UPDATE 2014-01-07: the AIVD released an English summary of their new publication “Transformation of jihadism in the Netherlands; swarm dynamics and new strength”. If you want to comment, please do so here.

Dutch news site Nu.nl reports (Jun 30, in Dutch) that the Dutch government decided to assign 25 million euro per year extra to the General Intelligence & Security Service (AIVD). Coincidentally, the Dutch government is currently preparing a proposal to change the Dutch Intelligence & Security Act of 2002. I’m not sure whether governmental claims about increased threats forecast broadening of powers — notably the power to carry out unselected interception of cable communications, as seen in GCHQ’s Tempora program. Such programs are not allowed under current Dutch law. The Dutch government will reveal its standpoint after the parliamentary summer break, which ends September 1st 2014.

Here is my translation to English of the report by Nu.nl:

AIVD gets 25 million euro per year extra

As of next year, the Dutch government will assign 25 million euro per year extra to the General Intelligence & Security Service (AIVD).

The Minister of the Interior, Ronald Plasterk, has reported that to the Parliament. The extra funding is made available because of “increased threats”, according to the letter [in Dutch] Plasterk sent to the Parliament. “Jihadists and returnees from war zones pose a substantial threat to our country. In addition, the unrest at the external border of Europe – such as Ukraine – and cyber threats have increased.”

Earlier it was decided that the AIVD had to cut its budget by 10 million euro in 2015, 22 million in 2016, 32 million in 2017 and 34 million as of 2018.

Budget cuts were made on IT and on efforts concerning right-wing extremism, left-wing extremism and animal rights extremism, and on presence abroad.

Clout

“Set measures such as efficiency improvements and the planned relocation of the AIVD to a location together with the Military Intelligence & Security Service (MIVD) still stand,” Plasterk writes on Monday. “This intensification will strengthen the operational effectiveness of the AIVD.”

“Jihadists and returnees from war zones pose a substantial threat to our country. In addition, the unrest at the external border of Europe – such as Ukraine – and cyber threats have increased.”, according to a press release from Plasterk. Since the beginning of the current government in 2012, the terrorist threat outlook in the Netherlands has become “increasingly negative”.

Previously determined measures that should have led to saving through efficiency improvement remain in effect, according to Plasterk. Also, it is still intended that the AIVD and the MIVD will be housed in the same building.

Hennis

Plasterk’s decision, which he co-announces on behalf of Minister of Defense Jeanine Hennis (who is responsible for the MIVD), comes after the AIVD on Monday reported [in Dutch] that over the past two years, fourteen Dutch jihadists were killed in Syria and Iraq.

According to Dick Schoof, the National Coordinator for Counterterrorism and Security (NCTV), the threat of returning jihadists in the Netherlands is more worrisome than ever.

Minister of Security and Justice Ivo Opstelten announced on Monday that the government will continue to use all available resources to address the “comprehensive” terrorist threat from jihadists.

Members of Parliament

Nevertheless, some Parliamentary concerns remain. The Christian Democratic Appeal (CDA) party wants to completely reverse the budget cuts, while government party People’s Party for Freedom and Democracy (VVD) wants to maintain the cuts on non-operational items. The Socialist Party (SP) and government party Labour Party (PvdA) showed themselves satisfied.

On Wednesday a debate about the AIVD will take place between Plasterk and the Parliament.

A series of official publications were released today:

• 2014-07-01: Summary of “Transformation of jihadism in the Netherlands; swarm dynamics and new strength” (in English)
• 2014-06-30: Parliamentary letter on various commitments and motions concerning AIVD (in Dutch) (in Dutch)
• 2014-06-30: Letter to Parliament concerning Integral approach to jihadism (in Dutch)
• 2014-06-30: Summary of NCTV’s “Terrorist Threat Assessment Netherlands #36” (in Dutch)
• 2014-06-30: Publication by AIVD: “Transformation of jihadism in the Netherlands: swarm dynamics and new strength” (.pdf, in Dutch)

EOF

UPDATE 2016-04-15: the government has decided to propose that the (existing) targeted interception power, the (new) untargeted cable interception power and the (existing) targeted hacking power will be subject to ex ante and binding oversight by a newly to be established oversight committee entitled “Toetsingscommissie Inzet Bevoegdheden” (TIB). That committee will consist of persons that have a background in the judicial branch. The government has submitted the revised draft bill to the Council of State, and after that, will be submitted to the House of Representatives. The CTIVD remains tasked with its existing ex post, non-binding oversight.

