Plan to gather evidence of crime and terrorism ‘quickly and efficiently across borders’

This article is more than 1 year old

This article is more than 1 year old

The European commission is seeking to force technology companies wherever they are based in the EU to hand over emails, text messages and app communications of terror suspects within hours of a court order.

Under the plans, judges in one member state will be able to seize electronic evidence held on a service provider in another European country through a transnational European production order.

The powers would further cover the seizure of data held outside the EU by a tech company “offering services in the union and established or represented” in an EU member state.

The information will have to be handed over by the service provider within 10 days of receiving the warrant, or as little as six hours in emergency cases.

Currently, depending on the legal vehicle, the time limits before which the tech companies need to respond to national courts can vary between 120 days to 10 months.

Frans Timmermans, the European commission’s vice-president, said: “Electronic evidence is increasingly important in criminal proceedings. We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice.

“There must be no hiding place for criminals and terrorists in Europe, online or offline. Today’s proposals will put in place unprecedented tools enabling the competent authorities not only to gather electronic evidence quickly and efficiently across borders but also ensuring robust safeguards for the rights and freedoms of all affected.”

The tech companies will also be under an obligation not to delete specific types of data.

European Digital Rights, a campaigning group, has warned that the measures pose a threat to people’s fundamental rights. However, the commission insisted that the order would only be applicable in the most serious of cases, and that all the normal safeguards of the judicial process would be in place.

More than half of all criminal investigations include a cross-border request to obtain electronic evidence, the commission said. The current ways to obtain such data were said to be “much too slow and cumbersome”. Almost two-thirds of crimes where electronic evidence is held in another country cannot be properly investigated or prosecuted, officials added.

The commission also wants to give law enforcement authorities access to bank account information, no matter where the data is held, in an effort to cut of the financing of terror groups active in Europe.

The level of information will be limited, however, to that held in national, centralised registries enabling the authorities to identify in which banks a suspect holds accounts.

As part of the roll-out of new initiatives devised in response to attacks on European soil in recent years, the EU is also seeking to improve the security features of ID cards used by citizens of member states in the Schengen travel area. Fingerprints and facial images will be stored on a chip in the cards.

An estimated 80 million Europeans currently have non-machine-readable ID cards without biometric identifiers.

Julian King, the UK’s European commissioner, responsible for security, said: “By giving law enforcement access to crucial pieces of financial information, we are closing another loophole being exploited by terrorists, and hitting them where it hurts – their finances.”</s>Technology companies such as Google, Microsoft and Facebook will be forced to hand over users' data to European law enforcement officials even when it is stored on servers outside the bloc, under a law proposed by the EU on Tuesday.

The law would allow European prosecutors to force companies to turn over data such as emails, text messages and pictures stored online in another country, within 10 days or as little as six hours in urgent cases.

The European Union executive says the proposed law, which would apply to data stored inside and outside the bloc, is necessary because current legal procedures between countries to obtain such electronic evidence can drag on for months.

"Electronic evidence is increasingly important in criminal proceedings," said European Commission Vice-President Frans Timmermans.

"We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice."

Digital borders are a growing global issue in an era where big companies operate so-called cloud networks of giant data centres, which mean that an individual's data can reside anywhere.

Technology companies have found themselves torn between protecting consumers' privacy while cooperating with law enforcement. The political pressure has intensified after Islamist-inspired attacks across Europe in recent years.

The United States recently moved to address the same problem, passing a law making it clear that U.S. judges could issue warrants for data held abroad while giving companies an avenue to object if the request conflicts with foreign law.

Prosecutors and police will have to ask a judge to approve their request for electronic evidence where it concerns more sensitive data, such as the actual content of messages, emails, pictures and videos.

They will also be able to ask companies to ensure electronic evidence is not deleted while they prepare their so-called production order.

Fraught with complexity

The proposal will apply only in cases where crimes carry a minimum jail sentence of three years. In cases of cybercrime there will be no minimum penalty requirement.

Where companies find themselves in a conflict-of-law situation because the country where data is stored forbids them from handing it over to a foreign authority, they will be able to challenge the seizure request.

However, such extraterritorial rules are fraught with complexity, legal and privacy experts warn.

In the United States, for example, certain companies are prohibited from disclosing information to foreign governments, while in Europe consumers' data privacy is strictly protected and companies are restricted in how they can transfer data outside the bloc.

"The Commission is proposing dangerous shortcuts to allow national authorities to obtain people's data directly from companies, basically turning them into judicial authorities," said Maryant Fernandez Perez, senior policy adviser at campaign group European Digital Rights.

