eight major issues we have to watch instead of just the workings of the Soviet Union and its various manifestations in the world.

And that has meant that on these crucial issues for U.S. intelligence, rogue states, weapons of mass destruction, terrorism, narcotics smuggling, the community has found itself very strapped. And you know, to spend time trying to figure out whether some technological fact about some friendly country’s part of their technology is relevant to some trade negotiation is — got to be something — I can’t believe anybody would be focusing on or spending any time on.

MODERATOR: OK, let’s start from the back and we’ll work our way forward.

QUESTION: I have a question about a definition. If the American company hires a local consultant in China, or Brazil or Afghanistan, who bribes at his own expense and his own account with or without knowledge of the American company, and he pays bribes. Is that as far as you are concerned, is that bribery or it is not?

WOOLSEY: It probably depends on the facts. But if the American employer had reason to believe from the past behavior of this individual or from the overall circumstances or from his expenses or from the fact that an award was given that didn’t seem understandable or justified by the bids, if for any reason, the American employer including a foreign individual who was directly employed by the United States, the gut (ph) company, had reason to believe that a bribe had occurred, it would be a violation of the Foreign Corrupt Practices Act. This is the sort of thing — there are things under the FCPA called red flags.

There’s a rather long list of behavior and circumstances which should raise suspicions. And the American companies and their boards of directors, are charged not just to report to the SEC or the Justice Department when they clearly and definitely know that someone overseas has been bribed. They are charged with conducting investigations and being on top of what all of their commercial agents and the like are doing. It’s a very demanding statute.

QUESTION: My question is not about industrial espionage specifically. I hope that’s all right. Sorry, Charlie.

There was a report in the New York Times a few weeks ago that said the Jordanian secret service had surpassed the Mossad, the Israeli Mossad in terms of how much they helped the U.S. in fighting terrorists and things like that. And I’m wondering if you could speak at all about how much — and that in fact, even in Jordan that the U.S. identifies its spies to the Jordanian government, a practice it doesn’t do in other places. So I was wondering if you would comment on that.

But also, if you could describe in any way how much the Israeli intelligence service and the U.S. intelligence service work together in terms of even finding out things about Iraq and weapons of mass destruction and those kinds of things.

WOOLSEY: Even if I were current — and I have not been current on this subject for the last five years since I left the government — I wouldn’t answer that question. I will say this. Both Jordan and Israel have very fine intelligence services. Both countries are friends of the United States. The countries under a lot of circumstances today are friends of one another. And a number of friendly countries in the Mideast cooperate with intelligence and otherwise, in dealing with rogue states and aggressive states in the Mideast. And I would certainly count Iraq as first and foremost in that later category.

MODERATOR: Far be it for me to ever try to control the topic of a conversation, but we are — I’ll go across the Sinai Peninsula to Thomas, if he’s on the economic topic?

OK, Thomas?

QUESTION: Trying to figure out what you said about (inaudible) and jungle of the snakes. Definitely, in the golden age of espionage there was spying and counter spying. And you cannot say that you are just a victim of the others and you don’t want to try to get information about the others. Definitely there is a kind of a spying, you know, to counter attack his espionage. This is my first question.

My second question is…

WOOLSEY: Let me see if I understand. Does the United States spy on countries that are trying to conduct industrial espionage against American corporations?

QUESTION: Yes.

WOOLSEY: In my time, yes. I don’t know whether we still do or not. But I would have considered it a useful, although not perhaps actually top priority for the United States to understand the workings of a foreign intelligence service that at the behest of its government was conducting espionage against American corporations to steal say technological secrets. What counter espionage it really is in the international context is essentially intelligence services spying abroad on foreign intelligence services that are in turn spying on their country.

And that is part of the warp and woof of international intelligence collection for the United States, for Egypt and for the countries represented by essentially everybody in this room.

QUESTION: My second part of the same question was that what about the privatized economic espionage?

QUESTION: I mean which is more than related to the industries and the firms and the — in general because always even the regular espionage were asking, for all of the human factor of intelligence collected. It’s important or just…

WOOLSEY: Well, with respect to some types of intelligence targets, particularly in the post-Cold War era — terrorism is one very good example — human intelligence, the human factor, espionage is distinct from technical intelligence collection, has really got to be first and foremost.

Terrorism is not something you learn a lot about from plants, to the contrary, notwithstanding from looking at terrorist camps through reconnaissance satellites. You need spies.

But with respect to you know economic espionage against the United States…

QUESTION: I mean in general from your perspective, economic espionage doesn’t get more human intelligence or rely on…

WOOLSEY: It’s hard to say. Again, these three areas that I mentioned that were salient in my time, again for this 5 percent of economic intelligence that’s secret, 95 percent being you pick up newspapers and surf the Web and whatever. But for the 5 percent that involves needing to steal secrets, I would say yes, that human intelligence if you’re talking about bribery, if you’re talking about finding out about companies that are shipping material around sanctions, if you’re talking about companies that are selling super computers to institutions in other countries, that can use them to design nuclear weapons, a lot of that, I would say a rather high proportion of it would typically have to come from human agents, from human sources.

QUESTION: With all of the other sources can you state why you’re failing and as dragon you mention the snakes? Secondly, recently it was deserved (ph) by India and the United States to cooperate more on international terrorism? Do you expect the intelligence agencies of the two countries to cooperate in order to track international terrorism and cooperate (ph)?

WOOLSEY: Well, the dragon was the Soviet Union and the last time I looked we won the Cold War. I don’t think we failed against the dragon. I would comment to your Mr. Matrokin (ph) and Mr. Andrews recent book, “The Sword and the Shield,” based on the KGB archives that Matrokin (ph) stole from essentially 1917 to 1985. And it’s a complicated story.

There were some things the KGB were very successful at such as technical intelligence collection against American corporations actually. But after the demise essentially of the American communist party’s vibrant life, right after the end of World War II and after the end of the American Soviet Alliance in ’45, beginning in ’47 or ’48, the playing field tended to move in an American direction. And Matrokin (ph) and Andrew would say that particularly in the ’60s and ’70s and into the ’80s, probably American intelligence collection against the Soviet Union across the board particularly against the government, was substantially superior to a rather dismal KGB performance against the United States.

QUESTION: (Inaudible) country?

WOOLSEY: The dragon that we fought for 45 years and slew, was the Soviet empire in my analogy.

QUESTION: That isn’t what I had in mind…

WOOLSEY: Well, but you — it was my analogy so I get to say what I had in mind.

(LAUGHTER)

Now with respect to the United States and India, India is a friendly country and we cooperate on a number of things and we’re — both diplomatically and from time to time in intelligence areas, and I would hope that it would continue.

At least that was true with I was DCI. For the last five years you would have to ask somebody else.

QUESTION: I know it’s hard to quantify, but what region of the world, if you can break it down, is most afflicted by this — if I can use the word — by this U.S. espionage, especially bribery?

Is it Middle East? Is it South Asia? Is it Europe? Is it…

WOOLSEY: Well, you have the bribers and the bribees. OK. Now in a number of parts of the world although some are struggling against it, there has been a tradition of public officials accepting bribes and it occurs in a number of places.

The part of the world that where this culture of getting contracts through bribery, that actually has a great deal of money, and is active in international contracting is to a first approximation Europe. And indeed if you look at the recent negotiations that deal with implementing the OECD convention on bribery that was signed, I think in late 1997, there have been a number of parliamentary acts passed.

WOOLSEY: The Germans, for example, have gotten rid of the provision of German tax law that permitted bribes to be deducted from income taxes. France is debating it; hasn’t gotten rid of it yet.

But there has been a general history — both because it’s been relatively prosperous, because it’s companies export — that I would say the principle offenders, from the point of view of paying bribes in major international contracts in the world, are Europe. And indeed, they are some of the very same companies — the companies are in some of the very same countries where the most recent flap has arisen about alleged American industrial espionage.

It leads me to wonder whether the next major international investigation on this sort of subject coming from Europe is going to be charging that there needs to be a major look at the problem of rude American maitre d’s.

I’ll leave it at that.

QUESTION: I have two questions, the first one regarding the peace process. In case of the peace process in the Middle East, do you believe the CIA will be able to change the way handling the cases in the region? And the second question regarding how did you handle the espionage against you, United States, from your allies, like Israel and the other famous cases in that?

WOOLSEY: Second one first. Certainly the United States, often for reasons for learning about technology, is the target of espionage from some very good friends and allies. It happens. Normally we try to work it out. We try not to make a major public fuss about it. But where prosecution is necessary and where it does occur, we are generally of the view that one should impose penalties consistent with the seriousness of the espionage and the amount of material that was turned over, not the degree of friendliness with the country.

I’m going to use a clear example, one that I’ve spoken on publicly a number of times, Jonathan Pollard. The question has come up, since Israel is a friend of the United States, shouldn’t the United States pardon Mr. Pollard? Both I, and I think almost anybody connected with the American intelligence community and law enforcement community has said no, because of the volume and seriousness of what he stole.

Now, you’re first question was about?

QUESTION: It was about the peace process…

(CROSSTALK).

WOOLSEY: The peace process, yes. CIA officers in a number of negotiating situations — and here we’re largely talking about analysts — are extremely helpful. I was an ambassador and arms control negotiator for the United States. I negotiated the CFE Treaty in Vienna in 1989 to ’91. And I had several CIA analysts on my delegation and they functioned very much like other U.S. government officials.

WOOLSEY: We didn’t formally call them CIA officials, but our Soviet and other counterparts knew that they worked for the CIA. And they chaired working groups for me on verification. They negotiated provisions with other countries, dealing with verification. They were valuable members of the team.

And they had very cordial relations with Soviet counterparts. Sometimes we would even have parties with the American CIA people, and the Soviet KGB people, you know. It was an odd time.

But nonetheless, this tradition of American intelligence officers being involved in negotiations is one that I think can be entirely positive. There is one aspect of the CIA officers’ involvement in the negotiations in the Mideast that I couldn’t tell from the public statements whether it was taking place or not, but I was concerned that it might, because it seemed to me it put the intelligence officers in the middle, between the negotiating parties, and led them to have to try to assess whether one party was violating the accords, and then explain it to the other party, going both ways. And I thought that was a bad position to put an intelligence officer in.

I thought the U.S. intelligence officers should collect intelligence for the United States. And if an American official had to go to one party or the other in the negotiations, and say, “You haven’t turned in all your weapons, and we know it,” or, “You haven’t done this, and we know it.” It ought to be a diplomat. It ought to be an official from the State Department, not an intelligence officer.

But with that footnote, with that, you know — and I can’t tell still, from the public statements, exactly what the role of the CIA officers in the Mid-Eastern — in the Palestinian-Israeli negotiations has been. With that footnote, I think that for the CIA, and for intelligence officers from other countries, there are a number of circumstances in which they can have a quasi-open, and professional, and very useful role on issues such as verifying agreements.

QUESTION: Mr. Woolsey, I understand that the U.S. is for — to promote democracies around the world, compared to dictatorships — number one. Number two — how much — and also CIA briefs president on a regular basis — on a daily basis on intelligence matters. How much president listen to the CIA reports, or their advice, including now, this report here in India Globe, and around the world in newspapers that he should not visit Pakistan? That’s according to the CIA intelligence reports. Should he visit Pakistan or not, in your guess?

WOOLSEY: Well, my — I’m not going to bite on that substantive recommendation. But I will say this. I think the CIA got a little bit spoiled in President Bush’s presidency, because having been a director of Central Intelligence himself, he was, and remains absolutely fascinated by intelligence, by the CIA. The CIA headquarters is now named after him. He had the intelligence briefer in every day, and so forth.

President Clinton is a speed reader. And he rather frequently reads the morning intelligence briefing, and annotates it, and sends it back with questions, rather than having the CIA briefer in. And if you’ll pardon me a moment of humor, when in 1994, in the autumn, after I’d been in the CIA job for a little over a year and a half, a small plane crashed into the south front of the White House. The White House staff joke, at the time, was, That must be Woolsey still trying to get an appointment.