Dutch website Nu.nl reports (in Dutch) that Harm Brouwer, the chairman of the Dutch Review Committee on the Intelligence and Security Services (CTIVD), signaled intelligence oversight problems in his address to the Dutch Senate. The CTIVD currently has no legal right to oversee or block actions of the intelligence services on an ex ante basis (i.e., beforehand): all oversight is performed ex post (afterwards). Brouwer states that without ex ante oversight, the oversight system is on a ‘slippery slope’. The Dutch Intelligence & Security Act of 2002 was reviewed in 2013 and a bill is currently being drafted by the Dutch government. Brouwer became the new CTIVD chairman starting January 1st 2014.

A translation of the report by Nu.nl:

Oversight committee warns about oversight on intelligence service AIVD

The actions of the Dutch security services should not be reviewed afterwards (ex post), but beforehand (ex ante). The subsequent decision should be legally binding.

Harm Brouwer, the chairman of the committee tasked with oversight on the intelligence services, stated that before the Dutch Senate on Tuesday.

According to Brouwer, the oversight is on a ‘slippery slope’ because it is currently being done after the fact. “It should be noted that judicial review is generally marginal”, he states.

The actions of the intelligence and security service AIVD and its military counterpart, the MIVD, are reviewed afterwards. Especially the fact that the conclusions of the CTIVD are not legally binding restricts the oversight, according to Brouwer.

He pointed out that citizens are generally unaware of the actions of these services. Therefore it can be difficult to prove that a service made a mistake.

Through a spokesman, the CTIVD emphasizes that Brouwer does not imply that there is too much wiretapping is going on in the view of the CTIVD.

Examples

Brouwer mentioned examples of how things can be different. “Belgium has ex ante review of the heaviest special powers, such as phone taps and internet taps”. If it is concluded that a wiretap is not permitted, the wiretap is not carried out, according to Brouwer.

The chairman of the CTIVD believes that it is now up to the Dutch parliament to improve the oversight.

On Tuesday, the Dutch Senate has talks with experts on espionage and the gathering of so-called metadata, following the revelations by whistleblower Edward Snowden. Last year, Snowden revealed, amongst others, that the NSA is wiretapping phone and data connections on a large scale.

EOF

On March 17th 2014, the Dutch Minister of Defense sent a letter (.pdf, in Dutch) to the Parliament concerning the progress of the development of offensive cyber capabilities in the Dutch armed forces. Below is my translation of the main body of that letter. Hyperlinks and parts in [] are mine. Dutch readers: if you have suggestions for improvement of my translation, please contact me, I’ll update this post.

[…]

What is the digital domain?

Original Dutch: “Wat is het digitale domein?”

The National Cyber Security Strategy identifies the digital domain (“cyberspace”) as the set of digital information, information infrastructures, computers, systems, applications and the interaction between information technology and the physical world through which information exchange takes place. Not only the Internet is meant by this, but also all the networks and digital devices that are not connected to the Internet. One can think of (highly classified) networks, but also the digital systems in vehicles, factories, vital infrastructures and sensor, weapon and command and control systems, among others.

Original Dutch: “De Nationale Cybersecurity Strategie duidt het digitale domein (“cyberspace”) aan als het geheel van digitale informatie, informatie-infrastructuren, computers, systemen, toepassingen en de interactie tussen informatietechnologie en de fysieke wereld waarover communicatie en informatie-uitwisseling plaatsvindt. Hiermee wordt dus niet alleen het internet bedoeld, maar ook alle niet met internet verbonden netwerken of andere digitale apparaten. Hierbij kan onder andere worden gedacht aan (hoog gerubriceerde) netwerken, maar ook aan de digitale systemen in voertuigen, fabrieken, vitale infrastructuren en sensor-, wapen- en commandovoeringsystemen.”

