The Digital Rights Chronicles: Mass surveillance in the EU
No, unfortunately this is not clickbait
This article is being published for a number of reasons. Firstly, because the European elections are coming up in a week’s time, and secondly, because it shocks me how the EU, which I love so much, is moving further and further away from human rights and how our digital rights are increasingly playing into our human rights. What’s more, I had a disturbing experience while researching this article — but not for the first time, as something similar happened to me when I was researching my eIDAS 2 article.
Please note that this article is strongly influenced by my personal views. I therefore encourage you to look into the topic independently and form your own opinion.
One more info: all YouTube videos linked here can be automitically translated to English.
The European Union. Beacon of democracy? Beacon of human rights? The destination of many refugees worldwide for precisely these reasons, but the light of this beacon is beginning to be nothing more than an afterimage on the retina of our minds. The European Court of Justice has almost surreptitiously given in to the insistence of some EU states on the subject of mass surveillance. And this at a time when more and more right-wing conservative parties are gaining power and influence throughout the EU.
The ECJ ruling of 30 April 2024
The judgment of the Court of Justice of the European Union of 30 April 2024 relates to data processing and retention. It notes that access to identity data associated with IP addresses may be justified under certain conditions, in particular to combat unauthorised use of communications systems and national defense under Article 15(1) of Directive 2002/58. It sets out requirements for the retention of such data in order to ensure compliance with data protection rules. Before authorities are allowed to access stored data, it must be checked by a court or an independent administrative body in order to prevent misuse and ensure the protection of data subjects. The ruling also lays down conditions governing access to the data and requires guarantees against misuse and unauthorised access in order to protect the rights of the data subjects.
In comparison with the ECJ ruling of 6 October 2020
Compared to the new ruling, the judgment of the European Court of Justice (ECJ) of 6 October 2020 set higher standards for the protection of privacy and the handling of personal data in electronic communications. The ECJ emphasised the need for any form of data retention to be strictly regulated in order to safeguard the fundamental rights of citizens. In particular, it stated that general and indiscriminate retention of traffic and location data is not compatible with the fundamental rights of EU citizens, except in cases that are clearly defined and limited to what is strictly necessary to combat serious threats such as terrorism and serious crime. In addition, the importance of independent verification before accessing this data was emphasised in order to prevent misuse and protect the privacy of individuals.
At first glance, the 2024 judgement appears to be a further development of the data protection framework by establishing specific justifications and procedures for accessing and storing identity data. However, it allows for an expanded use and analysis of data, justified by the fight against online counterfeiting and other specified threats. This is seen as a relaxation of the strict restrictions of 2020, as broader access rights to data are now granted, which could increase the risk of abuse and undermine the protection of individual privacy if data storage and use were handled less restrictively.
Mass surveillance in the EU — so what?
Yes, what is the author of this article so upset about? Mass surveillance has always existed somehow. Even under Hitler and the GDR elevated it to an art form. We live in dangerous times. Child molesters on every corner, connected through the digital network, as well as terrorists and organised crime. It’s a good thing that we are now all being monitored and these bad guys are being caught! With AI and other automated systems, we can track them down faster!
Long Story short: No.
Disadvantages of mass surveillance
“Democracy is in danger!” is a cry that is constantly heard in the current European election campaign and it is true. Unfortunately, one of the biggest threats to our democracy is not even a topic in this election campaign: the ECJ judgement, which makes mass surveillance so much easier. This is because it has been established that such surveillance, or even just the fear of surveillance, leads to a so-called “chilling effect”. This means that individuals — consciously and unconsciously — restrict and censor their actions and communication. This immense violation of privacy and data protection has consequences for private individuals as well as journalists and activists, which — whether intentional or not — restricts freedom of speech and opinion and thus jeopardises democracy. This violation of privacy and the increased possibility of political manipulation undermines political participation and the commitment of citizens in the long term.
“But not in the EU! We are a beacon of democracy!”
I’m just saying: Orbán in Hungary.
And here are three murdered journalists from the last 7 years who were killed because of their work in the EU:
- Giorgos Karaivaz — Murdered on 9 April 2021 in Alimos, investigated corruption and a network of organised crime and state institutions
- Ján Kuciak — Murdered on 21 February 2018 in Veľká Mača, researched corruption in the highest circles of Slovakian politics and business.