(LAUGHTER)

So, I may not be the best individual to ask with respect to daily interactions of that sort. But whether a president absorbs information by a daily meeting, or by reading — as at least in my time, was principally President Clinton’s method of absorbing intelligence — presidents normally pay a great deal of attention to what U.S. intelligence as a whole — not just the CIA — communicates to them. And sometimes they discount it and do something else. And sometimes they have a right to discount it. And sometimes they were wrong. But on that particular issue, I’m going to stay away from that with a 10-foot pole.

QUESTION: Sir, you mentioned about the dual technology transfer. I believe, you know, that’s from the other side of the story. This is a — maybe that’s falling into the term of an FBI, but given your experience, I’d like to have your comment on that. That is, what are those countries involved the most, in terms of stealing U.S. industry secrets here?

When you’re talking about rogue states, I consider that — do you consider China as a rogue state, or what? I mean, according to a lot of report that it is China, it is Japan, Korea, Taiwan and Israel involved most in those case.

QUESTION: But maybe you can tell us what exactly…

WOOLSEY: I’m not going to get in the business of talking about individual countries that way.

I would say this. With respect to technology theft from American corporations especially, the Soviet Union and the KGB were very good at this. The Metrokin (ph) book explains how and why. Happily, the Soviet Union was unable to take advantage of much of the technology because of their incredibly decrepit and terribly inefficient economy. But they were very vigorously involved in this.

It has also been the case, because of American technological leadership in a number of high-technology areas, that some of our old friends and allies are in this business as well, not only by putting microphones in the head rests of their airliners which cross the Atlantic, in first class seats, but in other ways as well.

There are European countries where one wants to — if you leave your briefcase when you go to dinner, if you’re a businessman and there’s anything sensitive in it, you should have your head examined. There are a number of parts of the world where American companies and individuals when they travel where there’s intelligence collection against them. And there’s some in this country, including from some friends — old friends of the United States.

We try to discourage this. We work hard at it. We talk privately with the countries and companies involved. We exert a good deal of effort to try to keep this from happening. But it is something that is rather substantially, in this country, principally on the mind of the FBI not the CIA. Because the only way it comes up for U.S. intelligence is if we learn overseas, in conducting an intelligence operation or collection, that that foreign country’s intelligence service is going to be doing something inside the U.S. Anything that actually takes place here, 99.9 percent of the time the relevant people are the FBI not the CIA.

I don’t know what to say other than I don’t really want to get into accusing individual countries. This waxes and wanes. No one is as involved in it as deeply as the KGB used to be on the behalf of the Soviet Union. But a number of countries still do it.

MODERATOR: And on that note, I’d like to say thank you. Thank you ladies and gentlemen.

WOOLSEY: Thank you for having me.

8 March 2000. Thanks to anonymous.

TRANSCRIPT
March 07, 2000
NEWS BRIEFING
JAMES WOOLSEY
FORMER CIA DIRECTOR
WASHINGTON, D.C.
JAMES WOOLSEY HOLDS BRIEFING AT THE FOREIGN PRESS CENTER
EVENT DATE: 03-07

MARCH 7, 2000

Find this story at 8 March 2000

HTML by Cryptome.

Die jüngsten Enthüllungen zeigen, wie umfassend das weltweite Internet überwacht wird. Einer der erfolgreichsten Kundschafter soll ein geheimnisumwittertes Atom-U-Boot der US-Amerikaner sein – die „USS Jimmy Carter“.
Am Meeresboden entlang sausen gigantische Datenmengen in Glasfaserkabeln um die Welt. Doch sicher sind sie dort keineswegs. Einer der Gründe dafür: das Atom-U-Boot „USS Jimmy Carter“. Der 138 Meter lange Koloss soll in der Lage sein, die Leitungen in der Tiefe anzuzapfen. In allen Ozeanen dieser Erde – und damit in Gebieten, die außerhalb der Hoheit der Vereinigten Staaten liegen.

Das nach dem früheren US-Präsidenten Jimmy Carter benannte U-Boot unterliegt höchster Geheimhaltung. 140 Mann Besatzung steuern das Boot durch die Ozeane, daneben kann es noch bis zu 50 Spezialkräfte aufnehmen. Von einer Multi-Mission-Platform können Taucher und Mini-U-Boote starten. Seit Anfang 2005 ist die „USS Jimmy Carter“ in den Weltmeeren unterwegs.

Angriffe auf Unterseekabel
Wie aber kommt das U-Boot überhaupt an die Daten heran? Darüber gibt es nur Gerüchte, doch mehrere Szenarien sind denkbar. So könnten die Tiefseespione in Glasfaserleitungen so genannte „Splitter“ einklinken. Diese elektronischen Bauteile schicken Kopien aller erfassten Daten über eine eigene Leitung direkt zum US-Militärgeheimdienst NSA.

Bei einer anderen möglichen Variante müssen die Unterseekabel nicht einmal aufgetrennt werden: „Es genügt, die Kabel leicht zu biegen, um an die Daten zu kommen“, erklärt der IT-Journalist Peter Welchering. Spezielle „Biegekoppler“ fangen die Lichtsignale ab und lesen sie aus. „Moderne Lauschgeräte benötigen weniger als nur zwei Prozent der optischen Leistung der Glasfaser, um dann das komplette Signal abzugreifen und in Bits umzuwandeln“, fügt Welchering hinzu.

Radarkuppeln und Satellitenspäher
Wirklich neu ist die Tatsache, dass Amerikaner, Engländer und andere Staaten internationale Kommunikationswege ausspähen, allerdings nicht. „Ich verstehe die ganze Aufregung nicht“, sagt Welchering. „Mit Echelon verhält es sich doch nicht anders, nur dass die jetzt in den Fokus geratenen Lauschangriffe in digitaler Form stattfinden.“

„Echelon“ heißt ein weltweites Spionagenetz, das mutmaßlich weit in die Zeit des Kalten Krieges zurückreicht. Seit den 1970er-Jahren gab es Gerüchte über seine Existenz. Abhörstationen und Weltraumsatelliten überwachen angeblich Telefongespräche, Faxverbindungen und Internet-Daten, die über Satellit geleitet werden. Auch Handygespräche und Funkverbindungen sollen abgehört werden. Kugelförmige Radarkuppeln wölben sich über die Antennen, die die Signale erfassen. Eine wichtige Anlage stand im bayerischen Bad Aibling. 2004 wurde sie geschlossen, nachdem bekannt geworden war, dass sie nach Ende des Kalten Krieges vor allem europäische Unternehmen ausspioniert hatte.
Betrieben wird „Echelon“ von Nachrichtendiensten der USA, Großbritanniens, Kanadas, Australiens und Neuseelands. Genau die fünf Staaten also, die auch bei der digitalen Datenspionage zusammenarbeiten.
Feind und „Freund“ hören mit
Auch Computer und Telefone anzuzapfen ist für Geheimdienste kein Problem. Um an die Daten zu kommen, bedarf es einfach einer entsprechenden Spionagesoftware. Zwar lassen sich nicht derartige Informationsmengen wie an Unterseekabeln abschöpfen, doch die Spione können gezielter attackieren. Und zum Beispiel ein bestimmtes Unternehmen ins Visier nehmen.

Der volkswirtschaftliche Schaden durch Industriespionage lässt sich schwer schätzen, weil die Dunkelziffern hoch sind. Das Beratungsunternehmen Corporate Trust geht von mindestens 4,2 Milliarden Euro pro Jahr allein in Deutschland aus.

Total verwanzt
Unter Verbündeten sollte das eigentlich ein Tabu sein: Trotzdem spähen US-Geheimdienstler auch die Europäische Union aus. Das berichtet zumindest das Nachrichtenmagazin „Der Spiegel“. Die diplomatischen Vertretungen der EU in Washington und bei den Vereinten Nationen in New York seien verwanzt worden, heißt es in dem Blatt unter Berufung auf Geheimdokumente des NSA-Enthüllers Edward Snowden. Darin würden die Europäer als „Angriffsziel“ benannt.

Die Methode, die Räume – angeblich oder tatsächlich – gegnerischer Nationen zu verwanzen, war schon im Kalten Krieg sehr beliebt. Der sowjetische Geheimdienst KGB entwickelte zum Beispiel so genannte passive Wanzen, die keine Batterie brauchten, sondern ihre Energie durch von außen eingestrahlte Mikrowellen erhielten. Die Sowjets konnten den US-Botschafter in Moskau auf diese Weise jahrelang abhören, ohne dass dies entdeckt wurde.

Der Mann mit dem Schlapphut hat noch nicht ausgedient
Trotz aller Hightech-Methoden, auf die Geheimdienste heute setzen: Nach wie vor ist der klassische Spion nicht aus der Mode gekommen. Für Aufsehen sorgt derzeit in Deutschland der Prozess gegen ein russisches Agentenehepaar, das 25 Jahre lang ein filmreifes Doppelleben geführt hatte. Jetzt müssen beide für mehrere Jahre hinter Gitter. Das Oberlandesgericht Stuttgart verurteilte den Ehemann zu sechseinhalb Jahren und seine Frau zu fünfeinhalb Jahren Haft.
Auch im Bereich der Wirtschaftsspionage sind Informanten ein wesentlicher Faktor. Denn in vielen Fällen sind es die eigenen Mitarbeiter einer Firma, die Betriebsgeheimnisse verkaufen.

Dienstag, 02.07.2013, 18:51 · von FOCUS-Online-Autor Harald Wiederschein

Find this story at 2 July 2013

© FOCUS Online 1996-2013

Der US-Geheimdienst NSA überwacht den weltweiten Internetverkehr. Dafür zapfen die Schnüffler auch Glasfaserkabel an, die am Meeresboden zwischen den Kontinenten verlaufen. Eine Schlüsselrolle soll dabei das U-Boot “Jimmy Carter” spielen.

Berlin – Jimmy Carter inszeniert sich gern als Freiheitskämpfer. Mit seinem Carter Center für Menschenrechte vermittelt der ehemalige US-Präsident in internationalen Konflikten, beobachtet Wahlen und setzt sich für transparente Regierungsführung in Entwicklungsländern ein. Für seine Arbeit wurde er mehrfach ausgezeichnet: Unter anderem erhielt er 1998 den Menschenrechtspreis der Vereinten Nationen und 2002 den Friedensnobelpreis.

2005 wurde ihm eine besondere Ehre zuteil: Die US-Marine benannte ein U-Boot nach Carter. Es ist das erste amerikanische Militär-U-Boot, das nach einem lebenden Ex-Präsidenten benannt wurde – und es ist nicht irgendeines. Die 138 Meter lange “Jimmy Carter” ist für Spezialoperationen ausgerüstet und nach Einschätzung von Geheimdienstexperten in der Lage, Unterwasserkabel anzuzapfen. Ein Boot also, das ausgerechnet von Carter hochgehaltene bürgerliche Freiheiten wie das Post- und Fernmeldegeheimnis zu verletzen sucht.

Bau und Ausrüstung des knapp 2,5 Milliarden Euro teuren U-Boots unterlagen strengster Geheimhaltung. “Sie werden niemanden finden, der mit Ihnen darüber spricht”, sagte Marinesprecher Kevin Sykes, als die “Jimmy Carter” Anfang 2005 in Dienst gestellt wurde.

Nur wenige Monate zuvor, im August 2004, hatte das US-Militär die USS “Parche” eingemottet. Dieses U-Boot hatte während des Kalten Kriegs Unterseekabel angezapft und galt als eine der wichtigsten Waffen im Spionagekrieg. Die Besatzung des Boots ist bis heute die höchstdekorierte Einheit der Marine. Das Militär nimmt ein solches Schiff nur dauerhaft außer Betrieb, wenn ein Nachfolger bereitsteht.

Das am stärksten bewaffnete U-Boot

140 Mann Besatzung leisten auf der USS “Jimmy Carter” Dienst. Sie verfügt über eine sogenannte Multi-Missions-Plattform, die wie ein Unterwasser-Hangar funktioniert. Von dort aus können Mini-U-Boote und Kampftaucher ins Wasser gelassen werden. 50 Spezialkräfte, etwa Navy Seals, kann das Atom-U-Boot aufnehmen. Für feindliches Sonar ist es kaum zu orten, weil seine Motoren extrem leise sind und der Bootskörper kaum elektromagnetische Strahlung abgibt.