Offensive cyber capabilities

Original Dutch: “Offensieve cybercapaciteiten”

The Ministry of Defense must have the knowledge and capabilities to act offensively in the digital domain in support of military operations. This involves the development of (knowledge of) complex, highly technical means and techniques that are aimed at increasing military capability.

Original Dutch: “Defensie moet over de kennis en capaciteiten beschikken om ter ondersteuning van militaire operaties offensief te kunnen optreden in het digitale domein. Het gaat hierbij om het ontwikkelen van (kennis over) complexe en hoogtechnologische middelen en technieken die er specifiek op zijn gericht het eigen militaire vermogen te vergroten.”

Offensive cyber capabilities are the digital means intended to influence or deny the opponent’s actions. These capabilities can be used to support conventional military capabilities. The use of such capabilities is subject to the relevant mandate and Rules of Engagement. The legal framework is no different from those concerning the use of conventional military means. Offensive cyber capabilities are distinguished from conventional means in that they can often be deployed only once, are developed for one specific purpose and have a limited lifetime. The development and use often require extensive and longterm intelligence gathering. Advanced (offensive) cyber capabilities are hardly comparable to the widespread, relatively accessible tools for cybercrime. It often concerns complex means that are knowledge-intensive and time-consuming to develop, mostly because cyber capabilities must be very accurate in order to prevent collateral damage. This does not mean that less complex and possibly more accessible cyber capabilities cannot be used during operations. But this, too, requires a good intelligence position.”

Original Dutch: “Offensieve cybercapaciteiten zijn de digitale middelen die tot doel hebben het handelen van de tegenstander te beïnvloeden of onmogelijk te maken. Deze capaciteiten kunnen in een militaire operatie worden ingezet ter ondersteuning van conventionele militaire capaciteiten. De inzet valt onder het desbetreffende mandaat en de geldende Rules of Engagement. De juridische kaders zijn niet anders dan die voor de inzet van conventionele middelen. Offensieve cybercapaciteiten onderscheiden zich van conventionele capaciteiten omdat ze vaak eenmalig inzetbaar zijn, specifiek voor één doel worden ontwikkeld en een beperkte levensduur hebben. Voor de ontwikkeling en inzet is veelal uitgebreide en langdurige inlichtingenvergaring noodzakelijk. Hoogwaardige (offensieve) cybercapaciteiten zijn nauwelijks vergelijkbaar met de wijd verbreide, relatief laagdrempelige instrumenten voor cybercrime. Het gaat veelal om complexe middelen waarvan de ontwikkeling kennisintensief en tijdrovend is, vooral omdat offensieve cybercapaciteiten zeer nauwkeurig moeten zijn om onbedoelde nevenschade te voorkomen. Dit laat onverlet dat in operaties ook kan worden gebruikgemaakt van minder complexe en mogelijk laagdrempelige cybercapaciteiten. Maar ook hiervoor is een goede inlichtingenpositie onontbeerlijk.”

Offensive cyber capabilities distinguish themselves from cyber means involved in and used for the protection of networks. They also differ from digital intelligence gathering and counter-intelligence activities. In the development of various types of cyber capabilities (defensive, offensive and intelligence) the consistency must be kept in mind. For offensive cyber operations and digital intelligence gathering, similar techniques and methods are often used, albeit with a different purpose and within a different legal framework. Therefore, intensive cooperation with the Military Intelligence and Security Service (MIVD) is necessary in the development of offensive cyber capabilities. A challenge in the deployment of offensive means is that at any time the adversary can discover and mitigate their own vulnerability, and that account must be taken of side effects for our own systems and those of allies or third parties.

