The Dutch Advisory Council on International Affairs (AIV), which in 2012 published advice on cyber warfare, has now published advice on internet freedom (.pdf, in Dutch). The report follows a request for advice that the Minister of Foreign Affairs sent to the AIV in February 2014. The AIV is an independent agency that administratively resides in the Ministry of Foreign Affairs.

The 97-page report is written by well-read people: references are made to, among others, DARPA’s Total Information Awareness program of 2002, the NSA’s Bullrun project, writings from Evgeny Morozov and Jonathan Zittrain, opinions expressed by the US PCLOB, and so on — in addition to explaining the history and politics of ICANN and the ITU, and the complex concepts of privacy, freedom and censorship.

Three questions are addressed (official translation; emphasis is mine):

1. How can the Dutch government ensure that internet freedom is embedded and further operationalized in Dutch domestic and foreign policy as effectively as possible, against the background of:
   1. the challenge facing governments, including the Dutch government, in weighing the right to privacy — as formulated in the UN resolution on this right — against other interests to be protected by those governments as they look for solutions to issues raised by digital communications;
   2. the leading role of the Netherlands in foreign policy concerning internet freedom, as illustrated by the Freedom Online Coalition (FOC), and the opportunities which the Netherlands has to influence the international debate, including the International Conference on Cyberspace in the spring of 2015; [=the Global Conference on Cyberspace 2015 (GCCS2015) – on 16 and 17 April, 2015]
      
   3. an international playing field in which more and more countries are seeking to exert tighter control over the internet (and its architecture) and are developing initiatives to that end;
      
   4. the right to protection of personal data, which is addressed in different ways by the UN, the Council of Europe and the EU.
2. Is Dutch jurisdiction over internet freedom limited to activities in the Netherlands, or does it, by virtue of the increased technological possibilities, extend to situations outside the country? If such jurisdiction does not extend this far, how can the Dutch government help to effectively safeguard internet freedom beyond the Netherlands’ borders?  
3. To what extent are businesses responsible for protecting citizens’ internet freedom in countries where they operate, and how can the Dutch government, both by itself and in cooperation with other countries, encourage businesses to assume such responsibility? [spoiler alert: the AIV defers this to corporate social responsibility, such as pursued by the Ruggie Framework]

The report makes the following eleven recommendations (my translation; emphasis is mine; ~1400 words):

Recommendation 1

Paragraphs III.2, III.4 and IV.3.2 explain that data of Dutch internet users is often stored on servers outside the Dutch jurisdiction. The countries where the servers are located are usually authorized to demand access to that data under certain conditions. Because computers cannot process encrypted data very well, and the data are stored outside the realm of Dutch legal protections, the cloud is potentially completely vulnerable. Safe Harbor agreements do not provide sufficient protection, because they are inadequate, hardly enforceable, and have large exceptions concerning national security. These risks deserve the cabinet’s full attention.

The Dutch government’s policy intends to make all domestic government-citizen relations happen via cyberspace: government records, registers and transactions must all take place electronically by 2017 [see a statement by the Minister of the Interior]. The AIV finds it to be urgent that clarity be sought on whether the storage and processing of these data risks the data to end up outside Dutch jurisdiction, where they cannot be sufficiently protected technically and legally. Policy measures and legal measures must be taken to prevent that, at least providing legal guarantees concerning access to the data equivalent to the legal safeguards that apply in the Netherlands (see paragraphs III.5.1 and III.5.2). Furthermore, it is important that the legal protection is sufficiently guaranteed.

Recommendation 2

The Netherlands has a good economic position on the internet market. It can improve this position by creating a positive business climate by means of optimal protection of internet freedom in all ways and facets discussed in the present advice. The organization of international conferences and institutes has a positive spin-off, but that remains ephemeral if it is not anchored in the Dutch internet community. As part of the international promotion of optimal internet freedom, the Netherlands could create a positive business climate in the Netherlands for internet companies, and stimulate the concentration of internet specialists in innovative science centers in the universities. Furthermore, the Ministry of Economic Affairs, that has a key role in this, could have better coordination between the directorates that deal with the internet.

Recommendation 3

The principle of human rights policy (one of the corner stones of the foreign policy) is that the Netherlands itself, without pretending to be perfect, wants to set an example, mostly in terms of openness and accountability: local democracy and freedom is the measure. This implies that the Netherlands must strive for the same high level of protection nationally as it promotes internationally. This is a responsibility of all Ministries, notably the Ministries dealing with internet topics.

In the pending constitutional amendment, the planned renewal of the Dutch Intelligence & Security Act of 2002, and the draft proposal Computer Crime III, it must be especially considered whether the Dutch government is following a policy and/or creates regulation that it can uphold internationally [in Dutch: “voor de dag kan komen”]. [note: essentially, this recommendation states that the Dutch govt should practice what is preaches, or else risks losing credibility. Dutch readers: see p.61 and p.68]

Recommendation 4

The ensuring of effective and independent oversight on intelligence and security services has got a lot of attention in the US following the Snowden affair, and it has also been discussed in the Netherlands by the review of the Dutch Intelligence & Security Act of 2002, among others by the motion filed by the Christian Democratic Appeal (CDA) party in the Senate that was adopted on October 7th 2014 (Eerste Kamer der Staten-Generaal, vergaderjaar 2014-2015, CVIII, D). The UN resolution “The promotion, protection and enjoyment of Human Rights on the Internet“, adopted in July 2012 by the UN Human Rights Council, according to which individuals have the same rights online as they have offline, must be guiding for Dutch policy. If, because of the permanent terror threat, means must be used against (categories of) persons that are not specifically suspected of anything, doing so can only be justified if effective and independent oversight exists. The AIV finds the strengthening of effective and independent oversight by the Dutch Data Protection Authority and the Dutch Review Committee on the Intelligence and Security Services (CTIVD) on the lawful and proportional use of investigatory and preventative powers, of great importance to internet freedom, as defined in the present advice, in the current state of technology and the changed international relations. [note, here, that the AIV does not rule out mass surveillance per se; it only states that mass surveillance can only be justified if “effective and independent oversight” exists.]