Das Schiff ist mit Torpedos sowie Flugkörpern der Typen “Harpoon” und “Tomahawk” ausgerüstet, die feindliche Ziele sowohl zu Wasser als auch an Land ausschalten können – auch mit Nuklearsprengköpfen. Außerdem ist die Besatzung in der Lage, Seeminen zu legen. Damit sei die “Jimmy Carter” das am stärksten bewaffnete U-Boot, das jemals gebaut wurde, jubelte “Undersea Warfare”, das offizielle Magazin der amerikanischen U-Boot-Flotte.

Seit die “Jimmy Carter” vom Stapel lief, haben US-Medien mehrfach darüber spekuliert, dass das Schiff Glasfaserkabel zwischen den Kontinenten anzapfen könnte. Das Pentagon hat diesen Berichten nie widersprochen. Im vom Whistleblower Edward Snowden enthüllten Prism-Spähprogramm bestätigt der US-Militärgeheimdienst NSA sogar die “Sammlung der Kommunikation über Glasfaserkabel, während die Daten hindurchfließen”. Die Marine teilt lediglich mit, dass das U-Boot mit “fortschrittlicher Technologie für spezielle Marinekriegsführung und taktische Überwachung” ausgestattet sei.

Unklar ist bislang jedoch, wie die so abgefangenen Daten dann zu den Analysten des US-Militärgeheimdienstes gelangen. In den siebziger Jahren mussten regelmäßig U-Boote zu den Kabeln herabtauchen, um die Bänder einzusammeln. Diese Mission wurde schließlich von einem sowjetischen Spion verraten – das Aufnahmegerät befindet sich seither im Moskauer KGB-Museum. Sollten auch heutzutage die Kommunikationsdaten aus den Unterseekabeln nur zeitversetzt bei den Geheimdienstlern ankommen, wären akute Warnungen vor Terrorwarnungen kaum möglich.

Wahrscheinlicher ist daher, dass die Besatzung der “Jimmy Carter” an den Glasfaserkabeln einen Splitter installiert und eine eigene Faserleitung in ein Rechenzentrum des Geheimdienstes gelegt hat. Peter Franck, Sprecher des Chaos Computer Clubs, hält es außerdem für möglich, dass IT-Experten an Bord des U-Boots die Daten bereits vor Ort vorfiltern und verdichten und über die normale Funkkommunikation zur Basisstation zurückfunken könnten.

In beiden Fällen würden die NSA-Agenten praktisch in Echtzeit den Internetverkehr überwachen können.

01. Juli 2013, 18:02 Uhr
Von Christoph Sydow

Find this story at 1 July 2013

© SPIEGEL ONLINE 2013

Über 200 Tiefseekabel verbinden die Kontinente und machen moderne Kommunikation erst möglich. stern.de zeigt, wo die wichtigsten Leitungen liegen – und welches deutsche Kabel angezapft wurde. Von Alexander Sturm

Wenn Sie den Mauszeiger über die Kabel bewegen, öffnen sich Info-Kästen zu den jeweiligen Tiefseekabeln.

Gäbe es die vielen tausend Kilometer Tiefseekabel nicht, die auf dem Grund der Weltmeere liegen, unser Alltag wäre ein anderer: All die Telefongespräche, E-Mails oder Online-Bankgeschäfte über Kontinente hinweg wären nicht vorstellbar. Knapp 20 der wichtigsten Kabel sind in der Grafik abgebildet. Moderne Leitungen können gut ein Terabit Daten pro Sekunde übertragen; das entspricht dem Inhalt von rund 120 Stunden Spielfilm. Das einzige transatlantische Kabel, das in Deutschland landet, das TAT-14 (im Bild gefettet), schafft laut dem US-Marktforscher Telegeography 1,87 Terabit pro Sekunde – und wurde vom britischen Geheimdienst abgehört.
Verlegung dauert bis zu drei Jahren

Eigentümer der Kabel sind Konsortien aus internationalen Telekommunikationsfirmen, die die Leitungen gemeinsam verlegen und betreiben. Staaten haben keinen Anteil, kaufen aber oft Datenkapazitäten, um Botschaften oder Militäreinrichtungen zu verknüpfen. Die Verlegung von Tiefseekabeln ist aufwendig: Je nach Länge, Zahl der Landungspunkte und Wetter dauert es bis zu drei Jahren (etwa für die Strecke Kalifornien-Japan und zurück über Hawaii), denn auf hoher See können nur zehn Kilometer Kabel pro Stunde ins Meer gelassen werden. Wartung ist dagegen kaum nötig: “Wenn die Kabel einmal im Wasser liegen, werden sie in der Regel nicht mehr angefasst”, sagt Alan Mauldin, Forschungsdirektor beim Marktforscher Telegeography.

1858 gelang die Verlegung des ersten transatlantischen Kabels zwischen Großbritannien und Neufundland, damals ein Kupfer-Eisen-Draht. Moderne Seekabel aus Glasfasern gibt es erst seit 1988. Sie haben einen Durchmesser von rund sieben Zentimetern und bestehen aus Hunderttausenden hauchdünnen Fasern, die von einem Kupferrohr, Aluminium, Stahlseilen und mehreren Schichten Kunststoff geschützt werden. Viele Tiefseekabel enden an sechs großen Knotenpunkten: New York, Cornwall, Alexandria, Hongkong, Singapur und Tokio. Das längste Tiefseekabel der Welt könnte man übrigens beinahe um den Äquator legen. Das 36.500 Kilometer lange EAC-C2C verbindet China und Japan mit den Philippinen, Taiwan, Hongkong, Südkorea und Singapur.

6. Juli 2013, 14:11 Uhr

Find this story at 6 July 2013

© stern.de

Data surveillance: how much is too much?

Huge masses of data flash around the world along thousands of miles of fiber optic cables. They are regularly tapped – sometimes legally, mostly secretly. While this technology is simple, filtering is a huge challenge.

Almost all the countries in the world expect their foreign intelligence services to tap and sift through international telecommunications. For that reason, network operators whose lines cross international borders are legally obliged to make certain intersection points available to the authorities. Britain’s Tempora program, for instance, had perfectly legal access to the information it obtained – at least when it passed through British territory.

From electricity to light, and back

But fiber-optic cables can also be tapped secretly, without the knowledge of the operators – though this is not exactly easy. To understand how it works, one has to look more closely at how the data actually passes through the cables.

A standard fiber-optic cable laid across land consists of 144 individual glass fibers, while undersea cables consist of a maximum of eight individual fibers. Using laser technology, the electronic data is initially turned into ultra-short flashes of light. These flashes represent the zeros and ones that all digital information is comprised of. A photodiode at the end of the cable turns the light flashes back into electrical signals.

Around 10 billion such flashes of light run through these cables every second, and each one can also transfer between 1.2 and 5 gigabytes of data per second. But since the capacity of fiber optics is never completely used up, in practice the data flow is usually equivalent to between one and five standard CDs.

Fiber optics need amplifiers
Thousands of miles of fiber optic cables are laid across the ocean floor

But after a certain distance, the data signal drops. Every 80 kilometers or so, the signals have to be re-amplified, explained Klaus-Dieter Langer of the Fraunhofer Heinrich-Hertz-Institute in Berlin.

This is done with the help of a “regenerator.” Undersea cables also have regenerators, which are supplied with electricity by copper cables laid across the ocean floor, together with the fiber optics.

These regenerators are the system’s weak point. At these spots, the fiber optics can be more easily tapped, because they are no longer bundled together, rather laid out individually (since each fiber must be amplified separately). At these points, data piracy is not necessarily easy – but that, as Langer puts it, is “just a technical hurdle.”

A vigilant network operator can spot such hacking attempts. “You need very sensitive measuring instruments,” said Langer, “then you can see when the signal strength suddenly dips.”

Order in the data chaos

Once a spy has succeeded in hacking into a cable, the bigger challenge emerges – sifting through the immense mass of data. This needs to be done quickly. Even if a single glass cable is operating only at 50 percent capacity, it can still deliver 10 terabytes of data in an hour. “Since storage capacity is finite, the trick is to analyze these 10 terabytes within an hour, and filter out what you’re looking for,” said Langer.

A lot of the data needs to be decrypted – which also means being temporarily stored. At the same time, intelligence agencies must proceed very selectively so as not to get bogged down in the flood of data. Langer believes that agents probably concentrate on single fibers belonging to certain operators of particular interest. “It makes more sense to search for certain content, rather than, for example, email conversations, telephone connections and the like.

Wire-tapping contest under the ocean
Huge server capacity must be immediately available to sift data

Hacking a cable only makes sense if you have large server capacity immediately available, which is why Langer is skeptical of recent media speculation about the USS Jimmy Carter, a nuclear submarine said to be on a mission to tap underwater cables. “It seems bizarre,” said Langer.

But Peter Franck, spokesman for the Chaos Computer Club digital rights collective, considers the submarine reports “absolutely believable.” Though tapping underwater cables is so secret “that it would never be publicly talked about,” so far reports in the American media have not been denied by the government.

Franck can imagine a number of ways in which data could be moved from the submarine to servers on shore. He speculates, for instance, that the data could be pre-filtered on board and then broadcast to a base via the normal radio communication. Or a device that records the data could be left on the ocean floor. “An extra vehicle could then come and pick it up,” Franck suggested.

Such underwater cables are certainly of considerable interest to intelligence agencies, since a huge part of international communication travels through them. It could certainly be the case that a lot of the world’s fiber optic cables are being tapped – and not only in countries where respective intelligence agencies are based.

Date 30.06.2013
Author Fabian Schmidt / bk
Editor Sonya Diehn

Find this story at 30 June 2013

© 2013 Deutsche Welle

The NSA espionage scandal has unsettled German companies. They are concerned that industrial secrets may have been stolen by US intelligence agencies.

Trust between Washington and Berlin has been shaken by the scandal over the alleged bugging of German government and EU buildings by US intelligence agencies. Reacting angrily to the apparent widespread surveillance of telephone and email communications, German politicians have demanded a speedy explanation from Washington. The EU and Germany do, after all, see themselves as partners of the US.

While the outrage may be exaggerated, there are legitimate, unanswered questions. For example: Why is the National Security Agency (NSA) collecting such large amounts of data, and for what end is that data being used?

The Trojan horse

The chairman of the conservative Christian Social Union’s small business group, Hans Michelbach, sees the surveillance of EU institutions by US intelligence agencies as a cause for alarm.

“The EU is not a supporter of terrorism, but is indeed a strong competitor in the global economy,” Michelbach said. He fears that not only European institutions, but also European and German firms may have been spied on, giving the US “dishonest advantages.”

Germany’s consumer protection minister, Ilse Aigner, warns that the joint fight against terrorism could be turned into a “Trojan horse” that “covers up espionage against governments and companies.”

Meanwhile, German companies have expressed both concern and astonishment at the extent of the spying.

“There was speculation in the past that conversations and Internet activity were being recorded by foreign intelligence agencies,” Volker Wagner, chairman of the Working Group for Economic Security, told DW. “But if the media reports are true, then the dimensions are alarming.”

Opportunity makes a thief

Other economic and industrial groups have reacted in a similar fashion. They want to know what kind of data was recorded and how it was used. At the moment, the European business community only has suspicions that industrial secrets were stolen by US intelligence agencies. Typically, stolen technologies and products show up in the hands of competitors or foreign countries years after they were originally taken.

But according to Wagner, the amount of data collected creates an incentive for abuse.

“One has to consider that American security services employ many freelancers, contractors and consultants,” Wagner said. “It’s estimated that in Washington alone, up to 1.5 million contractors work for the security services.”
Rösler said US espionage hurts prospects for a trade agreement

It’s uncertain whether all of these contractors respect the law. Rainer Glatz of the German Engineering Federation calls for the creation of an international treaty that clearly regulates data protection and intellectual property. Glatz believes that the private sector has to become more proactive and avoid relying on the state to protect corporate secrets. Countermeasures, such as firewalls, are being implemented by the companies the federation represents.