- Daphne Caruana Galizia — Murdered 16 October 2017 in Bidnija, researched corruption, money laundering, fraud and other criminal activities of the Maltese elite, including politicians — her research was linked to the Panama Papers.
In addition, there are further cases of threats to the security and human rights of other journalists and activists in connection with the Pegasus spyware, particularly in Poland and Spain.
In all these cases, surveillance of the victims played an important role. So anyone who believes that the data collected is not misused still believes in Santa Clause.
Why mass surveillance doesn’t help to catch the real bad guys and actually protects them
You can translate “not seeing the wood for the trees” into “not seeing the threat for the data”. Even with AI, this mass of data is more likely to slow down our security authorities, because even if an AI is constantly scanning and analysing our chat histories, that doesn’t mean it’s going to work. Firstly, you need the server power, which also eats up a lot of electricity (hallelujah, climate change!) and then you mustn’t forget that AI also makes mistakes. Accordingly, there will be a lot of false alarms, because the more data, the more errors. And all of this is now coming to our already completely overburdened authorities. First the investigating authorities, which are already having problems processing the normal flood of cases, and then our judiciary, which in some cases is unable to pass judgement even after 10 years because it has to keep postponing court dates due to overload (no kidding — this is the case in my family). In contrast to Germany, other countries have better digitalisation, which is why the exchange of information could be easier, but now imagine the mountains of files that have to be printed, scanned, faxed and printed again and again in an endless cycle.
The real bad guys are happy because, for one thing, they are unlikely to be discovered in the first place because, unlike the Joe Normal and Berta Dumb, they generally use encrypted communication and darknet platforms, which makes it harder for them to be caught by mass surveillance systems. And even if they do get caught, it is quite possible that their cases will be time-barred before they come before the judge, who will first have to deal with the other cases.
There is therefore a significant diversion of our resources, which is detrimental to law enforcement. Yes, it happens time and again that criminal, encrypted networks are uncovered, but they are not affected by this standard mass surveillance. They can only be caught with targeted investigations and decryption.
But I have nothing to hide!
You may think so, but that doesn’t mean that this surveillance doesn’t put you and/or your loved ones at risk.
Let’s play this out in a fictitious scenario in a fictitious, future Germany. Due to its topicality, I’ll do a case study in the context of cannabis partial legalisation in Germany and in the context of the CanG, but it will not only cover this topic, but also a case inspired by a real case I witnessed last year (but really only inspired — I try to make the scenario as realistic as possible).
CAUTION! EXTREME TRIGGER WARNING!
The beginning of the Mustermann tragedy
We are in Germany. The CDU won the last federal election and is now leading a minority government with the FDP. The AfD has become a leading party in the Bundestag. Max Mustermann legally grows three cannabis plants for his own use for his migraines after the CanG of the last federal government. Because he is a damn good gardener, his harvest exceeds the 50 gram permitted amount of dried flowers. However, because he has put so much love into caring for his plants and his sister Martina Mustermann is an MS patient, he doesn’t want to simply throw away the overproduction, but writes to her privately via WhatsApp asking if she would like some of his harvest, as he now has 80 grams instead of 50 grams.
Surveillance strikes
The new federal government aims to catch and imprison “all drug addicts” because it wants to catch the criminals. As a result, it has loosened the filter for surveillance in order to find all Bubatz criminals and many conservative judges also play along. As a result, the system discovers Max Mustermann’s chat, who is still waiting for a reply from his sister Martina. A major and attention-grabbing search of his flat in Munich ensues.
Max’s life in the meantime
His neighbours have of course noticed everything and are whispering behind closed doors. How can such a serious criminal be living in their honourable house? The tyres on Max’s bike are slashed and his circle of friends is also drastically reduced, because nobody wants to be targeted by the investigators and Max, as a lowly tax assistant, cannot afford to pay a criminal lawyer, which is why he has to make do with a public defender. A public defender who is appointed by the court and the judge is a CDU member. After a few days, Max’s boss at the tax office gets wind of the accusations. He can’t have a criminal in his honourable company and fires Max. Max writes to his sister again and again, but receives no reply. Max is increasingly terrorised by his neighbours and because he can no longer find work due to the investigations against him, he can no longer pay for his flat and moves in with one of his last friends on the couch. Max becomes depressed and suicidal. He has panic attacks every day because of the upcoming trial. After months, he receives a message from his sister saying that she cares about him and loves him, but can’t help because her ex is stalking her and she had to disappear.
