Europe – Page 3

Death to the ICO?

Chris Parsons draws my attention to a blog posting on the very swish and refurbished Privacy International site (nice job BTW – I will check in regularly). Simon Davies argues in this post for the ‘assisted suicide’ of the UK Information Commissioner’s Office (ICO) because it has become a ‘threat to privacy’. The bases for this argument are several, namely that:

“the legislation that underpins the Office is narrow and in places regressive”;
the ICO is “a quasi judicial regulator that sees its role as protecting data rather than people”, which leads to timid decisions;
the ICO is sometimes “ill-informed… and almost always out of step with the more proactive and advanced regulators overseas” especially when it comes to technology;
its complaints procedure is slow and frequently pointless;
there are too many surveillance-related commissioners in the UK (the Surveillance Commissioner, the Interception of Communications Commissioner, the Equality & Human Rights Commission etc.)
it is disconnected from “an information environment dominated by companies which appear to be largely exempt from local protections for citizens.”

Now, I’ve done some work on commission for the ICO, and therefore you might expect me to defend it from these criticisms. But in fact, I find much to agree with here, as well as some points with which I disagree, and much to ponder.

On the side of agreement,the ICO, like much of government, is undoubtedly technologically rather backward. When, in the Report on the Surveillance Society, we wrote about the way in which governments were behind the times, this was as much a message for them as for parliament or the executive. Maybe it is down to funding, maybe to institutional inertia, maybe deliberate choice, but the ICO has still has not taken serious steps to remedy this as Simon points out, and relies largely on occasional external reports, many of which are in any case general rather than specialist, to update it.

I also agree with the charge that the ICO has been relatively powerless in the face of the rise of corporate surveillance. This is not surprising given its origins as an arm’s-length regulator of government, and some of the particular issues of concern – like whether it took the Google wireless hacking episode seriously enough or made the correct decisions – are far from obvious. But one can clearly contrast the relatively activist stance of even quite bureaucratic Privacy Commissioners like the federal Canadian body over Facebook, with the ICO. It has in the recent past taken some serious actions against illegal private sector surveillance – for example the bust of a notorious blacklisting firm – but this direction appears to have fizzled out. Not being privy to internal policy discussions, I am not sure why.

Then there are some areas in which the criticisms are valid, but which may not be directed at the right target.

The first of these is the proliferation of Commissioners of various kinds – and incidentally, we have thankfully been spared the birth of yet another one with the cancellation of the ID Cards scheme. I have also been arguing for the merging of all the various surveillance-related quangos for a long time. The reason so many of them exist is partly because of the piecemeal way in which British legislative process occurs. There are rarely comprehensive Acts covering broad areas, instead existing institutions, however inappropriate to the job needed, are often merely supplemented or modified. The other reason is of course the ongoing effort to protect certain parts of the state from serious scrutiny, in particular the intelligence services and political police.

The second is that, fundamentally, it seems clear that British data protection and privacy legislation is generally archaic and not up to the job. Neither is its Freedom of Information legislation, even though it was a massive advance on the culture of secrecy that preceded what in retrospect may have been one of New Labour’s most important measures.

However, I am not sure that either of these points are in themselves a criticism of the ICO but rather of the legislation which created it, and the governance environment in which it has to operate. The way in which the ICO came about, through a rough fusion of old Data Protection and newer Freedom of Information functions produced a lumbering Frankenstein’s monster made of parts and bits, kept going on a drip-feed of limited funding, something that was never going to be capable of what campaigners expected of it. The same could be said partially of the critique of the complaints procedure, itself is a widely shared opinion and one with which I would not take issue. However, how much of this is down to the limited funding and staffing, and once again, the foundational legislation which hampers as much as empowers the ICO to do much of what we outsiders would want them to do?

