UPDATE 2017-11-10: answers (in Dutch, 9 pages; mirror) to parliamentary questions re: draft regulation DNA investigations in Wiv2017 (=Wiv20xx) intelligence law.

UPDATE 2015-06-15: the transcript (in Dutch) is available of the General Meeting that took place held on April 22nd 2015 in the parliament.

UPDATE 2015-04-15: the Dutch Minister of the Interior mentions (.pdf, in Dutch) “several dozen” DNA profiles were involved, which he requested to be destroyed, and are now destroyed. We now wait for that the bill that will be proposed to change the law such that it will be legal for the AIVD to store DNA profiles (under certain conditions and safeguards).

UPDATE 2015-04-01: the Dutch Minister of the Interior reportedly (in Dutch) seeks to change the law to allow the AIVD to store DNA profiles for the purpose of identifying persons. “If we have someone’s DNA and that person then carries out an attack, we can identify that person directly”, he said. The level of prior authorization required to store DNA is not yet determined, but it is suggested that in case of persons that have special professions, for instance lawyers and journalists, approval will typically need to be obtained from the Minister itself (highest possible level). The use of DNA for the purpose of determining a person’s health will remain forbidden.

On March 25th 2015, the Dutch Review Committee on the Intelligence and Security Services (CTIVD) published an oversight report (.pdf, in Dutch) about the use of forensic biology research methods by the Dutch General Intelligence & Security Service (AIVD) between 2002 to 2014. The CTIVD report was accompanied by a press release (.pdf, in Dutch).

Article 22 of the Dutch Intelligence & Security Act of 2002 (Wiv2002) permits the AIVD to “carry out research on objects for the purpose of establishing the identity of a person”, and is the main legal basis for the use of forensic biology research methods. Article 21 permits the AIVD to use agents, and agents may carry out tasks on behalf of the AIVD; for instance the application of forensic biology research.

While the AIVD is permitted to apply forensic biology research for the purpose of establishing the identity of a person, the CTIVD states that the AIVD is not permitted to do so for the purpose of examining a person’s health. The CTIVD found that the AIVD attempted to do so in two operations, part of one investigation, “a longer time ago”; the CTIVD finds this unlawful.

While the AIVD is permitted to take DNA from objects and store it until the identity of a person has been established, the CTIVD states that the AIVD is not permitted to store that DNA once an identity is established. The CTIVD found that the AIVD keeps a small-scale DNA database that contains information pertaining to persons that are already identified; the CTIVD finds this unlawful. The report itself states that the AIVD employs a forensic adviser, and that that adviser manages said DNA database. The database is stored on a stand-alone computer that is not accessible from the internal network of the AIVD. If an operational team wants to check a DNA profile, that has to be done via the forensic adviser or his supervisor. As stated in the press release, under the current Dutch law, that database can only contain DNA information of persons whose identity has not yet been established.

Here is a translation of the CTIVD’s press release:

The Dutch Intelligence & Security Act of 2002 does not permit the AIVD to create a DNA database

The Dutch Intelligence & Security Act of 2002 (Wiv2002) permits the AIVD to carry out forensic biology research. However, no specific regulation exists that safeguards the storage of cell material and DNA profiles. As soon as the AIVD has established the identity of a person, the DNA profile and possible cell material must be destroyed. The AIVD is thus not permitted to create its own DNA database. At the time of the investigation, it was found that the AIVD had such a database, at a limited scale. This is stated in a report published today by the Dutch Review Committee on the Intelligence and Security Services (CTIVD) about the application of forensic biology research methods by the AIVD.

If the AIVD examines physical characteristics of persons for the purpose of establishing their identity, the privacy of these persons is at stake. Examples include DNA research and dactyloscopy. The protection of privacy demands increasing attention, because the possibilities of, among others, DNA research have strongly increased. Much more personal characteristics can be derived from cell material (blood, saliva or body hair) nowadays than in the past. The CTIVD therefore in its oversight report established a framework for the application of forensic biology research methods.

Conditions

The law provides two conditions for the application of forensic biology research methods.

Condition 1: only objects, not persons, can be examined

The AIVD can only carry out forensic biologic research concerning objects that have body material on them. The Wiv2002 does not provide room to take such material from the body of persons, for instance by covertly pulling body hair. The AIVD is not permitted to infringe upon the physical integrity of persons.

Condition 2: examination is only permitted to establish a person’s identity

The purpose of the investigation must be to establish a person’s identity. That means:

• that the law does not provide room to carry out investigations if the identity is already known. It is required that at the time of the investigation, doubt exists about a person’s identity. A method in which, for instance, the DNA profile of an identified person is stored for future use to recognize the person’s identity when the person is expected to travel under an alias or disguise, is thus already not allowed because of this, and;
• the investigation can only be aimed at the identity of the person involved, or by means of related identifying characteristics, such as the DNA profile or the fingerprint. The Wiv2002 thus does not provide room for carrying out investigations into the decent or health of a person.

No legal basis for storing DNA profiles or cell material

European jurisprudence provides an additional condition for the application of forensic biology research methods. An adequate legal basis must exist for storing cell material and DNA profiles. This legal basis must provide minimal safeguards concerning storage period, use, third party access, procedures for maintaining the integrity and confidentiality of the data, and procedures for destruction.

The CTIVD found that such a specific regulation that provides safeguards for the storing of cell material and DNA profiles, does not exist for the AIVD. The Wiv2002 hence does not provide the legal basis. As long as the current law does not regulate the storing of DNA profiles and cell material, the AIVD is not permitted to create its own DNA database for any reason. At the time of the investigation, it was found that the AIVD had such a database, on a limited scale. As soon as the AIVD established a person’s identity, it must remove and destroy the DNA profile and possible cell material.

Examined operation

The CTIVD has examined all operations since 2002 — the year in which the law took effect — in which the AIVD has used forensic biology research methods. The number of operations was not large, but the use of such methods is increasing. The CTIVD has found unlawfulness in a limited number of operations.

EOF