Remote searches and jurisdiction on the Internet

Are Dutch law enforcement officers allowed to log into the Gmail-account of a suspect and check their e-mail for evidence gathering purposes?

This question has captivated me for the last 1,5 years. In 2011 I argued that hacking is not a legitimate investigatory method in the Netherlands. That might change soon, because the Dutch Minister of Safety and Justice plans to propose a bill which makes that possible (see also my earlier blog post on cross-border remote searches). However, interesting questions remain in relation to international criminal law and remote searches.

Old discussion

After the extensive study of Dutch parliamentary documents in relation to the investigatory method of a “network search”, I concluded in a new article (.pdf in Dutch) I wrote together with Charlotte Conings of the KU Leuven, that online investigatory methods can only be used on “computers in Dutch territories”. The exception to this rule is when officers are (a) “in good faith” that the computer resides on Dutch territory, (b) they have permission from another state to execute their investigatory methods on a computer in their territory, or (c) they operate on the basis of a treaty. Based on literature, most legal scholars affirm the general rule that secretly gathering evidence from computers in the territory of another state is in violation of international law.

Renewed discussion

The problem is that the “computer orientated jurisdiction rule” described above is hard to work with in practice. Especially due to cloud computing techniques, by way of which fragmented data can reside on many different servers in different countries, making it is increasingly hard to pinpoint the location of data on a server. Some suggest that because of this “loss of location” of data, law enforcement authorities are increasingly left in the dark as to which state “controls the data” and which state to ask for permission. As a consequence, they resort to gathering evidence remotely – via the Internet – under their own national procedural rules. The influence of cloud computing and criminal investigations is described in this interesting WODC-report (.pdf in Dutch. English summary available here) released two weeks ago.

In my opinion, it is quite clear in many cases which jurisdiction and thus which procedural rules apply to the majority of electronic communication services that make use of cloud computing. The reason for this is that many popular “cloud services” are US electronic communication service providers. As described in their law enforcement guideline, Google for example provides user data under specific conditions based on US law. With regard to data requests from “foreign law enforcement authorities” they explain that: “On a voluntary basis, we may provide user data in response to valid legal process from non-U.S. government agencies, if those requests are consistent with international norms, U.S. law, Google’s policies and the law of the requesting country.” I wonder how they deal with inconsistencies between the different norms prescribed by law..

The actual problem is that law enforcement authorities would much rather access the accounts directly, under their own rules, rather than waiting for Google to reply and having the uncertainty of whether they will actually provide the data.

Towards new jurisdictional rules?

In our new article, Charlotte and I analyzed the interesting “pragmatic approach” of Belgium towards online jurisdictional issues and investigatory methods. Under specific conditions, they will allow a remote search of connected computers, such as servers from webmail and online payment services, even if those servers are possibly situated in a different territory. We believe this pragmatic approach is interesting and maybe even desirable under certain conditions, as long as the investigatory methods are used on citizens and persons in the states own territory. If we would allow remote searches of the personal online accounts of foreigners, states would impose their own national rules on foreign nationals which in turn would create legal uncertainty for people about which procedural rules apply. Based on the reciprocity principle, states could do the same in our territory. This pragmatic approach is not ideal and does not solve the problem that the company who possesses the data may simply regard the unauthorized access of foreign authorities as a crime and treat it as such. In an ideal world, states would agree with one another under which conditions data can be gathered remotely over the Internet, but I doubt if that’s possible. The debate about online (enforcement) jurisdiction is far from over.

This is a cross post from

Some thoughts on the EU cybersecurity directive

Last week the European Commission presented a proposal for a directive (.pdf) on cybersecurity. The directive aims to improve network and information security by requiring Member States to implement a national cybersecurity strategy, a cybersecurity cooperation plan, a competent national authority on cybersecurity and a Computer Emergency Response Team (CERT). The directive also seeks to expand security breach notifications for IT incidents in relation to critical infrastructures and to create a infrastructure for confidential information sharing.

The directive raises some interesting questions about how cybersecurity is best dealt with.

Personally I am convinced cybercrime and cyberespionage incidents are rising exponentially, making it necessary for states to take action. A Washington Post article from a few days ago about Chinese espionage is illustrative of this fact. Our IT systems are often not protected adequately and we are rightfully concerned about the IT protection of critical infrastructures.