Then, some of the criticisms are more personal opinion, with which I am sure many in the ICO would disagree, particularly the idea that the ICO does not care about people. Both Simon and I know many people in the ICO personally and whatever our political differences with them, the idea that they are heartless data bureaucrats with no interest in people is a rather unhelpful and hyperbolic caricature, as is the idea that the ICO is an ‘enemy of privacy’. The ICO had a legally mandated job to do first and foremost and it needn’t, legally, go beyond that at all. Yet it has. The interventions that the previous Information Commissioner, Richard Thomas, made on surveillance in particular were absolutely vital in adding a new level to a debate that had previously, despite the best efforts of activists, campaigners and researchers, been of more marginal concern. One could argue that surveillance and privacy would never have become such a topic parliamentary debate, let along an election issue, without his advocacy. Certainly it hasn’t gone far enough, but is has hardly, during this period at least, acted as a stereotypically uncaring bureaucracy.

So what of the solutions?

Simon advocates only one: that the government “scrap the data protection functions of the ICO and building a new Privacy Act that creates a true watchdog with a broad mandate.” It is hardly surprising that Privacy International see the ‘privacy’ element as the most important one here. Simon will also not be surprised to discover that I disagree with him on this. In fact, my argument for a while has been that privacy cannot justifiably be prioritised over other forms of human informational rights. In addition, the concept of ‘human rights’ in general does not deal with everything about information relationships, positive or negative, and the many elements of those information relationships between state, citizen and corporation cannot be so arbitrarily separated.

I would therefore argue that a comprehensive Information Act, which covered citizens’ rights to information (their own, and that generated by government and corporations), their rights of privacy and the more general parameters of what the state and companies may know of those who information this is and how they are allowed to do so (i.e the limits of surveillance). I agree that ‘data protection’ is an out-of-date concept. But ‘privacy’ does not, and cannot, replace it, at least not alone. Privacy Commissioners, where they exist, find themselves dealing with a lot more than privacy and end up becoming ‘surveillance’ or ‘information commissioners’ in practice or by stealth, and in some cases an emphasis on privacy over all else can hamper legitimate needs to know (as has been true in the case of family members of elderly patients with dementia in Canada for example).

My conclusion about what a new Information Act would contain in terms of the regulatory bodies has something in common with Simon’s view, but I have two options. One is the creation of a single mega-regulator – a real Information Commissioner that covered all the areas of our information relationships with the state and corporations that would be able to go after corporations, local and national government over issues of their secrecy, transparency and accountability, and our privacy and informational needs. It wouldn’t just merge the existing ICO, Surveillance Commissioner, Interception of Communications Commissioner and so on), but start with new legislation and a new structure.

The other option would be a merge all the existing bodies but create two new ones to replace them: a Surveillance and Privacy Commissioner, to cover all of the areas of state and corporate intrusion into the lives of citizens, but also a Freedom of Information Commissioner, to cover the equally vital areas of state and corporate transparency and accountability. Privacy without FoI, whether together in one organisation or separate, is altogether too defensive an approach to what we can expect from the state.

And whichever route one took, the organisation(s) should have a wider range of powers built in and required – research (including technological foresight), advocacy, assessment, response and enforcement functions – with protected funding and legally binding decision-making capability. I think we would all be in agreement on that…

‘Turning Off’ the Internet

Boing Boing contributors have been doing a fascinating job of documenting the place of the Internet and social media in the ongoing turmoil spreading across Arabic countries. Until recently the focus had been on the use of social media tools by activists, but in the last few days, the empire has struck back. In particular the Egyptian state has effectively ‘turned off’ the Internet, cutting Net access and communications between Egypt and the rest of the world.

What’s particularly interesting is that the rulers of western ‘democracies’ seem to want similar powers. I’ve been writing about the growing movement amongst states to develop powers to split or close the Internet entirely for some time (see here, here and here, for example). Most recently, I reported on French efforts to develop Internet censorship power in wide-ranging circumstances, and as Sean Bonner on BB points out, a bill was introduced into Congress last year by, it’s that man again, Joe Liebermann, to give the USA government even greater powers to cut off civilian access to the Net entirely in the event of a ‘cyber-emergency’.

