A European Union inquiry into mass electronic surveillance has heard there is now little or no limit to the data that intelligence agencies can scrutinise on behalf of the United States and its allies.
“It will probably be easier to establish what [governments] don’t know about us,” said Sophie in ’t Veld, a Dutch Member of the European Parliament (MEP), after hearing submissions from investigative journalists Jacques Follorou from Le Monde, and Jacob Appelbaum, who is also a computer security researcher.
Appelbaum, a US citizen now living in Berlin, told members of the Civil Liberties, Justice and Home Affairs Committee (LIBE) in Brussels on Thursday: “the [National Security Agency, or the NSA for short] is not bound by European laws and they do not care what your laws say.”
The hearing was the first of a dozen meetings planned by LIBE, which began its inquiry in July after information leaked by ex-NSA contractor Edward Snowden to The Guardian newspaper revealed details of the US government’s unprecedented surveillance program.
A secret system called Prism, for example, allows the NSA to access the personal data of non-US citizens held by tech companies including Google, Facebook, and Apple.
Journalist and computer forensics expert Duncan Campbell told the committee there is not one surveillance system as previously thought, but “five overlapping systems that can collect [data] simultaneously” via intercepted cables, satellites, communication exchanges, and by compromising networks.
“And at the end of this story of many ways of getting at our data and our companies’ data and our governments’ data, is PRISM,” Campbell said.
The hearing coincided with further revelations by The Guardian, in conjunction with The New York Times and ProPublica, showing intelligence agencies have worked with technology companies to create vulnerabilities in encryption software that claims to protect users’ data.
Speaking via video conference The Guardian editor Alan Rusbridger said states were now partnering with corporations to place anyone using digital equipment under some form of surveillance.
This could not be allowed to happen without people’s consent, he said, and that consent could not be given without information.
“I’ve had senior officials within the British Government saying, ‘you’ve had your debate, now stop’,” Rusbridger said. “To me it is not for the state to be telling journalists when to stop.”
As Appelbaum outlined the different layers of encryption technology on his mobile phone the committee’s rapporteur and deputy leader of the European Parliamentary Labour Party, Claude Moraes, turned to colleagues and said: “I want one”.
Leaked documents show EU institutions in Brussels were also the subject of surveillance by the NSA.
Suspicions now run deep and some MEPs at the crowded hearing, which was also streamed online, nodded and tapped their desks in agreement when Appelbaum said he was offended by US President Barack Obama excusing US surveillance on the grounds that it only targeted foreigners.
Authorities from the US and EU will be invited to appear at later hearings, and a committee official said there were plans to invite Snowden to appear via video link from Russia where he has sought asylum.
This summer’s revelations have radically altered a pre-existing debate about data protection in Europe.
In June EU Justice Commissioner Viviane Reding said Prism was a “wake-up call” for European countries that were already in the process of amending the key EU Directive from 1995 for the internet age, including harmonising laws across jurisdictions.
Civil society groups European Digital Rights, and the Fundamental Rights European Experts Group last week made a submission to LIBE, renewing calls for the EU to revoke Safe Harbor authorisations that allow Europeans’ personal data to be sent to US-based companies even though US data protection laws are widely considered inferior to those in the EU.
LIBE is due to issue recommendations to the European Parliament by the end of the year.
