‘Rather paint it off than write it down’

The Assessment Committee Deployment of Powers (TIB) has put it all neatly in a row. Due to a new intelligence law, the secret services AIVD and MIVD will soon be allowed to hack more and more easily and ‘dragging’, eavesdropping on internet traffic on a large scale, will finally be possible. Promises that internet traffic to and from the Netherlands and traffic from streaming services such as YouTube will be spared have been explicitly undone. Commitments, including those that were added to the current intelligence law after the referendum in 2018, are failing in important ways.

“This is going to be really big,” TIB president Mariëtte Moussault summarizes the proposed “significant expansion” of the powers of the services. The short two-week consultation period ended on Friday. The law is to come into effect on July 1.

In addition to the fact that the services will soon be allowed to do more, the nature of supervision is changing, says Moussault. Less at the TIB, which checks in advance, more at the CTIVD, which monitors afterwards and during operations whether the services are complying with the rules. In the event of violations, the CTIVD is given the opportunity to suspend intelligence operations. According to the government, this fits better with the work of the services and is necessary to make the Netherlands more resilient against countries with offensive cyber programmes.

Despite the far-reaching changes, the TIB considers the bill ‘supervisible’, reads their formal response – provided that an article is lost and the TIB gets more people.

What will the services be able to do in the future?

“One of the things that will change is the credit. For example, a telephone tap: if a target If you receive a new telephone number, the services do not have to obtain permission from us again to listen in on that number, but they are ‘credited’. The law now concerns ownership or exclusive use. In the future, the services will also be able to eavesdrop on new devices, computers or servers that are not used exclusively by a target. For example, the services can also intercept citizens’ devices where hackers have penetrated, without us looking at it separately. This is replaced by supervision by the CTIVD.

“We are now also testing the technical risks of a hack. That will lapse in the new law, while it is important to know whether a hack is risky. For example, we want to know whether the services have unknown vulnerabilities [zogenaamde zero days, onontdekte fouten in software die hackers kunnen misbruiken, red.] going to use. These can be stolen by other services and used against you like a boomerang.

“Questions about technical risks will soon be answered in abstract terms and unknown vulnerabilities no longer need to be reported. At the same time, we are still allowed to ask the services anything to clarify their requests. That lack of clarity will become a source of irritation and mutual procedures.”

You expect that the services ‘will have access to a great deal of (internet) data from citizens for a long time’ as a result of the extension of cable interception. Is that desirable?

“We are regulators, not an action group. Supervision is possible. That is something else. I’m not saying: that expansion must come, I’m not saying that there is either not have to come. I do say: it is a considerable expansion, and that should have been written down more clearly by the legislator.

“Society has the right to know what the intelligence services can do and to what extent they can act. This is especially important for cable interception. We will come back to this in our annual report, but as it looks now, parts of that area will be painted black. We were too honest about how big the cable interception can get, and the services asked us to change parts because they thought it was state secrets. I’d rather make it black than write it differently. The cable is getting big and it is up to politicians to decide how desirable that is.”

You do have concerns about supervision.

“Due to the shift in supervision, we will have to work much more closely with the CTIVD. However, this bill aims to inform the services and the minister in advance about our contacts. In the first place, this is a fundamental objection: it is strange that independent supervisors are just not required to request permission for consultation.

“In practice, it also means that the services will be warned. Then on the other side they can let things go. I’m not saying they will, but people who care about safe driving also go a little faster when they know there are no controls.

“In addition, the services will soon be able to challenge our decisions with the Council of State. That appeals procedure will simply be an extra opportunity for them and will mean a lot of work for us. That’s not a bad thing, but we’ll need more people.”

In March 2021 you said you would resign if the TIB could no longer carry out a meaningful test. are you staying?

“At the moment I think it is responsible to continue. There are some things that need to be fixed in the bill as far as supervision is concerned. I have high hopes for that. As for the extension of powers, I’m curious if there will be a debate about that or if society is now saying: Russia is invading Ukraine, so what are we whining.”