The new e-services act sets up digital mass surveillance that has no parallel in Norwegian history. The intelligence service will now create a system to collect information on almost all digital communications in Norway. This includes messages you send via email or in apps, your phone calls, and much, much more. It doesn’t matter if you did something suspicious or not. We fear that the politicians do not understand the scope of what they have decided. Or do they actually think that such mass surveillance is acceptable? Collects data constantly The e-service’s task is to monitor foreign threats. The upcoming system will initially “only” collect data that crosses national borders. But the internet works in such a way that even an e-mail to the neighbor is likely to cross national borders. In any case, the interception does not take place physically at the border, but inside Norwegian companies’ IT systems. In practice, the e-service will collect data about almost everything we do, all the time, and store the data for a long time. This will be a system that enables almost total monitoring of the population. Criticism has been massive from large parts of Norwegian civil society. In addition, EU judges who have assessed similar laws in other countries have cast doubt on whether the Norwegian e-Services Act can be introduced. In September at the latest, an EU judgment established that it is illegal to carry out indiscriminate mass collection of data to prevent threats. Politicians who support the law are happy to point out that the E-service cannot search the huge amount of information collected whenever they want. They must ask the Oslo district court for permission each time. Experience from other countries with similar systems shows that the authorities are in practice allowed to use the data when they request it. We see no reason to expect anything else in Norway. Can weaken democracy Politicians who support the law also point to the system “only” collecting so-called metadata. This means that the system will not save the content of an SMS you send, but they can save who you sent it to, where you were when you sent it, and more. But the fact is that those who can compile metadata from several different companies, apps and services can find out a lot about you. They can see who you associate with and they can predict with certainty whether you are in a relationship, what your religion is, whether you are going through a divorce, your state of health, and more. Does the risk increase Do we not trust the authorities? Yes, we do not believe that the authorities want us to suffer. But there are many others out there who want this data. Everything from cybercriminals to Putin’s state hackers will look for vulnerabilities in the systems that will collect, process and store the data. Ironically, the monitoring system can therefore increase the risk of data going astray or being misused. A recent report from the National Audit Office, which reveals very serious deficiencies in the Norwegian Armed Forces’ IT systems, reinforces our concern about the E-service’s access to expertise and ability to secure its IT systems. We fully understand that the E-service wants as much data as possible. They have an important social mission, and collecting and analyzing information is a central part of their job. But we do not understand that the politicians are not more restrained, and more concerned with protecting our private lives. The certainty that the authorities can look deeply into our digital lives can weaken trust in the authorities. And that can make people more cautious about speaking out. Privacy is not only a personal but also a collective concept. The more we lose privacy, the more our democracy weakens. One paragraph remains It has already been decided that the monitoring system will be created, but the E-service may not use the system for intelligence until the Storting has processed and adopted the last, very central part of the law. It won’t happen until next spring. This last paragraph, 7-3, is about who should be able to order Norwegian companies to install eavesdropping equipment. At first, the authorities wanted to let the e-service manager decide this himself. The new proposal has changed little, now the e-service manager can “only” order companies to install monitoring equipment to test it. Thereafter, it is the Oslo district court that must make the monitoring permanent. Which companies can be required to monitor customers’ data traffic? The law is, probably on purpose, unusually vague and the framework is wide. We assume that Telenor, Finn.no and Vipps are among the many companies that may soon receive a message from the E-service. It must be possible to reverse Our foremost recommendation is that the government reverse and stop this. We realize that is unlikely to happen. If the system is to be built first, we ask that the control bodies, the EOS committee and the court, be provided with far more resources and expertise than what has been planned so far. This can hopefully help mitigate the most obvious harmful effects of the system. It should also be evaluated by independent expertise after a few years. For security reasons, a “suicide button” should also be included in the system, i.e. a mechanism for quickly shutting down the system and deleting all acquired data. A system with such great population control potential as this cannot be allowed to fall into the wrong hands.
ttn-69
Unparalleled mass surveillance – Speech