In its quest to improve cybersecurity, the Commission envisions a critical role for national cybersecurity centres. The promotion of public private partnerships, mandatory security breach notifications for critical infrastructures (which is defined quite broadly, see art. 3(8)(b)), secretive information sharing (see art. 9) and powers for cybersecurity centres to compel  security audits and information from “market operators and public administrations to provide information needed to assess the security of their networks and information systems” (art. 15), are all examples of measures proposed in the directive. Other than the proposed enforcement powers for cyber security centres, not much would change for the cybersecurity policy of the Netherlands. The directive proposes many measures that are already carried out or proposed in our own cybersecurity strategy, such as the security breach notification for critical infrastructures, governmental involvement in major cybersecurity incidents and the vigorous promotion of public private partnerships and information sharing.

The idea is that when cross-border incidents arise, cyber security centres notify other centres about the “cyber threat” to prevent more damage and possibly take coordinated action. By sharing information in public private partnerships the overall level of cybersecurity is improved and the relevant parties can respond to the incident in a coordinated manner. Because much of the IT infrastructure and important data is in private hands, cooperation from private companies is required. However, not all companies may wish to share private data, including client data, with cyber security centres and thereby automatically involve law enforcement authorities and security services. Because of the proposed establishment of a central authority for network and information security some even fear the “militarization of cyberspace”.  From a more cynical perspective, one may fear a bureaucratic toothless institution with conflicting powers and tasks overlapping those of other agencies. We could also consider other measures. For example, I support the plea (in Dutch) of Bart Schermer to actually provide the instruments to our privacy watchdog to enforce the requirement of “sufficient technological and organizational measures” to adequately protect personal data.

No panacea for cybersecurity

I believe we should be careful to place cybercrime-, cyberespionage-, cyberterrorism-, and cyberwarfare issues all under the umbrella term of “cybersecurity”. Issues relating to these different fields (of law) need attention on their own merits and may require different actions from our legislator. We should realize that cyber security centres and information sharing is no panacea for cybersecurity.

Is the ‘decryption order’ a good idea?

In December 2010, the Robert M.-case shocked the Netherlands. Robert M. was prosecuted and convicted for the sexual abuse of 67 children, of which many were younger than 3 years old. During the investigation the police found that the suspect used high grade encryption, impossible to crack without using the proper key. Fortunately for the police and public prosecutor, Robert M. gave up his key voluntarily. Other suspects derived from the Robert M-case did not cooperate so well. This led Members of the Parliament to call for a so-called ‘decryption order’, by way of which suspects could be forced to give up their key. The Minister of Safety and Justice commissioned research into the feasibility of decryption orders in the light of the right against self incrimination. About two weeks ago the research was published and it concluded that theoretically it is possible to regulate the decryption order. As a result, the Minister of Safety and Justice enthusiastically announced (in Dutch) the preparation of new regulations to make decryption orders possible in cases of child pornography and terrorist crimes. However, in my opinion, we should think twice before going down this path.

The decryption order

Prof. Koops of Tilburg University conducted thorough and in my view excellent research (.pdf in Dutch) into decryption orders. Both the technical and legal aspects were taken into consideration and a legal comparison was made from many different countries. An English summary of the report can be found here (.pdf). The author suggests that a decryption order (under threat of a criminal sentence) is legally possible, but only under stringent conditions. For example, the order could only be given in cases in which there are clear indications that the suspect is hiding something by using encryption.

Proving that the suspect probably used encryption to hide his criminal activities may be difficult, especially when certain encryption programs such as ‘TrueCrypt’ are used. The report warns that decryption orders may advance the use of such programs among criminals. In Great Britain (obviously a much bigger country than the Netherlands), governmental power was successfully used in only a handful of cases per year. What I found even more interesting is that public prosecutors were very skeptical about the practical uses of this governmental power. They preferred obtaining the key using alternative methods, namely by intercepting keys remotely via the Internet. The author of the report does not deny that this is an interesting and feasible alternative route to take, but suggests that legislator should choose between the two. Instead, the Ministry of Safety and Justice suggests in his letter we should do both.

Note that the ‘solution’ of a decryption order is limited to accessing data stored on a device at a different phase of a criminal investigation. An important argument for using alternative methods, more concretely the use of hacking, spyware and bugs as investigatory methods, is that they also aid law enforcement in dealing with the growing problem of the encryption of communications (not just stored data) and avoids the active cooperation of suspects in their own criminal case.

The least privacy infringing solution for the encryption problem?

The decryption order is considered by some (including prof. Koops) as the least privacy intrusive solution for the encryption problem. I dare to disagree. The solution of a ‘decryption order’ may be more far-reaching than most people think. As suggested in the report, it should include disabling the security measures on all computer devices, such as laptops, tablet computers and smartphones. It also may be possible for the government to force civilians to hand over passwords to access online social media services, webmail services and personal online storage services.