Recommendation 5

In 2014, the Netherlands will spend approximately 53.5 million euro on human rights policy (including Radio Netherlands Worldwide). Part of that is spent on promoting internet freedom. The Netherlands supports various important projects concerning internet freedom by providing man power and money. However, a coherent vision of the internet and the various facets that must be distinguished and emphasized, is lacking. Choices made concerning the support of such activities should be preceded by a general substantiation and prioritization, aimed at the facets of the internet problems that are relevant to the Netherlands. The government could, in consultation with those involved, develop specific measures that promote the freedom and security of the internet, such as the development and publishing of open source software. The AIV considers the lack of attention for improving international policy-making (such as the Internet Governance Forum and the reorganization of ICANN) to be a clear omission. [note: also see Recommendation 8: in the context of companies and internet organizations dominated by companies, the AIV considers it to be the government’s role to monitor whether new software and protocols infringe upon the European interpretation of the freedom of expression, privacy, and data protection.]

Recommendation 6

Much is happening concerning the EU issues as well. The Netherlands has a wait-and-see attitude concerning the upholding — or not — of the Safe Harbor agreement and the negotiations about the Umbrella agreement. The Netherlands has ample knowledge to play a more leading role in these topics. The Netherlands must take the view that upholding of the Safe Harbor agreement can not, without significant improvements, be a basis for data exchange with the US in the private sector. The Netherlands can use its chairmanship of the EU in 2016 to develop proposals for the EU with the purpose of renewing the existing, outdated legislation that has effects on internet freedoms.

Recommendation 7

A point of special attention is to provide better safeguards in the exchange of data between national intelligence and security services within Europe and beyond. In the renewal of the Dutch Intelligence & Security Act of 2002, the exchange of data between Dutch and foreign intelligence and security services should be legally regulated, in which sufficient safeguards must be provided for citizens, as explained in paragraph III.2.

Recommendation 8

The activities of companies and internet organizations dominated by companies can have a significant influence on internet freedom. Companies are primarily guided by profit considerations, and have to deal with various national and international legal frameworks. It is the government’s role to monitor whether new software, protocols, and such, infringe upon the European interpretation of the freedom of expression, privacy, and data protection. NGOs can have a signaling role. The question of how internationally operating companies can be involved in the Dutch human rights policy has been on the agenda for a long time. In the context of the present advice, the question is very urgent, because a small number of international companies is responsible for the international confidential and public communications, and the safeguards that should be provided. The government must therefore address the responsibility of these companies on international forums, and enter into a dialogue about human rights, such as the government also intends to do with foreign governments.

Recommendation 9

Questions related to internet freedom, as apparent in numerous places in the present advice, transcend governments departments, and are increasingly connected to responsibilities that must be carried by the private sector and other stakeholders. The transcending issues make the execution of the Dutch human rights policy, especially in this domain, into a shared responsibility. The AIV therefore recommends that coordination and shared responsibility is striven for during decision preparation and decision making concerning internet issues.

Recommendation 10

The Netherlands must have a more consistent policy concerning the question of the internet views it wants to express at which international forums, and in what coalitions. The Ministry must spend more money and man power in the Internet Governance Forum. Furthermore, it could promote privacy-enhancing measures within the ICANN and other internet organizations. An example is given in paragraph V.1: the WHOIS database of the SIDN, that registers domain names for the .nl domain, does not show address information of the domain name holder; bailiffs and lawyers can however request that data. The Netherlands could promote such a solution internationally.

Recommendation 11

In the policy-making concerning internet freedom, various Ministries are involved: the Ministry of Foreign Affairs, the Ministry of Security & Justice, the Ministry of Economic Affairs, the Ministry of the Interior, and the Ministry of Defense. The Ministry of Economic Affairs regularly consults with Dutch stakeholders in preparation for international meetings. This is an example that other Ministries can follow. Interviews with experts give the impression that the Ministry of Foreign Affairs has little connection with the Dutch internet community. It is desirable that the Ministry of Foreign Affairs assigns more personnel to bring knowledge of the internet up to standard, and to strengthen contacts with the domestic and foreign internet communities, also considering the EU.

We’ll have to wait and see how the government will respond to this advice, i.e., which recommendations they will (not) follow. The report does not address net neutrality; on page 9 it is stated that net neutrality is out of scope “because it relates to (European) competition law”. I don’t know how to interpret that (perhaps the AIV, which resides in the Ministry of Foreign Affairs, does not want to interfere with an issue that primarily resides in the Ministry of Economic Affairs).

These are ongoing developments in the Netherlands in which internet freedom can be at risk (probably a non-exhaustive list):

• In November 2014, the Dutch govt announced it proposal is being drafted to grant Dutch intelligence & security agencies bulk cable-interception power: the government is drafting a legislative proposal, conceptually described here, to update the Dutch Intelligence & Security Act of 2002, that would expand the existing bulk interception power of the Dutch intelligence agencies AIVD and MIVD from ether-only to also include cable communications. (Note: the latter already happened in Sweden in 2009: the FRA used to only be allowed bulk intercept of ether communications, but as of 2009 is also allowed to carry out bulk interception of cable communications, if tasked to do so. The Netherlands would, AFAIK, be the first country to contemplate introducing bulk cable interception in the post-Snowden era.)
• In November 2014, the Dutch govt expressed its intent to uphold telecom data retention: in April 2014, the ECJ ruled the EU Data Retention Directive to be invalid. In November 2014, the Dutch govt expressed its intent to uphold the Dutch implementation, i.e., the Dutch Telecommunications Data Retention Act of  2009, with some cosmetic changes. They also intend to proceed with implementing a nation-wide ANPR database.
• In January 2015, the Dutch govt will propose hacking powers for Dutch LE: there is the legislative proposal “Computer Crime III”, described here, that would provide law enforcement remote hacking powers to, under certain conditions, break into systems of which the geographic location is unknown (thus including systems that reside outside the Dutch jurisdiction);
• In August 2014, the Dutch govt announced anti-jihadism plans that include voluntary censorship imposed on ISPs: in August 2014, the Dutch govt expressed its intent to implement a sort-of-voluntary censorship regime, in which the govt asks Dutch ISPs to voluntarily take content offline without involving a judge. This evolved from, among other, the controversial Clean IT Project, describe here, that the Netherlands was chair of. From leaked documents of Clean IT, it turns out that one of the ideas that was going to be discussed internally was to exclude non-conforming ISPs from government tenders.
• The Pirate Bay was blocked for three years in the Netherlands: in 2011, Dutch ISPs were ordered to block access to The Pirate Bay following a court ruling in a case started by Dutch anti-piracy organization BREIN. In January 2014, a court decided (.pdf, in Dutch) that the blocking was ineffective and disproportional, and the blockade was lifted. The point of this: Dutch citizens were subject to a three year long court-imposed blockade that only eventually was ruled to be ineffective and disproportionate.

