Consent AIVD/MIVD bulk hack that involved data of millions was unlawful

Last year, the Assessment Committee Deployment of Powers twice labeled the permission that the AIVD or MIVD received from the minister to acquire bulk datasets from citizens as unlawful. In one case, it involved data from millions of citizens.

The Assessment Committee Deployment of Powers assessed the permission in the first half of 2020 as unlawful because the relevance could be questioned. It involved obtaining the data of millions of individuals who, according to the TIB, “are not or will never be in the attention of the services in any way.” The committee writes in its annual report: “Because it had to be taken into account that this data would be processed and stored for a long time, the effort was not considered proportionate.” Later in 2020, the TIB declared the permission to be unlawful for a similar request.

The so-called bulk hacks by the AIVD or MIVD concern the acquisition of data from, for example, telecom or hosting providers that cannot be retrieved directly and that the intelligence services want to obtain through a hack. This requires the consent of the relevant minister. This concerns data of large numbers of people, although the services focus on only one or more targets. The services must therefore assess the data for relevance as soon as possible, but have one year to do so. They should immediately destroy irrelevant data. Previously, the CTIVD considered the services to designate an entire bulk data set as relevant as unlawful.

In its annual report, the TIB briefly discussed cable-oriented interception, or the dragnet that the services on the cable are allowed to use on the basis of the WIV 2017. The TIB has not received any requests from the AIVD or MIVD for new cable taps, but because for one year, taps authorized in 2019 could be performed in 2020. The committee expects new requests for cable taps in the first half of 2021.

The TIB also complains that it has been misinformed several times by both intelligence services. In a few cases this involved not only the requests but also answers to questions. Although there are no indications that incorrect information was intentionally provided, the Committee would like to see an improvement in 2021. The TIB is also asking for expansion, since the number of requests from the AIVD and MIVD is rising sharply. In the period from April 1, 2020 to December 31, 2020, the TIB received 2165 requests. In 8.1 percent of the requests from the MIVD, the TIB ruled that the permission had been granted unlawfully. This was the case in 1.9 percent of the AIVD’s requests.