Forcing civilians under a criminal sanction to actively help law enforcement by providing them with access to their own data is incredibly intrusive and would be new to the criminal law system. The fact it may be theoretically possible to regulate a decryption order under the threat of a criminal sanction does not mean that we should.

This is cross post from

The advent of cross-border remote searches?

Last Monday (15 October 2012) our minister of Safety and Justice (under resignation), Opstelten, sent a letter (.pdf) to Parliament proposing several far reaching investigatory powers to fight cybercrime more effectively. Opstelten suggests incorperating the following investigatory methods in our Code of Criminal Procedure:

  • Remote access to computer systems and the placement of ‘technical devices’ (spyware) in computers.
  • Remote searches in computers, regardless of the location of the computer.
  • Disabling the accessibility of illegal files on computers, regardless of the location of computers.

All of these investigatory methods require an in-depth legal analysis. In this blog post I will only briefly discuss the possibility of cross-border remote searches in computers.

Cross-border remote searches

A cross-border remote search is the collection of evidence via the Internet in computers in other countries. More concretely, based on the letter, I can think of three types of cross-border remote searches that can be distinguished: 1. Using the login name and password of a suspect or hacking an account (accessed by a web portal) of a suspect in order to access and gather evidence from Gmail, Hotmail, or other cloud based online services, 2. Hacking in order to gather evidence from botnets, 3. Hacking a suspect’s personal computer in order to gather evidence remotely.

International criminal law issues

The most interesting legal problem of cross-border remote searches is whether such a search violates the international principle of territoriality and sovereignty of the country in which the data is stored. In the Netherlands we used to uphold a ‘server-orientated jurisdiction principle’, which basically meant that data in servers outside the Dutch territory could not be accessed without permission (before or after the infringement on their territory) or a treaty with the affected state.

It is not clear whether our state authorities are willing to completely let go of the principle, because when ‘the location of a server is clear’ traditional legal aid requests must be used (p. 5 of the letter). According to our minister, the location of a server is unclear in the case of services of cloud providers, because the data changes all the time from different servers at different locations. This is true, but in my opinion it is quite clear where and how evidence can be gathered from cloud service providers. I believe that with article 32(B) of the Convention on Cybercrime many states agreed that data can be gathered directly from companies on a voluntarily basis (and under their own conditions). If they don’t cooperate we can use legal aid requests. Many U.S. companies work well with law enforcement authorities and I wonder whether it is necessary to perform online remote searches in these accounts (although it might be necessary under certain circumstances). I guess the real problem is that Dutch law enforcement authorities want to apply Dutch law and collect evidence possibly located in other countries directly in a criminal case, instead of relying on the willingness of businesses or states when gathering evidence outside the Netherlands.


Article 32 of the Convention of Cybercrime does not solve the problem of servers that are (eventually) localized at so-called “bullet proof hosting providers” who do not cooperate with law enforcement authorities’ evidence gathering activities. As we have seen with the Dorifel-virus, this could lead to disastrous consequences (governmental employees working on type writers instead of computers, because computers were infected and unsafe to use). Maybe the time has come for us to no longer accept such situations, and to view the infringement of another state’s territory as a necessary evil in certain circumstances. The proposed investigatory methods may be suitable for a situation such as Dorifel. One must point out however that being able to use hacking as a investigatory method, does not mean the suspect will be successfully prosecuted, because a state may decide not to extradite their own citizen or prosecute him or her themselves.

Rest assured, the discussion about legalizing cross-border remote searches has just started. It will take a long time (maybe years) and require democratic processes before these far reaching investigatory powers will be implemented in our Code of Criminal Procedure.

This is a cross post from

Surveilleren en opsporen op internet

Mag de politie in het kader van toezicht stelselmatig gegevens vergaren uit open bronnen van internet? In hoeverre mogen politie en justitie gegevens van internet verzamelen over (groepen) mensen in het kader van opsporing? In het tijdschrift Justitiële Verkenningen (nr. 5, 2012, p. 35-49) gaan Bert-Jaap Koops en ik op deze vragen in. In dit blogbericht wil ik kort de belangrijkste punten uit het artikel behandelen. Het gehele artikel is hier te
downloaden (.pdf).

‘De politie mag onbeperkt gegevens van internet vergaren’

In de praktijk lijken sommige politieambtenaren de indruk te hebben dat alles wat op internet in open bronnen is te vinden gebruikt mag worden voor toezicht- en opsporingsdoeleinden. In het artikel trachten wij duidelijk te maken dat dit niet het geval is, omdat het handelen van de politie specifiek geregeld is in wet- en regelgeving. De hoofdregel daarbij is dat daar waar een meer dan geringe inbreuk in de persoonlijke levenssfeer van mensen wordt gemaakt, een specifieke wettelijke regeling voorhanden moet zijn. Koops en ik hebben de indruk dat bij het monitoren van gegevens van mensen op internet voor toezichtdoeleinden al snel een meer dan geringe privacyinbreuk wordt gemaakt en daar op dit moment geen afdoende wettelijke regeling voor is.