Original Dutch: “Offensieve cybercapaciteiten onderscheiden zich van cybermiddelen die worden ingezet op en ter bescherming van de eigen netwerken. Ook verschillen zij van digitale inlichtingenvergaring en van contra-inlichtingenactiviteiten. Bij de ontwikkeling van verschillende typen cybercapaciteiten (defensief, offensief en inlichtingen) moet wel de samenhang in het oog worden gehouden. Voor offensieve cyberoperaties en digitale inlichtingenvergaring worden veelal vergelijkbare technieken en methoden gebruikt, zij het met een ander oogmerk en binnen een ander wettelijk kader. Daarom is bij de ontwikkeling van offensieve cybercapaciteiten intensieve samenwerking met de Militaire Inlichtingen- en Veiligheidsdienst (MIVD) noodzakelijk. Een uitdaging bij de inzet van offensieve middelen is dat de tegenstander op elk moment zijn eigen kwetsbaarheid kan ontdekken en beperken, en dat rekening moet worden gehouden met neveneffecten voor eigen systemen en die van bondgenoten of derden.”

Offensive cyber in military operation

Original Dutch: “Offensieve cyber in militaire operaties”

Cyber capabilities wwill be an integral part of the overall military capability of the Dutch armed forces. They can not replace conventional military capabilities. The combined use of conventional and cyber capabilities can improve the effectiveness of the overall military operation, and thus the military capability to act.

Original Dutch: “Cybercapaciteiten zullen integraal deel uitmaken van het totale militaire vermogen van de Nederlandse krijgsmacht. Zij kunnen conventionele militaire capaciteiten niet vervangen. De gecombineerde inzet van conventionele en cybercapaciteiten kan de effectiviteit van de totale militaire operatie, en dus het militaire handelingsvermogen, vergroten.”

The planning and execution of operations in the cyber domain are largely similar to those of conventional military operations. In general, an operation begins with an exploratory phase in which intelligence is collected, among others on the digital capabilities of a potential adversary. Then, the likeliness of the intended effect and the possible risks and side effects are analyzed. By means of this the necessary offensive cyber capabilities are designed and developed. This concerns, for instance, very complex software that could disable an enemy weapon system or military communication systems. It may also involve relatively simple software. If the opponent has systems connected to the internet, the operation could be carried out via this way. If not, access to the opponent’s digital environment will have to be obtained by different means. Then, the phase of influencing, disruption or destruction of the opponent systems can begin.

Original Dutch: “De planning en uitvoering van operaties in het cyberdomein komen grotendeels overeen met die van traditionele militaire operaties. In het algemeen begint een operatie met een verkennende fase waarin inlichtingen worden verzameld, onder andere over de digitale capaciteiten van een potentiële tegenstander. Vervolgens worden de kansen op het beoogde effect alsmede mogelijke risico’s en neveneffecten geanalyseerd. Aan de hand hiervan worden de benodigde offensieve cybercapaciteiten ontworpen en ontwikkeld. Het gaat hierbij bijvoorbeeld om zeer complexe software die een vijandelijk wapensysteem of militaire communicatiesystemen zou kunnen uitschakelen. Het kan ook gaan om relatief eenvoudige programmatuur. Indien de opponent systemen aan het internet heeft gekoppeld, kan de operatie via deze weg worden ingezet. Zo niet, dan zal eerst op andere wijze toegang tot de desbetreffende digitale omgeving moeten worden verkregen. Vervolgens kan de fase van beïnvloeding, verstoring of destructie van het systeem van de tegenstander beginnen.”

Prior to the deployment of an offensive cyber capability, it is important to extensively test for efficacy and undesirable side effects. This takes place in a shielded digital practice environment.

Original Dutch: “Voorafgaand aan de inzet van een offensieve cybercapaciteit is het belangrijk deze uitvoerig te testen op effectiviteit en ongewenste neveneffecten. Dit gebeurt in een afgeschermde digitale oefenomgeving.”

A doctrine for military operations in the digital domain has been established last year in general terms. This year, the doctrine will be further developed and assessed during exercises where cyber is integrated. It is expected that the doctrine will be completed in the course of 2015. The doctrine will address, among other things, integration of cyber resources in the planning of military operations. The Defense Cyber Command (DCC) will appoint a cyber adviser to operational commanders who advises on the possibilities and vulnerabilities of systems, and the possible use of cyber means and the desired effects. These effects may be across the entire spectrum of military operations.”