This is not a drill, people, this is happening…

Spain vs. Google or Freedom of Expression vs. the Right to Be Forgotten

Several outlets are reporting today, the interesting clash between Spanish courts and Google. The argument is over whether Google should carry articles that have been challenged by Spanish citizens as breaching their privacy. An injunction was won in the courts by the Spanish data protection commissioner over publication of material that is being challenged under privacy legislation.

Clearly there are two main issues here. One is the specific issue of whether Google, as a search engine, can be considered as a publisher, or as it claims, simply an intermediary which publishes nothing, only linking to items published by others. This is important for Google as a business and for those who use it.

But the other is a more interesting issue which is the deeper question of what is going on here which is the struggle between two kinds of rights. The right to freedom of expression, to be able to say what one likes, is a longstanding one in democracies, however it is almost nowhere absolute. The problem in a search-engine enabled information age, is that these exceptions, which relate to both the (un)truth of published allegations (questions of libel and false accusation) and of privacy and to several other values, are increasingly challenged by the ability of people in one jurisdiction to access the same (libellous, untrue or privacy-destructive) information from outside that jurisdiction via the Internet.

In Spain, the question has apparently increasingly been framed in terms of a new ‘right to be forgotten’ or ‘right to delete’. This is not entirely new – certainly police records in many countries have elements that are time-limited, but these kinds of official individually beneficial forgettings are increasingly hard to maintain when information is ‘out there’ proliferating, being copied, reposted and so on.

This makes an interesting contrast with the Wikileaks affair. Here, where it comes to the State and corporations, questions of privacy and individual rights should not be used even analogically. The state may assert ‘secrecy’ but the state has no ‘right of privacy’. Secrecy is an instrumental concept relating to questions of risk. Corporations may assert ‘confidentiality’ but this is a question of law and custom relating to the regulation of the economy, not to ‘rights’.

Privacy is a right that can only be attached to (usually) human beings in their unofficial thoughts, activities and existence. And the question of forgetting is really a spatio-temporal extension of the concept of privacy necessary in an information society. Because the nature of information and communication has changed, privacy has to be considered over space and through time in a way that was not really necessary (or at least not for so many people so much of the time) previously.

This is where Google’s position comes back into play. Its insistence on neutrality is premised on a libertarian notion of information (described by Erik Davis some time ago as a kind of gnostic American macho libertarianism that pervades US thinking on the Internet). But if this is ‘freedom of information’ as usually understood in democratic societies, it does have limits and an extreme political interpretation of such freedom cannot apply. Should Google therefore abandon the pretence of neutrality and play a role in helping ‘us’ forget things that are untrue, hurtful and private to individuals?

The alternative is challenging: the idea that not acting is a morally ‘neutral’ position is clearly incorrect because it presages a new global norm of information flow presaged on not forgetting, and on the collapse of different jurisdictional norms of privacy. In this world, whilst privacy may not be dead, the law can no longer be relied on to enforce it and other methods from simple personal data management, to more ‘outlaw’ technological means of enforcement will increasingly be the standard for those who wish to maintain privacy. This suggests that money and/or technical expertise will be the things that will allow one to be forgotten, and those without either will be unable to have meaningful privacy except insofar as one is uninteresting or unnoticed.

New Year, New Walls

A few years ago the European Union was celebrating the demise of national borders. At the same time, critics were warning that the Schengen Agreement foretold a ‘Fortress Europe’. Up until recently, that fortress was largely composed of information systems and conventional border controls, but now Greece is making it very physical with a new ‘border wall’ with its old enemy, Turkey. Admittedly this wall is not on the same scale as those erected by Israel (in unilaterally establishing a border with Palestine) or the USA (along the border with Mexico), and will be placed at a site near the river Evros in Thrace, described as ‘highly permeable’ to illegal immigration which tends to funnel through Turkey into the EU via Greece.

The EU is making vaguely protesting noises, which are likely almost entirely insincere and will in any case be ineffective (see the similar quickly withdrawn complaints over France’s disgraceful expulsions of Roma and Sinti people last year). The real reasons for the new barrier may be rather more opportunist and cynical in any case: in a time of financial crisis in Greece with the government reeling from popular protest, turning on the ‘Other’, and being seen to be tough in immigration, is a classic populist strategy of diversion.

