In het CBP-advies (.pdf; meer) inzake de retentie van telecommunicatiegegevens dd 16 februari 2015 argumenteert het CBP over openbaarmaking door private partijen van anonieme en geaggregeerde statistieken over aantallen intercepties en bevragingen van verkeers- en gebruikersgegevens:

Het CBP heeft kennis genomen van initiatieven van marktpartijen om anonieme en geaggregeerde statistieken openbaar te maken over aantallen intercepties en bevragingen van verkeers- en gebruikersgegevens. Hun doel is maatschappelijke transparantie te verschaffen over het gebruik van deze ingrijpende bevoegdheden door de overheid. De Minister van Veiligheid en Justitie heeft de telecom- en internetaanbieders, in beantwoording van Kamervragen hierover, ernstig ontraden om dergelijke statistieken openbaar te maken. De minister verwijst daarbij naar een eerdere uitspraak van de staatssecretaris “dat de verstrekking van geaggregeerde informatie de belangen van opsporing en vervolging ernstig in de weg kan staan. Een dergelijke verstrekking kan namelijk inzicht geven in de werkwijzen van de politie en het openbaar ministerie en kwaadwillenden zouden op basis hiervan hun werkwijze kunnen aanpassen.”

De minister neemt in het jaaroverzicht van het ministerie van Veiligheid en Justitie een overzicht op van het totale aantal vorderingen ‘historische gegevens’ door het OM. Dit jaarlijkse totaalaantal biedt echter geen inzage in de bevragingen door inlichtingen- en veiligheidsdiensten, en is bovendien moeilijk te interpreteren, omdat niet gespecificeerd is om hoeveel personen het gaat, over welke termijnen het gaat, en om wat voor soorten criminaliteit. WODC schrijft hierover: (…) het opvragen van telecomgegevens in Nederland wordt geregistreerd per telefoonnummer, IMEI- nummer, IP-adres of ‘paallocatie’, waarover gegevens worden opgevraagd. Omdat mensen vaak meerdere telefoons gebruiken, geven deze cijfers geen inzicht in het aantal personen van wie er jaarlijks telecomgegevens worden opgevraagd of van het aantal opsporingsonderzoeken of de aard van de opsporingsonderzoeken waarvoor deze gegevens worden opgevraagd.” Ook bij het vorderen van mastgegevens gaat het om meer betrokken personen, omdat dan informatie wordt verkregen over alle mobiele gesprekken die op een bepaald tijdstip via een bepaalde mast zijn gevoerd. Bovendien betreffen de statistieken ook vorderingen van gegevens die niet onder de Wet bewaarplicht vallen.

De stelling dat personen hun werkwijze zouden kunnen aanpassen op grond van anonieme, geaggregeerde statistieken, is niet onderbouwd. De regering gaat zonder toelichting voorbij aan het advies van het WODC om meer inzicht te bieden “door de vorderingen zodanig te registreren dat zichtbaar wordt over hoeveel personen er jaarlijks telecommunicatieverkeersgegevens worden opgevraagd, in hoeveel zaken dit gebeurt en voor welke soort zaken deze gegevens worden opgevraagd.” Het ontbreken van transparantie op dit punt staat democratische controle op de (effectiviteit van de) uitoefening van bevoegdheden in de weg, en biedt ook geen inzicht aan burgers over de inzet van dit instrument.

EOF

UPDATE 2015-10-30: the Dutch government announced it has decided on a bill that revises the invalidated Telecommunications Data Retention Act of 2009. Changes are proposes to take into account recent Dutch and European jurisprudence: access to retained data will now require prior approval from a magistrate (specifically, in Dutch, a “rechter-commissaris”), and only be permitted regarding offenses that allow temporary remand (and thus only regarding offenses that carry a maximum penalty of four or more years imprisonment). The status of the bill can be viewed here (in Dutch). The government will consult the Council of State and then submit the bill to parliament.

On February 16th 2015, the Dutch Data Protection Authority (DPA) published its advice (.pdf, in Dutch; mirror) about a bill that the Dutch government announced in November 2014 to change the Dutch Telecommunications Data Retention Act of 2009 to take into account the ECJ’s April 2014 invalidation of the EU Data Retention Directive (2006/24/EC). More about the announced Dutch bill here. In short: the DPA finds the proposal of the Dutch government to (still) violate necessity, proportionality and subsidiarity. The DPA published the following press release:

The Dutch Data Protection Authority (Dutch DPA) at the request of the minister of Security and Justice has issued its advice on a draft bill containing amendments to the existing data retention obligations for telephony and internet communications data. The Dutch DPA finds the need to retain all telephony and internet data in the Netherlands is insufficiently substantiated. The Dutch DPA therefore recommends that the bill shall not be presented to Parliament.

The draft bill is proposed following a decision from the Court of Justice of the European Union in April 2014, annulling the European data retention directive. The Court ruled that a general retention obligation for telecommunications data is in contradiction with the fundamental right to data protection as laid down in European law.

Content of the draft bill

The draft bill proposes amendments on several points, including:

• the introduction of a prior check by an examining judge of requisitions by public prosecutors to obtain historical telecommunications data;
• the introduction of a distinction between a retention period of twelve months for telephony data and the consultation period of these data of between six and twelve months, depending on the nature of the crime.

Necessity

The retention of the historical telephony and internet data of virtually all Dutch citizens for 6 to 12 months is a far-reaching measure, requiring an irrefutable demonstration of necessity.