Original Dutch: “Een doctrine voor het militair optreden in het digitale domein is vorig jaar op hoofdlijnen tot stand gekomen. Dit jaar wordt de doctrine verder uitgewerkt en getoetst tijdens oefeningen waarin cyber wordt geïntegreerd. Naar verwachting is de doctrine in de loop van 2015 gereed. De doctrine zal onder andere ingaan op het integreren van cybermiddelen in de operationele planning van militaire operaties. Zo zal het Defensie Cyber Commando (DCC) een cyberadviseur aan operationele commandanten ter beschikking stellen die adviseert over de mogelijkheden en kwetsbaarheden van de eigen systemen en de mogelijke wijze van inzet van cybermiddelen en de beoogde effecten. Dit kunnen effecten zijn in het gehele spectrum van militair optreden.”

State of affairs

Original Dutch: “Stand van zaken”

Last August, I informed you about the status of the Defense Cyber Strategy (Parliamentary Papers 33321, No.2). In that letter I reported that the focus of the Defense Cyber Strategy initially lies with the defensive cyber capabilities (protection of networks, systems and information) and the expansion of the information capacity of the digital domain. The development of these two components proceeds as planned and will continue in 2014 and 2015. As reported in the note ‘In the interest of the Netherlands’, the Ministry of Defense will put more emphasis on developing the ability to conduct cyber operations, including by accelerated establishment of the DCC.

Original Dutch: “In augustus jl. heb ik u geïnformeerd over de stand van zaken van de Defensie Cyber Strategie (kamerstuk 33321, nr. 2). In die brief heb ik gemeld dat het zwaartepunt van de Defensie Cyber Strategie aanvankelijk ligt bij de defensieve cybercapaciteiten (de bescherming van netwerken, systemen en informatie) en de uitbreiding van de inlichtingencapaciteit voor het digitale domein. De ontwikkeling van deze twee componenten verloopt zoals voorzien en zal voortgaan in 2014 en 2015. Zoals gemeld in de nota ‘In het belang van Nederland’ zal Defensie zich nadrukkelijker richten op het ontwikkelen van het vermogen cyberoperaties uit te voeren, onder andere door het versneld oprichten van het DCC.”

The DCC will begin in Q3/2014 with a staff element, an operations department, a technology department and the Defense Cyber Expertise Center (DCEC). The operations department will build capabilities to support units during deployment and exercises. The technology department will develop cyber capabilities in close cooperation with the MIVD. These will not yet be available in 2014, beceause the recruitment and training of the necessary personnel has not yet been completed.

Original Dutch: “Het DCC zal al in het derde kwartaal van 2014 beginnen met een stafelement, een afdeling operaties, een afdeling technologie en het Defensie Cyber Expertise Centrum (DCEC). De afdeling operaties zal de capaciteit opbouwen om eenheden gedurende de inzet en oefeningen te ondersteunen. De technische afdeling zal in nauwe samenwerking met de MIVD offensieve cybercapaciteiten ontwikkelen. In 2014 zullen die nog niet beschikbaar zijn omdat de werving en opleiding van het hiervoor noodzakelijke personeel nog niet is afgerond.”

To achieve the desired acceleration, the Taskforce Cyber will merge into the DCC. In addition, the DCC, within the existing financial framework, will be extend with additional staff, including a number of training places and functions for cyber reservists. [Some 150 cyber reservist positions are expected.]  It is expected that the DCC will be operational by the end of 2015.

Original Dutch: “Om de beoogde versnelling te bereiken zal de Taskforce Cyber opgaan in het DCC. Daarnaast wordt het DCC, binnen de huidige financiële kaders, uitgebreid met extra personeel, waaronder een aantal opleidingsplaatsen en functies voor cyberreservisten. Naar verwachting zal het DCC eind 2015 operationeel zijn.”

[…]

EOF