Bij surveilleren en opsporen op internet gaat het allang niet meer om een ‘Googelende opsporingsambtenaar’, maar om politiesystemen waarmee snel en efficiënt gegevens op internet kunnen worden afgestruind op zoek naar de relevante informatie. Het is niet helemaal duidelijk wat de politiesystemen precies kunnen en wat met een ‘near real time
Internet monitoring service’ wordt bedoelt, maar documenten die zijn vrijgekomen na een Wob-verzoek op de website van het NCTB lichten een tipje van de sluier op.

Wij zijn met betrekking tot het vergaren van gegevens op internet met geautomatiseerde ICT-toepassingen van mening dat het gebruik van deze systemen op basis van art. 2 Politiewet 1993 onvoldoende voorzienbaar is voor burgers en de wetgever zich moet uitspreken over deze gegevensverwerkingen. Als zij vinden dat het gebruik van deze systemen noodzakelijk is voor een effectief politieoptreden zou zij daarvoor (naar onze
mening) een nieuwe wettelijke grondslag met waarborgen voor het gebruik daarvan
moeten creëren.

Opsporen op internet

Het vergaren van gegevens op internet voor toezichtsdoeleinden moet in theorie gescheiden worden van het vergaren van gegevens voor opsporingsdoeleinden. Soms lopen de twee in elkaar over, maar op dit moment is het zo dat in kader van opsporing de politie (meestal in opdracht van een officier van justitie) meer ernstige privacyinbreuken mogen worden gemaakt door middel van toepassing van  bijzondere  0psporingsbevoegdheden. Al eind jaren ‘90 heeft de wetgever met de Wet bijzondere opsporingsbevoegdheden ( Wet BOB ) te kennen gegeven dat opsporingsbevoegden ook op internet mogen worden toegepast. Het is echter niet helemaal duidelijk wat de reikwijdte van deze bevoegdheden in een internetomgeving precies is.

Op dit moment lijkt het afhankelijk van de interpretatie van opsporingsambtenaren (en soms een officier van justitie als die erbij betrokken wordt) hoe ver ze kunnen gaan bij het vergaren van informatie op internet. Er is ook opvallend weinig jurisprudentie over voorhanden, behalve één gepubliceerde zaak waarbij de rechter te kennen gaf dat een
opsporingsambtenaar van Google Earth in zijn onderzoek gebruik mag maken. Tegelijkertijd gaf de rechter aan dat ‘de bevoegdheid om rond te kijken in een openbaar netwerk niet de bevoegdheid impliceert om stelselmatig voor de uitoefening van de politietaak gegevens van internet te downloaden en in een politieregister op te slaan’.

Koops en ik zijn het zelf ook niet helemaal over eens op welk moment nu precies bij het vergaren van gegevens uit open bronnen op internet een meer dan geringe inbreuk wordt gemaakt op de persoonlijke levenssfeer van de betrokkenen. Dit leggen we in het artikel ook uit. Wel zijn wij het er over eens dat het criterium van een ‘meer dan geringe privacyinbreuk’ leidend is en dat wanneer daarvan sprake is het vergaren van gegevens door de politie zou kunnen worden ondergebracht onder de bijzondere opsporingsbevoegdheid van stelselmatige observatie (art. 126g Sv). Maar zelfs die bijzondere opsporingsbevoegdheid slaat niet naadloos aan bij de opsporingshandeling van politie en justitie op internet. Dit zetten we in het artikel verder uiteen.

Daarom concluderen we dat: ‘de wetgever deze problematiek bewust moet analyseren en zich daarbij moeten baseren op de huidige internetomgeving, die veel verder is ontwikkeld en er anders uitziet dan in 2000 het geval was’ (p. 47). Eventueel zou voor opsporen op internet het criterium ‘stelselmatigheid’, waarbij een ‘min of meer volledig beeld van een bepaald aspect van het leven van een persoon wordt verkregen’ leidend kunnen blijven. Daarbij zou de bijzondere opsporingsbevoegdheid van stelselmatige observatie toegepast kunnen blijven worden, maar het is wenselijk als de wetgever dit
expliciet maakt (om ongewenste interpretaties van de wet te voorkomen) of een andere wettelijke grondslag voor de opsporingshandeling creëert. In de tussentijd kunnen advocaten met een actieve proceshouding de opsporingspraktijk aan de kaak stellen. Rechters zullen zich daar vervolgens moeten over uitspreken, waardoor het wet- en regelgevingskader voor surveilleren en opsporen op internet meer helder wordt.

