Sunday, July 20, 2014

"Significant gaps" in Department of Justice IT security

You might think that the Department of Justice and Equality - which is responsible for data protection law in Ireland - would have adequate security in place for its own systems. Apparently not. Here's an excerpt from briefing materials for the new Minister, Frances Fitzgerald:
Significant gaps have been found in levels of IT security in use to protect our systems and data. The systems have become out of date as investment (as with infrastructure) has not been applied to maintaining levels at what would be deemed adequate. A security consultant has been retained and a dedicated security manager has been taken on to review and remediate this deficiency. This will require significant investment and resource to bring us to a suitable level of protection and awareness. (p.82)
Proving the point, the briefing material was released as a PDF with crude redaction, easily defeated by the time honoured method of copying and pasting the blacked out material. While the department hurriedly pulled the material from its own site the entire brief remains available in Google cache.

Wednesday, July 16, 2014

July 2014 updates

Blogging here has been light with most material going on Twitter or instead but I should jot down a few updates you might not otherwise have seen.
  • I've put together a surveillance library on the DRI site which brings together in one place the key sources on state surveillance in Ireland. It is, as far as I know, the first time this has been done and the process of pulling together all the documents highlighted to me just how opaque and fragmented the Irish surveillance systems are.
  • DRI has succeeded in its application for amicus status in Max Schrems' challenge to the transfer of personal data to the US under Safe Harbour. Following the decisions in Digital Rights Ireland and Google Spain it is clear that the ECJ is prepared to adopt strong positions on privacy issues and I look forward to being able to contribute to their continued development of the law.
  • The Internet Content Governance Advisory Group published its report in June. The report is a sensible and balanced assessment which focuses on education and parental empowerment rather than legislative responses. I do have a concern about the recommendation that internet messages should be brought within the scope of the existing law on "grossly offensive, indecent, obscene or menacing" messages - while the recommendation itself is quite nuanced there is a risk that a clumsy implementation could jeopardise free expression online in the way that Fergal and I outlined before the Oireachtas social media hearings last year.
  • In a peculiar case, an Irish man was convicted of criminal damage for posting a Facebook update purporting to be from his ex-girlfriend. He was fined €2,000 for posting a status update from her phone stating that she was a "whore" who "would take any offers". This was the first time that the offence of criminal damage to data was used in relation to social media and it is notable in that the sentence imposed was based not on the damage itself but on the reputational harm the damage caused.
  • The "right to be forgotten" is beginning to have an impact on Irish newspapers.
  • Revenue and Social Welfare staff continue to misuse personal data.
  • Finally, the Irish courts have seen regular convictions for online harassment, using the existing provisions of the Offences Against the Person Act 1997, raising the question whether the Content Advisory Group recommendation for change is genuinely necessary.

Friday, April 11, 2014

ECJ finds data retention unacceptable in a democratic society

My preliminary thoughts on our data retention victory, in yesterday's Irish Independent:

This is a significant decision for Irish law. The Digital Rights Ireland case will now return to the High Court in Dublin which will decide whether Irish data retention law is unconstitutional in light of the European Court of Justice ruling.

It is difficult to see how the national law implementing the directive can stand up to challenge now that the directive itself has been held invalid. Consequently it is very likely that new Irish legislation will be proposed.

More generally the judgment will have fundamental implications both throughout Europe and worldwide. The decision itself is effective throughout all 28 member states and will provide greater privacy protection for over half a billion EU citizens.

It will almost certainly be followed by more cases in other member states by national civil rights groups challenging local data retention laws. It also comes at a time when data protection law throughout Europe is under review and will help to establish high standards for any new law.

Finally, this is the first major ruling on surveillance following the Edward Snowden revelations and is clearly influenced by the abuses which he exposed. The judgment will be of central importance to other cases, pending against the UK government, challenging internet surveillance by the British intelligence service GCHQ. In effect, the European Court of Justice has set out a position which directly rejects the type of indiscriminate mass surveillance carried out by the US and UK governments as being unacceptable in a democratic society.
Full text.

Wednesday, March 26, 2014

Recording of calls to and from Garda stations

I have a piece in today's Irish Independent on the revelation that there was widespread recording of calls to and from garda stations over a number of years. Excerpt:
The revelation that telephone calls to and from garda stations have been systematically recorded since the 1980s raises many fundamental issues for the Garda Siochana and for the wider criminal justice system.

The most grave issue is that each recording likely amounted to a serious criminal offence. Under Irish law, the recording of a telephone conversation on a public network without the consent of at least one party to the call amounts to an "interception", a criminal offence carrying a possible term of imprisonment of up to five years.

Interceptions can only be authorised by a warrant signed by the Minister for Justice, but such warrants are restricted to specific cases involving serious offences and are limited to three-month periods. There is no suggestion that any such warrant was issued in relation to this system, and it is clear that the system as a whole fell well outside the bounds of any possible warrant.

Consequently, unless gardai were notified that their calls might be recorded then a large number of criminal offences are likely to have been committed by and within the Garda Siochana itself.
Full text.

Thursday, March 20, 2014

Yahoo moves from London to Dublin; scuppers UK spies

It's surprising to see Ireland as a privacy haven, but by comparison with the UK we look good. The arrogance of the Home Office is astonishing - it genuinely appears to believe it should be able to dictate where a company runs its business so as to allow it to engage in mass surveillance.
Theresa May summoned the internet giant Yahoo for an urgent meeting on Thursday to raise security concerns after the company announced plans to move to Dublin where it is beyond the reach of Britain's surveillance laws.  By making the Irish capital rather than London the centre of its European, Middle East and Africa operations, Yahoo cannot be forced to hand over information demanded by Scotland Yard and the intelligence agencies through "warrants" issued under Britain's controversial anti-terror laws...