The Dutch DPA notes that the substantiation of this necessity in the draft bill falls short, even though law enforcement authorities have been able to gain experience with using retained telecommunications data in the 4,5 years since the entry into force of the Data Retention Law.

Moreover, the draft bill does not address the question whether less far-reaching alternative measures would be available to obtain the same result.

Disproportionate infringement of private life

The Dutch DPA notes the government holds on to a general data retention obligation. The Dutch DPA therefore concludes the infringement of the private life of virtually all Dutch citizens is too big and disproportionate.

It furthermore finds that 3 other preconditions have not been met that remain important, even if the data retention obligation were to be restricted. These are:

1. the need to inform people that their data have been accessed after a criminal investigation has been finalised;
2. transparency on the use of retained data, for example through the release of statistics on the number of times data have been accessed;
3. the need to introduce exemptions for those bound by a duty of professional confidentiality.

Distinction between collection and use

Finally, the Dutch DPA has assessed the distinction between the retention of data and the subsequent use of these data, as envisaged by the government. This distinction does not alter the disproportionality between the purpose of the data collection and the infringement on the private life of virtually all citizens. Therefore, this general data retention obligation is unlawful.

Notably, in November 2014, the Dutch government provided the following argument to justify upholding the existing indiscriminate data retention:

If the data about these persons [i.e., persons without known links to serious offenses] cannot be retained before the offense is committed, such a search query would not be useful. The retaining of certain data about all citizens is thus necessary, as it is not possible to distinguish suspects and non-suspects in advance.

Considering the large privacy infringement and insufficient safeguards, the DPA rejects this argument. The DPA wraps up its advice as follows:

In conclusion, the DPA finds that the proposed changes of the Telecommunications Data Retention Act of 2009 do not meet the requirements of necessity, proportionality and subsidiarity, and that the bill remains in violation of three specific aspects of proportionality, as laid down in Articles 7 and 8 of the Charter and in Article 8 of the ECHR.

We’ll now have to wait and see the Dutch government’s response to this advice.

Lastly, the DPA wrote the following about openly publishing annual statistics about interception and about requests for traffic data and user data (emphasis is mine):

The DPA has taken notice of initiatives from private parties to publish anonymous and aggregated statistics about interceptions and requests for traffic data and user data. Their objective is to provide transparency about the government use of these invasive powers. The Minister of Security & Justice in has seriously discouraged telecom and internet providers to publish such statistics. The Minister references an earlier statement made by the Secretary of State made, namely “that the provisioning of aggregated information can seriously harm the interest of prosecution. Such information can provide insight into the methods of police and the public prosecution service, and adversaries could change their behavior based on that.

In the annual report of the Ministry of Security & Justice, the Minister includes an overview of the total number of requests for ‘historical data’ by the public prosecution service. This annual total does however not provide insight into requests by intelligence & security services, and moreover, is difficult to interpret, because the number of persons is not specified, nor what periods, nor what types of crime. The Scientific Council for Government Policy (WODC) states: “(…) in the Netherlands requests for telecom data are counted by phone number, IMEI number, IP address or cell tower location that data is requested about. Because people use multiple phones, these numbers do not provide insight into the annual number of persons about whom telecom data is requested, or of the number of criminal investigations, or the nature of these investigations”. In requesting cell tower data requests, more persons are involved, because information is obtained about all mobile conversations that took place on a certain time via a specific tower. Moreover, the statistics also include requests for data that are not part of the Dutch Telecommunications Data Retention Act.

The proposition that persons could change their behavior on the basis of anonymous, aggregated statistics, is not substantiated. The government ignores, without explanation, the WODC’s advice to provide more insight “by counting the requests in a way such that it becomes visible about how many persons telecommunications traffic data is requested annually, in how many investigations, and what type of investigations.” The lack of transparency about this aspect hinders democratic oversight on the (effectiveness of the) use of powers, and also does not provide insight to citizens into the use of this instrument.

Related:

• 2015-02-16: Dutch DPA says government’s data retention plans still illegal (el Reg)
• 2014-11-26: Dutch govt response to ECJ’s April 2014 ruling on the EU Data Retention Directive (this blog)
• 2014-07-17: Evaluation report on the Dutch implementation of the EU Data Retention Directive (this blog)
• 2007-07-01: Dutch DPA advises negatively on Dutch draft data retention (this concerns the draft of the current law; EDRi)

EOF

Cryptome tweeted a link to the US Director of National Intelligence’s updated poster (.pdf, Jan 12; mirror) entitled “Principles of Intelligence Transparency for the Intelligence Community”. The poster contains the following text (I added emphasis to parts I find interesting):

The Principles of Intelligence for the Intelligence Community (IC) are intended to facilitate IC decisions on making information publicly available in a manner that enhances public understanding of intelligence activities, while continuing to protect information when disclosure would harm national security. These Principles do not modify or supersede applicable laws, executive orders, and directives, including Executive Order 13526, Classified National Security Information. Instead, they articulate the general norms that elements of the IC should follow in implementing those authorities and requirements

The Intelligence Community will:

1. Provide appropriate transparency to enhance public understanding about:
   1. the IC’s mission and what the IC does to accomplish it (including its structure and effectiveness)
   2. the laws, directives, authorities, and policies that govern the IC’s activities; and
   3. the compliance and oversight framework that ensures intelligence activities are conducted in accordance with applicable rules.
2. Be proactive and clear in making information publicly available through authorized channels, including taking affirmative steps to:
   1. provide timely transparency on matters of public interest;
   2. prepare information with sufficient clarity and context, so that it is readily understandable;
   3. make information accessible to the public through a range of communications channels, such as those enabled by new technology;
   4. engage with stakeholders to better explain information and to understand diverse perspectives; and
   5. in appropriate circumstances, describe why information cannot be made public.
3. In protecting information about intelligence sources, methods, and activities from unauthorized disclosure, ensure that IC professionals consistently and diligently execute their responsibilities to:
   1. classify only that information which, if disclosed without authorization, could be expected to cause identifiable or describable damage to national security;
   2. never classify information to conceal violations of law, inefficiencies, or administrative error, or to prevent embarrassment;
   3. distinguish, through portion marking and similar means, classified and unclassified information; and
   4. consider the public interest to the maximum extent possible when making classification determinations, while continuing to protect information as necessary to maintain intelligence effectiveness, protect the safety of those who work for or with the IC, or otherwise protect national security.
4. Align IC roles, resources, processes and policies to support robust implementation of these principles, consistent with applicable laws, executive orders, and directives.

As a courtesy reminder (source):

The National Intelligence Strategy identifies and explains the IC’s objectives – what the IC intends to accomplish (mission objectives) and how the IC will accomplish them (enterprise objectives).

The seven “mission objectives” are:

1. strategic intelligence;
2. anticipatory intelligence;
3. current operations;
4. cyber intelligence;
5. counterterrorism;
6. counterproliferation; and
7. counterintelligence.

The six “enterprise objectives” are:

1. integrated mission management;
2. integrated enterprise management;
3. information sharing and safeguarding;
4. innovation;
5. our people; and
6. our partners.

For the first time, The National Intelligence Strategy includes the seven “Principles of Professional Ethics for the Intelligence Community,” which were published in September 2012:

(now citing from source)

1. Mission
   We serve the American people, and understand that our mission requires selfless dedication to the security of our Nation.
2. Truth
   We seek the truth; speak truth to power; and obtain, analyze, and provide intelligence objectively.
3. Lawfulness
   We support and defend the Constitution, and comply with the laws of the United States, ensuring that we carry out our mission in a manner that respects privacy, civil liberties, and human rights obligations.
4. Integrity
   We demonstrate integrity in our conduct, mindful that all our actions, whether public or not, should reflect positively on the Intelligence Community at large.
5. Stewardship
   We are responsible stewards of the public trust; we use intelligence authorities and resources prudently, protect intelligence sources and methods diligently, report wrongdoing through appropriate channels; and remain accountable to ourselves, our oversight institutions, and through those institutions, ultimately to the American people.
6. Excellence
   We seek to improve our performance and our craft continuously, share information responsibly, collaborate with our colleagues, and demonstrate innovation and agility when meeting new challenges.
7. Diversity: We embrace the diversity of our Nation, promote diversity and inclusion in our work force, and encourage diversity in our thinking.

Related:

• 2014-02-06: DCAF: Overseeing Intelligence Services: A Toolkit (2012)

EOF

The current Dutch Intelligence & Security Act of 2002 (Wiv2002) only permits bulk interception of ether communications (e.g. satellite and radio), but not of cable communications (e.g. fiber, copper). The Wiv2002 codified the interception practice as it had existed for decades, which did not include bulk interception of cable communications. In August 2014, the Dutch government sent a letter to parliament that describes the development of the bill that will change the law (more). Yesterday, February 10th 2015, the Dutch parliament discussed these plans. A summary of highlights was published (in Dutch) on news site Tweakers by Joost Schellevis. Here is a translation of his article (hyperlinks and parts in [] are mine):

Plasterk: AIVD will not intercept everyone

By Joost Schellevis

The secret service will not wiretap everyone if the powers of the secret services will be expanded. That was promised by Minister of the Interior, Ronald Plasterk, in the House. “I rule out that AMS-IX will be tapped entirely”, stated to Plasterk.

Tuesday evening, the House debated on the expansion of powers of the AIVD and MIVD. The cabinet wants to permit the services to carry out untargeted [e.g. in mass]; they are now only permitted to wiretap specific internet connections, but cannot collect large amounts of data seeking for patterns.

This does not mean that everyone will be eavesdropped on without a reason, Plasterk states. “I rule out that AMS-IX will be tapped in its entirety”, he states, referencing the largest internet exchange of the Netherlands, and one of the largest exchanges in the word. The Minister, who is responsible for the AIVD, does not exclude that the AMS-IX will be wiretapped. According to Plasterk, untargeted wiretaps can only be used for a “limited goal”. Eavesdropping of all Dutch citizens does not qualify for that, he says. “I cannot imagine a limited goal for which that is acceptable”, according to the Minister. MP Jeroen Recourt (PvdA) questioned how that promise will be laid down in law.

“Concerning the impression that the Netherlands is mass-wiretapped: that’s not true”, states his colleague, Minister of Defense Jeanine Hennis-Plasschaert, who is responsible for the MIVD. Without the new powers, the MIVD would be “deaf and blind”, according to the Minister. Where the AIVD focuses on threats within the Netherlands, the MIVD deals with threats abroad, such as areas where Dutch military personnel operate.

