The TIM-Huawei Decree and the Chinese’knot untangling

The Italian Presidency of the Council sets the conditions to include Huawei’s technology in the Italian 5G network and might ease the overcoming tensions between the USA and China by Andrea Monti

The Prime Ministerial Decree of August 7, 2020, allows TIM (the former Italian telco monopolist) to use Huawei’s 5G technology, having identified adequate measures to prevent the risks of using Chinese equipment for Italy’s new generation network. This news follows, and contradicts, the exclusion of Huawei from the tender to provide TIM with the same 5G devices because of the need for “diversification of partners” (a requirement lately imposed by the Conte-Huawei Decree). Originally published in Italian by Continue reading “The TIM-Huawei Decree and the Chinese’knot untangling”

GDPR compliance needs more incidents than fines

By Andrea Monti – originally published in Italian by Infosec News

I write this article in one of those rare moments when I indulge in the belief that computer security is something that should be taken seriously. I do not want to disrespect the many professionals who try to work by seriously helping customers and employers to “keep the ship going”. Nor, however, can I pretend to ignore what the cybersecurity market was and has become. Without many hackers, there would not even be the slightest improvement in security caused by these stunts.

Crime’s apology? Incitement to commit a crime? No, merely stating an objective fact: in the field of computer security, it is not the fines that induce legal compliance.

Project Gutenberg and the Crusader of Copyright

In the name of the new crusade against the “pirates of copyright” the public prosecutor of Rome seizes, the site of the cultural project that digitizes and puts online copyright-free books. But neither the court nor the Guardia di Finanza has noticed. Is it a justifiable mistake? by Andrea Monti – originally published in Italian by Infosec.News
Continue reading “Project Gutenberg and the Crusader of Copyright”

Platforms’ liability for news theft

by Andrea Monti (originally published in Italian by IlSole24Ore – May 1, 2020)

The criminal investigations against the unlawful distribution of newspapers, periodicals and books are interesting in several respects. Firstly, it is a step towards making those who commit a crime by hiding behind the screen of a smartphone, i.e. the user of a service, responsible for their course of action. Secondly, it focuses on “platforms”, i.e. those operators who “rely” on the access network to make profits and who therefore can immediately provide data to prosecutors and perform selective blocking. Thirdly, and as a consequence, it puts again on the table the issue of the actual (non) neutrality of platforms. EU Directive 31/00 is evident in this respect: operators who do not interfere in users’ behaviour must not perform pre-emptive monitoring. But those who, like platforms, are not “neutral” to those who use them should not be able to take advantage of this possibility, as has been happening for some time in Italy and Europe.

Hopefully, the European Union eventually decide to give platforms an autonomous legal status and liability. However, these criminal investigations create a legal precedent on another very technical but essential issue: the possibility of configuring a responsibility (whether under the criminal intent or other liability doctrines) for crime by design. The idea is simple: as in any human action, when somebody decides to do something, has to make sure that it does not cause damage and upholds the law. If somebody designs a platform (or a business model that exploits it) without mechanisms that prevent its illicit use, and the absence of these mechanisms is what makes my product/service successful, then he cannot deflect his liability.

In this specific case, therefore, it is necessary to understand the way Telegram works and assess, for example, if it is a provider of a press distribution service and then if the entire revenue generation model is based on service neutrality.

Finally, this case is the test-bed for that case law (Cass. penale, sez.II sent. 11959/20) that, after only twenty-five years from the first theoretical elaborations, finally recognizes the nature of “thing” to data and files. This jurisprudence opens the possibility to charge a defendant not only of copyright infringements but also of serious crimes such as money laundering or receiving stolen goods. In this case, it would be possible to claim more substantial charges for the perpetrators of the offences, and more dissuasive for those who have “nasty thoughts”.

The Strasbourg Court: operators may retain data on purchasers of prepaid SIM cards

According to a ruling of the European Court of Human Rights, storing data of those who buy a prepaid SIM card does not infringe the privacy and helps criminal investigations.
by Andrea Monti

On January 30, 2020, the European Court of Human Rights issued the judgment in Case 50001/12 (Breyer v. Germany). The Court ruled that it is lawful for telephone operators to retain personal data of prepaid SIM card users and communicate it to the authorities in response to a formal request. The principle expressed by the Court seems trivial and obvious, but it is an essential barrier to the overwhelming invasiveness of a poorly understood “right to privacy”, which is much too often invoked inappropriately.

