Project Gutenberg and the Crusader of Copyright

In the name of the new crusade against the “pirates of copyright” the public prosecutor of Rome seizes, the site of the cultural project that digitizes and puts online copyright-free books. But neither the court nor the Guardia di Finanza has noticed. Is it a justifiable mistake? by Andrea Monti – originally published in Italian by Infosec.News
Continue reading “Project Gutenberg and the Crusader of Copyright”

The Strasbourg Court: operators may retain data on purchasers of prepaid SIM cards

According to a ruling of the European Court of Human Rights, storing data of those who buy a prepaid SIM card does not infringe the privacy and helps criminal investigations.
by Andrea Monti

On January 30, 2020, the European Court of Human Rights issued the judgment in Case 50001/12 (Breyer v. Germany). The Court ruled that it is lawful for telephone operators to retain personal data of prepaid SIM card users and communicate it to the authorities in response to a formal request. The principle expressed by the Court seems trivial and obvious, but it is an essential barrier to the overwhelming invasiveness of a poorly understood “right to privacy”, which is much too often invoked inappropriately.

The decision follows an action brought in Germany by two civil rights activists who had complained that their privacy had been violated because of the obligation in question, laid down in Article 111 of the German Telecommunications Code.
This provision burdens with two obligations an operator offering telecommunications services involving the allocation or otherwise management of telephone numbers. The first is the duty to ask the customer for an identity document and then to keep the number assigned, the name, address (and date of birth, in the case of natural persons) of the holder, the address of the circuit in the case of a fixed line, the IMEI of the mobile terminal (when supplied with the number), the date of entry into force of the contract. The second is to communicate these information to the authorities pursuing a legitimate request.

In a frankly captious manner, the two complainants took the view that their privacy was infringed by the mere fact that the data in question were stored, without complaining about any form of abusive interception or other electronic surveillance by the German institutions. And – it should be added – it is not clear where the “violation of privacy” would be in the conservation of data which are entirely harmless and which, moreover, at least in Italy, should in any case be preserved to ensure compliance with tax and civil law.

After an in-depth analysis of the national, European and Community regulatory framework, the Court found that the system of control over the activities of public authorities – and in particular the investigative ones – is adequate to allow the balance between the individual right to respect for private life and the duty of the State to bring to justice those responsible for criminal acts.

For the record, the decision was not unanimous because one of the judges released a dissenting opinion. In synthesis, the dissenting judge held that non-critical data such as those subject to conservation would, in any case, have allowed the police forces to associate specific contents to the identity of the holder of the SIM (hardly an issue, since this is precisely what is expected of the investigating authority).
In addition, said the dissenting judge, German law created a preventive and generalized listing of all the holders of a SIM card, i.e. … a telephone directory. Again, it is hard to see where the violation of “fundamental rights” would be.
Finally, and this is the weakest part of this dissenting opinion, the conservation of these data would be disproportionate with respect to the “protection of privacy” because German law allows access to data not only the judicial authorities but also the emergency services, customs and fiscal and tax control services. Put in these terms, therefore, “in the name of privacy” the State should not be able to use the personal data of the SIM holders to counter tax evasion, customs fraud or to intervene in an emergency. A rather paradoxical conclusion.

Net of the questionable “minority motion”, this decision – especially from an Italian perspective – expresses a rather banal principle, since, as is well known, the Italian operators acquire the identity document not only in the SIM purchase phase but also in every subsequent intervention (from substitution, to change of size, to migration toward another operator).

At the same time, however, the decision reveals how distorted and instrumental is the concept of the “right to privacy”, which is invoked in an increasingly disjointed way, in the belief that it is like Captain America’s shield or Iron Man’s Hulkbuster: an instrument capable of blocking the operation of any other law.

In reality, this is not so because the right to respect for one’s family and private life can and must step back in the name of public interests such as, precisely, that of investigating criminal actions, provided that the public authorities are under scrutiny and that the limitation of an individual right is proportionate to the judicial goal.

It is clear, therefore, that the claims of the plaintiffs had no real substance because they translated into generic, abstract and unrelated statements with actual violations of some fundamental right. And one wonders what the meaning of such actions is since they have the effect of damaging the right to respect for private life rather than protecting it.

On the sidelines, in conclusion, it is worth mentioning one collateral but no less important aspect of the judgment: the fact that the decision considers “national security” (and not only the fight against crime) as a suitable criterion for establishing the limitation of fundamental rights.

While, however, criminal law and investigation rule govern the fight against crime, the concept of “national security” is not defined by law as an objective of political action.

The consequence is that if the need to protect national security is not “incorporated” into a law defining its contents and operational limits, then national security becomes an unbearable weight that alters any balance with the protection of individual rights. In other words, that would mean to use a political (rather than legal) criterion to intervene on constitutionally guaranteed rights, without going through Parliament’s assessment.

If anything, it would have been essential to ask the Court to intervene on this issue, rather than on others of marginal importance.

Understanding the robustness of a perimeter defense

This video shows the different penetrating power of various pistol caliber and gives a useful tip for those who (claim to) work in the IT security field: when setting up a perimeter defense, the “penetrating power” of the attack should be taken into account.

In other words, there is no “one-fit-all” solution when it comes to building a digital bulletproof vest, and if somebody thinks that a fancy leather jacket might be the very same than a kevlar vest with ceramic plates, he might be wrong. Deadly, as it would be the infrastructure he claimed to protect.

Prevention and Repression of Computer Crime against the EU: the problem is clear, the solution doesn’t

On May 17, 2019 the Council of the European Union has established

a framework which allows the EU to impose targeted restrictive measures to deter and respond to cyber-attacks which constitute an external threat to the EU or its member states, including cyber-attacks against third States or international organisations where restricted measures are considered necessary to achieve the objectives of the Common Foreign and Security Policy (CFSP).

In other words, this framework allows the EU to enforce a series of sanctions – including the prohibition of entry into the EU – to  those who attack the computer resources located in the Union from other countries. At first glance, everything would look normal and – all in all – acceptable. But since the devil is in the details, a more in-depth look at the matter reveals a few problems.

Firstly, the violation of the principles of due process: a computer attack is a crime and for sanctions to be applied to the culprits,  a proper trial is necessary. In the outline envisaged by the Council of European Union, this is not foreseen.  A blatant violation of the fundamental rights of the individual (also) recognized by the Nice Charter.

Secondly, even if the first condition is met, it must be remembered that in criminal matters the jurisdiction belongs strictly and solely to the national legislator. What cases and which penal codes or similar rules will be applied in order to decide whether we are dealing with an event which falls within the scope of the ‘framework’ laid down by the Council?

Thirdly, are we talking about public policy, state security or the defense of the interests of the Union? The question is not trivial because in the first case the “domain” is that of a hypothetical “EU Ministry of the Interior”, in the second of the hypothetical “European secret services” and in the third case of the “Ministry of Defense”. Ambiguously, however, the Council speaks of “discouraging” (i.e. “preventing”) and “opposing” (i.e. “reacting”) in order to achieve the objectives of the foreign policy “And” those of the common security. This means that “prevention” and “reaction” to the cyber attacks are instruments of “enforcement” of the foreign policy of the EU also independently of security issues.

Let’s get ready to face very interesting issues…