Interview in SC Online

Een paar weken geleden werd een interview (.pdf) met mij afgenomen over de plannen van Opstelten m.b.t. cybersecurity. In het interview wordt ingegaan op de meldplicht ‘security breaches’ en de toekomstige rol van het Nationaal Cyber Security Centrum (NCSC). Daarbij plaats ik vraagtekens bij sommige voorstellen en roep ik op tot debat over o.a. de meldplicht en informatieuitwisseling bij het NCSC.

Vergeet niet dat een soortgelijke discussie over dit soort maatregelen ook (of wél?) in het buitenland plaatsvinden. Nog niet zo lang geleden was veel van doen over de Amerikaanse ‘Cyber Security Act’ die meer informatie-uitwisseling mogelijk zou moeten maken en de oprichting van een instantie die dat zou moeten faciliteren. Zie bijvoorbeeld deze Q&A op de website van de Electronic Frontier Foundation. Dat wetsvoorstel heeft het uiteindelijk niet gehaald door privacyzorgen en tegenstanders van meer bureaucratie.

Seminar: Investigating Cybercrime

On September 28 2012, eLaw@Leiden in cooperation with Fox-IT is hosting a seminar about cybercrime. The seminar will take place from 13.00-16.30 hours at the Leiden Observatory in Leiden.

Aim of the seminar

The aim of the seminar is to provide expert legal and criminological knowledge to the participants about cybercrime and raise awareness about the subject matter.
During the afternoon, various cybercrime experts will answer the following questions:
–           What are cybercrimes and how are they perpetrated?
–           How are cybercrimes criminalized?
–           What obstacles arise in investigating cybercrime cases?
–           Are remote searches by law enforcement authorities necessary?
–           What is the way forward in fighting cybercrime?


12.30-13.00 hours:
Registration at the Leiden Observatory
13.00-13.15 hours: Introduction
13.15-14.00 hours: Keynote speech – Prof. Susan W. Brenner
14.00-14.45 hours: Speech – Prof. Bert-Jaap Koops
14.45-15.05 hours: Coffee and tea break
15.05-15.30 hours: Live hacking demo
15.30-16.15 hours: Speech – Mr. Lodewijk van Zwieten
16.15-16.30 hours: Questions and Answers


Our keynote speaker for the afternoon is Susan W. Brenner from the University of Dayton. Professor Brenner is the author of various books in the field of cybercrime and
cybersecurity, such as Cybercrime: Criminal Threats from Cyberspace (Praeger, 2010) and Cyberthreats: The Emerging Fault Lines of the Nation State (Oxford University Press, 2009).

Our second speaker for the day is Bert-Jaap Koops from the University of Tilburg. Professor Koops is a highly regarded legal scholar in the field of cybercrime.
Also, the national public prosecutor in the field of High Tech Crime & Telecom, Lodewijk van Zwieten, will provide a presentation in which the legal aspects of a fictional criminal case are analyzed.

Registration and fee

Participation in the seminar is free of charge and all people with an interest in the legal and criminological aspects of cybercrime are invited. Afterwards there is the possibility to have drinks and network with the participants at Café Babbels in Leiden.
Due to a limited amount of room, only 50 people can participate, including a maximum of 10 students. At September 14 2012 we will let people know if they are selected.
Participants must register by emailing,
–           Your name and affiliation (company or institution).
–           Your motivation why you want to be chosen to participate in the seminar.

Address and travel directions

The address of the Leiden Observatory is:
Oude Sterrewacht
Sterrenwachtlaan 11
2311 GW Leiden

You can find travel directions at:
We look forward to seeing you on September 28!
eLaw@Leiden and Fox-IT

Our government should provide statistics about online data collection

Three weeks ago (June 25, 2012) our state secretary of the ministry of Safety and Justice answered parliamentary questions about ‘wiretapping social media services and online privacy’. A parliamentary member repeatedly requested (four times in total) statistics about the use of ‘social media wiretaps’ in collecting evidence by law enforcement authorities. Once again the Dutch state secretary Mr. Teeven refused to provide these statistics, stating that it would harm criminal investigations and prosecutions. Our minister of Safety and Justice also refused to provide transparency about ‘social media
wiretaps’ last Sunday (August 12 2012), according to this article on the popular Dutch news website In this blog post I will make several observations on the subject. First of all, I believe it is wrong to speak of ‘social media wiretaps’ and secondly, in my opinion, the government should provide these statistics.