Max’s conviction
After the investigation is completed, Max Mustermann is sentenced to 3 years imprisonment for possession of cannabis in a not insignificant quantity and 15 years imprisonment for unauthorised trafficking in narcotics. His public defender is not well paid and is therefore generally not very motivated to help his client, as he cannot waste so many resources on him because he would otherwise be in financial difficulties himself.
Organised crime
Is booming and enjoys the distraction. She successfully expands her network and her business while the authorities pounce on Max Mustermann.
The case Martina Mustermann
Martina was so in love with Martin Aufrecht. A strong man. Handsome. Charming. Gorgeous. Especially when they moved into a house together and he hit her with his fist. The beatings became more and more frequent when she was diagnosed with multiple sclerosis. Martin forced Martina to quit her job and isolated her more and more from her friends and family. Until one day her brother Max paid her a surprise visit in Düsseldorf while Martin was at work in the drugs squad.
Criminal complaint
At the hospital, they discovered that her cheekbone and arm were broken and her collarbone was fractured. There were also lots of haematomas. She filed a complaint when everything was documented. There was no room in the women’s refuge and as Martina was a recipient of income support and owned her own house with her abuser, she was not allowed to move into her own flat. She was told to stay in the house. Max didn’t allow this and Martina moved in with him for the time being.
No escape
Martina healed, underwent therapy, found work again and moved into her own flat. In the meantime, Martin kept calling and messaging her. Martina changed her number, deleted her old email addresses and her social media accounts, but Martin kept finding ways to threaten her. Martina reported it to the authorities, but it didn’t stop. It went on like this for months and the court hearing still hadn’t happened. Suddenly Martina finds photos of herself with crosshairs under her door slit. Again, she reports it to the authorities, but they are overwhelmed. Max and Martina feel powerless and Max starts gardening because the stress gives him extreme migraines. One day, Martina realises that her door has been broken into. Should she go to Max? But he’s already having so much trouble with the pressure… Martina decides to pack her things and leave without telling anyone. She moves to a village in the east. Martina is given false papers in a network of stalking victims. She lives there and feels safe. Until she reads about the charges against Max Mustermann in the newspaper. She gets a mobile phone and writes to her brother.
Found
Max’s communications have been monitored and Martin, who has been transferred to Munich, sees the message from Martina. Using the IP address and other data, he finds Martina’s new home. He opens the old door lock without any problems and waits for Martina, who is working in a supermarket. Martina comes home and Martin stabs Martina to death with 20 stabs. The media will write about a family tragedy and the judge will say that Martin was also a victim, because Martina had withdrawn her love from him and the pain was simply overwhelming for Martin, who only acted out of love. Martin gets 5 years in prison.
The course of events and the judgement are inspired by various reports on the subject of femicides in Germany.
An unrealistic scenario?
Does this scenario from Martina seem unrealistic to you? It is not. Does the name Jamal Khashoggi mean anything to you? A journalist who was murdered in the Saudi consulate in Istanbul on 2 October 2018 when he went to get necessary documents for his upcoming wedding. Saudi agents were waiting for him, who murdered and dismembered him. A trap planned by the Saudi government, made possible by the data and information gathered through the surveillance of Khashoggi’s entourage — not himself — using Pegasus spyware. And especially when you consider the scandal with the private addresses of German activists and politicians that Nazis obtained through a police insider, we know that such data can very quickly fall into the wrong hands.
In the course of my research, I was often told that the data was already being permanently stored and monitored anyway. That may even be true in part. But it is a completely different matter when data retention is already legalised and the infrastructure for a surveillance apparatus is already ready and waiting to be handed over to governments that think nothing of democracy. An infrastructure that makes it very easy to keep undesirable people down, if not kill them. This also deprives the victims and their families of the chance to seek legal recourse to bring those responsible to justice — perhaps only in retrospect, when a change of government has taken place. Any obstacle, no matter how small, that makes it more difficult for the oppressors, possibly (considering the political development, not even that unlikely) in other EU countries, to legitimise this surveillance and oppression is good and important. What are the tears we shed for Hong Kong worth if we don’t even fight for our freedom while we still have it?