The decision follows an action brought in Germany by two civil rights activists who had complained that their privacy had been violated because of the obligation in question, laid down in Article 111 of the German Telecommunications Code.
This provision burdens with two obligations an operator offering telecommunications services involving the allocation or otherwise management of telephone numbers. The first is the duty to ask the customer for an identity document and then to keep the number assigned, the name, address (and date of birth, in the case of natural persons) of the holder, the address of the circuit in the case of a fixed line, the IMEI of the mobile terminal (when supplied with the number), the date of entry into force of the contract. The second is to communicate these information to the authorities pursuing a legitimate request.

In a frankly captious manner, the two complainants took the view that their privacy was infringed by the mere fact that the data in question were stored, without complaining about any form of abusive interception or other electronic surveillance by the German institutions. And – it should be added – it is not clear where the “violation of privacy” would be in the conservation of data which are entirely harmless and which, moreover, at least in Italy, should in any case be preserved to ensure compliance with tax and civil law.

After an in-depth analysis of the national, European and Community regulatory framework, the Court found that the system of control over the activities of public authorities – and in particular the investigative ones – is adequate to allow the balance between the individual right to respect for private life and the duty of the State to bring to justice those responsible for criminal acts.

For the record, the decision was not unanimous because one of the judges released a dissenting opinion. In synthesis, the dissenting judge held that non-critical data such as those subject to conservation would, in any case, have allowed the police forces to associate specific contents to the identity of the holder of the SIM (hardly an issue, since this is precisely what is expected of the investigating authority).
In addition, said the dissenting judge, German law created a preventive and generalized listing of all the holders of a SIM card, i.e. … a telephone directory. Again, it is hard to see where the violation of “fundamental rights” would be.
Finally, and this is the weakest part of this dissenting opinion, the conservation of these data would be disproportionate with respect to the “protection of privacy” because German law allows access to data not only the judicial authorities but also the emergency services, customs and fiscal and tax control services. Put in these terms, therefore, “in the name of privacy” the State should not be able to use the personal data of the SIM holders to counter tax evasion, customs fraud or to intervene in an emergency. A rather paradoxical conclusion.

Net of the questionable “minority motion”, this decision – especially from an Italian perspective – expresses a rather banal principle, since, as is well known, the Italian operators acquire the identity document not only in the SIM purchase phase but also in every subsequent intervention (from substitution, to change of size, to migration toward another operator).

At the same time, however, the decision reveals how distorted and instrumental is the concept of the “right to privacy”, which is invoked in an increasingly disjointed way, in the belief that it is like Captain America’s shield or Iron Man’s Hulkbuster: an instrument capable of blocking the operation of any other law.

In reality, this is not so because the right to respect for one’s family and private life can and must step back in the name of public interests such as, precisely, that of investigating criminal actions, provided that the public authorities are under scrutiny and that the limitation of an individual right is proportionate to the judicial goal.

It is clear, therefore, that the claims of the plaintiffs had no real substance because they translated into generic, abstract and unrelated statements with actual violations of some fundamental right. And one wonders what the meaning of such actions is since they have the effect of damaging the right to respect for private life rather than protecting it.

On the sidelines, in conclusion, it is worth mentioning one collateral but no less important aspect of the judgment: the fact that the decision considers “national security” (and not only the fight against crime) as a suitable criterion for establishing the limitation of fundamental rights.

While, however, criminal law and investigation rule govern the fight against crime, the concept of “national security” is not defined by law as an objective of political action.

The consequence is that if the need to protect national security is not “incorporated” into a law defining its contents and operational limits, then national security becomes an unbearable weight that alters any balance with the protection of individual rights. In other words, that would mean to use a political (rather than legal) criterion to intervene on constitutionally guaranteed rights, without going through Parliament’s assessment.

If anything, it would have been essential to ask the Court to intervene on this issue, rather than on others of marginal importance.