Social media wiretaps?

The parliamentary member who sent the written questions to the cabinet members responsible assumed that communication via social media services can be wiretapped, just as public (electronic) telecommunication services can. This is however not the case, as an electronic communication provider is, legally speaking, different to an electronic public telecommunication service or network provider. Not all electronic communication
providers have to change their infrastructure to facilitate wiretapping, unlike public electronic telecommunication service providers. They do, however, have to comply with requests for the collection of data.

One of the most common grounds for data collection requests by law enforcement is the collection of user data or registration data on the basis of article 126na, 126nc or 126n of the Dutch Code of Criminal Procedure. For law enforcement officials it is possible to
collect all other data on the grounds of article 126nd of the Dutch Code of Criminal Procedure, except ‘sensitive data’ such as data about the religious beliefs or health of an individual and stored communication data. Another commonly used investigatory power is article 126ng(2) of the Dutch Code of Criminal Procedure by which stored communication data – such as ‘private messages’ that are sent from one person to another via social media services – can be collected by law enforcement authorities.

In sum, it is (so far) not possible to legally wiretap a social media service without its cooperation, although law enforcement authorities can request this type of data from social media services.

Transparency about online data collection

In my view data collection from online social media services and other communication providers will become an increasingly important investigatory power of law enforcement authorities. There are two important reasons for this. The first reason is that people use
more and more online communication services to communicate with each other. It is difficult to wiretap all these different services and sometimes it is not legally (and some say technically) possible to force these services to place a wiretap. The second reason is that encryption makes data over Internet wiretaps unreadable for law enforcement authorities. By having that data collected by communication service providers directly, law enforcement authorities can obtain the communication data anyway (this is described in more detail in my (Dutch) article (.pdf) about Internet wiretaps). Note that the same trend is developing overseas, for example in the United States. Read for example this paper on SSRN from Peter Swire.

For the past couple of years – and because of the asserted pressure of members of the parliament and civil rights movements – our government has provided statistics about the use of (Internet) wiretaps. Although these figures are often misinterpreted by the media, they do provide an insight into the use of investigatory powers by law enforcement and also a reason to request an explanation from the cabinet members responsible.
Because online data collection partly replaces the investigatory technique of wiretapping, I believe it is important and logical to provide statistics about the use of this investigatory power as well. I do not see how providing this statistical data would harm investigations. Such statistical data would only tell us how often these privacy infringing investigatory powers are used. Therefore in my opinion the cabinet member(s) responsible should try their best to provide more transparency about online data collection, rather than using weak arguments to support their refusals to provide statistics.

This blog post is a crosspost from Leiden Law Blog.

Debat over aftappen

Twee weken geleden (23 mei 2012) heb ik een seminar bijgewoond over aftappen naar
aanleiding van het WODC-onderzoek ‘het gebruik van de telefoon- en internettap in de opsporing‘. De media schreef over het rapport met name dat ‘Nederland koploper in aftappen is’ (zie bijvoorbeeld

Kamerleden duikelden vervolgens over elkaar heen om in de media te herhalen dat
het een schande is dat Nederlands koploper is en de notificatieplicht moet worden nagekomen. Andere onderzoeksresultaten uit het rapport zijn verder nauwelijks ter sprake gekomen. In dit bericht wil ik daar enkele opmerkingen over maken.

Telefoontap minder effectief?

Al voor het seminar begon en het rapport officieel aan het publiek beschikbaar werd
gesteld kwam de Volkskrant al met het berichtdat de ‘telefoontap steeds minder effectief
’. Dat was misschien niet zo netjes van de Volkskrant, maar het haalde wel een
belangrijke boodschap uit het rapport. Namelijk dat steeds meer mensen van andere communicatiemiddelen dan de telefoon gebruik maken en daardoor niet alle communicatie meer over de reguliere tap komt. Het is daarom niet verbazend dat
opsporingsdiensten meer van de internettap gebruik zijn gaan maken en het aantal ingezette internettaps is verdubbeld van 1704 taps in 2010 naar 3331 taps in 2011. Volgens de demissionaire regering (brief van 25 mei 2012, Kamerstukken II 2011/12, 30 517, nr. 25)is dat te verklaren door de toename van het gebruik van internettoepassingen op smartphones. De WODC-onderzoekers geven aan dat door gebrek aan capaciteit en kennis bij de politie het aantal ingezette internettaps nog relatief laag is gebleven.