CCIA, a tech association that includes Google and Facebook, welcomed the proposal but said it only offered a limited mechanism for addressing the risk that companies find themselves torn between two conflicting national laws.

"We welcome today's proposals, which can help authorities obtain digital evidence more effectively and with more transparency and legal clarity," said Alexandre Roure, CCIA Europe's senior manager.

Ultimately, the Commission hopes to start talks with the United States on a deal to help law enforcement authorities to seize evidence held on each other's territories.

"We always think it's useful to have an EU-US coordinated approach instead of a French-US approach, a Belgian-US approach because that leads to fragmentation," a Commission official said.</s>related media assets (image or videos) available. Click to see the gallery.

2 related media assets (image or videos) available. Click to see the gallery.

Technology companies such as Google, Microsoft and Facebook will be forced to hand over users' data to European law enforcement officials even when it is stored on servers outside the bloc, under a law proposed by the EU on Tuesday.

BRUSSELS: Technology companies such as Google, Microsoft and Facebook will be forced to hand over users' data to European law enforcement officials even when it is stored on servers outside the bloc, under a law proposed by the EU on Tuesday.

The law would allow European prosecutors to force companies to turn over data such as emails, text messages and pictures stored online in another country, within 10 days or as little as six hours in urgent cases.

The European Union executive says the proposed law, which would apply to data stored inside and outside the bloc, is necessary because current legal procedures between countries to obtain such electronic evidence can drag on for months.

"Electronic evidence is increasingly important in criminal proceedings," said European Commission Vice-President Frans Timmermans.

"We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice."

Digital borders are a growing global issue in an era where big companies operate so-called cloud networks of giant data centres, which mean that an individual's data can reside anywhere.

Technology companies have found themselves torn between protecting consumers' privacy while cooperating with law enforcement. The political pressure has intensified after Islamist-inspired attacks across Europe in recent years.

The United States recently moved to address the same problem, passing a law making it clear that U.S. judges could issue warrants for data held abroad while giving companies an avenue to object if the request conflicts with foreign law.

Prosecutors and police will have to ask a judge to approve their request for electronic evidence where it concerns more sensitive data, such as the actual content of messages, emails, pictures and videos.

The proposal will apply only in cases where crimes carry a minimum jail sentence of three years. In cases of cybercrime there will be no minimum penalty requirement.

Where companies find themselves in a conflict-of-law situation because the country where data is stored forbids them from handing it over to a foreign authority, they will be able to challenge the seizure request.

However, such extraterritorial rules are fraught with complexity, legal and privacy experts warn.

In the United States, for example, certain companies are prohibited from disclosing information to foreign governments, while in Europe consumers' data privacy is strictly protected and companies are restricted in how they can transfer data outside the bloc.

"The Commission is proposing dangerous shortcuts to allow national authorities to obtain people's data directly from companies, basically turning them into judicial authorities," said Maryant Fernandez Perez, senior policy adviser at campaign group European Digital Rights.

Ultimately, the Commission hopes to start talks with the United States on a deal to help law enforcement authorities to seize evidence held on each other's territories.

"We always think it's useful to have an EU-U.S. coordinated approach instead of a French-U.S. approach, a Belgian-U.S. approach because that leads to fragmentation," a Commission official said.</s>On May 25, the EU Data Protection Directive 95/46/EC on the protection of personal data will be replaced by a General Data Protection Regulation (GDPR). The preparation of this move has been long in the making, but it was suddenly put in the limelight by the "Facebook affair," the discreet use of personal data of millions of Facebook users by consulting firm Cambridge Analytica without their consent.

Speaking to Sputnik, Rebecca Cousin, partner at London-based law firm Slaughter and May, said that the new regulation is designed to expand the scope of EU citizens' data protection to companies based to foreign-based companies and toughen the financial consequences of leaking data to third parties.

"The new regime has extraterritorial effect so it will apply to companies who do not have an EU base if they offer goods or services to individuals in the EU or if they monitor their behavior. This will bring many more entities within the scope of the EU data privacy regime and we are therefore seeing companies from around the world assessing the impact of the GDPR on them and what steps they need to take to comply," she said.

In terms of financial penalties, Cousin, who co-heads the Slaughter and May Data Protection and Privacy practice, explained that companies will not only face a manyfold hike in potential losses if they fail to protect their customers' data, but also a greater number lawsuits by individuals as an outfall of greater awareness in the wake of the Cambridge Analytica scandal and the EU response.

