TRACKING SURVEILLANCE Surveillance Creep Has Made the Leap Front and Centre As the World Responds to COVID-19

SURVEILLANCE TRACKING SURVEILLANCE Surveillance creep has made the leap front and centre as the world responds to COVID-19. EWAN SUTHERLAND charts the shifts in technology, practice and norms he practice of surveillance began with the covert At the time of writing, governments of all persuasions interception of mail, with telegram and telephone are moving to utilise surveillance technologies to address interception being added centuries later. These the profound health and economic challenges wrought T activities were undertaken by the police and secret by the COVID-19 pandemic. police, later intelligence services, together with the post office, often without an explicit legal framework or checks SURVEILLING THE SURVEILLERS and balances, but constrained by limited resources. Although the public was rarely told directly about Over time these practices had to be reconciled with the surveillance techniques or the scale of their use, some growing recognition of privacy as a human right under information found its way into newspaper reports of national constitutions and international treaties, with trials and into crime and spy fiction and, later, the the European Union creating a right to data protection. cinema. Nowadays, universal and regional treaties exist Liberalisation of telecommunications markets demanded to protect human rights, including privacy, in countries the clarification of authorisation for wiretapping, and the with significant observance of the rule of law. But payment of costs and legal liabilities through legislation and surveillance technologies are also embedded in network licensing. equipment as “lawful interception” and available to The scope of surveillance was expanded with the countries with little, if any, regard for human rights. profusion of new services, enabled by advances in While there are formalised mechanisms in some technology, the increasing use of over the top applications, jurisdictions, such as complaints bodies, and annual often without providers having a legal or physical presence reporting, the level of privacy protection is inconsistent in the particular jurisdiction. overall and transparency and oversight around Perceptions of the threats, especially of the rise of surveillance remains patchy, with governments often terrorism, changed views of the scale and scope of the data closely guarding and actively concealing information. and metadata that should be collected, often under pressure Countries treat matters of national security very for immediate action and fear of criticism for the failure to differently, with too many parliaments entirely have intercepted or passed information between agencies. excluded from such topics and power reserved to the The result has been varied national regimes, offering head of state and security agencies. While parliaments different levels of protection for individuals, with should be overseeing police and intelligence services governments using tools purchased, sometimes covertly, and scrutinising budgets and practices, the use of from a complex surveillance industry ecosystem. technologies such as international mobile subscriber Surveillance has moved into the internet of things, with identity-catchers (IMSI-catchers) and surveillance the plethora of internet-enabled devices, some wearable, and malware have almost never been discussed. Whereas the complications of often unencrypted transmission of data the collection of metadata has been debated in some to service providers. Increasingly, citizens and consumers parliaments, being an obligation imposed on commercial transmit and share their data in the name of security and operators. health, or for convenience, lifestyle and entertainment. Reports on the use of interception and surveillance For example, local police forces in the United States have are presented to a small number of more powerful partnered with home security company Ring to offer free parliaments, but the vast majority of countries do not or discounted smart camera systems to local residents. In publish policies, list equipment available to their police addition to features such as video-enabled doorbell ringing and intelligence services or indicate the scale of their on homeowner smartphones, Ring facilitates police access surveillance activities. The United Nations frequently 1 to images taken from doorbell cameras. There are concerns reports violations of human rights, but is unable to these can be intercepted directly or images obtained from enforce them. There is commendable work by groups the service provider without a court order or the consent of such as the Citizen Lab and Privacy International, but the customer. these are too few in number for the task they face. 8 InterMEDIA | April 2020 Vol 48 Issue 1 www.iicom.org IIC EVENTS The growth of corporate social responsibility block the use of the Consolidated ICT Regulatory has seen some multinational corporations adopt Management System were rejected on appeal, policies and report on the surveillance activities despite lower courts accepting arguments that the they conduct in response to judicial and police collection of call data records violated the right to orders. As Vodafone noted, it was forbidden by the privacy.8 A case that the mandatory registration governments of Egypt and South Africa to disclose of SIM cards in South Africa violated the right to anything more than the legal provisions, despite privacy was launched a decade ago, but has yet to concerns about both regimes.2 While the MTN conclude.9 Group has published its human rights strategy, it Cross-border. The issue of court-ordered access manages to reconcile this with the surveillance to servers came to prominence with BlackBerry, and wiretapping obligations of the repressive which encrypted its BlackBerry Messenger service governments of Iran, Syria and Yemen, apparently on servers in Canada. Governments in, for example, to the satisfaction of its investors.3 India and the United Arab Emirates worked to persuade BlackBerry to place servers in their LITIGATION AND LOCATION jurisdictions so that they might have access to the Litigation has been a source of insight into the contents.10 A different approach has been taken in workings of lawful intercept regimes, which often Russia where, following the “colour” revolutions have a cross-border dimension, and has shaped and the Arab Spring, systematic monitoring that approaches to surveillance. had been reduced in post-Soviet times was reinstated United States. The Electronic Frontier with expanded capacity, notably of social networks.11 Foundation (EFF) sued the US National Security The Putin administration has attempted to force Agency, challenging its right to operate the social network providers to locate servers in Russia Orwellian sounding “Room 641A”, an interception and to store user data for one year, in order to bring facility at AT&T. The case was dismissed by the them within its control, reinforced by blocking non- Court of Appeals, because of retroactive immunity compliant services at the international gateway.12 granted by the US Congress,4 which the US Supreme Court consequently declined to hear.5 A SURVEILLANCE ECOSYSTEM A further case by the EFF was dismissed by the Governments have imposed obligations on operators District Court, then reinstated by the Court of and service providers to collect and store data Appeals, but has yet to reach judgement.6 and metadata about their customers. Standards United Kingdom. Public interest litigation have evolved under the term “lawful interception” is underway in the United Kingdom, following used in what is now a complex global market for freedom of information requests, to determine how hardware and software, that includes well-known many IMSI-catchers have been purchased by the and specialist firms, including some venture capital police and what the policy is for their use, since funded start-ups.13 Police and intelligence services there had been no public disclosure.7 purchase equipment to undertake surveillance, Africa. There have been occasional cases about at best with limited reporting to parliaments and human rights, but there is no right to privacy in the public. Access to surveillance, encryption and the African Union treaty. In Malawi, attempts to decryption tools is no longer the exclusive www.iicom.org April 2020 Vol 48 Issue 1 | InterMEDIA 9 SURVEILLANCE domain of governments and security or law light aircraft to scan wider areas. enforcement agencies. A number of firms supply IMSI-catchers, Supposedly, the export of surveillance purportedly only to law enforcement authorities, technologies from Western countries is controlled but devices are available for sale on Alibaba,14 by the Wassenaar Arrangement, to ensure they while GitHub has instructions for a do-it-yourself are not available to autocratic or authoritarian device. Last year, Bangladesh tendered for a governments. However, some exports appear backpack IMSI-catcher for its notorious Rapid to avoid the controls and some vendors are Action Battalion15, building on prior equipment in countries that are not signatories. It seems and training procurements by the same unit. likely that just as demand is met for encryption In many African countries there are technologies, demand will also be met for requirements that SIM cards be registered in interception and decryption technologies, a database, which when linked to an IMSI- regardless of concerns for human rights. Indeed, catcher would generate names and addresses, some countries may

Load more