“In addition, we have to school the employees in the sales department and the service technicians on how to protect corporate information,” Glatz told DW.

EU-US trade agreement jeopardized

Germany’s IT small business association is pursuing a different approach. The group has suggested the creation of Europe-wide corporate consortiums as a counterbalance to the economic power of the US.

But the American and European economies are supposed to become even more integrated in the future. The EU and US hope to implement a free trade agreement. German Economy Minister Philipp Rösler has said that while Berlin still has an interest in such a partnership with the US, the espionage scandal has negatively impacted the project.

“The US now has to quickly clarify the allegations and provide transparency,” Rösler said.

Industrial espionage causes billions of euros in economic damage in Germany. The security consultancy Corporate Trust estimates that it cost 4.2 billion euros ($5.4 billion) in 2012.

Date 03.07.2013
Author Jennifer Fraczek / slk
Editor Andreas Illmer

Find this story at 3 July 2013

© 2013 Deutsche Welle

Echelon system identified as “legislation-free zone”

In a major report to be published this week, the Echelon committee of the European Parliament has found that the conduct of electronic surveillance activities by US intelligence breaches the European Convention of Human Rights even when conducted, allegedly, for law enforcement purposes. It concludes that if the British and German governments fail to prevent the improper use of surveillance stations sited on their territory to intercept private and commercial communications, they may be in breach both of community law and of human rights treaties.

Composite Signals Organisation Station Morwenstow, run by Britain’s GCHQ, was the first station built to intercept civil commercial satellite communications as part of the ECHELON system

Two drafts of the proposed EP report, prepared by rapporteur and MEP Gerhard Schmidt, were leaked earlier this month. The form and wording of the committee’s final report is due to be settled by the full committee in a meeting in Brussels on Tuesday 29 May.

Comparison of the two drafts shows that the committee was waiting to question American government and trade officials about their use of economic intelligence before making its final comments. But, two weeks ago, the American government decided to snub them after members had already arrived in Washington, abruptly cancelling a series of planned meetings.

The declared policy of the US government, as explained last year by former CIA director James Woolsey, is to use the U.S. intelligence system spy on European companies in order to gather evidence of bribery and unfair trade practices. Woolsey said “Yes, my continental European friends, we have spied on you. And it’s true that we use computers to sort through data by using keywords”. “We have spied on you because you bribe”, he wrote in the Wall Street Journal[1].

US economic intelligence policies in support of business and trade were exposed four months ago in a detailed new report to the Echelon committee. That report on “COMINT impact on international trade”[2] is published here exclusively for the first time today. The report traces in detail how U.S. intelligence gathering priorities shifted dramatically after the end of the Cold War, with the result that “about 40 percent of the requirements” of U.S. intelligence collection became “economic, either in part or in whole”.

Echelon committee vice-chairman Neil MacCormick (Scotland) wants to see legal changes to protect private communications; meanwhile “people should treat their e-mails like seaside postcards” that anyone else can read.

The new priorities for economic intelligence were approved by the first President Bush in a document called NSD-67 (National Security Directive 67), issued by the White House on 20 March 1992. By using the CIA and NSA to spy on foreign rivals of American companies, the declared U.S. objective was to “level the playing field” in foreign trade.

After the new policies came into force, the incoming Clinton administration set up a new Trade Promotion co-ordinating committee, with direct intelligence inputs from the CIA and direct links to U.S. business through a new “Advocacy Center”. Intelligence from NSA and CIA was supplied to the U.S. government department of Commerce through an “Office of Intelligence Liasion”, which was equipped to handle intercepted communications such as those supplied by the Echelon network.

According to documents provided to the Echelon Committee and now published here, the CIA team in the Commerce Department proposed gathering information on “primary competitors” of American business in a major Asian market. One document shows that, of 16 U.S. government officials attending a meeting on winning contracts in Indonesia, 5 were from the CIA (see Annexe 2-3[3]).

Two of the NSA’s largest electronic intelligence stations are located at Bad Aibling, Bavaria and Menwith Hill, in England. Both stations intercept satellite communications and use surveillance satellites to collect communications from the ground, anywhere in the western hemisphere.

The U.S. congress was recently told that, as a result of “levelling the playing field”, American companies gained $145 billion worth of business during the 1990s, after intelligence agencies claimed to have detected and defeated bribery or unfair conduct by foreign competitors. Many such contracts were listed in dossiers of cases publicised during the 1990s.

According to reports of “success stories” published by the Advocacy Center, European countries have lost out massively. France lost nearly $17 billion dollars worth of trade, and Germany $4 billion out of a total of about $40 billion. Sweden lost $386 million worth of business, the Netherlands $184 million. Not all “successes” necessarily involved allegations of bribery, but many did.

Despite the huge number of cases in which it claims to have detected bribery, the U.S. government has never published any evidence to substantiate its claims. Nor has it instigated any prosecutions. Equally hard to substantiate has been evidence in specific cases where secret interception activities are alleged to have affected a major contract. All of the specific accounts of European business losses, such as the lost of an $8 billion Airbus contract in 1994, were published by the American press, at a time when the Clinton administration wanted to publicise that it was doing its best for business.

The clear motive was to tell the Americans that their government and intelligence agencies were now helping with the economy. But when Europe became concerned about the Echelon system, such stories stopped appearing in the U.S. media, and information dried up.

The job of the US Department of Commerce’s Advocay Center is to “aggressively support U.S. bidders in global competitions where advocacy is in the national interest”.

Many MEPs suspect that the American claim only to use their secret listening systems, including the Echelon network, to prevent bribery are a smoke screen to cover straightforward spying for business and trade purposes.

The report on “COMINT impact on international trade” sets out, with many detailed sources, the case that from 1992 to date Europe is likely to have sustained significant employment and financial loss as a result of the U.S. government policy of “levelling the playing field”. The report does not address whether the U.S. position that such interventions were and are justified by corrupt and or unfair behaviour by foreign competitors or governments are reasonable or, in fact, are true.

But it is not necessary to show that intelligence information has been given directly to U.S. corporations for major economic damage to be assessed to have occurred. The boundaries of such estimates could lie between $13 billion and $145 billion. The only certain observation is that the exact figure will never be known.

Although failing to find new reports of European business losses beyond those appearing in the American media in 1994-1996, the Echelon committee has found that even if it were proven that bribery was involved, this does not make NSA activities of this kind legal in Europe. The draft report points out that:

“The American authorities have repeatedly tried to justify the interception of telecommunications by accusing the European authorities of corruption and taking bribes. It should be pointed out to the Americans that all EU Member States have properly functioning criminal justice systems. If there is evidence that crimes have been committed, the USA must leave the task of law enforcement to the host countries. If there is no such evidence, surveillance must be regarded as unproportional, a violation of human rights and thus inadmissible.”

Just a week ago, former CIA director Woolsey repeated his claims of European bribery at a meeting in New York. In the context of any such activities conducted at NSA’s British and German stations, this now appears to be an admission of unlawful conduct.

According to the draft report, “under the terms of the ECHR, interference in the exercise of the right to privacy must be proportional and, in addition, the least invasive methods must be chosen. As far as European citizens are concerned, an operation constituting interference carried out by a European intelligence service must be regarded as less serious than one conducted by an American intelligence service”.

Not least, this is because European citizens or companies could only get legal redress for such misconduct in national courts, not American courts.

“Operations constituting interference must therefore be carried out, as far as possible, by the German or UK authorities, particularly when investigations are being conducted for law enforcement.”

The draft committee report concludes that “there would seem to be good reason … to call on Germany and the United Kingdom to take their obligations under the ECHR seriously and to make the authorisation of further intelligence activities by the NSA on their territory contingent on compliance with the ECHR”.

The IC2001 papers

Four new studies on “Interception Capabilities – Impact and Exploitation” were commissioned by the Temporary Committee on the Echelon Interception System of the European Parliament in December 2000. The new studies update and extend the previous EP report, “Interception Capabilities 2000″[4], which was prepared in 1999. They cover the use of communications intelligence (COMINT) for economic purposes, legal and human rights issues, and recent political and technological developments. Among the key topics covered are the documentary and factual evidence for the existence of the COMSAT (communications satellite) intercept system known as “ECHELON”.

These studies were presented to the Echelon Committee at its Brussels meeting on 22 and 23 January 2001. The fourth study, on new political and technical developments, was presented only in the form of a slideshow. These studies are published with permission from the secretariat of the Echelon Committee.

ECHELON and its role in COMINT

IC2001, paper 1[5]

This paper summarises the evidence for the existence of ECHELON as a global interception system. It records official admissions about the secret UKUSA agreement that links English-speaking signals intelligence organisations. The paper also provides detailed answers to questions put by the Committee. It points out that very few media reports have provided original new information about Echelon, and that many press reports have enlarged on the nature of the interception systems and their capabilities, without evidence.

COMINT impact on international trade

IC2001, paper 2[6]

Paper 2 sets out, with detailed sources, the case that from 1992 to date Europe is likely to have sustained significant employment and financial loss as a result of the U.S. government policy of “levelling the playing field”, introduced in 1991. It also refers to:

Annexe 2-1[7] Background papers about the U.S. Trade Promotion Co-ordinating Committee (TPCC) and the Advocacy Center, including statements of purpose

Annexe 2-2[8] A questionaire for U.S. companies to answer in order to determine whether or not they are deemed “American” and thus qualify for official assistance. The questionnaire is also on the internet[9].

Annexe 2-3[10] Documents revealing the CIA’s role in U.S. trade promotion, obtained under the Freedom of Information Act.

Annexe 2-4[11] U.S. trade “Success stories” affecting Europe – financial and geographical analysis Many of the stories can be viewed online[12] For example, this report[13] concerns the controversial power plant at Dabhol, India.

COMINT, privacy and human rights

IC2001, paper 3[14]

This paper reveals that Britain undertakes to protect the rights of Americans, Canadians and Australians against interception that would not comply with their own domestic law, while offering no protection of any kind to other Europeans. This and other background papers provided to the Echelon committee have prompted them to observe that “possible threats to privacy and to businesses posed by a system of the ECHELON type arise not only from the fact that is a particularly powerful monitoring system, but also that it operates in a largely legislation-free area.”

Other Reports

The committee were also given copies of three key articles about US intelligence and economic activity:

“Why We Spy on Our Allies”[15], by James Woolsey, former director of the CIA, Wall Street Journal, 17 March 2000.

“It’s true that we use computers to sort through data by using keywords. Have you stopped to ask yourselves what we’re looking for?”

“U.S. spying pays off for business” by Bob Windrem, NBC News Online, 15 April 2000 Originally published at MSNBC[16] This link is broken, but an alternative copy is here[17] and on other sites.

“U.S. companies have benefited when U.S. intelligence redirected its Cold War assets towards economic intelligence.”

“U.S. steps up commercial spying[18] – Washington gives companies an advantage in information”, by Bob Windrem, NBC News Online, 7 May 2000. Again, the link has recently been broken, but an alternative copy is at www.gn.apc.org/cndyorks/caab/articles/spying.htm[19].

“Documents, all published during the Clinton administration, appear to confirm reports that America’s electronic eavesdropping apparatus was involved in commercial espionage.”

Duncan Campbell 27.05.2001

Find this story at 27 May 2001

Copyright © Telepolis, Heise Zeitschriften Verlag

Top secret documents detail the mass scope of efforts by the United States to spy on Germany and Europe. Each month, the NSA monitors a half a billion communications and EU buildings are bugged. The scandal poses a threat to trans-Atlantic relations.

At first glance, the story always appears to be the same. A needle has disappeared into the haystack — information lost in a sea of data.

For some time now, though, it appears America’s intelligence services have been trying to tackle the problem from a different angle. “If you’re looking for a needle in the haystack, you need a haystack,” says Jeremy Bash, the former chief of staff to ex-CIA head Leon Panetta.