"In the new regulation, sanctions are increasing with fines having a maximum of 4% of worldwide annual turnover (or EUR 20 million if higher). To give a comparison, the maximum level of fines in the UK is currently £500,000. The size of the fine is, therefore, a much greater deterrent for internet giant firms such as Facebook or Google, albeit the reputational impact has always been a strong deterrent. It will continue to be important for many companies. The fines go to the regulators as opposed to individuals bringing claims for damages. I expect an increase in civil cases against companies for data issues in part due to the greater awareness of individuals’ rights and claims companies are starting to promote the ability to bring these type of claims," she said.

The first basic question is to wonder why a directive, a European law, approved by the European Parliament and then transposed by each country into its national legislation, must suddenly be replaced by a European regulation, immediately applicable to all.

The reason is to eliminate delays and time losses that result from each country deciding on data flow regulations autonomously, often slightly different from the original directive, with some oversight by the European Commission, according to legal industry experts.

"Of course, nowadays such data can easily be transferred outside the Union to countries which do not necessarily guarantee an equivalent level of protection. In order to prevent these data from being used contrary to European rules, the Directive specifically targets "cross-border flows" (ie transfers of personal data outside the European Union). The directive prohibits such flows to third countries that do not provide a level of protection which it qualifies as "adequate". The European Commission is responsible for deciding whether a country provides such a level of protection. If this is not the case, the Directive nevertheless allows a transfer subject to compliance with certain conditions, for example where the controller provides 'adequate guarantees'," Says Jean-Francois Bellis, from the Brussels law firm Van Bael & Bellis, told Sputnik.

Until 2013, the United States was considered as "safe" with no transfer problems. Europeans lived under the "Safe Harbour" agreement between Brussels and Washington.

READ MORE: Too Much Profit in ‘Monetizing Our Privacy' for Facebook to Fear Regulation

But then, on June 6, 2013, Edward Snowden, a computer specialist working for the CIA and the NSA, revealed the scale of the surveillance that the NSA was doing on US and foreign networks, including social media. Europeans were listened in by the CIA. This was a huge scandal at the time. Snowden, the whistle-blower, sought refuge in Hong Kong and then Russia, where he has obtained asylum until 2020.

How Ireland Comes Into Play

With regards to the specifics of Facebook's presence in Europe, which until recently used Ireland as a base for its tax and revenue operations, experts explained that data transfers out of Europe to the United States have yet to be determined by the Court of Justice of the European Union (CJEU), which has yet to make a ruling on a five-year-old legal case against Facebook. The proceedings were initiated in 2013 following a complaint lodged by Austrian lawyer Max Schrems with the Irish data protection authority.

"Why Ireland? Because Facebook Ireland shared the European data with Facebook Inc in the United States. According to Mr. Schrems, the surveillance program of the US national security agency, which Edward Snowden had just made public, was incompatible with European fundamental rights and, as a result, according to Schrems, Facebook had to suspend cross-border data to the United States to the extent that it could potentially be subject to massive surveillance by the NSA. This procedure gave rise to a preliminary question to the CJEU, which in 2016 annulled the EU-US Safe Harbor," Jean-Francois Bellis said.

Of course, the European Commission, the US government and the companies involved tried to find a solution to enable the data flows to continue across the Atlantic.

READ MORE: Debate US Style: NRA Official Calls for Killing Supporters of Gun Regulation

Following the cancellation of the Safe Harbor agreement, Facebook Ireland abandoned the so-called "adequacy" system for a system of "sufficient guarantees" and has entered into a contract with Facebook Inc. incorporating the "Standard Contractual Clauses" of the European Commission. These Standard Contractual Clauses were recognized by the European Commission as offering "sufficient guarantees" for cross-border flow.

The Court of Justice of the European Union should, therefore, provide answers to a number of questions that will determine whether the Model Contractual Clauses can still be used for transfers of personal data to the United States. The importance of this decision is considered as thousands of companies make use of such Standard Contractual Clauses.

"The Irish court has the ability to refer questions of European legislation to the ECJ where it needs a ruling on the law in order to be able to apply it to the facts of the case. The only certainty now is that it won’t be a quick process to get the ruling of the European Court of Justice," Rebecca Cousin from Slaughter and May said.

I could be another two years before the European court gives an answer and states whether Facebook and the other internet giants can export European data to the United States. Urgent issues can wait a little longer.</s>BRUSSELS—The U.S. and the European Union are aligning rules to help crime-fighters access suspects’ emails, text messages, photos and other data, despite simmering trans-Atlantic tensions.