Plasterk gave an example of the use of the new powers: the services will be able to gather who calls certain numbers in Syria. “Then we can map those networks”, according to Plasterk. This only involves metadata, i.e., who calls who; not the contents of the communication. Next, certain phone numbers can be intercepted. Although Plasterk mentioned phone numbers, he later added that this could also involve internet traffic.

Coalition partners VVD and PvdA, who have a joint majority in the House, earlier already stated they will support the plans. According the MP Jeroen Recourt (PvdA) the cabinet has found a good balance between privacy and security. “Privacy must be guaranteed, but the secret services must also be able to do their work”, according to Recourt prior to the debate. Recourt finds the word “untargeted wiretapping” misleading. “It suggests that a large dragnet will be used, but that is not the case.”

MP Klaas Dijkhoff (VVD) agrees, he says to Tweakers. “The image that ‘untargeted’ suggests is a US-like system in which we intercept the entire internet, and search it for something interesting afterwards”, according to Dijkhoff. He notes that the power cannot be used without a reason, and that the Minister must approve it.

Nonetheless, resistance emerged in the rest of the House. “I want the cabinet to first prove why this is necessary”, according to MP Gerard Schouw (D66) prior to the debate. “Furthermore, oversight must be improved. Otherwise, no expansion of powers should take place, in our opinion. The effectiveness must also be justified in a better way.” Schouw also plead for a privacy impact assessment [more] of the proposal legislation.

The Socialist Party (SP) was even more critical; MP Ronald van Raak asked why the cabinet thinks this power is necessary at this time. The Christian Union thinks the premise of the law to be “good”, but made several remarks. “Why is no judge involved in placing a tap?”, asked MP Gert Jan Segers.

The PVV and SGP were more positive about the legislation. “The law must be modernized”, stated MP Roelof Bisschop (SGP). MP Martin Bosma (PVV) was more sure: “If you sit behind your desk at the editors of Charlie Hebdo and don’t come home, that is an infringement on privacy too”, stated Bosma, referencing the attacks in Paris.

GroenLinks was not present during the debate, but earlier stated to be critical of the plan. “This plan is very awkward”, stated MP Liesbeth van Tongeren. According to GroenLinks, it has not been proven that data collection leads to more arrests. The Party for Animals (PvdD) was also absent.

The bill will appear in April, or so promised Minister Plasterk during the debate. The cabinet will attempt to carry out an internet consultation, in which interested parties can provide their feedback to the bill. Plasterk could however not guarantee it. The cabinet hopes that the bill will be implemented next year.

Whether the law will indeed become reality, is difficult to predict. The Senate currently opposes it: in a motion filed by Senator Hans Franken (CDA), the Senate asked the cabinet to renounce ‘untargeted and large-scale surveillance of cable communications’. The motion was co-signed by Senators of the Socialist Party, PvdA, D66 and GroenLinks. Next month, however, provincial elections are held, as a result of which the composition of the Senate changes. 

On February 6th, prior to the debate, Bastiaan Goslings, Governance and Policy Officer at AMS-IX, expressed (in Dutch) concern that expansion of powers will harm the digital economy:

The necessary trust that foreign parties must have to do business here, will disappear as a result of these plans. The Netherlands will lose its key role in the global internet. (…) Lots of safeguards are emphasized in rhetoric language, but I am seriously concerned about the extent of this law. (…) It fundamentally deteriorates our integrity.

During the debate, the Dutch Minister of Defense mentioned the following justifications for the new law, in terms of consequences of not having that law:

• cyber threats cannot be identified timely;
• Dutch military personnel abroad is probably less protected and supported (the Minister added that cable networks are increasingly used in mission areas and conflict zones);
• terrorist activities may not be identified timely;
• the true intentions of risk countries who may be seeking WMDs will remain hidden (the Minister added, with strong seriousness in voice and facial expression, that we lost insight into activities of countries possibly seeking WMDs, because those countries changed to cable communications);
• we are not able to quickly build an information position in upcoming crises abroad;
• theft of intellectual property, vital economical information, and state secrets goes unnoticed.

Two days after the debate, Prime Minister Mark Rutte stated (in Dutch) that freedom and democracy are at stake with jihad.

Privacy First, a Dutch privacy advocacy organization, announced (in Dutch) that they will go to court if the bulk interception law will be adopted.

Reflecting on the debate, kudos for useful questions and tenacity go to opposition MPs:

• Gerard Schouw (D66) for questions about proportionality, effectiveness, insisting on a privacy impact assessment for this law, asking for transparency (e.g. interception statistics such as published in Belgium (more) and Germany, but not in the Netherlands) and for referencing previous findings by the oversight committee CTIVD of unlawfulness and carelessness in the use of existing powers;
• Ronald van Raak (SP), for his persistence in questioning whether the law won’t simply be bypassed by the bulk interception that is already being carried out by foreign states.

And to a lesser extent, kudos for questions asked by two MPs of the two political parties representing the government:

• Jeroen Recourt (PvdA) for asking how the Minister plans to lay down in law his promise concerning proportionality, e.g., that not all citizens will be wiretapped;
• Anouchka van Miltenburg (VVD) for questioning the contradiction of requiring “untargeted interception” to be “goal-bound”, and asking whether raw bulk intercepts (i.e., from the acquisition phase, the first phase in the new interception framework; successive phases will be subject to heavier safeguards and oversight) can be exchanged with foreign states.