An enormous haystack it turns out — one comprised of the billions of minutes of daily cross-border telephone traffic. Add to that digital streams from high-bandwidth Internet cables that transport data equivalent to that held in Washington’s Library of Congress around the world in the course of a few seconds. And then add to that the billions of emails sent to international destinations each day — a world of entirely uncontrolled communication. And also a world full of potential threats — at least from the intelligence services’ perspective. Those are the “challenges,” an internal statement at the National Security Agency (NSA), the American signals intelligence organization, claims.

Four-star General Keith Alexander — who is today the NSA director and America’s highest-ranking cyber warrior as the chief of the US Cyber Command — defined these challenges. Given the cumulative technological eavesdropping capacity, he asked during a 2008 visit to Menwith Hill, Britain’s largest listening station near Harrogate in Yorkshire, “Why can’t we collect all the signals all the time?”

All the signals all the time. Wouldn’t that be the NSA’s ideal haystack? So what would the needle be? A trail to al-Qaida, an industrial facility belonging to an enemy state, plans prepared by international drug dealers or even international summit preparations being made by leading politicians of friendly nations? Whatever the target, it would be determined on a case by case basis. What is certain, however, is that there would always be a haystack.

A Fiasco for the NSA

Just how close America’s NSA got to this dream in cozy cooperation with other Western intelligence services has been exposed in recent weeks by a young American who, going by outward appearances, doesn’t look much like the hero he is being celebrated as around the world by people who feel threatened by America’s enormous surveillance apparatus.

The whole episode is a fiasco for the NSA which, in contrast to the CIA, has long been able to conduct its spying without drawing much public attention. Snowden has done “irreversible and significant damage” to US national security, Alexander told ABC a week ago. Snowden’s NSA documents contain more than one or two scandals. They are a kind of digital snapshot of the world’s most powerful intelligence agency’s work over a period of around a decade. SPIEGEL has seen and reviewed a series of documents from the archive.

The documents prove that Germany played a central role in the NSA’s global surveillance network — and how the Germans have also become targets of US attacks. Each month, the US intelligence service saves data from around half a billion communications connections from Germany.

No one is safe from this mass spying — at least almost no one. Only one handpicked group of nations is excluded — countries that the NSA has defined as close friends, or “2nd party,” as one internal document indicates. They include the UK, Australia, Canada and New Zealand. A document classified as “top secret” states that, “The NSA does NOT target its 2nd party partners, nor request that 2nd parties do anything that is inherently illegal for NSA to do.”

‘We Can, and Often Do Target Signals’

For all other countries, including the group of around 30 nations that are considered to be 3rd party partners, however, this protection does not apply. “We can, and often do, target the signals of most 3rd party foreign partners,” the NSA boasts in an internal presentation.

According to the listing, Germany is among the countries that are the focus of surveillance. Thus, the documents confirm what had already been suspected for some time in government circles in Berlin — that the US intelligence service, with approval from the White House, is spying on the Germans — possibly right up to the level of the chancellor. So it comes as little surprise that the US has used every trick in the book to spy on the Washington offices of the European Union, as one document viewed by SPIEGEL indicates.

But the new aspect of the revelations isn’t that countries are trying to spy on each other, eavesdropping on ministers and conducting economic espionage. What is most important about the documents is that they reveal the possibility of the absolute surveillance of a country’s people and foreign citizens without any kind of effective controls or supervision. Among the intelligence agencies in the Western world, there appears to be a division of duties and at times extensive cooperation. And it appears that the principle that foreign intelligence agencies do not monitor the citizens of their own country, or that they only do so on the basis of individual court decisions, is obsolete in this world of globalized communication and surveillance. Britain’s GCHQ intelligence agency can spy on anyone but British nationals, the NSA can conduct surveillance on anyone but Americans, and Germany’s BND foreign intelligence agency can spy on anyone but Germans. That’s how a matrix is created of boundless surveillance in which each partner aids in a division of roles.

The documents show that, in this situation, the services did what is not only obvious, but also anchored in German law: They exchanged information. And they worked together extensively. That applies to the British and the Americans, but also to the BND, which assists the NSA in its Internet surveillance.

Unimaginable Dimensions

SPIEGEL has decided not to publish details it has seen about secret operations that could endanger the lives of NSA workers. Nor is it publishing the related internal code words. However, this does not apply to information about the general surveillance of communications. They don’t endanger any human lives — they simply describe a system whose dimensions go beyond the imaginable. This kind of global debate is actually precisely what Snowden intended and what motivated his breach of secrecy. “The public needs to decide whether these policies are right or wrong,” he says.

The facts, which are now a part of the public record thanks to Snowden, disprove the White House’s line of defense up until now, which has been that the surveillance is necessary to prevent terrorist attacks, as President Barack Obama said during his recent visit to Berlin. NSA chief Alexander has sought to justify himself by saying that the NSA has prevented 10 terrorist attacks in the United States alone. Globally, he says that 50 terrorist plots have been foiled with the NSA’s help. That may be true, but it is difficult to verify and at best only part of the truth.

Research in Berlin, Brussels and Washington, as well as the documents that have been reviewed by the journalists at this publication, reveal how overreaching the US surveillance has been.

Germany, for its part, has a central role in this global spying system. As the Guardian newspaper, which is working together with Snowden, recently revealed, the NSA has developed a program for the incoming streams of data called “Boundless Informant.” The program is intended to process connection data from all incoming telephone calls in “near real time,” as one document states. It doesn’t record the contents of the call, just the metadata — in other words, the phone numbers involved in the communication.

It is precisely the kind of data retention that has been the subject of bitter debate in Germany for years. In 2010, the Federal Constitutional Court in Karlsruhe even banned the practice.

“Boundless Informant” produces heat maps of countries in which the data collected by the NSA originates. The most closely monitored regions are located in the Middle East, followed by Afghanistan, Iran and Pakistan. The latter two are marked in red on the NSA’s map of the world. Germany, the only country in Europe on the map, is shown in yellow, a sign of considerable spying.

Spying on the European Union
An NSA table (see graphic), published for the first time here by SPIEGEL, documents the massive amount of information captured from the monitored data traffic. According to the graph, on an average day last December, the agency gathered metadata from some 15 million telephone connections and 10 million Internet datasets. On Dec. 24, it collected data on around 13 million phone calls and about half as many Internet connections.

On the busiest days, such as Jan. 7 of this year, the information gathered spiked to nearly 60 million communications processes under surveillance. The Americans are collecting metadata from up to half a billion communications a month in Germany — making the country one of the biggest sources of streams of information flowing into the agency’s gigantic sea of data.

Another look at the NSA’s data hoard shows how much less information the NSA is taking from countries like France and Italy. In the same period, the agency recorded data from an average of around 2 million connections, and about 7 million on Christmas Eve. In Poland, which is also under surveillance, the numbers varied between 2 million and 4 million in the first three weeks of December.

But the NSA’s work has little to do with classic eavesdropping. Instead, it’s closer to a complete structural acquisition of data. Believing that less can be extrapolated from such metadata than from intercepted communication content would be a mistake, though. It’s a gold mine for investigators, because it shows not only contact networks, but also enables the creation of movement profiles and even predictions about the possible behavior of the people participating in the communication under surveillance.

According to insiders familiar with the German portion of the NSA program, the main interest is in a number of large Internet hubs in western and southern Germany. The secret NSA documents show that Frankfurt plays an important role in the global network, and the city is named as a central base in the country. From there, the NSA has access to Internet connections that run not only to countries like Mali or Syria, but also to ones in Eastern Europe. Much suggests that the NSA gathers this data partly with and without Germany’s knowledge, although the individual settings by which the data is filtered and sorted have apparently been discussed. By comparison, the “Garlick” system, with which the NSA monitored satellite communication out of the Bavarian town of Bad Aibling for years, seems modest. The NSA listening station at Bad Aibling was at the center of the German debate over America’s controversial Echelon program and alleged industrial espionage during the 1990s.

“The US relationship with Germany has been about as close as you can get,”American journalist and NSA expert James Bamford recently told German weekly Die Zeit. “We probably put more listening posts in Germany than anyplace because of its proximity to the Soviet Union.”

Such foreign partnerships, one document states, provide “unique target access.”

‘Privacy of Telecommunications’ Is ‘Inviolable’

But the US does not share the results of the surveillance with all of these foreign partners, the document continues. In many cases, equipment and technical support are offered in exchange for the signals accessed. Often the agency will offer equipment, training and technical support to gain access to its desired targets. These “arrangements” are typically bilateral and made outside of any military and civil relationships the US might have with these countries, one top secret document shows. This international division of labor seems to violate Article 10 of Germany’s constitution, the Basic Law, which guarantees that “the privacy of correspondence, posts and telecommunications shall be inviolable” and can only be suspended in narrowly defined exceptions.

“Any analyst can target anyone anytime,” Edward Snowden said in his video interview, and that includes a federal judge or the president, if an email address is available, he added.

Just how unscrupulously the US government allows its intelligence agencies to act is documented by a number of surveillance operations that targeted the European Union in Brussels and Washington, for which it has now become clear that the NSA was responsible.

A little over five years ago, security experts discovered that a number of odd, aborted phone calls had been made around a certain extension within the Justus Lipsius building, the headquarters of the European Council, the powerful body representing the leaders of the EU’s 27 member states. The calls were all made to numbers close to the one used as the remote servicing line of the Siemens telephone system used in the building. Officials in Brussels asked the question: How likely is it that a technician or service computer would narrowly misdial the service extension a number of times? They traced the origin of the calls — and were greatly surprised by what they found. It had come from a connection just a few kilometers away in the direction of the Brussels airport, in the suburb of Evere, where NATO headquarters is located.

The EU security experts managed to pinpoint the line’s exact location — a building complex separated from the rest of the headquarters. From the street, it looks like a flat-roofed building with a brick facade and a large antenna on top. The structure is separated from the street by a high fence and a privacy shield, with security cameras placed all around. NATO telecommunications experts — and a whole troop of NSA agents — work inside. Within the intelligence community, this place is known as a sort of European headquarters for the NSA.

A review of calls made to the remote servicing line showed that it was reached several times from exactly this NATO complex — with potentially serious consequences. Every EU member state has rooms at the Justus Lipsius building for use by ministers, complete with telephone and Internet connections.

Unscrupulous in Washington

The NSA appears to be even more unscrupulous on its home turf. The EU’s diplomatic delegation to the United States is located in an elegant office building on Washington’s K Street. But the EU’s diplomatic protection apparently doesn’t apply in this case. As parts of one NSA document seen by SPIEGEL indicate, the NSA not only bugged the building, but also infiltrated its internal computer network. The same goes for the EU mission at the United Nations in New York. The Europeans are a “location target,” a document from Sept. 2010 states. Requests to discuss these matters with both the NSA and the White House went unanswered.

Now a high-level commission of experts, agreed upon by European Justice Commissioner Viviane Reding and US Attorney General Eric Holder, is to determine the full scope of the routine data snooping and discuss the legal protection possibilities for EU citizens. A final report is expected to be released in October.

The extent of the NSA’s systematic global surveillance network is highlighted in an overview from Fort Meade, the agency’s headquarters. It describes a number of secret operations involving the surveillance of Internet and international data traffic. “In the Information Age, (the) NSA aggressively exploits foreign signals traveling complex global networks,” an internal description states.

Details in a further, previously unpublished document reveal exactly what takes place there. It describes how the NSA received access to an entire bundle of fiber-optic cables, which have a data-transfer capacity of several gigabytes per second. It is one of the Internet’s larger superhighways. The paper indicates that access to the cables is a relatively recent development and includes Internet backbone circuits, “including several that service the Russian market.” Technicians in Fort Meade are able to access “thousands of trunk groups connected worldwide,” according to the document. In a further operation, the intelligence organization is able to monitor a cable that collects data flows from the Middle East, Europe, South America and Asia (see graphic).

But it is not just intelligence agencies from allied nations that have willingly aided the NSA. Revelations related to the Prism program make it clear that agents likewise access vast quantity of data from US Internet companies.