UK Control Orders to be replaced by Surveillance Orders

There has been a lot of speculation in the last couple of weeks about the fate of the ‘Control Orders’ that have been placed on various people (largely British Muslims) who are strongly suspected by the authorities of involvement with terrorism, but who have not committed any crime that would likely lead to a successful prosecution. These orders tend to amount to forms of curfewing or house arrest without trial, and banning them from using all forms of telecommunications, and needless to say, have been immensely controversial with civil liberties groups arguing that they subvert the rule of law, and that if there is evidence of terrorist activity people should be investigated and charged with such offenses. This has also been a test case for the willingness of the Conservative- LibDem coalition to take onboard key Liberal Democrat priorities and to go further in rolling back the creeping authoritarianism that characterised the final years of the New Labour regime.

So what will replace them? Speculation had centred around the replacement of the order with a system that allowed suspects to move around relatively freely but placed them under intensified ongoing surveillance. Now the BBC is claiming that it has details of what are likely to be called ‘Surveillance Orders’. These, they say, will give the security services the power to:

Ban suspects from travelling to locations such as open parks and thick walled buildings where surveillance is hard;

Allow suspects to use mobile phones and the internet but only if the numbers and details are given to the security services;

Ban suspects travelling abroad; and

Ban suspects meeting certain named individuals, but limited to people who are themselves under surveillance or suspected of involvement in terrorism.

Some of this is hardly new: those suspected of involvedment in football hooliganism in the UK have been subject to travel bans since the 1980s, and it seems to be from this that precendent is taken for at least this part of the new place. It is also almost funny that certain locales are seemingly specified as being difficult for surveillance – and I know this won’t be in the actual Bill – but, surely it is actually quite useful for real terrorists to know this? 😉

But this is all very interesting not least because it uses ‘surveillance’ as a supposed replacement for ‘control’, or as something synonymous with increased freedom. That may be so in physical terms, but the constant monitoring suggested under these new orders creates something very far from freedom. However in many ways it constitutes simply an intensified version of the kind of low-level constant monitoring or mass surveillance that is characteristic of contemporary surveillance societies. It is not so much that there are the ‘unwatched’ and the ‘watched’ rather there is a spectrum of surveillance between the lightly and heavily monitored. The new ‘Surveillance Orders’ would merely seem to push the dial for an individual into the category of heavy monitoring.

Internet doit être défendu! (4)

I write this addition to my ongoing series of thoughts on the implications of the Wikileaks scandal, en Francais because according to Le Point, the the Assemblée Nationale has passed a bill, Loppsi 2, which, amongst other things, in its Article 4, allows the French government to ban particular websites, and essentially to ‘filter’ the Internet. The Bill of course has ‘good intentions’, in this case, it is aimed at paedophiles, but the wording is such that it allows a far wider use against “la cybercriminalité en général”. Regardless, as the article points out: “Les expériences de listes noires à l’étranger ont toutes été des fiascos,” in other words such bills have generally been a complete failure as in most cases the state’s technology and expertise cannot deliver what the law allows.

However, I am left wondering what makes this any different from what China does, and what moral right the French state now has to criticise Chinese censorship or indeed any other regime that is repressive of information rights. And of course, what other very reasonable ‘good intentions’ could be drawn upon for closing the Net – opposing ‘information terrorism’, par example?

New Report on UN ‘Blacklisting’

There is a new report out from the European Centre on Constitutional and Human Rights (ECCHR) on blacklisting practices, particularly the UN’s , after 9/11. The report by Gavin Sullivan and Ben Hayes, suggests that the UN 1267 list of supposed Taliban and Al-Qaeda members and supporters in particular, which I have described as ‘kafkaesque’ in the past here, is:

“beyond the powers of the Security Council. While international terrorism remains an atrocious crime … it does not justify the exercise by the Security Council of supranational sanctioning powers over individuals and entities. “

Czech Republic operating illegal ‘gay’ screening

The Czech Republic is violating the European Convention on Human Rights by using a controversial and highly privacy-invasive method of screening those seeking asylum on grounds of being persecuted for their sexual orientation.