In April 2015, the Global Conference on CyberSpace (GCCS) 2015 takes place in the Netherlands. We’ll see whether the new interception bill will be available by then, whether the government will have submitted to the House its pending proposal to grant hacking powers to the police, and, hopefully, to what extent the Dutch government follows the recommendations on internet freedom made in December 2014 by the Advisory Council on International Affairs (AIV). Furthermore, the Minister of Foreign Affairs, Bert Koenders stated in a speech that the Dutch government will launch a “new, large initiative” to improve cyber security and prevent cyber crime:

We will launch a large new initiative for capacity building in cyber, open to states and private companies in order to assist countries to create sufficient capacity to improve cyber security and prevent cyber crime.

The latter will be likely be announced at GCCS 2015. [UPDATE: …and it indeed was (April 2015): the Global Forum on Cyber Expertise.]

EOF

UPDATE 2015-02-11: Highlights of Dutch parliamentary debate about upcoming bulk interception bill

Op dinsdag 10 februari 16:30-19:30 vindt een Algemeen Overleg over IVD-aangelegenheden plaats met Hennis en Plasterk. De agendapunten beloven een interessante discussie:

1. Convenant Joint Sigint Cyber Unit (JSCU);
2. Toezichtsrapport CTIVD inzake onderzoek door de AIVD op sociale media (rapport nr. 39);
3. Afschrift van een brief aan de Algemene Rekenkamer over de gewijzigde motie van de leden Schouw en Van Toorenburg (t.v.v. Kamerstuk 30977, nr. 99) over de effecten van de bezuinigingsvoorstellen op het werk van de AIVD (Kamerstuk 30 977, nr. 105);
4. Aanbieding van het toezichtsrapport van de Commissie van Toezicht betreffende de Inlichtingen- en Veiligheidsdiensten (CTIVD/Commissie) inzake de inzet van de afluisterbevoegdheid en van de bevoegdheid tot de selectie van sigint door de AIVD (nr.40);
5. Kabinetsstandpunt over het advies van de Commissie evaluatie Wiv 2002 (commissie Dessens) inzake bijzondere bevoegdheden in de digitale wereld;
6. Reactie op het verzoek van het lid Van Raak over geheime malware;
7. Afschrift van een gelijkluidende brief aan de voorzitter van de Eerste Kamer betreffende een motie van het Eerste Kamerlid De Vries c.s. over kwetsbaarheden op internet;
8. Reactie op het verzoek van het lid Van Tongeren, gedaan tijdens de regeling van werkzaamheden d.d. 18 december 2014, inzake het bericht dat een advocatenkantoor door de AIVD is afgeluisterd;
9. Aanbieding CTIVD toezichtsrapport nummer 41 inzake het onderzoek naar de activiteiten van de BVD jegens de heer R.H.G. van Duijn;
10. Reactie op de interviews van de heer Snowden in Nieuwsuur en De Volkskrant.

Live video en live audio is beschikbaar.

Ook relevant, maar geen agendapunt voor het AO van 10 februari, is het overleg van de Europese ministers van Justitie & Binnenlandse Zaken over terrorisme tijdens een informele meeting op 29/30 januari, in Riga. In het Nederlandse verslag (.docx, Feb 9) van die vergadering zien we het volgende:

De EU Contraterrorisme-Coördinator (CTC), de heer De Kerchove, gaf aan dat de Verklaring van Parijs een goed startpunt is. Hij hoopt dat de Commissie de daar genoemde onderwerpen opneemt in de nieuwe Interne Veiligheidsstrategie. De CTC gaf aan dat internet een belangrijke rol speelt. Er moet nadrukkelijk aandacht komen voor encryptie op het internet, encryptie maakt het namelijk moeilijk illegale inhoud te onderscheppen.

(…)

(…) Belangrijke aanvullende maatregelen zijn o.a. het tot stand brengen van de publiek-private samenwerking met internetproviders met het oog op het detecteren en verwijderen van illegale inhoud. Van belang hierbij is het opstellen van een tegenboodschap en het kunnen lezen van berichten die worden geplaatst (encryptie).

Publiek-private samenwerking met internetproviders met het oog op detecteren en verwijderen van illegale inhoud is één van de 13 best practices die voortvloeien uit het Clean IT-project (2011-2013), dat was gericht op het terugbrengen van “terrorist use of the internet”. Dat beleid is al geruime tijd in ontwikkeling, en betreft een vorm van quasi-vrijwillige censuur zonder rechterlijk toezicht. Ten aanzien van encryptie per se heeft Nederland nog geen beleid of standpunt. De IVD’en mogen reeds hacken en versleuteling ongedaan maken, en het kabinet heeft gezegd het parlement begin 2015 te vragen om goedkeuring voor een hackbevoegdheid voor politie, maar het is de vraag of men verwacht met die middelen alle gegevens te kunnen ontsleutelen die men wil ontsleutelen. Alternatieve (maar extreme) middelen zouden — in theorie — kunnen zijn het verplicht afstaan van sleutels door internetbedrijven en/of het verbieden van cryptografie die de overheid niet kan omzeilen/kraken. Idealiter kunnen veiligheidsbelangen voldoende worden beschermd door bestaande bevoegdheden beter of anders in te zetten (wie het antwoord heeft, mag het zeggen).