NSA ‘Alliances With Over 80 Major Global Corporations’
Heads of these companies have vociferously denied that the NSA has direct access to their data. But it would seem that, outside of the Prism program, dozens of companies have willingly worked together with the US intelligence agency.

According to the documents seen by SPIEGEL, a particularly valuable partner is a company which is active in the US and has access to information that crisscrosses America. At the same time, this company, by virtue of its contacts, offers “unique access to other telecoms and (Internet service providers).” The company is “aggressively involved in shaping traffic to run signals of interest past our monitors,” according to a secret NSA document. The cooperation has existed since 1985, the documents say.

Apparently, it’s not an isolated case, either. A further document clearly demonstrates the compliance of a number of different companies. There are “alliances with over 80 major global corporations supporting both missions,” according to a paper that is marked top secret. In NSA jargon, “both missions” refers to defending networks in the US, on the one hand, and monitoring networks abroad, on the other. The companies involved include telecommunications firms, producers of network infrastructure, software companies and security firms.

Such cooperation is an extremely delicate issue for the companies involved. Many have promised their customers data confidentiality in their terms and conditions. Furthermore, they are obliged to follow the laws of the countries in which they do business. As such, their cooperation deals with the NSA are top secret. Even in internal NSA documents, they are only referred to using code names.

“There has long been a very close and very secret relationship between a number of telecoms and the NSA,” Bamford, the expert on the NSA, told Die Zeit. “Every time it gets discovered it stops for a while and then starts up again.”

The importance of this rather peculiar form of public-private partnership was recently made clear by General Alexander, the NSA chief. At a technology symposium in a Washington, DC, suburb in May, he said that industry and government must work closely together. “As great as we have it up there, we cannot do it without your help,” he said. “You know, we can’t do our mission without the great help of all the great people here.” If one believes the documents, several experts were sitting in the audience from companies that had reached a cooperation deal with the NSA.

In the coming weeks, details relating to the collaboration between Germany’s BND and the NSA will be the focus of a parliamentary investigative committee in Berlin responsible for monitoring the intelligence services. The German government has sent letters to the US requesting additional information. The questions that need to be addressed are serious. Can a sovereign state tolerate a situation in which half a billion pieces of data are stolen on its territory each month from a foreign country? And can this be done especially when this country has identified the sovereign state as a “3rd party foreign partner” and, as such, one that can be spied on at any time, as has now become clear?

So far, the German government has made nothing more than polite inquiries. But facts that have now come to light will certainly increase pressure on Chancellor Angela Merkel and her government. Elections, after all, are only three months away, and Germans — as Merkel well knows — are particularly sensitive when it comes to data privacy.

The NSA’s Library of Babel

In a story written by the blind writer Jorge Luis Borges, the Library of Babel is introduced as perhaps the most secretive of all labyrinths: a universe full of bookshelves connected by a spiral staircase that has no beginning and no end. Those inside wander through the library looking for the book of books. They grow old inside without ever finding it.

If an actual building could really approach this imaginary library, it is the structure currently being erected in the Utah mountains near the city of Bluffdale. There, on Redwood Road, stands a sign with black letters on a white background next to a freshly paved road. Restricted area, no access, it reads. In Defense Department documents, form No. 1391, page 134, the buildings behind the sign are given the project No. 21078. It refers to the Utah Data Center, four huge warehouses full of servers costing a total of €1.2 billion ($1.56 billion).

Built by a total of 11,000 workers, the facility is to serve as a storage center for everything that is captured in the US data dragnet. It has a capacity that will soon have to be measured in yottabytes, which is 1 trillion terabytes or a quadrillion gigabytes. Standard external hard drives sold in stores have a capacity of about 1 terabyte. Fifteen such hard drives could store the entire contents of the Library of Congress.

The man who first made information about the Utah center public, and who likely knows the most about the NSA, is James Bamford. He says: “The NSA is the largest, most expensive and most powerful intelligence agency in the world.”

Since the 9/11 terror attacks, the NSA’s workforce has steadily grown and its budget has constantly increased. SPIEGEL was able to see confidential figures relating to the NSA that come from Snowden’s documents, though the statistics are from 2006. In that year, 15,986 members of the military and 19,335 civilians worked for the NSA, which had an annual budget of $6.115 billion. These numbers and more recent statistics are officially confidential.

In other words, there is a good reason why NSA head Keith Alexander is called “Emporer Alexander.” “Keith gets whatever he wants,” says Bamford.

Still, Bamford doesn’t believe that the NSA completely fulfills the mission it has been tasked with. “I’ve seen no indications that NSA’s vastly expanded surveillance has prevented any terrorist activities,” he says. There is, however, one thing that the NSA managed to predict with perfect accuracy: where the greatest danger to its secrecy lies. In internal documents, the agency identifies terrorists and hackers as being particularly threatening. Even more dangerous, however, the documents say, is if an insider decides to blow the whistle.

An insider like Edward Joseph Snowden.

07/01/2013 11:11 AM
By Laura Poitras, Marcel Rosenbach, Fidelius Schmid, Holger Stark and Jonathan Stock

Find this story at 1 July 2013

© SPIEGEL ONLINE 2013

BRUSSELS—Senior European politicians demanded explanations from Washington of allegations that the National Security Agency spied on European Union institutions, risking a corrosion of trust as the EU and U.S. embark on negotiations over a free-trade accord.

The German weekly magazine Der Spiegel reported over the weekend that the U.S. placed listening devices in EU offices in Washington, infiltrated computers there and electronically spied on EU bodies elsewhere. It cited secret documents obtained by former NSA contractor Edward Snowden as the basis for its report.

Reuters

A former NSA base in Germany. A German politician criticized allegations the U.S. spied on European officials.

The allegations come at a sensitive time. The EU in June gave the go-ahead for the start of trade negotiations with the U.S., which are likely to start soon. Though the talks are expected to take at least two years, the European Parliament, where many lawmakers are highly sensitive to privacy issues, will need to approve any accord.

“Partners do not spy on each other,” EU Justice Commissioner Viviane Reding said at a public forum in Luxembourg. “We cannot negotiate over a big trans-Atlantic market if there is the slightest doubt that our partners are carrying out spying activities on the offices of our negotiators. The American authorities should eliminate any such doubt swiftly.”

Snowden on the Run

U.S. authorities sought to catch Edward Snowden before he reached his next goal: political asylum in Ecuador.

French Foreign Minister Laurent Fabius said his country had formally requested clarification from Washington. “These facts, if confirmed, would be absolutely unacceptable,” he said.

Germany’s Justice Ministry also called for the U.S. to clarify the matter, and for European Commission President José Manuel Barroso to act. “If the media reports are true, it’s reminiscent of the approaches of enemies during the Cold War. It’s beyond any stretch of the imagination that our friends in the U.S.A. see the Europeans as enemies,” German Justice Minister Sabine Leutheusser-Schnarrenberger said in a statement.

“Comprehensive spying by the Americans on Europeans cannot be allowed,” she said, adding that it is unlikely the U.S. could justify bugging European diplomacy offices as part of the global fight on terrorism.

The European External Action Service, the foreign policy arm of the EU whose premises were an alleged target of U.S. surveillance, said the issue “is clearly a matter of concern.” It said the U.S. authorities “have told us they are checking on the accuracy of the information…and will come back to us as soon as possible.”

The U.S. Office of the Director of National Intelligence said the U.S. is responding to the European Union privately about the allegations.

The U. S. “will respond appropriately to the European Union through our diplomatic channels,” the office said. “We will also discuss these issues bilaterally with EU member states.”

The office’s statement didn’t address the specific allegations but said, “We have made clear that the United States gathers foreign intelligence of the type gathered by all nations.”

In a separate report Sunday, the Guardian newspaper in Britain said an NSA document lists 38 embassies and missions as “targets” for the agency’s spying, among them the French, Italian and Greek embassies. The article cited information leaked by Mr. Snowden as it source.

The allegations are the latest to emerge in U.S. and European media about surveillance activities by the U.S. and its closest allies based on Mr. Snowden’s disclosures. Mr. Snowden is at a Moscow airport, arriving there from Hong Kong in a bid to travel to Ecuador, where he has applied for political asylum.

The lead author of Der Spiegel’s report was Laura Poitras, an American documentary filmmaker who created a video interview with Mr. Snowden, distributed online, in which he described why he released information from some of the NSA documents.

Ms. Poitras also was co-author of an article in the Washington Post, based on Mr. Snowden’s leaks, about an NSA program to gain access to U.S. Internet companies’ computers in an effort to track online activities of foreigners suspected in terrorist activity.

Julian Assange, founder of the antisecrecy site WikiLeaks, said Sunday there would be no halting future disclosures from Mr. Snowden. “Look, there is no stopping the publishing process at this stage. Great care has been taken to make sure that Mr. Snowden can’t be pressured by any state to stop the publication process,” he said in an interview with the ABC network from the Ecuadorean embassy in London, where he is seeking refuge.

According to intelligence specialists, the activities alleged in Der Spiegel’s report are similar to previously reported spying efforts among friendly countries. While allies have no intention of attacking one another, they seek information on decision-making within each other’s governments, and as a way to tell whether those governments might be spying on them.

The NSA raised concerns in 2006 about the merger of French-owned phone-equipment company Alcatel with U.S.-based Lucent because U.S. officials feared the deal would provide the French extraordinary access to U.S. telecommunications systems.

The NSA raised similar issues more recently over Chinese telecom-gear company Huawei Technologies’ efforts to expand in the U.S.

The president of the European Parliament, Martin Schulz, said in a statement he was “deeply worried and shocked about the allegations of U.S. authorities spying on EU offices.”

The statement added: “If the allegations prove to be true, it would be an extremely serious matter which will have a severe impact on EU-U.S. relations…on behalf of the European Parliament, I demand full clarification and require further information speedily from the U.S. authorities with regard to these allegations.”

A spokesman for the German Foreign Ministry declined to comment on the allegations.

According to Der Spiegel, an NSA document dated September 2010 showed that the Washington embassy of the European Union was bugged and its computer network infiltrated. Similar measures were taken at the European mission to the United Nations in New York. The document described the Europeans as “targets.”

In addition, the U.S. bugged EU conversations in Brussels, spying on theJustus Lipsius building, headquarters of the Council of the European Union, according to the report.

The magazine reported that the NSA saves information on about a half billion phone or Internet connections from Germany every year through its “Boundless Informant” program.

Only a few countries labeled as close friends by the NSA are largely exempt from its monitoring: the U.K., Australia, Canada and New Zealand, the magazine said. An additional 30 countries are classified as “third party,” with an internal NSA presentation saying the agency is able to intercept signals from these countries and often does, Der Spiegel reported.

The controversy over the new allegations is reminiscent of the furor ignited in Europe in 2000 by disclosures about the NSA’s so-called Echelon project, which included commercial organizations among its alleged targets, prompting an investigation and report from the European Parliament.

The report drew a distinction between spying for national-security reasons and for commercial advantage, saying the latter could breach EU law.

European lawmakers have also expressed disquiet about the sharing of European financial data with U.S. authorities.

The reports about the NSA’s alleged activities already have prompted Ms. Reding, the EU justice commissioner, to organize, together with U.S. Attorney General Eric Holder, a panel of experts to find out how much data about Europeans was shared.
—Stacy Meichtry in Paris and Siobhan Gorman in Washington contributed to this article.

Write to Stephen Fidler at stephen.fidler@wsj.com, Frances Robinson at frances.robinson@dowjones.com and Laura Stevens at laura.stevens@wsj.com

A version of this article appeared July 1, 2013, on page A4 in the U.S. edition of The Wall Street Journal, with the headline: Officials Slam Alleged NSA Spying on the EU.

Updated June 30, 2013, 7:26 p.m. ET
By STEPHEN FIDLER, FRANCES ROBINSON and LAURA STEVENS

Find this story at 30 June 2013

Copyright 2012 Dow Jones & Company, Inc.