A BBC report (via BoingBoing) says that the country’s interior ministry has been criticised by the EU Agency for Fundamental Rights for using a ‘penile plethysmograph‘ on such claimants.

This so-called ‘phallometric test’ uses sensors attached to the penis which measure blood flow when different images are shown. The evidence from such tests is not recognised by courts in many countries due to its many problems including lack of standardization and the highly subjective interpretation of results.

UK U-turn on Interception Consulation

The BBC reports that the UK Home Office has been forced by the European Union to accept input from civil and digital rights groups over the revision of its Regulation of Investigatory Powers Act (RIPA) – I’ve posted lots on RIPA here in the past, so it’s worth doing a search of this site for some of the backstory.

The u-turn was apparently sparked by the EU’s report on the Phorm debacle (see also here) which, amongst other things concluded that the UK was in breach of the Privacy Directive for having no adequate complaints procedure or systems of legal redress for those who believe they have been subject to illicit surveillance. Amongst the little nuggets in this story is the fact that since its creation in 1986, the Interception Commissioner has upheld four complaints. Yes, four. 4.

The consultation has also been extended to the 17th of December, so get writing if you haven’t already made your views known. You can find the consultation document here (pdf).

Campaigners uncover UK local government spending on CCTV

Using Freedom of Information requests, Big Brother Watch in the UK has managed to get hold of figures from many British local governments on how much they spend on CCTV surveillance systems.

According to the Press Association, the annual spend by 336 local councils on the installation and operation of CCTV cameras over a three year-period from 2007/08 and 2009/10 totalled £314,835,170.39 (around $400M US). That’s a large amount of money in an ‘age of austerity’… however it is still not complete as there are another 80 local governments who did not respond to the requests. Interestingly there were still some local governments, albeit only 15, who still did not operate public-area CCTV. That’s not to say that the local police forces in those areas did not, however. There are some cities in Britain, the exception rather than the rule, like Newcastle for instance, where police own and operate public CCTV cameras. I am not sure if these are the types of councils making the claims, and I will have to look at all the figures in greater detail.

The top ten spenders on CCTV over the three years were listed as:

the city of Birmingham, Britain’s second-largest city, and controversial for its special scheme targeted at ‘Muslim’ areas, but also with a massively regenerated and semi-privatised city-centre. £10,476,874.00
Sandwell metropolitan borough, a large urban area to the north-west of Birmingham £5,355,744.00
the city of Leeds, in Yorkshire, whose downtown district is the epitome of the characterless, over-regenerated urban centre. £3,839,675.00,
the city of Edinburgh, capital of Scotland, a wannabe global city, and former G8 meeting host, £3,600,560.00
the borough of Hounslow, on the edge of urban and suburban west London, £3,573,186.45
the borough of Lambeth, a diverse south London district, £3,431,301.00
the city of Manchester, one of the cities we studied in our book on urban resilience, which put a huge amount in to CCTV in the downtown core the wake of a provisional IRA bombing, which has now also been gentrified out of recognition – it also has a signficant suburban gang problem, £3,347,310.00
the borough of Enfield, a leafy north-east London suburb, £3,141,295.00
the borough of Barnet, also in north London, £3,119,020.00
the borough of Barking and Dagenham, in east London, on the borders with Essex, and another area of high racial tensions stoked by a strong local British National Party, £3,090,000.00.

Half of the top ten are London boroughs, outside of the centre of London, showing that CCTV is still diffusing outwards from the heavily surveilled core around the financial centre of the City of London and the government district of Westminster. Not surprisingly, the diffusion is also continuing primarily to the major urban centres beyond London, and the case of Sandwell perhaps shows that the greater Birmingham area is going through a similar process seen in London. In any case, public area video surveillance is not going away in the UK any time soon, and the new government will have to, at some time, demonstrate what it actually meant by introducing greater regulation of CCTV.