The Netherlands will be hosting the fourth international Cyberspace Conference — Global Conference on Cyberspace 2015 (GCCS2015) — on April 16-17th 2015, and will be chair of the EU in 2016; these are opportunities for the Dutch government to pursue its stated human rights objectives; for instance by following the AIV’s recommendations. According to the National Cyber Security Strategy 2 – From awareness to capability (.pdf, 2013) , the Netherlands seeks to be a diplomacy hub for expertise on international law and cyber security (quote from page 25):

It would be nice to see the Dutch national developments — many of which have international implications — be discussed at the Cyberspace Conference in 2015. I’m not aware whether that is the case.

The remainder of this post consists of a translation of the press release (Dec 19, in Dutch) and of the paragraph “Summary and conclusions”. Hyperlinks and parts in [] are mine.

WARNING: THESE ARE UNOFFICIAL TRANSLATIONS.

Here is a translation of the AIV’s press release (~400 words):

The internet: a global free space with limited state control

The internet was initially seen as a new technology that would provide a large contribution to the freedom of expression, but it also has consequences for other human rights, notably the right to privacy. This is of importance to a number of current legislative proposals, such as the renewal of the Dutch Intelligence & Security Act of 2002 (Wiv2002), the renewal of Article 13 of the Dutch Constitution concerning the postal secret [in Dutch: “briefgeheim”], and the proposals to extend powers of the police to fight computer crime.

Nearly everything that individuals do on the internet leaves trails, the so-called traffic data. The collection and analysis of very large amounts of traffic data has become possible thanks to increased computational power. While such data by itself does not say a lot about the internet user, by combining various traffic data a profile can often be made of an individual. That can threaten the privacy of internet users.

Governments and companies are increasingly offering services via the internet. The government, for instance, wants citizens to apply for a scholarship or housing benefits via the internet, because it is cheaper. The storage and processing of digital data in the cloud risks data ending up in a location outside the jurisdiction of Dutch authorities. In the US, where the large internet companies are located, the protection of privacy for foreigners is weaker than in the EU. In the cloud, data can not technically and legally be sufficiently protected. Other governments or companies, who have nothing to do with the scholarship or housing benefits of Dutch citizens, can then sometimes obtain access to that data. The Netherlands and the EU must take policy measures and legal measures to prevent that, for instance by making better arrangements with other countries.

Due to the permanent terror threat, intelligence and security services in various countries also increasingly make use of these possibilities. They also collect data about individuals who are not suspected of terrorism or other crimes. The AIV finds that this is only justifiable if effective and independent oversight exists on the intelligence and security services.

Companies play an increasingly large role in internet freedom in various ways. They can thwart governmental censorship, or cooperate with it. Some companies intend to collect data about individuals, threatening the right to privacy. Internet companies can design their technology in a way that increases internet freedom, or not pay attention to that. The legal role of companies in these aspects is not yet established. The AIV believes it is useful if the Human Rights Ambassador would not only consult with other countries, but also has human right dialogues with large internet companies.

Here is a translation of the paragraph “Summary and conclusions” of the advice report (~1400 words):

Summary and conclusions

Chapter II explains that the internet has disembodied itself from the classic structure of international law of a treaty (that laid down global agreements about telecommunication), an international organization (the ITU) and the national states cooperating therein. A semi-private multistakerholder model replaced it, consisting of the ICANN (naming and addressing) and a set of technical groups that deal with internet standards and protocols. This was accompanied by a technical revolution in the way of sending data and a social revolution in the way of communication. Formally, the ICANN is still part of the US Department of Commerce. After the Snowden affair, the general feeling is that this association can no longer be upheld. A new structure needs to be found, based on the multistakeholder model.

This form of governance limits itself to the technical layers of the internet, although no consensus exists within the internet community even about this narrow definition of governance (see Chapter V.2). Besides this new internet structure, the old organization ITU actively keeps trying to expand its influence, recently in attempt to change the International Telecommunications Regulations during the World Conference on International Telecommunications in Dubai, so far without success. Within the ITU, states such as Russia and China attempt to increase their control over internet communications, also its content. However, the UN started a new development with the Internet Governance Forum. In this global platform, states, in cooperation with other stakeholders, attempt to achieve consensus about the meaning of internet governance. So far with partial success, because it is very difficult — outside of the more technical issues — to reach consensus on topics that involve various views on values. The government’s questions are answered against this background.

The first question was: how can the Dutch government ensure that internet freedom is embedded and further operationalized in Dutch domestic and foreign policy as effectively as possible? Chapter III discusses this question at a conceptual level. First, it is explained that the current constitutional communications and privacy framework no longer suits today’s technology. At the same time, it is evident that such change must involve deliberation and carefulness, because a change can result in decreased protection.

This is demonstrated by, among others, the communication secret [in Dutch: “communicatiegeheim”] in relation to traffic data. In a network society, the communications secret is no longer a fixed given, but a protection of how and in what context an individual can communicate freely. A second aspect is that legal concepts are either designed for a different technical reality than the current internet (for instance the concept of “processing” in the data protection law), or assume a situation in which a clear distinction can be made between the “transport of a message” and “expressing a message” (from media and telecommunications law). Two other entangled questions are the international jurisdiction and universality versus national sovereignty. This contradiction is best seen in the difficult negotiations between the EU and US about the Safe Harbor principles in data protection. Another important aspect is the ongoing erosion of the concept of personal data, as a result of developments such as Big Data and mass or targeted surveillance of citizens. Many incorrectly assume that traffic data are, by definition, not personal data, while a collection of traffic data can allow establishment of (individual) profiles. The assumption that anonymous data can be collected on a large scale without effective oversight, is thus incorrect.