The European Commission proposed Tuesday that national law enforcement authorities be allowed to access data stored on tech companies’ servers in other EU countries or the U.S., to speed cross-border criminal investigations. Tech firms that don’t comply risk fines.</s>Technology companies such as Google, Microsoft and Facebook will be forced to hand over users’ data to European law enforcement officials even when it is stored on servers outside the bloc, under a law proposed by the European Union yesterday.

The law would allow European prosecutors to force companies to turn over data such as emails, text messages and pictures stored online in another country, within 10 days or as little as six hours in urgent cases.

The EU executive says the proposed law, which would apply to data stored inside and outside the bloc, is necessary because current legal procedures between countries to obtain such electronic evidence can drag on for months.

“Electronic evidence is increasingly important in criminal proceedings,” said European Commission Vice President Frans Timmermans.

“We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice.”

On the frontline of the ongoing investigation into claims that Cambridge Analytica may have illegally harvested Facebook data for political ends, former CA boss Alexander Nix has refused to appear for a second grilling by British lawmakers, the MPs’ scrutiny panel investigating him said yesterday.

The ex-CA chief executive was due to appear today before parliament’s culture, media and sport committee over the British political consultancy firm’s highly controversial work. They wanted to probe inconsistencies in the testimony he gave before the committee on February 27.

Digital borders are a growing global issue in an era where big firms operate so-called cloud networks of giant data centers, which means that an individual’s data can reside anywhere.

Technology companies have found themselves torn between protecting consumers’ privacy while cooperating with law enforcement. The political pressure has intensified after Islamist-inspired attacks across Europe in recent years.

The United States recently moved to address the same problem, passing a law making it clear that US judges could issue warrants for data held abroad while giving firms an avenue to object if the request conflicts with foreign law.

Prosecutors and police will have to ask a judge to approve their request for electronic evidence where it concerns more sensitive data, such as the actual content of messages, emails, pictures and videos.

The proposal will apply only in cases where crimes carry a minimum jail sentence of three years. In cases of cybercrime there will be no minimum penalty requirement.</s>SAN FRANCISCO (Reuters) - U.S. Department of Homeland Security Secretary Kirstjen Nielsen warned on Tuesday that a European data privacy law taking effect next month may have “unintended consequences” that harm the United States’ ability to protect itself from cyber attacks.

The European Union law, called the General Data Protection Regulation (GDPR), is the biggest overhaul of online privacy since the birth of the internet, giving Europeans the right to know what data is stored on them and the right to have it deleted.

Online data privacy is important and contextual across borders and different cultures, Nielsen said during a keynote appearance at the RSA cyber security conference in San Francisco.

But “what we don’t want are the unintended consequences of preventing the research community to be able to give us a heads up on (cyber) threats that are coming our way,” she said.

“In other words, through trying to protect a citizen’s privacy we eliminate the ability of many of the vendors and researchers who otherwise have access to data to see the trends in attacks,” Nielsen said.

While some U.S. officials have in recent months raised concerns publicly about the European law, Nielsen is the most senior Trump administration official yet to do so.

Her remarks suggest that any attempts by the U.S. Congress to legislate comprehensive privacy protections would face hurdles from the Trump administration.

Calls for new digital privacy rights in American law have increased after disclosures that the political consultancy Cambridge Analytica obtained data on more than 87 million Facebook users from quizzes that were supposed to be for academic research.

Among the Trump administration’s concerns are limitations the law seeks to impose on accessing data about website registrations that can often offer clues for investigators pursuing cyber criminals.

The strong limits on what can be done with data on users are a source of concern for security professionals in government, internet companies and outside forensics and investigations providers.

As things stand, many European uses and others who sign on to online services housed within the region would not be giving companies explicit permission to use their data in probes of fraud or other criminal activity, security experts told Reuters this week.

Unless the GDPR is amended, companies and outside investigators will lose access to material that many users have not realized they were giving up.

The experts said that they were working on ways to recover access to some of that material, which they declined to detail. The most straightforward would be an explicit declaration when users join what data could be used as evidence against people that harm them or against the users themselves.

On Monday, White House cyber coordinator Rob Joyce on Twitter said that GDPR would “undercut a key tool for identifying malicious domains on the internet.”

Joyce said at a conference last month that U.S. officials were trying to persuade European regulators to allow a carve out in the law for security researchers to continue collecting data pertinent to data breaches or other cyber crime investigations.</s>Technology companies could be ordered to release vital electronic data, such as emails and text messages, to law enforcement agencies in as little as six hours under proposed European Union rules aimed at speeding up access to electronic evidence on crimes such as terrorist plots.

Judges would get the right to directly request key data regardless of where it is stored, with a deadline to respond within 10 days, or six hours in case of an emergency, the European Commission said on Tuesday. The proposals are aimed at replacing an unwieldy system that too often slows down investigations due to the difficulties to access this data.