De vermeende ineffectiviteit heeft niet geleid tot een daling van het aantal taps.
De traditionele telefoontap is zelfs meer ingezet dan ooit (van 22006 in 2010 naar 24718 in 2011). De telefoontap blijkt nog steeds een effectieve opsporingsmethode te zijn. In de brief van de regering wordt bevestigd dat de telefoontap vooral nuttig indirect bewijsmateriaal oplevert. Soms geeft het ook aanleiding tot een effectieve en efficiënte inzet van andere opsporingsbevoegdheden. Tijdens het seminar werd ook door een officier van justitie toegelicht dat een verdachte soms wel van 8 prepaid telefoons gebruik maakt en dat kan ook (deels) een verklaring leveren voor het hoge aantal ingezette taps. Persoonlijk kreeg ik bij het seminar de indruk (door het gebrek aan debat daarover) dat de internettap nog niet zo’n grote rol speelt in opsporingsonderzoeken. Deze opsporingsbevoegdheid is volgens mij vooral relevant in de meer high tech opsporingsonderzoeken waarbij verdachten voornamelijk via internet communiceren. Afgevraagd kan worden of dit in de toekomst gaat veranderen als steeds meer mensen voor hun communicatie vooral van internet gebruik maken. Ik denk dat het belangrijk is
daar nu al over na te denken en debat te voeren.

De overwegingen in de brief van de regering over de internettap vond ik zelf wel interessant en die wil ik hier nog kort uitlichtten. Over de internettap werd gezegd dat
inmiddels ‘geselecteerde internettoepassingen’ kunnen worden afgetapt, waardoor
niet het gehele netwerkverkeer hoeft te worden geanalyseerd. Naast dat dit efficiënter is, komt dat natuurlijk ook de privacy van de betrokkene ten goede.
Opstelten geeft nogmaals aan ‘zowel nationaal als internationaal wordt onderzocht of er aanpassing van wet- en regelgeving nodig is om ook op internet de juiste mogelijkheden te hebben voor de opsporing’. Voor het zomerreces moet de Kamer daarover worden geïnformeerd.

In mijn eigen artikel over de internettap geef ik aan dat door versleuteling het in toenemende mate lastig wordt de inhoud van communicatie via internet af te tappen. Tegelijkertijd kan met de inzet van alternatieve opsporingsmethoden veel worden bereikt. De bijzondere opsporingsbevoegdheid van direct afluisteren (artikel 126l Sv), inclusief de mogelijkheid tot het plaatsen van een keylogger, biedt mogelijk een interessant alternatief om het probleem van versleuteling te omzeilen. De opsporingsbevoegdheid mag in een woning echter slechts worden toegepast bij misdrijven waar een gevangenisstraf van 8 jaar of meer op staat. De praktische toepassing van deze opsporingsmethode is daardoor beperkt. In de Verenigde Staten wordt wellicht vaker van deze opsporingsmethode gebruik gemaakt om het probleem van versleuteling te omzeilen. Zie bijvoorbeeld ook deze analyse cryptografie-deskundige Matt Blaze over de Amerikaanse ‘wiretap report’ van 2010 (die van 2011 verschijnt hopelijk later deze maand).

Het is mij niet duidelijk geworden in hoeverre opsporingsdiensten in Nederland concreet
gehinderd worden door versleuteling. Ook ben ik benieuwd in hoeverre de nieuwe versie van het IP-protocol (IPv6) in de nabije toekomst mogelijk een probleem gaat vormen voor opsporingsdiensten. Wellicht zou de Nederlandse politie daar over wat meer kunnen zeggen naar voorbeeld van hun overzeese collega’s. In de Verenigde Staten probeert de FBI namelijk duidelijk te maken dat dit wel degelijk een probleem is. Zie daarover bijvoorbeeld dit interessante bericht op CNET.

Reactie Kamerleden

Van de reactie van Kamerleden had ik om eerlijk te zijn wel wat meer verwacht. Kamerlid El Fassed stuurde twee dagen voor het verschijnen van het rapport een viertal Kamervragen in. In mijn ogen maakt hij terecht een punt over het verschaffen van transparantie over het aantal vorderingen van gegevens bij sociale mediadiensten. Ik zie niet in hoe informatie over het aantal verzoeken tot gevolg kan hebben dat verdachten hun gedrag daarop zouden aanpassen, zoals staatssecretaris Teeven eerder heeft aangegeven.

Daarnaast stelt El Fassed de vraag of het niet verstandig zou zijn of voor het aftappen
van telefoons en sociale media door opsporingsautoriteiten dezelfde voorwaarden
moeten gelden. Blijkbaar is El Fassed of GroenLinks niet goed op de hoogte van de wetgeving. Sociale mediadiensten zijn (vooralsnog?) niet aftapplichtig; daar kunnen slechts gegevens worden gevorderd. Voor het vorderen van opgeslagen gegevens
(o.g.v. artikel 126ng lid 2 Sv) gelden verder dezelfde voorwaarden als voor een telecommunicatietap. Dit heb ik overigens ook uitvoerig uiteen gezet in mijn artikel over de internettap.