In addition, it is found that security must be understood in the context of the rule of law. Striving for the unattainable ideal of precluded event security can result in measures that are disproportional and harm the balance of the rule of law.

Furthermore, the present advice points out the ongoing battle concerning the broadening of the concept of internet governance; this too is important for the anchoring of internet freedom. This battle is fought in, among others, the ITU (paragraph II.3). The debate about the new organization that will replace ICANN is also of great importance, because control over the root is critical to internet freedom, and because ICANN is central to internet governance (paragraph V.1). The Internet Governance Forum seems like a suitable forum to discuss issues concerning the operationalization of internet freedom, but the secretariat of this forum suffers from a lack of personnel and financial means.

Moreover, the government can contribute to promoting internet freedom by applying the same normative principles in domestic policy discussions as those it promotes abroad. There is a risk that free constitutional democracies develop a Janus Face of legally protected freedom and insufficiently legal limitations of freedom, such as explained in paragraph V.2. That currently undermines the credibility of the US, as criticized in the Foreign Policy study “Begins At Home” by Richard Haass, president of the Council of Foreign Relations.

The second question was whether Dutch jurisdiction over internet freedom is limited to activities in the Netherlands, or Dutch jurisdiction, by virtue of the increased technological possibilities, extends to situations outside the country? If such jurisdiction does not extend this far, how can the Dutch government help to effectively safeguard internet freedom beyond the Netherlands’ borders? On the internet, the production, storage and distribution of information is no longer restricted by time and location. The internet does not have national boundaries. Although the technical possibilities have increased, this does not imply that powers are extended. In paragraph V.2.2 this question is focused on the legislative proposal Computer Crime III. The AIV finds that the draft proposal provides extended powers that exceed what is permissible by international law.

Nonetheless, national states have an important role because the physical infrastructure of the internet starts and ends within a territory over which the states have factual and legal power. The questions concerning access and free and uncontrolled communication are thus focused within national law. Chapters III and V, in which questions of access, surveillance and censorship are addressed, show that it concerns national decisions that must be tested against international (or regional: ECHR and EU) treaties. Paragraph V.4, on the other hand, explains that the large international enterprises, who have a key role in access and free use of the internet, are only very partially within Dutch jurisdiction, namely only when acts take place within the Dutch jurisdiction. It is regularly discussed when this precisely is the case in internet services. The Google Spain arrest of the European Court of Justice is a breakthrough on this aspect.

The third question was whether companies are responsible for protecting citizen’s internet freedom in countries where the companies operate, and how the Dutch government, by itself and in cooperation with other countries, can call upon companies to take that responsibility. The present advice explains that the organization of modern electronic communication strongly differs from the era in which the fixed phone and telex where the most important means of communication. State monopolies in international legal structure are replaced by a system of many players. In this system, the role of companies is large; this is discussed in several places in this advice, notably in Chapter II and in paragraph V.4. Companies have an important role in internet governance, and are provides of various services such as search engines, cloud (paragraph III.4.1 and IV.3.2) and email. Sometimes, companies are forced to act as an extension of the government, such as in data retention (paragraph III.2) or censorship, that they may or may not oppose (paragraph V.3). Companies thus have a considerable influence on internet freedom.

It can be concluded that the position of internet companies is not always clear legally. For instance, in the Netherlands, it is not clear for social media whether they are subject to telecommunication law or to media law. The answer to that question has important consequences for the extent to which those companies can be called to take responsibility concerning the contents of communications and publications. Furthermore, companies can be stuck between national jurisdictions with various legal regimes. For companies, commercial considerations are usually decisive, also where it involves the collection, processing and storage of data of internet users. The answer to the question to what extent companies are responsible for protecting internet freedom can not yet be given, legally. This question must be understood within the wider context of corporate social responsibility. To that end, the Ruggie Framework was established, which is topic of international discussion, but that has special relevance in this domain.

The AIV states it interprets the word “internet freedom” in terms of the House of Freedom’s categories, as included in the Freedom on the Net 2013 report (.pdf, 2013):

• Obstacles to access: assesses infrastructural and economic barriers to access; governmental efforts to block specific applications or technologies; and legal, regulatory, and ownership control over internet and mobile phone access providers.
• Limits on content: examines filtering and blocking of websites; other forms of censorship and self-censorship; manipulation of content; the diversity of online news media; and usage of digital media for social and political activism.
• Violations of user rights: measures legal protections and restrictions on activity; surveillance; privacy; and repercussions for online activity, such as prosecution, imprisonment, physical attacks, or other forms of harassment.

Related:

• 2015-02-27: Governments Covertly Fund Internet Freedom Activists (re: Hivos’ Digital Defenders Partnership (DDP), started by NL, US & UK in 2012)

EOF

UPDATE 2015-07-01: the court of The Hague has ruled today that the Dutch government must, in the next six months, change its current policy for interception of privileged communications: ruling (in Dutch) and press release (in Dutch). If the government fails to comply, it has to seize any such interception.

UPDATE 2015-06-26: the Minister of Defense sent a letter (in Dutch) to parliament to explain the relation between privileged (lawyer/client) communications and national security. Here’s a translation of the essence:

(…) First I want to point out that the position a lawyer holds in criminal law is different from the one in context of an investigation by the intelligence & security service, in the course of carrying out their legal tasks on the basis of the Dutch Intelligence & Security Act of 2002. The rules that apply to a lawyer in criminal (procedure) law as holding a privileged position, do not apply one-on-one to in the latter context. Situations can exist in which the interest of national security prevails over the interest of privileged persons (in this case, being able to talk freely with clientele). As I stated during the parliamentary question time of April 21st 2015, the intelligence services can only under strict conditions proceed to use special powers against lawyers. In addition to the safeguards that apply to every use of a special power (necessity, subsidiarity and proportionality), extra criteria apply, including a shorter period of use of the power (one month instead of the normal three months). (…)

UPDATE 2015-03-10: in response (in Dutch) to parliamentary questions following a plead (in Dutch) from the National Bar Council, the Dutch Minister of the Interior stated that he does not believe it is necessary to introduce ex ante court approval for intercepting communications of lawyers.