EOF

For a book from 1996 that is not about computers, Running a Ring of Spies by Jefferson Mack has some relatively good OPSEC advice concerning the use of computers (pages 163-164):

The techniques of using computers as spy tools and protecting the integrity of the files are far beyond the scope of this book. Any intelligence agent intending to use a computer as part of an intelligence-collection operation should go through the following checklist:

• Don’t save or store any documents you want to keep secret on the hard disk or a floppy disk with no encryption. Always work on plain text documents in RAM memory and encrypt before storing the information on disks.
• Always use a total erase program when deleting any sensitive file from a hard or floppy disk that you or your spy controls.
• Keep all sensitive information in encrypted format on floppy disks rather than the hard disk drive and have a hiding place for such disks that is located as far from the computer as is practical. Take the disks out of hiding only when working on them and return them to their hiding place immediately when you’re finished.
• Most encryption systems sold on the market can be easily broken, including many that advertise they can’t be broken. Many of the encryption systems bundled with word processor software are not secure. Know what makes an encryption program trustworthy.
• Even if you are sure you have the best encryption program available, double-encrypt everything, using two different systems.
• If you are sending messages by modem, always use an encryption system based on the RSA analog and a public key code. Among the best of these programs is Pretty Good Privacy, which can be found on many computer bulletin boards for free.
• Change passwords frequently. The great advantage of the RSA encryption system is that the public key passwords can be changed daily and given out in an open message.
• Be aware that it is possible to read a computer screen from a distance of up to several hundred feet with equipment that can be put together in a garage. Always take steps to ensure your computer is isolated and electromagnetic emissions are minimized.

If you don’t understand what I’m talking about in any of the above points don’t put your trust in computers until you do. If you do understand what I am talking about, you will not only be able to use computers with some degree of confidence, but you will be able to quickly and easily steal computer data of the computers of most people using them.

Secure wiping, plain text in RAM, trusting software, public key cryptography, changing passwords often, TEMPEST: key aspects even 19 years after the book was published.

Further reading:

• The OPSEC Process (1996, from U.S. DoD Joint Publication 3-54; explains the general OPSEC process. The suggestions made by Mack are measures that could be taken on the basis of this process, in Action 5. The DoD OPSEC process, too, is still relevant in 2015, but obviously the threats, vulnerabilities and measures have changed with technology.)

EOF

UPDATE 2017-08-17: another incident occurred today at the NPO headquarters in Hilversum. A man took a hostage and was arrested after a peaceful resolve of the hostage situation. It is said to concern a confused man, speaking poor Dutch, and reportedly told police he wanted to speak to a (any?) CNN reporter. (CNN has no physical presence in Hilversum.)

UPDATE 2015-06-19: the Dutch Public Prosecution Service demands 4yr prison sentence for hostage taker at Netherlands Broadcasting Authority (=NOS).

UPDATE 2015-01-29 23:56 UTC+1: turns out the attacker used a fake weapon. Suspect not known to police.

UPDATE 2015-01-29  23:14 UTC+1: BBC story: Gunman arrested at Dutch news broadcaster NOS.

UPDATE 2015-01-29 22:30 UTC+1: it is suggested the attacker is 19-year old Tarik Z. from the town of Pijnacker; freshmen student of chemistry at TU Delft; not listed among known jihadists; NOS anchor is quoted as saying: “confused loner, student who lost parents [EDIT: last week], not a terror-motive”.

UPDATE 2015-01-29 22:05 UTC+1: Attacker seems to suggest affiliation with a hacker collective, claims they were hired by intelligence services. Claims they have seen things that they want to bring to light. It is unclear whether there’s any truth to his claims. The building is now cleared.

A little before 20:00 UTC+1, at which the eight o’clock national TV news starts broadcasting, an armed gunman [EDIT: allegedly Tarik Z. from the Dutch town Pijnacker] entered the building of Dutch broadcasting organization NOS, located at the Media Park in Hilversum, and demanded air time. He has been arrested, and nobody got hurt. Nothing was broadcasted live, but the arrest was recorded by rolling cameras. A photo appeared on Twitter showing a letter the man handed to NOS reporter Martijn Bink. Here is a translation of that text (the second paragraph seems to be text that the gunman wanted the presenter to tell live on television):

When you read this, do not panic. Do not scream and do not warn your colleagues. Act as if nothing is happening. I am heavily armed. If you cooperate, nothing will happen to you. Be aware that I am not acting alone. There are five other and 98 hackers who are ready to carry out a cyber attack. Moreover, eight heavy explosives have been placed in this country that contain radioactive material. If you do not bring me to studio 8 to take over the live broadcast, we are necessitated to act. You do not want to be responsible for that, right? So bring me to studio 8 now, the NOS studio.

We have been taken hostage by heavily armed men [added in handwriting: in studio 8, Media Park Hilversum]. More of them are present in the rest of the country and they have 98 hackers ready to carry out a cyber attack. Also, eight heavy explosives have been placed throughout the country, that contain radioactive material. They want to carry out a live broadcast to tell their story. From the outside it is monitored whether the broadcast can be viewed throughout the Netherlands. Their demands are therefore, among others, 1. This building will not be assaulted. 2. The live broadcast will not be delayed, not interrupted for one second, and not edited. 3. To be clear, no information and no subtitles will be added to the live broadcast. If these demands are met, we will be released. I will repeat this. [repeat]

It is currently [Jan 29th 22:49 CET] unclear to what extent the statements are true or false, and even whether the gun was real or not.