Exclusive: Edward Snowden papers reveal 38 targets including EU, France and Italy

Berlin accuses Washington of cold war tactics

One of the bugging methods mentioned is codenamed Dropmire, which according to a 2007 document is ‘implanted on the Cryptofax at the EU embassy, DC’. Photograph: Guardian

US intelligence services are spying on the European Union mission in New York and its embassy in Washington, according to the latest top secret US National Security Agency documents leaked by the whistleblower Edward Snowden.

One document lists 38 embassies and missions, describing them as “targets”. It details an extraordinary range of spying methods used against each target, from bugs implanted in electronic communications gear to taps into cables to the collection of transmissions with specialised antennae.

Along with traditional ideological adversaries and sensitive Middle Eastern countries, the list of targets includes the EU missions and the French, Italian and Greek embassies, as well as a number of other American allies, including Japan, Mexico, South Korea, India and Turkey. The list in the September 2010 document does not mention the UK, Germany or other western European states.

One of the bugging methods mentioned is codenamed Dropmire, which, according to a 2007 document, is “implanted on the Cryptofax at the EU embassy, DC” – an apparent reference to a bug placed in a commercially available encrypted fax machine used at the mission. The NSA documents note the machine is used to send cables back to foreign affairs ministries in European capitals.

The documents suggest the aim of the bugging exercise against the EU embassy in central Washington is to gather inside knowledge of policy disagreements on global issues and other rifts between member states.

The new revelations come at a time when there is already considerable anger across the EU over earlier evidence provided by Snowden of NSA eavesdropping on America’s European allies.

Germany’s justice minister, Sabine Leutheusser-Schnarrenberger, demanded an explanation from Washington, saying that if confirmed, US behaviour “was reminiscent of the actions of enemies during the cold war”.

The German magazine Der Spiegel reported at the weekend that some of the bugging operations in Brussels targeting the EU’s Justus Lipsius building – a venue for summit and ministerial meetings in the Belgian capital – were directed from within Nato headquarters nearby.

The US intelligence service codename for the bugging operation targeting the EU mission at the United Nations is “Perdido”. Among the documents leaked by Snowden is a floor plan of the mission in midtown Manhattan. The methods used against the mission include the collection of data transmitted by implants, or bugs, placed inside electronic devices, and another covert operation that appears to provide a copy of everything on a targeted computer’s hard drive.

The eavesdropping on the EU delegation to the US, on K Street in Washington, involved three different operations targeted on the embassy’s 90 staff. Two were electronic implants and one involved the use of antennas to collect transmissions.

Although the latest documents are part of an NSA haul leaked by Snowden, it is not clear in each case whether the surveillance was being exclusively done by the NSA – which is most probable as the embassies and missions are technically overseas – or by the FBI or the CIA, or a combination of them. The 2010 document describes the operation as “close access domestic collection”.

The operation against the French mission to the UN had the covername “Blackfoot” and the one against its embassy in Washington was “Wabash”. The Italian embassy in Washington was known to the NSA as both “Bruneau” and “Hemlock”.

The eavesdropping of the Greek UN mission was known as “Powell” and the operation against its embassy was referred to as “Klondyke”.

Snowden, the 30-year-old former NSA contractor and computer analyst whose leaks have ignited a global row over the extent of US and UK electronic surveillance, fled from his secret bolthole in Hong Kong a week ago. His plan seems to have been to travel to Ecuador via Moscow, but he is in limbo at Moscow airport after his US passport was cancelled, and without any official travel documents issued from any other country.

Ewen MacAskill in Rio de Janeiro and Julian Borger
The Guardian, Sunday 30 June 2013 21.28 BST

Find this story at 30 June 2013

© 2013 Guardian News and Media Limited or its affiliated companies. All rights reserved.

Europa und Deutschland sind Hauptziele der Überwachung durch den US-Geheimdienst NSA. Millionen von Daten werden hierzulande von Obamas Spionen gesammelt. Doch Angela Merkels Regierung wirkt erstaunlich passiv. Warum?

Berlin – Als Sabine Leutheusser-Schnarrenberger kürzlich am Brandenburger Tor der Rede von Barack Obama lauschte, sah man sie in bester Stimmung. Sie winkte mit einem US-Fähnchen, die Worte des Präsidenten zu Freiheit und Gerechtigkeit gefielen der Liberalen sehr.

Knapp zwei Wochen später ist von der guten Stimmung der Ministerin nichts mehr übrig. Selten hat man sie so verärgert vernommen wie an diesem Sonntag. “Es sprengt jede Vorstellung, dass unsere Freunde in den USA die Europäer als Feinde ansehen”, sagt sie. Sie fühle sich “an das Vorgehen unter Feinden während des Kalten Krieges” erinnert.

Anlass des Aufschreis der Justizministerin ist ein SPIEGEL-Bericht, der unter Berufung auf Dokumente des Whistleblowers Edward Snowden neue Details der Spähprogramme des US-Geheimdiensts NSA offenlegt. Ob Wanzen in EU-Vertretungen, Lauschangriffe auf Brüsseler Behörden oder das flächendeckende Abschöpfen deutscher Telekommunikationsdaten – der Geheimdienst scheint vor nichts zurückzuschrecken.

Unter Parlamentariern macht sich Entsetzen über das Ausmaß der Spähattacken aus Übersee breit. Als “Riesenskandal” bezeichnet der Präsident des Europaparlaments, Martin Schulz (SPD), die Vorwürfe. Von einer “unvorstellbar umfassenden Spionageaktion” spricht Grünen-Fraktionschefin Renate Künast, von einer “ernsthaften Erschütterung des Vertrauensverhältnisses” der FDP-Innenexperte Jimmy Schulz.

Innenminister Friedrich im Wartemodus

Kritik gibt es aber nicht nur an der Regierung in Washington. Auch das Agieren der Kanzlerin rückt plötzlich in den Fokus. Angela Merkel müsse “den Sachverhalt schnellstens klären”, fordert ihr Herausforderer Peer Steinbrück. Wenn die Kanzlerin nun noch immer behaupte, das Thema gehöre in bilaterale und geheime Gespräche, “dann gibt sie sich der Lächerlichkeit preis”, sagt Künast.

Es ist Wahlkampf, klar. Aber über die Kritik kann sich die Bundesregierung kaum beschweren. Mit Ausnahme der Justizministerin macht Merkels Mannschaft nicht den Eindruck, als habe das Thema oberste Priorität.

Vom CSU-Bundesinnenminister ist seit dem Auffliegen des ersten Spähprogramms vor einigen Wochen kaum etwas zu hören. Hans-Peter Friedrich hat kürzlich ein paar Fragen über den Atlantik geschickt und befindet sich seitdem im Wartemodus. Die Kanzlerin besprach das Thema mit dem US-Präsidenten bei dessen Besuch in Berlin. Aber viel mehr als ein paar mahnende Worte, bei modernen Überwachungstechniken stets die Verhältnismäßigkeit im Blick zu haben, sprang dabei nicht heraus.

Es ist – gerade in der Sicherheitspolitik – nicht ganz einfach, auf Konfrontation mit den USA zu gehen, deutsche Behörden haben zuletzt immer wieder von den Informationen ihrer amerikanischen Partner profitiert. Aber angesichts der neuen Enthüllungen stellt sich die Frage, wie viel Zurückhaltung sich die Bundesregierung eigentlich leisten kann.

Wie Verwanzungen und flächendeckende Lauschangriffe in Partnerländern noch mit Terrorabwehr rechtfertigt werden sollen, erscheint fraglich. Wenn von einem ausländischen Nachrichtendienst derart systematisch die Privatsphäre der Bürger unterlaufen wird, sind ein paar offene Worte sicher nicht zu viel erwartet. Manche sind man da weiter. Frankreichs Außenminister Laurent Fabius drängte die USA am Sonntag zu einer Stellungnahme, die Brüsseler Kommission ebenso, auch der Generalbundesanwalt schaltete sich in die Spähaffäre ein.

Wie lässt sich Druck auf die USA ausüben?

Fragen gibt es genug. Kann es wirklich sein, dass deutsche Dienste von der großflächigen Vorratsdatenspeicherung nichts wussten, wo doch gerade im Sicherheitsbereich zwischen Berlin und Washington ein reger Austausch herrscht? Werden deutsche Bürger aktuell überwacht, und welche Bereiche der Kommunikation sind betroffen? Und was tut die Bundesregierung eigentlich konkret, um das Recht auf informationelle Selbstbestimmung der Bürger hierzulande gegen Angriffe von außen zu schützen?

Die Zurückhaltung von Merkel und Co. macht inzwischen auch die eigenen Reihen ungeduldig. Als die Bundesregierung im Parlamentarischen Kontrollgremium kürzlich über die Details der US-Überwachung in Deutschland Bericht erstatten sollte, konnten dem Vernehmen nach dazu weder Friedrichs Staatssekretär etwas sagen noch Merkels Geheimdienstkoordinator. Man warte noch auf Antworten aus Washington, hieß es. Auch unter Abgeordneten von Union und FDP machte sich daraufhin Ärger breit. Bis Mitte August soll die Bundesregierung jetzt ihre Hausaufgaben nachholen. Dann tagt das geheime Gremium erneut.

Schon jetzt wünscht sich mancher aber, dass die Koalition mehr Druck auf die Amerikaner ausübt. Besonders im EU-Parlament gibt es dazu einen Strauß an Überlegungen. Die einen denken darüber nach, Whistleblower Snowden einen Preis zu verleihen. Die anderen wollen die Abkommen zur Übermittlung von Bank- und Fluggastdaten aufkündigen. Und dann ist da noch die Idee, die seit einiger Zeit laufenden Verhandlungen für eine gemeinsame Freihandelszone zwischen Brüssel und Washington zu überdenken.

Auch in der Union gibt es dafür Sympathien – wohlwissend, dass es sich dabei um ein Lieblingsprojekt der Kanzlerin handelt. “Wie soll man”, fragt Elmar Brok, Chef des Auswärtigen Ausschusses für Auswärtige Angelegenheiten des Europaparlaments, “noch verhandeln, wenn man Angst haben muss, dass die eigene Verhandlungsposition vorab abgehört wird?”

30. Juni 2013, 18:53 Uhr
Von Veit Medick

Find this story at 30 June 2013

© SPIEGEL ONLINE 2013

Reports of NSA snooping on Europe go well beyond previous revelations of electronic spying

Sabine Leutheusser-Schnarrenberger: ‘If the media reports are true, it is reminiscent of the actions of enemies during the cold war’. Photograph: Ole Spata/Corbis

Transatlantic relations plunged at the weekend as Berlin, Brussels and Paris all demanded that Washington account promptly and fully for new disclosures on the scale of the US National Security Agency’s spying on its European allies.

As further details emerged of the huge reach of US electronic snooping on Europe, Berlin accused Washington of treating it like the Soviet Union, “like a cold war enemy”.

The European commission called on the US to clarify allegations that the NSA, operating from Nato headquarters a few miles away in Brussels, had infiltrated secure telephone and computer networks at the venue for EU summits in the Belgian capital. The fresh revelations in the Guardian and allegations in the German publication Der Spiegel triggered outrage in Germany and in the European parliament and threatened to overshadow negotiations on an ambitious transatlantic free-trade pact worth hundreds of billions due to open next week.

The reports of NSA snooping on Europe – and on Germany in particular – went well beyond previous revelations of electronic spying said to be focused on identifying suspected terrorists, extremists and organised criminals.

Der Spiegel reported that it had seen documents and slides from the NSA whistleblower Edward Snowden indicating that US agencies bugged the offices of the EU in Washington and at the UN in New York. They are also accused of directing an operation from Nato headquarters in Brussels to infiltrate the telephone and email networks at the EU’s Justus Lipsius building in the Belgian capital, the venue for EU summits and home of the European council.

Citing documents it said it had “partly seen”, the magazine reported that more than five years ago security officers at the EU had noticed several missed calls apparently targeting the remote maintenance system in the building that were traced to NSA offices within the Nato compound in Brussels.

Less than three months before a German general election, the impact of the fresh disclosures is likely to be strongest in Germany which, it emerged, is by far the biggest target in Europe for the NSA’s Prism programme scanning phone and internet traffic and capturing and storing the metadata.