The home secretary called the meeting with Yahoo to express the fears of Britain's counter-terrorism investigators. They can force companies based in the UK to provide information on their servers by seeking warrants under the Regulation of Investigatory Powers Act, 2000 (Ripa).  The law, now under review by a parliamentary committee, has been widely criticised for giving police and the intelligence agencies too much access to material such as current emails and internet searches, as well as anything held on company records...

"There are concerns in the Home Office about how Ripa will apply to Yahoo once it has moved its headquarters to Dublin," said a Whitehall source. "The home secretary asked to see officials from Yahoo because in Dublin they don't have equivalent laws to Ripa. This could particularly affect investigations led by Scotland Yard and the national crime agency. They regard this as a very serious issue."

Saturday, March 08, 2014

Oliver Connolly is wrong – Sgt McCabe broke no laws with his secret recording

I have a piece in today's Irish Independent on Oliver Connolly's claim that his rights were infringed by secret recording of his comments. To put it mildly, I'm not convinced. Here's the piece with added links:

Oliver Connolly is wrong – Sgt McCabe broke no laws with his secret recording

SECRET recordings by a party to a conversation can be powerful things. When somebody does not know they are being recorded, they are more candid in their comments. They are often prepared to reveal things they would never repeat publicly. The recording then becomes important evidence to expose inconsistencies between public positions and private admissions.

Unsurprisingly, those who are recorded often feel threatened by this. A common response in many jurisdictions – not just Ireland – is to claim that secret recording is illegal or in breach of the right to privacy.

The former Garda Confidential Recipient, Oliver Connolly, has now taken that approach, asserting that his "constitutional right to privacy" was infringed and that garda whistleblower Sgt Maurice McCabe acted "in breach of confidence" by secretly recording and publishing details of a meeting with him. He has also said that politicians, by repeating excerpts under parliamentary privilege, have further violated his constitutional rights.

These, however, are not correct statements of the law. The starting point is that Irish law generally requires only "single party consent" for the recording of conversations – whether on the phone or in person.

Unlike some other countries, where legislation expressly requires that all parties should consent to a recording, in Ireland any one party can record the conversation. Other parties need not agree – or even be informed.

There are exceptions to this general rule. In some situations, data protection law imposes higher duties on businesses, employers and other "data controllers".

But those duties do not apply to information that an individual keeps only for their "personal affairs" – meaning Sgt McCabe's covert recording would not be covered by data protection rules.

Mr Connolly correctly states that Irish law recognises a constitutional right to privacy – and it is true that this right could apply to recordings if they related to his personal life. The carrying out of his public functions is quite another matter. There is no basis for saying that senior public officials enjoy a right to privacy in the way they carry out their duties. Public officials act on behalf of the people – not in any private capacity – and are open to scrutiny about what they do in our name.

In any event, the claim of privacy is misguided where a person voluntarily reveals information in the course of their duty. There can be no reasonable expectation of privacy in information that has been deliberately disclosed in this way, however much a person might later regret the disclosure.

Mr Connolly might superficially appear to have a better case as regards confidentiality. His former title – Confidential Recipient – reflects duties in the 2007 regulations establishing that role to "take all practicable steps to ensure that the identity of the confidential reporter is not disclosed".

But those duties are imposed to protect the identity of the whistleblower. They apply to the Confidential Recipient, the Garda Commissioner, the Minister for Justice and Equality, GSOC, and the Chief Inspector of the Garda Inspectorate – in short, to everyone other than the whistleblower himself. The confidentiality belongs to the whistleblower and can be waived by him.

In any event, even if a duty of confidentiality did apply, it would be defeated by a countervailing public interest that favours disclosure.

In this case, it is clear that there is such a public interest. Mr Connolly is alleged to have said: "If Shatter thinks you're screwing him, you're finished" and: "If Shatter thinks it's you, or if he thinks that it is told by the commissioner or the gardai, here's this guy again trying another route to put you under pressure, he'll go after you."

Such comments about the minister by the person designated to receive complaints of garda wrongdoing can only give rise to very significant concern. They would certainly be a matter of genuine interest and importance to the general public which would override any obligation of confidentiality.

One more law should be mentioned. Sgt McCabe is also subject to the Garda Siochana Act 2005, which prohibits disclosures of information which are "likely to have a harmful effect". But "harmful effect" is defined very narrowly by the legislation to mean only particularly serious and direct harms such as "facilitating the commission of an offence". The information revealed by Sgt McCabe would not come within the terms of this prohibition.

In short, there does not appear to be any support for Mr Connolly's claim that Sgt McCabe made an "unlawful recording". Rather than attempting to shift the focus to the actions of Sgt McCabe, Mr Connolly might do better to consider how he can help resolve the significant public concerns which have been raised by this episode.

TJ McIntyre is a lecturer in the UCD Sutherland School of Law

Saturday, August 31, 2013

What would Turkey like to hide from its citizens?

Internet censorship in Turkey is a prime example of why democracies should not attempt to filter the internet. I've blogged before about the blocking of Richard Dawkin's website by the Turkish authorities so I was fascinated to learn that a full list of sites which have been blocked by Turkey is available. The information has been compiled by which identifies 31,694 sites as having been blocked, roughly doubled from last year. You can also view all blocked sites as a single page.

Highlights of the blocking list? In addition to Kurdish news sites, it includes the entirety of:

Google Groups
Google Sites

One important caveat - not everything on the list is currently blocked. Turkey has flipflopped on many of these sites with on again/off again bans at different times for different reasons. Some sites - such as YouTube - have also been unblocked after caving in to Turkish government pressure and agreeing to censor for Turkish users.

More on Turkish blocking from the excellent Reporters Without Borders site. The Guardian has a recent piece on how Turkish internet users are getting around this censorship.