UPDATE 2014-12-22: NRC Handelsblad published a piece (in Dutch) by Ot van Daalen (@digidefence) in which Ot, citing the case described below, recommends lawyers to encrypt communication with clients.

Today, Dutch newspaper NRC Handelsblad reports (in Dutch) that the Dutch intelligence & security agency AIVD spied on the Amsterdam-based lawyer office Prakken d’Oliveira, that defends terror suspects, among others. Here is a translation of NRC’s report:

AIVD admits eavesdropping on law firm that defends terror suspects

The secret service AIVD admits it eavesdropped on lawyers of the Amsterdam-based law firm Prakken d’Oliveira. The office states so on its own website, revealing a letter [.pdf, in Dutch] from Minister of the Interior, Ronald Plasterk.

The firm had filed a complaints because lawyers had been suspecting for years that they are eavesdropped on by the AIVD. Prakken d’Oliveira defends many terror suspects, among others. In the written answer from the Minister, the Dutch Review Committee on the Intelligence and Security Services (CTIVD) partially confirms the complaint. The Minister states he will follow the CTIVD’s recommendation and says that the AIVD acted “inappropriately” in transcribing the phone conversations, text messages, and emails.

Wiretapped despite policy

The AIVD thereby admits that between January 1st 2003 and July 1st 2014, conversations have been eavesdropped, and text messages and emails from the lawyers where read and transcribed. The CTIVD says it has doubts about the necessity of transcribing communication of the law firm prior to 2007. In that year, the AIVD established a policy concerning wiretapping of phones, among others. But according to the CTIVD, messages have been transcribed unlawfully after that.

The eavesdropping of contact between lawyers and suspects is, in principle, prohibited by the attorney–client privilege [in Dutch: “verschoningsrecht”]. That privilege ensures free consultation between both parties, such that a proper defense can be prepared. Exceptions can only be made in case of imminent threats.

In a statement on its website, Prakken d’Oliveira states that the regulation concerning eavesdropping is “seriously inadequate”. The law firm wants the law to be changed such that wiretapping of communication means is only allowed after prior approval of a court. Currently, the AIVD can eavesdrop if the Minister consents that doing so is necessary.

EOF

UPDATE 2015-07-15: Dutch intel oversight committee (still) seeks to publish statistics on use of special powers, suggests topics for debate on the new bill.

The below is a comparison of (lawful) public availability of statistics about the use of investigatory powers by intelligence & security services in Belgium and the Netherlands; I intend to add more countries if I can find the necessary information (legislation, etc.).

Belgium: ADIV and VSSE

Belgium has a non-military intelligence & security service (VSSE) and a military intelligence and security service (ADIV). Oversight on lawfulness and expediency is carried out by the Belgian Standing Committee I (in Dutch: “Vaste Comité I”), an independent specialist body consisting of three persons, and some staff. The Standing Committee I is established by the Act Governing Review of the Police and Intelligence Services and the Coordination Unit for Treat Assessment of 1991 (hereafter: “Review Act of 1991”). The VSSE and ADIV are established by the Intelligence Services Act of 1998 (hereafter: “W.I&V”). The W.I&V provides the VSSE and ADIV with special investigatory powers. Oversight reports written by the Standing Committee I are not automatically fully published; it is possible to withhold elements from publication.

Article 35-2 of the Review Act of 1991 states that the Standing Committee I reports quantitatively on the use of such powers. My translation of the relevant part in that article:

(…) The report contains the number of warrants, the duration of use of the special methods for data collection, the number of persons [=targets] involved, and, where appropriate, the yields. The report also describes the activities of the Standing Committee I.

There is a restriction, however:

The elements contained in the report may not harm the proper functioning of the intelligence and security services or put the cooperation between Belgian and foreign intelligence and security services at risk. [note: the latter firstly concerns information shared with Belgium by foreign services.]

With that in mind, take note of the statistics in the table below that the Standing Committee I included in its 2013 activity report (.pdf, in Dutch and French): a LOT of transparency, I’d say. The fact that it is published is evidence in support of the hypothesis that this information is not considered to harm proper functioning of the Belgian services.

Bulk collection: neither ADIV nor VSSE currently (=Dec 2014) have a legal basis for any form of bulk collection; neither via intercepts, nor via requests for traffic/subscriber addressed to telco’s (source).

Netherlands: AIVD and MIVD

The Netherlands has a general intelligence & security service (AIVD) and a military intelligence and security service (MIVD). Oversight on lawfulness is carried out by the Dutch Review Committee on the Intelligence and Security Services (CTIVD), and independent specialist body consisting of three persons. Oversight on expediency resides at the Minister. All three entities are established by the Dutch Intelligence & Security Act of 2002 (hereafter: “Wiv2002”). The Wiv2002 provides the AIVD and MIVD with special investigatory powers.

CTIVD oversight reports are always sent to Parliament and openly published, but may, and often do, contain a classified appendix. The CTIVD can decide for itself what topics it wants to investigate, but also start an investigation at the request of Parliament. In 2008, the CTIVD for the first time looked into the use of interception powers: targeted interception ex Article 25 Wiv2002, and selection from bulk-interception ether communication ex Article 27 Wiv2002. In 2010, the CTIVD decided to make interception an annually recurring topic of investigation.

Several attempts have been made by Dutch media, civil organizations (notably Bits of Freedom) and MPs to obtain interception statistics from the intelligence services. In 2010, Parliament adopted a motion requesting interception statistics. Two statistics were published: the number of targeted interceptions by the AIVD (1,078) and the MIVD (53) during 2009. No statistics from other years are available. In October 2014, a court in The Hague accepted the government’s argument that such numbers, in combination with other information that is already public or will become public in the future, provide insight into the methods and practices used by the AIVD and that this poses a risk to the effective functioning of the AIVD. In December 2014, the CTIVD decided to publish these statistics — but it got censored last-minute by the Minister of the Interior. Interesting stuff.

The table below shows the known statistics for the use of special powers by the AIVD and MIVD over 2013: none. Open question: how should the difference with Belgium be explained?