A video fragment is available of the attack, and the gunman, after reportedly having self-identified as belonging to a hacker collective, is saying:

[…inaudible…] will be said, that are very great world affairs. We were, say, hired by intelligence services, and there we saw things that cast doubt on current society. We will now bring those things to light.

Allegedly, NOS personnel was forbidden, via an internal email, to tweet about the affair, or bring information out in any way.

Here is a copy of the video still of the gunman published at http://www.nu.nl/binnenland/3982448/gewapende-man-zendtijd-eist-opgepakt-in-nos-pand.html :

Here is a copy of the photo of the letter shown on Twitter (original source: https://twitter.com/IbHaarsma/status/560883916736065536 ; edited to be more readable and republished at https://twitter.com/FloortjeHVNL/status/560889377153642497/photo/1):

EOF

UPDATE 2015-01-31: AIMSICD is an alternative to SnoopSnitch that does not require a Qualcomm MSM8210 chipset.

Jacob Appelbaum (@ioerror) wrote instructions for modifying a Motorola Moto E phone to install SnoopSnitch and — notably — removing the internal microphone and other sensors to prevent the phone from being used as a remote bug (e.g. the mic being eavesdropped whilst you’re not calling). For fun, I bought the exact model Jacob mentions, a Moto E XT1021, at a Dutch Media Markt store for EUR 103. Modification of the hardware is very simple and demonstrated clearly on Jacob’s page through a series of photos. You need a regular phone Torx screwdriver (a dozen or so of screws need to be removed) and something sharp to pry off both microphones; I used a potato knife (to state the obvious: removing the mic will not hide your call metadata or contents of your phone calls). I left the other sensors untouched for now. The software modification is slightly more involved. Perhaps of use to some, here are the steps it took to root the phone from an OS X 10.9 system, and to install SnoopSnitch (if you find errors or omissions, please contact me, I will correct it). Your mileage may vary.

1. Get the Android SDK and Motorola’s Moto E drivers for OS X:
   • Android SDK: http://developer.android.com/sdk/index.html
   • Motorola MDM: https://motorola-global-portal.custhelp.com/app/answers/detail/a_id/88481 (note: OS X 10.9 isn’t officially supported, but it works. When connecting the phone to my system, some “networksetup” dialog kept popping up, but it can be ignored)
   • Install both.
2. Enable USB debugging:
   • Turn on the phone. Go to the “Settings” screen, then to “About phone”. Touch “Build number” entry 7 times to get the “Developer options” menu item to appear under “Settings”. Go there and enable “USB debugging”. On connecting to a computer, a dialog will pop up asking whether to permit USB debugging from that computer: press “OK”.
3. Unlock the bootloader:
   • Go to https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a , sign in, press “Next”.
   • Boot the phone into fastboot mode by pressing and hold power + volume down for a few seconds, then release. The phone should boot and show the following screen (note: at the top it lists the CPU as a Qualcomm MSM8210):
     
   • Connect the phone to the computer using the USB cable. The message “USB connected” will appear on the phone.
   • On the computer, run the following commands:

     $ cd $HOME/Library/Android/sdk/platform-tools/
     $ ./fastboot oem get_unlock_data
     ...
     (bootloader) [............ part1 ..........]
     (bootloader) [............ part2 ..........]
     (bootloader) [............ part3 ..........]
     (bootloader) [............ part4 ..........]
     (bootloader) [... part5 ...]
     OKAY [  0.257s]
     finished. total time: 0.257s
     $

   • Append the five parts into one string, and enter it in the input field “Can my device be unlocked?” in the Motorola website, press “Agree”. You should receive an email containing an unlock code.
   • Run:

     $ ./fastboot oem unlock [.....unlock code....]
     ...
     (bootloader) Unlock code = [.....unlock code....]
     (bootloader) Unlock completed! Wait to reboot
     $

4. Root the phone:
   • Download SuperSU (credits to @ChainfireXDA) and the CWM recovery image (credits to members of the XDA-Developers Moto-E forums), for instance these DDL mirrors:

     $ wget -O SuperSU-v2.45.zip https://cyberwar.nl/d/20150124_MotoE_UPDATE-SuperSU-v2.45_MIRROR.zip 
     [...] 
     $ wget -O cwm6.0.4.9_recovery.img https://cyberwar.nl/d/20150124_MotoE_cwm6.0.4.9_recovery_MIRROR.img 
     [...] 
     $

   • Connect the phone via USB, then put SuperSU on it as follows (don’t forget the trailing “/” in “/sdcard/” or it fails to copy):

     $ ./adb push UPDATE-SuperSU-v2.45.zip /sdcard/ 
     4043 KB/s (4016989 bytes in 0.970s)
     $

   • Disconnect the phone, put it in fastboot mode by pressing and holding power + volume down.
   • Flash the CWM recovery image as follows (note: after running this command, an error message appears on the phone that can be ignored: “Mismatched partition size (recovery)”):

     $ ./fastboot flash recovery cwm6.0.4.9_recovery.img
     target reported max download size of 299892736 bytes
     sending 'recovery' (8146 KB)...
     OKAY [  0.430s]
     writing 'recovery'...
     OKAY [  1.123s]
     finished. total time: 1.553
     $

   • Press volume down, then volume up. The unlocking is now triggered. Wait a few seconds until the “CWM-based Recovery” menu appears. This looks as follows:
     
