‘Supervision of the fight against cybercrime is poorly regulated'
Investigation services and cyber criminals both make grateful use of the opportunities offered by digital technologies. Both groups' use of these services leads to breaches of privacy for citizens. The current legislation falls short in providing protective measures, is the conclusion reached by Professor of Privacy and Cybercrime, Bart Schermer. Inaugural lecture 7 November.
Although crime statistics have been going down for a number of years, cybercrime is showing the opposite trend. New technologies are a catalyst for new criminal behaviour, Schermer states. The proceeds from cybercrime are high, while the risk of being caught is small. Added to this, digital technologies make it easier to commit offences, while detection is becoming more difficult.
Contest between criminals and police
In response to these developments, the police also make use of digital technologies. According to Schermer, it is a 'contest between the criminals making use of increasingly advanced technologies to hide their identity and behaviour, and the police using new detection methods to try to track the criminals down.’ The digital methods they use can have a negative impact on privacy.
The legislation that is intended to safeguard privacy is outdated, Schermer believes. 'The current Code of Criminal Procedure is inadequate to tackle the fight against cybercrime. And even the proposals for modernisation that will shortly be going through Parliament won't solve the current problems.'
Insufficient legal safeguards
The police are able to gain access to large amounts of data by confiscating data carriers and dismantling encrypted chat services. This bulk collection and analysis of data can cause a major. But, according to Schermer, it is only the collection of data that is regulated by law, and there are too few safeguards related to analysing the data.
'If the police don't scrutinise themselves, nobody else will.'
That is worrying because it is precisely when data is being analysed that the risk of breaches of privacy are greatest. ‘The police draw all kinds of associations between different data, and mistakes are easily made, such as making a wrong interpretation. At the moment, these kinds of analyses are only monitored internally. If the police don't scrutinise themselves, no one else will, not even a judge.'
No supervision
A further issue is that investigative powers are increasingly being used for intelligence and interception purposes. For example, the police might learn of a potential cyber attack, and intercept the attack by accessing and taking down a server. In this kind of case, the police aim is not to trace and prosecute the perpetrator, but only to stop an illegal activity. Schermer: ‘Such a case won't come before a judge who would evaluate the police activity. So, if errors are made, there will be no rapping of the knuckles. As a result, there is a privacy risk because the police are able to access all kinds of servers without any checks being made.'
Stricter supervision
Schermer believes that improvements are needed in how the use of digital technologies by investigation services is supervised. 'European courts are very clear about this. Independent legal supervision has to be tightened up, both in advance in the supervision by the examining magistrate, and afterwards in the examination by a trial judge.' The professor believes that specific authorities need to be put in place for digital intelligence and disruption. 'Then, the police will be responsible for maintaining public order and security in the digital world the same as in the physical world, in addition to their investigative role.'
'Lack of clarity is not good for anyone.'
Clearly, building privacy safeguards into the law will not only restrict the police, but will also give them some new opportunities, Schermer believes. 'The rules that the police have to adhere to will then be very clear. Because there is so much uncertainty today, the police just do whatever seems appropriate, and a judge might well disapprove of their actions afterwards. In the present situation, the police sometimes don't take act on things because there is no certainty about whether particular investigative methods are allowed. Investigative powers properly prescibed in the law offer guidelines for how to strike the right balance between considerations of privacy and investigation. If there is a lack of clarity, that does nobody any good.'
Text: Tom Janssen
Image: Created with Dall-E, an artificial intelligence programme that creates images from textual descriptions.