Persoonlijk vind ik het jammer dat een debat over de niet-aftapbaarheid van telecommunicatie en telecommunicatiediensten die zich soms aan de aftapplicht
lijken te onttrekken is uitgebleven. Wat mij betreft zijn dit ook belangrijke vragen waar over gediscussieerd moet worden.Wellicht biedt de toekomstige brief van Opstelten over
opsporingsbevoegdheden op internet hiervoor een mooie aanleiding.

Wiretapping Internet Communications

An important report from the Dutch governmental judicial organization ‘WODC’ (Research and Documentation Centre) about wiretapping was published yesterday. For this report I wrote about ‘the possibilities and limitations of wiretapping internet
’ (.pdf (in Dutch)). In this blog post I will give a brief overview of my
research findings. Some readers might be surprised that Internet communications can be legitimately wiretapped, but what might surprise even more is that this  relatively new investigatory technique is rapidly getting less effective with regard to the interception of
the contents of data sent over the Internet.

Workings of an internet wiretap

More and more people are communicating with each other by using the Internet. Not only are most telephones connected over the Internet, many people use alternative ways to communicate via the Internet. Think of modern services like Skype, Whatsapp, e-mail and the sending of private messages through chat programs and other services. It is important for investigative authorities to be able to wiretap the content of certain
information or messages that is sent over the Internet during criminal investigations. The intercepted internet traffic can hold important (mostly indirect) evidence. Intercepting the content of this data is however more of a challenge than intercepting telephone conversations.

In practice, internet traffic data is usually intercepted at the Internet Service Provider, more specifically at the ‘access provider’. Access providers provide internet connections for their clients. All incoming and outgoing traffic of a certain IP address is intercepted and this can be analyzed and made visible by law enforcement authorities. This means that for example search terms in Google are visible to the investigative authorities and
also chat conversations that are sent unencrypted over the Internet through programs (like MSN Messenger), or private messages send through certain apps (such as Whatsapp) or the communications through certain social media services (such as Hyves). The problem is that only unencrypted traffic can be made visible by law enforcement agencies.

Encryption and mobile devices

Lately, more and more online services began using certain encryption. Sometimes the use of encryption for internet services is an option for users (like with Facebook and Hotmail) and sometimes it is standard (when using Twitter or Gmail for instance). In this context, encryption scrambles data so that the content of the intercepted data from a certain IP
address cannot be made visible by law enforcement. For example, it is suspected investigative authorities are unable to decrypt ‘telephone conversations’ that are send over Skype. Internet users can also make the conscious decision to use strong encryption in their communications, for example by using the e-mail program ‘Pretty Good Privacy’. In addition, the possibilities of wiretapping internet connections is undermined by mobile devices that connect to the Internet (using WiFi connections for example). Many people use different Internet
connections in a single day and since wiretaps can only be placed at specific IP-addresses, it is often impossible to intercept all communications.

Possible solutions

A solution would be to intercept traffic from internet communication service providers. However, it is unclear for many of these services if they fall under the broad definition of ‘public telecommunications service provider’ in our Telecommunications law. But even if they do, it’s often impossible to enforce our laws, because their main offices are situated in territories outside of the Netherlands. The Dutch government could take action and provide more clarity about which services fall under the definition of a ‘public telecommunications provider’ and force them to facilitate in wiretapping (at least with regard to services within the Dutch territories). An obligation to wiretap involves costs
and privacy implications. Some internet communication services might not be able to comply with the obligation or it might create too much of a burden which impedes on innovation.

Not all is lost for law enforcement authorities however. Besides the availability of many other investigative powers to collect useful information about suspects and their internet communications, law enforcement can still deduce important data from so called ‘traffic data’ of wiretaps. This information shows for example at which time (and place to a certain extent) a suspect connects to computers. A wiretap might show a suspect using
an anomization service or connecting to a service such as Gmail in the United States. This information may provide important leads for law enforcement.

In short, the effectiveness of internet wiretaps deteriorated over the last decade due the increased use of encryption and mobile internet. At the same time the necessity of wiretapping Internet communications increased, because many people started using different means of communication besides telephones. Before amendments are made to wiretapping laws in order to wiretap on more internet communication services, it must be considered whether those amendments are absolutely necessary and what consequences it might have for privacy en innovation.

This article is a cross-post from Leiden Law Blog