   • Press volume down to select “install zip”; then press power.
   • “choose zip from /sdcard” is already selected; press power.
   • Press volume down to select select “0/”, press power, press volume down several times to select “UPDATE-SuperSU-v2.45.zip”, then press power.
   • Press volume down to select “Yes – Install UPDATE-SuperSU-v2.45.zip”, press power.
   • Select “+++++Go Back+++++”, press power.
   • “reboot system now” is selected; press power. When asked “Root access possibly lost. Fix?”, select “No” (default). Press power.
5. Install SnoopSnitch:
   • Under “Settings”, “Security”, enable “Unknown sources”, and disable “Verify apps” (else the phone will keep asking “Allow Google to regularly check device activity for security problems, and prevent or warn about potential harm?”)
   • Connect your phone to the internet (e.g. via WiFi), then open https://f-droid.org/, click “Download”.
   • Pull down the screen from the top, wait until the FDroid.apk download is complete. Scroll down, press “Install”. When done, click “Open”.
   • Press the magnifying glass, search for “SnoopSnitch”. Press “(+)” to install it. Grant it all the privileges it requests.
6. DONE.

EOF

UPDATE 2015-07-01: Ars Technica reports: “The UK’s prime minister, David Cameron, has re-iterated that the UK government does not intend to “leave a safe space—a new means of communication—for terrorists to communicate with each other.” This confirms remarks he made earlier this year about encryption, when he said: “The question is are we going to allow a means of communications which it simply isn’t possible to read. My answer to that question is: no, we must not.””

UPDATE 2015-01-30: the joint statement (.pdf) that followed the meeting does not contain any indication that mandatory disclosure of encryption keys was in fact discussed during the Jan 29/30 meeting. (Which does not imply it was not discussed.)

The EU Counter-Terrorism Coordinator (CTC) wrote input (.pdf, Jan 17) for preparation of the informal meeting of Justice and Home Affairs Ministers in Riga, Latvia on January 29th. On page 10 (of 14) the document addresses access to communication, and explicitly suggests discussing rules to oblige internet companies and telcos operating in the EU to disclose encryption keys:

f) Encryption/interception

Since the Snowden revelations, internet and telecommunications companies have started to use often de-centralized encryption which increasingly makes lawful interception by the relevant national authorities technically difficult or even impossible. The Commission should be invited to explore rules obliging internet and telecommunications companies operating in the EU to provide under certain conditions as set out in the relevant national laws and in full compliance with fundamental rights access of the relevant national authorities to communications (i.e. share encryption keys).

This of course is not unlike the UK Prime Minister reportedly (Jan 13, BBC) stating that there should be no “means of communication” that “we cannot read”; and a few days later, Barack Obama reportedly (Jan 16, WSJ) making statements of similar nature.

It is not clear why the EU CTC’s document mentions “often de-centralized” in the first sentence in the above quote, as “de-centralized encryption” in its usual meaning is not a problem that one would typically address by obliging internet companies and telcos to disclose keys.

We’ll learn more after January 29th.

Related:

• 2015-01-20: Europe Considers Surveillance Expansion After Deadly Attacks (Paul Hockenos / The Intercept)

EOF

UPDATE 2015-01-06: news item by AP (preceding and unrelated to this blogpost).

On January 6th 2015, the Dutch Review Committee on the Intelligence & Security Services (CTIVD) announced (in Dutch) that it will carry out an investigation into the role of the Dutch intelligence & security services AIVD (general) and MIVD (military) in decision-making concerning flight route safety. This follows the MH17 disaster of July 2014. The remainder of this post consists of an unofficial translation of the CTIVD’s announcement.

Announcement of investigation into role of AIVD and MIVD in decision-making concerning flight route safety

In a letter of November 21st 2014, the Minister of the Interior and the Minister of Defense have requested the Dutch Review Committee on the Intelligence & Security Services (CTIVD) to investigate the role of the intelligence & security services AIVD and the MIVD in the decision-making concerning safety of flight routes. The Dutch Safety Board has requested the Ministers to commission the CTIVD to start an investigation.

The letter states that following the crash of flight MH17 of Malaysia Airlines of July 17th 2014, the Dutch Safety Board is investigating, among others, the decision-making concerning the establishment of flight routes. During this investigation, three research questions emerged concerning the AIVD and MIVD.

These research questions are:

• What is the formal structure between the AIVD and MIVD and the parties relevant to aviation safety, such as airlines, air traffic control and the Ministries concerning information sharing on threats to safety?
• What are the specific activities carried out by the AIVD and MIVD in exchanging information with parties relevant to aviation?
• What information did the AIVD and MIVD have about the safety situation in Eastern Ukraine prior to the crash of the MH17, and to what extent did they share the information with parties relevant to aviation safety? What were the considerations to share, or not to share?

The CTIVD decided it will meet the request of the Ministers. Different than usual according to the Dutch Intelligence & Security Act of 2002 (Wiv2002), the CTIVD will report its findings directly to the Dutch Safety Board. This has been requested by the Ministers. In accordance with the CTIVD’s method of investigation, the CTIVD strives to deliver its report during the spring of 2015. The Dutch Safety Board will publish its own findings together with the CTIVD’s findings.

This announcement accompanies a letter (.pdf, in Dutch) sent by the CTIVD to Parliament, and the letter (.pdf, in Dutch) sent by the Ministers to the CTIVD. Neither document contains information beyond what is presented in the above translation.

EOF