The documents reviewed by Der Spiegel showed that Germany was treated in the same US spying category as China, Iraq or Saudi Arabia, while the UK, Canada, Australia, and New Zealand were deemed to be allies not subject to remotely the same level of surveillance.

Germany’s justice minister, Sabine Leutheusser-Schnarrenberger, called for an explanation from the US authorities. “If the media reports are true, it is reminiscent of the actions of enemies during the cold war,” she was quoted as saying in the German newspaper Bild. “It is beyond imagination that our friends in the US view Europeans as the enemy.”

France later also asked the US for an explanation. The foreign minister, Laurent Fabius, said: “These acts, if confirmed, would be completely unacceptable.

“We expect the American authorities to answer the legitimate concerns raised by these press revelations as quickly as possible.”

Washington and Brussels are scheduled to open ambitious free-trade talks next week after years of arduous preparation. Senior officials in Brussels are worried that the talks will be setback by the NSA scandal. “Obviously we will need to see what is the impact on the trade talks,” said a senior official in Brussels.

A second senior official said the allegations would cause a furore in the European parliament and could then hamper relations with the US.

However, Robert Madelin, one of Britain’s most senior officials in the European commission, tweeted that EU trade negotiators always operated on the assumption that their communications were listened to.

A spokesman for the European commission said: “We have immediately been in contact with the US authorities in Washington and in Brussels and have confronted them with the press reports. They have told us they are checking on the accuracy of the information released yesterday and will come back to us.”

There were calls from MEPs for Herman Van Rompuy, president of the European council – who has his office in the building allegedly targeted by the US – and José Manuel Barroso, president of the European commission, to urgently appear before the chamber to explain what steps they were taking in response to the growing body of evidence of US and British electronic surveillance of Europe through the Prism and Tempora operations.

Guy Verhofstadt, the former Belgian prime minister and leader of the liberals in the European parliament, said: “This is absolutely unacceptable and must be stopped immediately. The American data-collection mania has achieved another quality by spying on EU officials and their meetings. Our trust is at stake.”

Luxembourg’s foreign minister, Jean Asselborn, told Der Spiegel: “If these reports are true, it’s disgusting.” Asselborn called for guarantees from the highest level of the US government that the snooping and spying be halted immediately.

Martin Schulz, the head of the European parliament, said: “I am deeply worried and shocked about the allegations of US authorities spying on EU offices. If the allegations prove to be true, it would be an extremely serious matter which will have a severe impact on EU-US relations.

“On behalf of the European parliament, I demand full clarification and require further information speedily from the US authorities with regard to these allegations.”

There were also calls for John Kerry, the US secretary of state on his way back from the Middle East, to make a detour to Brussels to explain US activities.

“We need to get clarifications and transparency at the highest level,” said Marietje Schaake, a Dutch liberal MEP. “Kerry should come to Brussels on his way back from the Middle East. This is essential for the transatlantic alliance.”

The documents suggesting the clandestine bugging operations were from September 2010, Der Spiegel said.

Der Spiegel quoted the Snowden documents as revealing that the US taps half a billion phone calls, emails and text messages in Germany a month. “We can attack the signals of most foreign third-class partners, and we do,” Der Spiegel quoted a passage in the NSA document as saying.

It quoted the document from 2010 as stating that “the European Union is an attack target”.

On an average day, the NSA monitored about 15m German phone connections and 10m internet datasets, rising to 60m phone connections on busy days, the report said.

Officials in Brussels said this reflected Germany’s weight in the EU and probably also entailed elements of industrial and trade espionage. “The Americans are more interested in what governments think than the European commission. And they make take the view that Germany determines European policy,” said one of the senior officials.

Jan Philipp Albrecht, a German Green party MEP and a specialist in data protection, told the Guardian the revelations were outrageous. “It’s not about political answers now, but rule of law, fundamental constitutional principles and rights of European citizens,” he said.

“We now need a debate on surveillance measures as a whole looking at underlying technical agreements. I think what we can do as European politicians now is to protect the rights of citizens and their rights to control their own personal data.”

Germany has some of the toughest data privacy laws in Europe, with the issue highly sensitive not least because of the comprehensive surveillance by the Stasi in former communist east Germany as well as the wartime experience with the Gestapo under the Nazis.

Der Spiegel noted that so far in the NSA debacle, the chancellor, Angela Merkel, had asked only “polite” questions of the Americans but that the new disclosures on the sweeping scale of the surveillance of Germany could complicate her bid for a third term in September.

Ian Traynor in Brussels
The Guardian, Sunday 30 June 2013 21.55 BST

Find this story at 30 June 2013

© 2013 Guardian News and Media Limited or its affiliated companies. All rights reserved.

Overzealous data collectors in the US and Great Britain have no right to investigate German citizens. The German government must protect people from unauthorized access by foreign intelligence agencies, and it must act now. This is a matter of national security.

“Germany’s security is also being defended in the Hindu Kush, too,” Peter Struck, who was Germany’s defense minister at the time, said in 2002. If that’s true, then the government should also be expected to defend the security of its people at their own doorstep. Because the massive sniffing out and saving of data of all kinds — that of citizens and businesses, newspapers, political parties, government agencies — is in the end just that: a question of security. It is about the principles of the rule of law. And it is a matter of national security.

We live in changing times. At the beginning of last week, we thought after the announcement of the American Prism program, that US President Barack Obama was the sole boss of the largest and most extensive control system in human history. That was an error.

Since Friday, we have known that the British intelligence agency GCHQ is “worse than the United States.” Those are the words of Edward Snowden, the IT expert who uncovered the most serious surveillance scandal of all time. American and British intelligence agencies are monitoring all communication data. And what does our chancellor do? She says: “The Internet is uncharted territory for us all.”

That’s not enough. In the coming weeks, the German government needs to show that it is bound to its citizens and not to an intelligence-industrial complex that abuses our entire lives as some kind of data mine. Justice Minister Sabine Leutheusser-Schnarrenberger hit the right note when she said she was shocked by this “Hollywood-style nightmare.”

An Uncanny Alliance

We have Edward Snowden to thank for this insight into the interaction of an uncanny club, the Alliance of Five Eyes. Since World War II, the five Anglo-Saxon countries of Great Britain, the United States, Australia, New Zealand and Canada have maintained close intelligence cooperation, which apparently has gotten completely out of control.

It may be up to the Americans and the British to decide how they handle questions of freedom and the protection of their citizens from government intrusion. But they have no right to subject the citizens of other countries to their control. The shoulder-shrugging explanation by Washington and London that they have operated within the law is absurd. They are not our laws. We didn’t make them. We shouldn’t be subject to them.

The totalitarianism of the security mindset protects itself with a sentence: If you have nothing to hide, you have nothing to fear. But firstly, that contains a presumption: We have not asked the NSA and GCHQ to “protect” us. And secondly, the sentence is a stupid one: Because we all have something to hide, whether it pertains to our private lives or to our business secrets.

No Agency Should Collect So Much Data

Thus the data scandal doesn’t pertain just to our legal principles, but to our security as well. We were lucky that Edward Snowden, who revealed the spying to the entire world, is not a criminal, but an idealist. He wanted to warn the world, not blackmail it. But he could have used his information for criminal purposes, as well. His case proves that no agency in the world can guarantee the security of the data it collects — which is why no agency should collect data in such abundance in the first place.

That is the well-known paradox of totalitarian security policy. Our security is jeopardized by the very actions that are supposed to protect it.

So what should happen now? European institutions must take control of the data infrastructure and ensure its protection. The freedom of data traffic is just as important as the European freedom of exchange in goods, services and money. But above all, the practices of the Americans and British must come to an end. Immediately.

It is the responsibility of the German government to see to it that the programs of the NSA and GCHQ no longer process the data of German citizens and companies without giving them the opportunity for legal defense. A government that cannot make that assurance is failing in one of its fundamental obligations: to protect its own citizens from the grasp of foreign powers.

Germans should closely observe how Angela Merkel now behaves. And if the opposition Social Democrats and Green Party are still looking for a campaign issue, they need look no further.

06/24/2013 05:07 PM

A Commentary by Jakob Augstein

Find this story at 24 June 2013

© SPIEGEL ONLINE 2013

Berlin drängt auf Antworten aus London: Justizministerin Leutheusser-Schnarrenberger hat zwei britische Kabinettsmitglieder per Brief aufgefordert, mehr Details über das Spähprogramm Tempora zu veröffentlichen. In den Schreiben übt die FDP-Politikerin indirekt Kritik an der Cameron-Regierung.

Berlin – Jetzt schaltet sich die Bundesjustizministerin ein: Sabine Leutheusser-Schnarrenberger (FDP) hat den britischen Justizminister Christopher Grayling und die britische Innenministerin Theresa May aufgefordert, mehr Informationen über das Geheimdienstprogramm Tempora offenzulegen. Am Dienstag wandte sich Leutheusser-Schnarrenberger schriftlich an die beiden Kabinettsmitglieder von Großbritanniens Premier David Cameron. Die Briefe liegen SPIEGEL ONLINE vor.

In den beiden Schreiben identischen Inhalts, die am Vormittag parallel an die Minister verschickt wurden, äußerte sich die Ministerin sehr besorgt über die jüngsten Berichte über das gigantische Spähprogramm. Der Verdacht, durch digitale Überwachungsmethoden “riesige Mengen an Daten, E-Mails, Facebook-Nachrichten und Anrufe zu sammeln, zu speichern und zu verarbeiten”, hätte in Deutschland erhebliche Bedenken ausgelöst, heißt es in den Briefen.

Leutheusser-Schnarrenberger forderte Aufklärung in folgenden Punkten:

Auf welcher Rechtsgrundlage das Spähprogramm ausgeführt worden sei,
ob auf konkreten Verdacht ausgespäht oder die Daten allgemein ohne Anlass gesammelt worden seien,
ob die Überwachungsmaßnahmen von Richtern hätten abgesegnet werden müssen,
wie die Abhöraktionen konkret funktioniert hätten, welche Daten genau gespeichert und ob deutsche Bürger betroffen seien.

Auch übte sie indirekt Kritik an der Informationspolitik der Cameron-Regierung. “Die Kontrollfunktion von Parlament und Justiz zeichnet einen freien und demokratischen Staat aus. Sie kann aber nicht ihre Wirkung entfalten, wenn Regierungen bestimmte Maßnahmen in Schweigen hüllen”, hieß es weiter.

Leutheusser-Schnarrenberger appellierte an Grayling und May, die Grundsätze der Bürgerrechte nicht aus den Augen zu verlieren und mahnte Aufklärung an. “In unserer modernen Welt bieten die neuen Medien den Rahmen für einen freien Austausch von Meinungen und Informationen. Ein transparentes Regierungshandeln ist eine der wichtigsten Voraussetzungen für das Funktionieren eines demokratischen Staates und bedingt die Rechtsstaatlichkeit”, so die Ministerin.

Die FDP-Politikerin hatte sich bereits im Zusammenhang mit dem amerikanischen Spähprogramm Prism schriftlich an ihren US-Kollegen gewandt. Sie regte zudem an, im schwarz-gelben Kabinett eine Internet-Task-Force aus den beteiligten Ministerien zu bilden.

Die Ministerin beendete ihre Schreiben mit der Forderung nach strengeren Datenschutzstandards in der EU. Das Thema müsse beim nächsten Treffen der EU-Justizminister im Juli auf die Tagesordnung, so Leutheusser-Schnarrenberger.

Am Montag hat die Bundesregierung von Großbritannien offiziell Auskunft über das massenhafte Anzapfen von Telefon- und Internetverbindungen verlangt. Dazu sandte das Innenministerium eine Reihe von Fragen an den britischen Botschafter. Zur europäischen Chefsache will Kanzlerin Angela Merkel den Fall Tempora allerdings vorerst nicht machen. Beim EU-Gipfel Ende der Woche wolle Merkel keine Debatte über das britische Spionageprogramm forcieren, hieß es zu Beginn der Woche.

25. Juni 2013, 11:40 Uhr

Find this story at 25 June 2013

© SPIEGEL ONLINE 2013