• Home /
• Statewatch Database /
• EU: Remote searches of computer hard drives: “cyber patrols” and state agencies can spy on, for example, lawyers, journalists and activists across borders by Tony Bunyan

EU: Remote searches of computer hard drives: “cyber patrols” and state agencies can spy on, for example, lawyers, journalists and activists across borders by Tony Bunyan

01 July 2008

On 5 June the German Federal Ministry for the Interior announced proposals to amend the Federal Criminal Police Office Act to allow authorisation to conduct online computer searches and video surveillance in private homes in "cases of terrorist threats". More precisely this will allow it to carry out:

the surveillance of private homes and telecommunications as well as remote searches of computer hard drives" and of: "the acoustic and visual surveillance of private homes.

While the German proposal is limited to “terrorist threats” this was the first public recognition that state agencies – in Germany and other EU states – have the technological ability to carry out “remote searches” of computer hard drives.

And it can be observed that if state agencies can remotely access computer hard drives they can also add to or change their content or install a “trojan” (virus).

On the 11 July the EU Council Presidency sent a Note on its: “Comprehensive plan to combat cyber crime” to COREPER (the committee of Brussels-based high-level representatives of each Member State) and the Council (EU doc no: 11784/08). Under the sub-heading “The emergence of new issues” it notes that legal powers have been adopted in some Member States for “blocking” sites containing child pornography and:

the use of investigations under pseudonyms (cyber patrols) and their possible extension to areas other than child pornography.

Powers to monitor and “block” child pornography sites would receive wide support but the extension of “cyber patrols” and “blocking” to other issues could be highly contentious – for example, to a planned cross-border protest at a G8 Summit or material discussing “terrorism” thought to be aiding “radicalisation”. Another “new issue” is:

the area of remote computer searches, which are a delicate issue because of their cross-border nature. (emphasis added)

Having referred to “projects already in existence” which require “common approaches” it is clear that state agencies in some Member States are already conducting cross-border remote computer searches – for example, state agencies in Italy could be searching computer hard drives in France, those in the UK searching those in Spain and so on.

This Council Presidency Note in July was, of course, just that – a basis for discussion. However, it was very swiftly – given the long Brussels summer “break” – transformed into a proposal for formal Council “Conclusions” which slipped unnoticed, and un-reported, through the October Justice and Home Affairs Council as an “A” Point (adopted on the “nod” without discussion, EU doc no: 13567/08). However, the adopted version only refers to:

measures to facilitate remote computer searches, allowing investigators rapid access to data

There is no mention of the “delicate issue” of “cross-border” searches. Neither is there any mention of data protection, privacy, reporting procedures or legal powers.

Council “Conclusions” are non-binding (“soft law”) but they are enabling, that is, it is open to any or all EU Members States and their agencies to introduce measures to “facilitate” remote computer searches at will.

The concept of “cyber-crime” currently covers scams such as “phishing”, getting confidential information from victims; terrorism; child pornography; and attacks on information systems – all of which would get broad support.

However, there are now clearly stated intentions to extend these categories to “other areas” - one such extension is to cover “material [that] glorifies violence and terrorism”.

This is a classic instance where having developed a technology for specific purposes - terrorism and child pornography – state agencies seeks to extend the practice across a whole range of issues. Quite extraordinarily the Council Conclusions authorise measures to facilitate remote computer access, within and across borders, to access content and with the possibility that this content could be altered or added to without the knowledge of the individual or group. Lawyers working on contentious cases could be spied on as could journalists or protest groups planning a demonstration. They could also be “set-up” with material being “planted” in their computers.

To adopt such a measure without any reference to data protection, privacy or legal powers puts us in a state of lawlessness.