Sleep Act referendum: Privacy First call to local political parties

As part of the upcoming referendum around the new Intelligence and Security Services Act (Sleep Act), Privacy First today sent out the call below (pdf version) to all local political parties nationwide:

Dear local politician,

On 21 March 2018, we may go to the polls, not only to elect the parliament for the next four years in the municipality, but also to vote in the referendum on the new Intelligence and Security Services Act. Privacy First would hereby like to alert you to some crucial parts of this new law that may also affect the residents of your municipality.

Dragnet

You may already have heard about it: the nickname of the new Intelligence and Security Services Act is the Tracking law. This is due to the new power in the law to tap the internet traffic of large groups of people at the same time. For instance, a tap can be placed on a particular municipality, a district, neighbourhood or street if a secret service 'target' lives there. This involves collecting the communications of innocent citizens through a digital trawl. Privacy First believes that the data of innocent citizens does not belong with the intelligence agencies. Moreover, the effectiveness of intelligence agencies is decreasing due to the excessive amount of data collected.

Sharing data with foreign countries

Data gathered from the trawl may be shared unevaluated with foreign countries under the new law. This means that Dutch intelligence services can share unseen and unselected data (of innocent citizens) with foreign countries. The use of this data can then no longer be monitored by the Dutch services.

Access to (municipal) databases

The new law allows direct, automatic access to databases across the private and public sectors. It allows intelligence services to real-time access the Basic Registration of Persons and other sensitive local databases. Moreover, encrypted (communication) data should be decrypted upon request. Refusal to comply with a decryption order is punishable by 2 years' imprisonment.

Hacking power

Under the new law, the intelligence agencies will have the ability to conduct a target hacking through innocent third parties. This means that by hacking a third party (aunt, sister, friend, girlfriend, grandfather, colleague, neighbour, work, government, etc.), the intelligence service gains access to information about the service's target. This means that the devices of innocent citizens in your municipality can be hacked by the services. These citizens will never be informed of this (there is no notification requirement for this).

Call

We call on you to support Privacy First in safeguarding the human rights of all residents of Dutch municipalities and call on your constituents to at vote the Intelligence and Security Services Act in the referendum on 21 March. This should take the law back to the drawing board and add significant human rights safeguards.

Thank you in advance for your support!

Sincerely,

Privacy First Foundation