Bulk collection: yes, via interception (Article 26/27), but only ether. Both AIVD and MIVD have that power, but it is used far more for military tasks (MIVD) than national security. It is carried out by the NSO, which becomes part of the JSCU.  In November 2014, the Dutch cabinet announced it seeks to expand this power to permit bulk interception of cable communication. Legislation is currently (=Dec 2014) being drafted. According CTIVD report 38 (.pdf, in Dutch; see p.39), Article 28/29 do not permit acquisition of bulk traffic/subscriber data from telco’s. Article 24 (hacking) has been used to obtain web forum data in bulk; in cases where many non-targets where involved, the CTIVD judged this did not satisfy the requirement proportionality (although those cases did satisfy the requirement of necessity).

Germany: BND, MAD, BfV and LfV

INFORMATION NEEDED: all information, tips, hints, suggestions, etc. are welcomed: see “Contact me” on the right. I’m both interested in learning whether or not statistics are officially published, and if they are, where I can find them.

UK: GCHQ, MI5, MI6, MoD (RIPA)

INFORMATION NEEDED: all information, tips, hints, suggestions, etc. are welcomed: see “Contact me” on the right.

An aggregate statistic is available of the number RIPA warrants issued to GCHQ, MI5, MI6 and the MoD, combined. Much more statistics are available; see the IOCC’s report (.pdf) over 2013.

EOF

Today, the Dutch Data Protection Authority (CBP) announced it is imposing an incremental penalty payment to Google of up to 15 million euros:

CBP issues sanction to Google for infringements privacy policy

Press release/15 December 2014

The Dutch Data Protection Authority (Dutch DPA) has imposed an incremental penalty payment on Google. This sanction may amount to 15 million euros. The reason for the sanction is that Google is acting in breach of several provisions of the Dutch data protection act with its new privacy policy, introduced in 2012.

Infringements

The results of the investigation by the Dutch DPA, as published earlier, show that Google combines personal data of internet users, amongst others to display personalised ads. This combining not only involves people that are logged in to a Google account, but also people that use the search engine, or people that visit a (third party) website that places or reads cookies from Google.

Data about for example search queries, location data, video’s watched and e-mails can be combined with each other, while those services serve very different purposes. This combining occurs without Google adequately informing the users in advance and without the company asking for consent. This is in breach of the law.

“Google catches us in an invisible web of our personal data without telling us and without asking us for our consent. This has been ongoing since 2012 and we hope our patience will no longer be tested,” says Jacob Kohnstamm, chairman of the Dutch DPA.

Incremental penalty payment

The Dutch DPA demands that Google:

• Will ask for the unambiguous consent of users for the combining of personal data from the different Google services. This can be achieved via a separate consent screen. Unambiguous consent can’t be obtained through information about this processing in the general (privacy) terms and conditions.
• Further clarifies the information in its privacy policy in order to provide clear and consistent information to people on which personal data are used by the different services of Google.
• Provides clear information about the fact the YouTube is part of Google. With regard to this last point, Google seems to have already taken measures in the Netherlands.

Google has been given until the end of February 2015 to take the measures described above to end the breaches of the Dutch data protection act. After that, the Dutch DPA will verify whether Google has met all demands.

European data protection authorities

In the beginning of 2012, Google announced the introduction on 1 March 2012 of a global new privacy policy, applicable to the users of all services of Google. Following that, the French data protection authority launched an investigation, on behalf of all European data protection authorities. This resulted in the publication of investigation results in October 2012.

After this investigation, 6 data protection authorities, in France, Germany, the UK, Italy, Spain and the Netherlands decided to start national investigations, based on their own national data protection laws.

Google has recently sent a letter to the 6 data protection authorities, in which the company announces a large number of measures to comply with European privacy laws. The Dutch DPA has not yet established whether the proposed measures will end all the violations found by the Dutch DPA.

Related:

• 2013-11-28: Dutch DPA: privacy policy Google in breach of data protection law (CBP) + report Investigation into the combining of personal data by Google (.pdf, CBP)

EOF

UPDATE 2017-07-11: updates moved to bottom.

On December 12th 2014, Dutch newspaper Volkskrant reported (in Dutch) that a majority of Dutch MPs favor the establishment of an independent “House for Whistleblowers”. There is a bill (.pdf, in Dutch), accompanied by a Memory of Understanding (MoU) (in Dutch), proposing a “House for Whistleblowers Act”.

The bill establishes a House for Whistleblowers (hereafter: the House) as a “zelfstandig bestuursorgaan” (ZBO), the Dutch version of a quasi-autonomous non-governmental organization. The House will consist of an advisory department and an investigatory department. The advisory task and investigatory task are subject to separation of duty. To make the House more independent from the government than normal ZBOs — and thereby deviating from the concept of ZBOs as defined by Dutch law —, the following rules will apply:

• the Minister cannot appoint, suspend, or dismiss members of the House;
• the Minister cannot require the House to provide information concerning the substance and methods of specific investigations;
• the Minister cannot establish policy rules concerning the House’s task performance;
• the Minister cannot dismantle the House.

Based on data from the National Ombudsman, the Whistleblowers Expert Group and the Advice Centre for Whistleblowers, it is anticipated — according to the MoU — that the House will be processing report from four to six hundred whistleblowers annually, and that 10 percent of the reports, some 50 per year, will result in an investigation. The annual budget for the House is estimated at 3.5 million euro.

The bill provides whistleblowers the protection that they cannot be fired while an investigation by the House is ongoing. The following wrongdoings concerning public interest are explicitly recognized:

• violation of a statutory provision;
• a public health risk;
• a risk to the safety of persons;
• a threat to the environment;
• a threat to the proper functioning of a public service or a business as a result of an improper way of acting or negligence.

