Indifference may lead to bad legislation on e-data

Last week I listened with growing disbelief as a management representative from Eircell explained that a positive side-effect…

Last week I listened with growing disbelief as a management representative from Eircell explained that a positive side-effect of the September 11th terrorist attacks would be that the public would now accept the "need" to build in back-door methods of surveillance in electronic networks.

"I think a lot of people who resisted these attempts [to introduce 'back doors' in the past] might accept the need for this now, especially if the government is monitored," he said, at a Wireless Wednesday gathering to discuss the legal issues. His perspective was clearly stated as support for such a development.

In other words, law enforcement should have the right to demand that technologies used by the public for communication - email, landline and mobile phones, and wireless communications - have a special hidden entry point that would enable those communications to be monitored.

Businesses across the world have been strong opponents of back doors, for obvious reasons. Discussions between business partners and clients are highly confidential. They also can have an element of national security or competitiveness.

READ MORE

Business, therefore, has at times become an unlikely partner with privacy organisations. The left and the right see common ground, and they want it protected from the prying eyes of the state.

Given Eircell's large base of business customers, I found it extraordinary that they would not be energetically opposing back doors and any other attempt at increased surveillance of their customers.

I also thought they would, at the very least, be cautious in stating such a pro-surveillance opinion given that, along with Digifone, Eircell met the Data Protection Commissioner this week to explain why it was holding customer call records for up to six years, an apparent violation of the Data Protection Act. Eircell had said it, in part, needed to hold on to those records in case law enforcement wanted them sometime in the future. Even the surveillance-mad British require that such records be destroyed unless a search warrant in advance asks for material to be retained.

But the digital world can seem so abstract that many still dismiss this notion of back doors and increased surveillance with a "so what?" If you are persuaded by this argument, then consider the basic issue in a more concrete context. Imagine the Garda demanding a key to every citizen's back door, because they might want to look around the inside of your house at some future point. While most citizens fully support the right of law enforcement to conduct searches when they have solid evidence of illegal activity - and have gone through the route of obtaining appropriate warrants - most of us would not feel comfortable handing over our house keys in anticipation of future searches.

This is placing enormous - and, I would argue, in an historical context, very inappropriate - trust in the State as caretaker parent to its potentially wayward child citizens.

Let's set aside the fact that one would need an impossible system of international law enforcement cooperation for back doors to be effective, which would mean trusting every nation's government to avoid abuse of the system. One would first need to trust the State here - and, as our Eircell friend said, its ability to be effectively monitored.

So let's review the State's record on privacy issues.

First, the State offers no explicit protection to privacy in the Constitution. That's OK, you might say, the Republic has signed the European Convention for the Protection of Human Rights and Fundamental Freedoms, which includes strong privacy protections. But alas, in the 51 years since it was signed, the Republic - alone in Europe - has not managed to write it into law.

But wait, you say, the Supreme Court does recognise the right to privacy here. One of the key cases establishing this right was Kennedy and Arnold v Ireland. But, oh dear, that's the case where the State placed wiretaps on two journalists not so long ago, the subject of bitter argument recently among politicians over apologies about the matter.

Well, you say, we now have the Data Protection Act. Er, yes, but that's only the first, 1988, one. We were supposed to bring the 1997 expanded directive into law by October 1st, 1998, and the European Commission has now taken us to the European Court of Justice for failing to do so. As we approach 2002, the Government says we might have this legislation in place by next year - if the Government doesn't get voted out before it's enacted.

But we do have a data protection commissioner and office to investigate abuses in the use of personal data, you say. Yes, but two commissioners in a row have complained that they are so short staffed they cannot possibly offer "any reasonable level of service to the public".

Now our Government intends to sign the Council of Europe Draft Convention on Cybercrime. This will require countries to adopt new laws regarding wire-tapping, encryption and surveillance, including the use of back doors.

There are provisions to require internet service providers to retain all customer email and internet data. Many countries recently signed up to the draft proposal and, in press coverage, the State was incorrectly listed as one that did not intend to sign. It does. But new primary and secondary legislation will be needed.

Some in the Government argue that the State recognises the importance of guaranteeing privacy and the encryption protections we already have in the E-Commerce Act. They say new legislation will not damage the reputation of the State as an open, lightly regulated business environment.

Yet I am deeply worried that in this pro-technology, pro-business, pro-information society we are trying to create, we take almost no collective interest in how such laws are drafted.

Almost alone in Europe, and among what might be termed the pro-tech economies, we have no watchdog group monitoring the State and Europe's actions and proposed legislation in this area. Only the Irish Council of Civil Liberties has made a valiant attempt to tackle such issues, but a dedicated digital rights group is badly, badly needed.

Otherwise, we risk getting the legislation, nationally and on the European level, that we deserve - potentially damaging legislation brought in with the indifference of the citizens and businesses it will directly affect.

klillington@irish-times.ie