P.S.: The server power needed for this surveillance is truly catastrophic for the EU’s climate efficiency. Not the point of the article, but not unimportant in times of climate change.
Political developments in the EU
As a German who is very aware of the responsibility she inherited from National Socialism, I am particularly concerned about the shift to the right in Europe, which — when I think of the populist statements of its supporters and our historical experiences — is happy to abuse surveillance. In Germany, we have an increase in AfD support to 21%, with Hungary followed by Poland, France and Italy seemingly topping the list of countries with the most support for right-wing conservative parties. This makes these European elections even more important.
Lack of true digital expertise
Unfortunately, it really is like that. If I look at the German party landscape, there is only one party that has genuine digital expertise: the Pirate Party. Unfortunately, all the others more or less lack it. But you’ll have to see for yourself, but statements such as “The Internet is new territory for all of us” and advocacy of mass surveillance don’t exactly demonstrate a high level of digital competence (and in the latter case, advocacy of human rights and the protection of democracy).
You have the choice
I have to admit that Nico Semsrott, especially with his programme “See Brussels and die”, really puts a damper on things when it comes to the question of democracy and transparency in the EU, but also gives you tips on what you can do yourself.
We have many parties and I think we also have some (many) politicians who care about our democracy and human rights. I’m not going to give you a voting recommendation here, but like so many others, I recommend that you use the Wahl-O-Mat and perhaps also read through the election programmes of the parties that come into the closer selection, because the Wahl-O-Mat doesn’t necessarily cover all topics (such as mass surveillance and privacy — lol).
Resignation is NOT an alternative
We are not yet in a dictatorship or autocracy. Yes, the cases of abuse of surveillance systems have come from governments. See it as a warning of what we face when parties that don’t value human rights and democracy too much have a majority in parliament. So use the voice you have. An ocean is ultimately just a collection of drops and yet it influences life on the whole earth.
So on 9 June 2024, vote for the party that you think can best lead the EU.
Before I tell you my anecdote about my research, I would like to recommend the last Aspekte episode from ZDF (unfortunately only in German available). It was really good.
Anecdote(s) from my research
To be honest, last year I thought it was a coincidence that I couldn’t really find anything about eIDAS 2 on Google, but this year the same phenomenon occurred during my research, which I captured in a screenshot:
But I saw this one on DuckDuckGo:
As I said before, it’s not the first time I’ve experienced this and it makes me feel… uneasy. For other searches, Google shows me results, but as soon as I search for something specific on critical issues relating to EU policy, the results are… meagre and worry me. Google is still one of the first places to go when doing online research and then this… that’s not good.
You can find more articles on the topic of digital rights here:
If you liked this article, don’t hesitate to applaud and share it. If you would like to share your own experiences with me, I look forward to your comments and if you don’t want to miss my other articles, feel free to follow me.
This article was translated by using DeepL to save time.
Sources:
DW (2024). Right-wing parties forecast for gains in 2024 EU elections. Retrieved from https://p.dw.com/p/4beIR
Politico (2024). EU election 2024: New poll shows right-wing populist surge. Retrieved from https://www.politico.eu/article/eu-election-2024-right-wing-populist-surge