Concerning whistleblower reports from the public sector, the bill obligates the following parts of government to fully cooperate with investigations carried out by the House:

• the state;
• provinces;
• municipalities;
• water boards;
• public bodies for industry and the professions, for instance:
  • the Social and Economic Council of the Netherlands (SER)
  • the Dutch Order of Lawyers (NOvA)
  • the Dutch Institute of Chartered Accountants (NBA)
  • the Dutch Order of the Accountants-Administrator’s consultants (NvOAA)
  • the Royal Notarial Association (KNB)
  • the Royal Association of Bailiffs (KBvG)
  • …
• other public bodies authorized under the Constitution;
• European Grouping of Territorial Cooperation (EGTC) organizations seated by statutory in the Netherlands;
• other legal persons established under public law, for instance, from the ZBO register:
  • the Authority for Consumers and Markets (ACM)
  • Staatsbosbeheer
  • National Library of the Netherlands (KB)
  • Netherlands Organisation for Scientific Research (NWO)
  • Royal Netherlands Academy of Arts and Sciences (KNAW)
  • TNO
  • …
• other legal persons not established under public law vested with public authority, with the exercise of that authority being the core activity of the legal person, for instance:
  • Authority for the Financial Markets (AFM)
  • DNB

The House is also granted full physical access to these organizations. Based on Article 9:31 of the the General Administrative Law Act (in Dutch: “Algemene bestuurswet”), officials from these bodies can be required to provide information. Officials are however allowed to refuse, if providing information is contrary to interests of national security, or constitutes a breach of official secrecy or other legal provisions.

Concerning whistleblower reports from private sector, the House can summon any individual and require them to provide information, but the House is not granted full physical access.

It is proposed that the House has a chair person and at most four members, to be appointed by Parliament, and such that “all relevant expertise” to carry out its legal tasks is present. It is proposed that the House is supported by its own agency, employed by the House.

In 2013, opponents of bill included the Dutch Association for Medium and Small Enterprises (VNO-NCW), the Dutch Association for Listed Companies (VEUO), the Dutch Minister of the Interior, the Netherlands Authority for the Financial Markets (AFM) and the DNB. The Minister and regulators expressed worries about potentially harmful interference with investigations that existing authorities are undertaking. Also, the combination of an advisory task and an investigatory task in a single organization was criticized.

Excluded from reporting a suspicion of wrongdoing to the House are magistrates (in Dutch: “rechterlijke ambtenaren”) and officials of the Dutch intelligence and security services AIVD and MIVD, as well as members of the Dutch Review Committee on the Intelligence and Security Services (CTIVD). According to the MoU, the reason for this exclusion is that those organizations have existing procedures for reporting and handling wrongdoing. These officials are however free to contact the House for Whitleblowers to obtain advice.

Lastly, here is my translation of the report by Volkskrant (hyperlinks and parts in [] are mine):

Netherlands first to establish independent House for Whistleblowers

Things usually don’t end well for someone who reports wrongdoing in government or business. A parliamentary majority wants to change that by establishing an independent House for Whistleblowers.

The Netherlands will be the first European country to have an independent House for Whistleblowers that provides legal protection for whistleblowers and investigates reports from whistleblowers.

The objective is to prevent whistleblowers from being isolated, fired, and forgotten without the wrongdoing being addressed.

That is the core of the bill that MPs from seven parties, led by Ronald van Raak (Socialist Party) sent to the Council of State this week. The House for Whistleblowers will be a quasi-autonomous non-governmental organization (in Dutch: “zelfstandig bestuursorgaan”), independent of the central government. It will have an annual budget of approximately 3.5 million euro and will be supporting four hundred to six hundred whistleblowers annually.

‘Whistleblowers are now often left to fend for themselves, while they often render a service to society’, Van Raak states. ‘They will soon be able to go to the House for Whistleblowers. They cannot be fired while an investigation into the wrongdoings they reported is ongoing. The objective is to prevent whistleblowers from being isolated, fired, and forgotten, without the wrongdoing being addressed.’

Van Raak has worked on the bill for over two years, after earlier attempts to regulate the legal position of whistleblowers failed. The reason for Parliament to address this issue was, among others, the fate of Ad Bos, the whistleblower who exposed fraud in the Dutch construction industry [.pdf, 2006]. Bos ended up living in a caravan, years after he had exposed the large-scale collusion of construction companies.

‘I am regularly contacted by whistleblowers, and as an MP I want to do something about the wrongdoings that they report’, says Van Raak. ‘This often could not be done because my sources would then be fired. That situation was very unsatisfactory.’

The bill’s authors expect that in 10 percent of the cases — about fifty times a year — employees of the House of Whistleblowers will themselves carry out research into possible wrongdoings. The House will get extensive powers for that, especially if the wrongdoing involves the government. The public authority involved, such as a Ministry or a water board, must provide the researchers full access, and fully cooperate.

The estimations of the annual numbers of whistleblowers and investigations to be carried out by the House of Whistleblowers are based on data from the National Ombudsman, the Whistleblowers Expert Group and the Advice Centre for Whistleblowers, where most whistleblowers currently turn to. The bill aims to end the fragmentation of policy concerning whistleblowers.

The House will also investigate private sector wrongdoings, but cannot simply walk in there. Investigation into reports from businesses will initially be limited to requesting information and written evidence. In case of suspicion of offenses, the Public Prosecution Service will be contacted.

The driving force behind the improved legal protection of whistleblowers is Gerrit de Wit, chairman of the Whistleblowers Expert Group Foundation. The former detective blew the whistle on fraud and corruption of officials at the Ministry of Housing at the end of the previous century, and has since been fighting for better treatment of whistleblowers.

‘Of course we wanted to have arranged things for whistleblowers even better, but it is an achievement on and by itself that this proposal is now sent to the Council of State’, De Wit says. ‘In the past fifteen years I have talked to hundreds of whistleblowers and saw the majority of them be ostracized. That will change in the near future, which is a victory’.

Own responsibility

Behind the screens, a lot of lobbying was going on up until last week to prevent that whistleblowers would get legal protection. Opponents, including employers’ organizations, fear that the House of Whistleblowers will attract troublemakers and employees threatened with losing their job. They also think companies already are responsible themselves for dealing with wrongdoings in the workplace and that more than enough supervisors and inspection agencies exist.

Professor Leo Huberts (VU University), who specializes in integrity policy, thinks the establishment of an independent organization is a good thing. But, according to Huberts: ‘What I greatly miss, is focus on prevention. Integrity mostly is about awareness, about culture. This proposal also seems unfinished, and the name is quaint. The initiative started off with the right agenda that whistleblowers who report wrongdoings and have to deal with retribution, deserve legal and financial support. The proposal looks like an ambitious building under construction, but as far as I’m concerned, eventually a real nation-wide House for Integrity will exist.’

A large parliamentary majority is in favor of introducing the House for Whistleblowers. An earlier version of the bill was adopted by the Parliament, but got rejected by the Senate.