"While law enforcement authorities still work with cumbersome methods, criminals use fast and cutting-edge technology to operate,” EU Justice Commissioner Vera Jourova said in a statement on Tuesday. “We need to equip law enforcement authorities with 21st century methods to tackle crime, just as criminals use 21st century methods to commit crime.”

Police investigations into the terror attacks in Belgium’s capital Brussels just over two years ago connected the main suspect to a cell involved in other European attacks, which the police suspected communicated mainly through email drafts. Under current rules, access to one particular email stored on a Microsoft Corp. server in Ireland would take about a year, by which time data risks being deleted, according to the commission.

“We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice,” Frans Timmermans, first vice-president at the commission said. The new plans would give authorities “unprecedented tools” to access electronic evidence “quickly, efficiently across borders.”</s>Tech giants such as Facebook, Skype or Google will be forced to hand over data to crime and terror investigators in other EU countries under new laws put forward by the European Commission.

Companies will have to respond to requests for emails, texts or messages in apps within 10 days or six hours in case of emergencies, regardless of where the data is held, if the proposal becomes EU law.

More than half of all criminal investigations now include a cross-border request to obtain electronic evidence held in another country in or outside the EU. But two thirds of those probes cannot be properly prosecuted because the current system is too cumbersome.

The new European Production Order will allow...</s>On May 25, 2018 the General Data Protection Regulation (GDPR) will come into effect, heavily impacting global business. In an effort to protect its citizens, the EU passed firm legislation that aims to protect the personal data that companies may receive from its users and clients. Due to the demanding features of the GDPR, businesses that wish to remain efficient will need to become familiar with the legislation’s terms and respond strategically in order to avoid any disruptions to their operations.

The GDPR was initially proposed by the European Commission, the legislative body of the European Union, in January 2012. Two years later, in 2014, the European Parliament approved the legislation, allowing for its official passage in 2016. The transition period, referred to as a “two-year post-adoption grace period” will end on May 25, 2018, enabling the GDPR to take full effect and its terms to become enforceable.

Interestingly, a study conducted by Dell and Dimension Research concluded that approximately 80% of businesses know “little to nothing about the GDPR” and that 97% have not created a plan for how they are to respond. Unfortunately, this ignorance can lead many firms to incur a number of hefty fines.

The EU intends to prevent many of the data and privacy breaches that are common in a data driven societies and economies. It stresses that data processing is applicable regardless of whether or not it is done in the EU region. Interestingly, the GDPR will even affect foreign companies who may have clients and services within the European Union.

Businesses that violate GDPR can face tremendous penalties. Specifically, a company can be fined as much as 4% of annual revenue or 20 million euros, whichever is greater. Violations may include not having company records in order, failing to notify the authorities and victims of a data breach within 72 hours, and not having enough customer consent to process their personal data. The regulation stresses that acquiring consent for processing personal data is critical. Therefore, companies must provide terms and conditions that are “clear and distinguishable from other matters,” and must be distributed in an “intelligible and easily accessible form” to comply with GDPR standards and ensure that customers are aware of their privacy risks.

In order to fully protect EU citizens’ data, GDPR will provide them with certain rights to prevent company misuse. They will have the right to be notified if their personal data is being processed, where it is being processed, and the purpose for processing it, establishing data transparency between subjects and companies. Data subjects will also have the right to be “forgotten,” which is known as Data Erasure. This gives individuals the power to not only halt the processing of their personal data, but to completely erase it from the company’s systems. Data Erasure may only take place if the data is said to “no longer be relevant” to the original goals of the processing or if an individual removes his or her consent. Moreover, companies will be required to provide data upon request to data subjects, which is referred to as data portability. Upon request, companies must be able to transmit data to an individual in a “commonly used and machine-readable format.”

The concept of data minimisation is emphasized, as well. This refers to the requirement that data may only be processed and retained if it is necessary for the purposes outlined in advance. Additionally, access to personal data must be limited to those that conduct the data processing.

Companies whose primary operations involve processing and regularly monitoring data subjects or data related to crime will be required to appoint a DPO, or a Data Protection Officer, to be responsible for keeping internal company records.

The detailed requirements of the GDPR and its near global impact will shape the way organizations across Europe and the world do business and approach data and privacy. Once this goes into effect in May, businesses will be required to adjust their operations accordingly to effectively comply and avoid penalties.
The European Commission announces plans to force tech companies worldwide that provide services within the European Union to supply data on their users in counterterror investigations.