Euronews (2022). Denmark election: From kingmakers to comeback kids, five things we learned from the vote. Retrieved from https://www.euronews.com/2022/11/02/denmark-election-from-kingmakers-to-comeback-kids-five-things-we-learned-from-the-vote
Politico (2019). Meet Denmark’s new anti-Islam, anti-immigration, anti-tax party. Retrieved from https://www.politico.eu/article/denmark-new-right-wing-party-nye-borgerlige
DW (2019). Denmark’s left turns right in general election. Retrieved from https://www.dw.com/en/denmarks-left-turns-right-in-general-election/a-49056923
DW (2019). Denmark’s Social Democrats move back into power. Retrieved from https://www.dw.com/en/denmarks-social-democrats-move-back-into-power/a-49056984
Atlantic Council (2020). Putting privacy limits on national security mass surveillance: The European Court of Justice intervenes. Retrieved from https://www.atlanticcouncil.org/article/putting-privacy-limits-on-national-security-mass-surveillance-the-european-court-of-justice-intervenes
Amnesty International (2023). EU: Bloc’s decision to not ban public mass surveillance in AI Act sets a devastating global precedent. Retrieved from https://www.amnesty.org/en/latest/news/2023/12/eu-decision-not-to-ban-public-mass-surveillance
DW (2024). Aktueller Stand des Cannabisgesetzes in Deutschland. Retrieved from https://www.dw.com/en/aktueller-stand-des-cannabisgesetzes-in-deutschland/a-56093187
Tagesschau (2024). CDU/CSU und ihre Haltung zur Cannabis-Legalisierung. Retrieved from https://www.tagesschau.de/inland/cdu-cannabis-legalisierung-101.html
Süddeutsche Zeitung (2024). AfD und die Cannabis-Legalisierung: Kritische Stimmen und politische Positionen. Retrieved from https://www.sueddeutsche.de/politik/afd-cannabis-legalisierung-102.html
Bundeszentrale für politische Bildung (2024). Überblick zur Cannabis-Legalisierung in Deutschland. Retrieved from https://www.bpb.de/themen/gesundheit/cannabis-legalisierung-deutschland-2024
BGH (2024). Urteil zur Vorratsdatenspeicherung und Datenschutz in Deutschland. Retrieved from https://www.bundesgerichtshof.de/DE/Urteile/BGH_2024_Vorratsdatenspeicherung.html
Politico (2024). Europe’s state of mass surveillance. Retrieved from https://www.politico.eu/article/europes-state-of-mass-surveillance
Atlantic Council (2024). The European Court of Justice’s decision on data retention and its impact. Retrieved from https://www.atlanticcouncil.org/article/european-court-of-justice-decision-data-retention
Netzpolitik (2024). Gericht lässt Massenüberwachung des Internets zu. Retrieved from https://netzpolitik.org/2024/eugh-urteil-gericht-laesst-massenueberwachung-des-internets-zu/#:~:text=Der%20EuGH%20hat%20gerade%20den,Ein%20Gastkommentar
Netzpolitik (2024). „Traurige Wende beim Schutz der Privatsphäre“. Retrieved from https://netzpolitik.org/2024/eugh-urteil-zur-vorratsdatenspeicherung-traurige-wende-beim-schutz-der-privatsphaere/
Netzpolitik (2024). Wenn die Abwehrfront bröckelt. Retrieved from https://netzpolitik.org/2024/vorratsdatenspeicherung-wenn-die-abwehrfront-broeckelt/
eco (2024). Mögliche Einigung beim Quick-Freeze-Verfahren: eco fordert konsequente Aufhebung der Vorratsdatenspeicherung. Retrieved from https://www.eco.de/presse/moegliche-einigung-beim-quick-freeze-verfahren-eco-fordert-konsequente-aufhebung-der-vorratsdatenspeicherung/
InfoCuria (2024). URTEIL DES GERICHTSHOFS (Plenum). Retrieved from https://curia.europa.eu/juris/document/document.jsf?text=&docid=285361&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1
EUR-Lex (2020). URTEIL DES GERICHTSHOFS (Große Kammer). Retrieved from https://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:62018CJ0511
Wikipedia (2024). Treffen von Rechtsextremisten in Potsdam 2023. Retrieved from https://de.wikipedia.org/wiki/Treffen_von_Rechtsextremisten_in_Potsdam_2023#Teilnehmer
Schneier, B. (2006). Terrorists, Data Mining, and the Base Rate Fallacy — Schneier on Security. Retrieved from https://www.schneier.com/blog/archives/2006/07/terrorists_data.html
Corrigan, R. (2019). Mass surveillance not effective for finding terrorists. Retrieved from https://www.newscientist.com/article/dn26801-mass-surveillance-not-effective-for-finding-terrorists/