UPDATES (from new to old)

UPDATE 2018-12-19: Former employees report wrongdoings about the House for Whistleblowers (in Dutch, NOS). One report is about (in)effectiveness of the House for Whistleblowers in general, including its administrative procedures; another report is about about the procedure of the appointment of the current chair, Wilbert Tomesen, who previously was chair of the Dutch Data Protection Authority (in Dutch: “Autoriteit Persoonsgegevens”). The NOS report contains no further details.

UPDATE 2018-03-06: Best Practice Guide voor wetgeving ter bescherming van klokkenluiders (in Dutch, by Transparency Netherlands)

UPDATE 2017-12-20: Nieuwe Eurobarometer onderstreept slechte staat van klokkenluidersbescherming (in Dutch; post by Transparency Netherlands regarding the new Eurobarometer special report on corruption that covers public and corporate activity)

UPDATE 2017-12-14: Herstart Huis voor Klokkenluiders (in Dutch; post by the House for Whistleblowers reporting that the house will be rebooted). Also today, a report on this by Transparency Netherlands: Huis voor Klokkenluiders staat op instorten na kritisch rapport (in Dutch).

UPDATE 2017-10-31: The European Parliament calls for protection of whistleblowers (EDRi).

UPDATE 2017-10-20: Crisis in Huis voor Klokkenluiders (Merijn Rengers, NRC Handelsblad; in Dutch). The director of the House for Whistleblowers, Paul Loven, resigns over inability of the House for Whistleblowers to complete a single investigation in its first sixteen months of existence. Some 30 out of 800 reports received from (possible) whistleblowers were considered worthy of investigation. While the House was established after extensive debates in Dutch parliament and has its own legal basis, a spokesperson states that practice is more complex than expected. Loven requested former top official Maarten Ruys to conduct an investigation into this; it is not yet clear who will be Loven’s successor. The situation reminds a bit of what was observed in the U.S. in Feb 2015 regarding the Occupational Health and Safety Administration (OSHA: OSHA Whistleblower Investigator Blows Whistle on Own Agency.

UPDATE 2017-07-11: Wet Huis voor Klokkenluiders: een update (Linda Schut, Transparency Netherlands; in Dutch).

UPDATE 2017-03-13: NOS reports that since the House for Whistleblowers was opened in July 2016, 530 persons have made reports to it. 70 of them were established to be actual whistleblowers, the remainder reported was is qualified as ‘differences of opinion at work’. Half of the reports were made by persons employed in the private sector, one third of the reports were from persons employed in the public sector. The House for Whistleblowers published its annual report 2016 (.pdf; mirror) and a press statement.

UPDATE 2016-07-04: today, the House for Whisteblowers is officially opened (reports by NRC Handelsblad, in Dutch), and located in the city of Utrecht. Its first director is Paul Loven. It is stated that the House for Whistleblowers, which is established through Dutch national law, is the first of its kind in the world. Organizations that have 50+ employees are, as of now, expected to have (or establish) internal procedures for reporting perceived wrongdoings (and yes, that will come as a surprise to many organizations; for instance, 10% of Dutch municipalities, all of which have 50+ employees, currently have no such procedures). The House for Whistleblowers acts as a safe place to obtain advice and as a means of last resort for carrying out investigations in case internal reporting fails — or in case suspicions are that upper management (C-level) and/or shareholders are involved in fraud. Questions remain: as stated elsewhere in this blogpost, the House for Whistleblowers has both an advisory department and an investigatory department, which are ‘strictly separated’, but what nonetheless means that the ‘lawyer’ and ‘judge’ functions are exercised by people who are part of the same physical organization. Time will tell how this works out in practice. (Note: please do read the remainder of this post for more details; the House for Whistleblowers is deals (only) with reports that affect a public interest, as explained elsewhere in this post. The legal details of whistleblowing are complicated; for more information, refer to e.g. the ‘klokkenluiders’ category at the Dutch website ‘Bijzonder Strafrecht’ and the legal expert book ‘Klokkenluiders in perspectief’ (Q4/2015).)

UPDATE 2016-03-01: today, the Senate adopted (unanimously) the bill (.pdf). Furthermore, the Senate adopted (non-unanimously) a motion (.pdf) intended to also provide protection, against being disadvantaged as result of reporting wrongdoing, to non-employees who report alleged wrongdoing from a work situation, such as interns, volunteers and self-employed persons, who have no labor contract with the organization about which they submit a report to the House of Whistleblowers.

UPDATE 2016-12-xx: Transparency Netherlands published a position paper (.pdf, in Dutch) on the House for Whistleblowers.

UPDATE 2016-02-12: update (in Dutch) on the legislative proposal House for Whistleblowers.

UPDATE 2016-01-11: Dutch piece by Michael van Woerden (KeyCompliance) on the upcoming Senate debate on the legislative proposal (9 & 16 Feb 2016): “Voor klokkenluiders wordt 2016 het jaar van de waarheid”

UPDATE 2015-07-06: in-depth article by Rik van Steenbergen (Netherlands Trade Union Confederation, FNV): Whistleblowing Protection in the Netherlands: Latest Developments.

UPDATE 2015-07-01: overview article by M. Verveld-Suijkerbuijk (lawyer at NautaDutilh), in Dutch: “Het wetsvoorstel Huis voor klokkenluiders: Een praktijkgerichte bespreking” (.pdf, 2015)

UPDATE 2015-04-09: new documents available (in Dutch): the advice from the Council of State (.docx), an updated legislative proposal (.docx) that incorporates that advice, and an updated Memorandum of Understanding (.docx).

UPDATE 2015-03-18: meanwhile, at the EU level: CoE Parliamentary Assembly: Call for protection of whistleblowers in national security-related fields ; i.e., the PACE Committee on Legal Affairs & Human Rights adopted the draft report “Improving the Protection of Whistleblowers” (.pdf, Mar 18; mirror). The draft report will be discussed at the PACE summer session in Strasbourg on 22-26 June 2015. (source: Statewatch) Huffington Post has an article about it (Mar 20).

UPDATE 2015-03-02: indeed, a house for whistleblowers might itself need whistleblowing — see this U.S. example: OSHA Whistleblower Investigator Blows Whistle on Own Agency

EOF