Daragh Murray, Pete Fussey, Kuda Hove, Wairagala Wakabi, Paul Kimumwe, Otto Saki, Amy Stevens, The Chilling Effects of Surveillance and Human Rights: Insights from Qualitative Research in Uganda and Zimbabwe, Journal of Human Rights Practice, Volume 16, Issue 1, February 2024, Pages 397–412, https://doi.org/10.1093/jhuman/huad020
Claudia Aradau, Emma Mc Cluskey, Making Digital Surveillance Unacceptable? Security, Democracy, and the Political Sociology of Disputes, International Political Sociology, Volume 16, Issue 1, March 2022, olab024, https://doi.org/10.1093/ips/olab024
Zygmunt Bauman, Didier Bigo, Paulo Esteves, Elspeth Guild, Vivienne Jabri, David Lyon, R. B. J. Walker, After Snowden: Rethinking the Impact of Surveillance, International Political Sociology, Volume 8, Issue 2, June 2014, Pages 121–144, https://doi.org/10.1111/ips.12048
Wong, C. (2014). A Clear-Eyed Look at Mass Surveillance. Retrieved from https://www.hrw.org/news/2014/07/25/clear-eyed-look-mass-surveillance
Guild, E. (2014). What does mass surveillance do to Human Rights?. Retrieved from https://www.opendemocracy.net/en/can-europe-make-it/what-does-mass-surveillance-do-to-human-rights/
Muižnieks, N. (2016). Human rights in Europe should not buckle under mass surveillance. Retrieved from https://www.opendemocracy.net/en/digitaliberties/human-rights-in-europe-should-not-buckle-under-mass-surveillance/
Hasenson-Gross, M. (2022). Remembering the Holocaust must prompt us to challenge today’s human rights abuses. Retrieved from https://www.opendemocracy.net/en/holocaust-memorial-day-uyghurs-china-genocide-never-again/
CPJ. (2024). Explore CPJ’s database of attacks on the press. Retrieved from https://cpj.org/data/?status=Killed&start_year=2015&end_year=2024&group_by=location_sorted&motiveConfirmed%5B%5D=Confirmed&type%5B%5D=Journalist
Amnesty International. (2022). The Pegasus Project: One year on, spyware crisis continues after failure to clamp down on surveillance industry. https://www.amnesty.org/en/latest/news/2022/07/the-pegasus-project-one-year-on-spyware-crisis-continues-after-failure-to-clamp-down-on-surveillance-industry/
Amnesty International. (2023). EU: Final vote on spyware inquiry must lead to stronger regulation. Retrieved from https://www.amnesty.org/en/latest/news/2023/06/eu-final-vote-on-spyware-inquiry-must-lead-to-stronger-regulation/
Politico. (2022). Europe’s online child abuse law will make us all less safe. Retrieved from https://www.politico.eu/article/europe-online-child-abuse-law-make-us-less-safe/
Wittig, J. (2024). Legaler Besitz, illegaler Erwerb?. Retrieved from https://www.lto.de/recht/hintergruende/h/cannabis-schwarzmarkt-illegaler-erwerb-zeuge-staatsanwaltschaft-legalisierung/
Patzak, J. (2024). Erste Entscheidung des BGH zur nicht geringen Menge im KCanG. Retrieved from https://community.beck.de/2024/04/23/erste-entscheidung-des-bgh-zur-nicht-geringen-menge-im-kcang
Middle East Monitor. (2021). US says Saudi crown prince approved Khashoggi operation. Retrieved from https://www.middleeastmonitor.com/20210226-us-says-saudi-crown-prince-approved-khashoggi-operation/
Middle East Monitor. (2021). Khashoggi’s friends, family targeted by Saudi, UAE using Israel spyware, data leak reveals. Retrieved from https://www.middleeastmonitor.com/20210719-khashoggis-friends-family-targeted-by-saudi-uae-using-israel-spyware-date-leak-reveals/
Zeit Online. (2021). Der Anschlag nach dem Mord. Retrieved from https://www.zeit.de/politik/ausland/2021-07/jamal-khashoggi-mord-journalist-ueberwachung-software-pegasus-saudi-arabien
Zeit Online. (2023). Nur einer unter Tausenden. Retrieved from https://www.zeit.de/politik/2023-04/jamal-khashoggi-journalist-pegasus-investigativpodcast
t3n. (2023). Kashoggi-Mord: Pegasus-Spyware auf Handy von Ehefrau gefunden. Retrieved from https://t3n.de/news/kashoggi-mord-pegasus-spyware-1439660/
Grubwinkler, K. (2024). BGH gegen Rechtsstaatlichkeit — LIVE. Retrieved from https://www.youtube.com/watch?v=ybBgPQkG_o4
