7 ms·

NL national security law to grant automatic permission for targeted surveillance

210 points by pseudotrash 3y ago

moi2388 3y ago
It sounds really scary, but it’s so they can actually collect evidence. Now they target a hacking group but can’t break in with their targets to actually collect evidence. They still need a judge to provide a warrant, there is still oversight. In practice not much will change, except they only have to ask for 1 warrant instead of 10 like they do now.
joanne123 3y ago
[dead]
teamspirit 3y ago
I'm having issues loading the page. https://archive.is/J3ieO https://archive.is/J3ieO if it helps anyone.
deleted 3y ago
[deleted]
jacquesm 3y ago
One example of where this would apply is for instance against criminals whose medium of information exchange has been compromised. Yes, they are 'victims', but they are also perps and probably in much worse crimes than the original hack of their comms. An example of such a situation is the EncroChat hack.
- daenney 3y ago
  It also applies to all victims of hackers, irrespective of whether the victims themselves are supposedly criminals or not. So if you get hacked, then suddenly the government can hack you too. No amount of hypothetical "it could also be used against criminals" balances out the bonkers overreach this represents.
  - jacquesm 3y ago
    In theory yes, but in practice this hasn't happened and I really don't expect it to happen. I've seen enough of LE in NL up close to have an idea of how it all hangs together and this article definitely has a point: the law should be worded more carefully but at the same time it isn't going to get out of hand the way the article would have you believe. Plenty of oversight here and judges that take conflicting laws fairly seriously (such as the GDPR, but also laws regarding the gathering of evidence and such). NL has lots of problems, but lack of judicial oversight over both the police and the intelligence services isn't one of them, in fact you could make a pretty good argument that the degree of oversight actually hinders going after tech savvy criminals. But better too much than too little. This law won't change that by much as far as I can see.
    - ar-jan 3y ago
      You say "this hasn't happened" and "plenty of oversight", but the president of the review committee just resigned because of this. And she isn't allowed to inform the public nor parliament of what has already been happening, even before this change. As in, examples of the type of surveillance already happening have been redacted from the annual report of the review committee [0]. The annual report was specifically made to omit operational details and only inform of the general picture, but parts have been declared state secret. The now ex-president of the review committee stated she could not inform parliament because she did not want to go to prison for 15 years [1]. 0: https://www.tweedekamer.nl/kamerstukken/detail?id=2023Z05165&did=2023D12102 https://www.tweedekamer.nl/kamerstukken/detail?id=2023Z05165... 1: https://debatdirect.tweedekamer.nl/2023-03-30/binnenlandse-zaken/groen-van-prinstererzaal/technische-briefing-door-ctivd-en-tib-over-de-tijdelijke-wet-cyberoperaties-17-30/video https://debatdirect.tweedekamer.nl/2023-03-30/binnenlandse-z...
    - costco 3y ago
      "Going dark" is a scam - https://crimesciencejournal.biomedcentral.com/articles/10.1186/s40163-023-00185-4 https://crimesciencejournal.biomedcentral.com/articles/10.11... for instance found that there was no difference in conviction rate for cases involving E2EE encryption vs those that didn't in the Netherlands. The government just wants the halcyon period of surveillance from late 1900s to the early 2000s back but these supposed tech savvy criminals almost never turn out to exist.
- hulitu 3y ago
  Another example are opposition's politicians.
- radicalbyte 3y ago
  The thing is, is that we've had an oversight commission who reacted quickly to decide in those cases. That worked, it provided oversight. Now they want free reign to spy on everyone.
  - jacquesm 3y ago
    Wanting something and getting it aren't the same thing and it wouldn't be the first time that something like this gets enacted and then gets shut down again. My main worry would be journalists, those are at some danger from stuff like this especially when they are protecting their sources. If this ever gets abused that's where I would expect it to happen.
    - coldtea 3y ago
      That's one of the prime real uses cases they'd care about...
      - jacquesm 3y ago
        Yes, and clearly there should be a very pointed note about journalists in this law if it is to be put into practice. But for the likes that use(d) EncroChat I'm all for it. Btw, both lawyers and journalists have quite a few special protections under Dutch law and it isn't clear to me that this proposal would trump those protections, in fact if challenged I would expect the judiciary to affirm that those protections carry the most weight.
        ahubert 3y ago
        Author here - the protections remain in theory, but will not longer be active beforehand. It is possible that the oversight committee finds the time to check afterwards, but they aren't obliged to do so. Also, by then the damage is done.
        jacquesm 3y ago
        Yes, that's the risk, but: similar issues have been flagged in the past and in the end oversight won out so I'm not quite as worried as you are. A typical scenario is that a hacker is using a series of nested accesses to compromised systems, if the original warrant allows for tracking the hacker on the first system then there is no time to obtain warrants for the systems that are uncloaked as the result of the investigation, this happens pretty much in real time. So this provision allows the investigation to proceed and will have a reasonable time allowed to 'catch up'. It definitely is possible that it will be abused, but that will lead to this provision being disbanded, as has happened in the past when dutch LE overstepped their authority. I'm fairly sure that those lessons - and the cases thrown out as a result - have been learned, but of course it is very well possible that we'll see a re-run. I'm on the fence on this one, I'd say let's see where it leads because it is clear to me that the digital world is moving much faster than law enforcement can normally speaking keep up with and a lot of crime is perpetrated because of that. The risk of abuse of such methods is always present, and 'protections in theory' that are abused tend to find very unsympathetic judges in this country. It's fairly clear that something will have to change if LE is to keep up with the increase in online crime, whether this overshoots the mark or not remains - in my view - to be seen. It definitely has that risk, but then again, so would every other proposal short of the status quo and that clearly isn't effective enough.
13of40 3y ago
Assuming a security analyst is allowed to look at content that's been identified as malicious beyond some threshold like 99.9%... And in order to address emerging threats, they should be able to apply their judgement based on threat indicators like known bad hashes, origin from known bad email addresses or IPs, etc. to call something malicious beyond that threshold... Does that mean that if they know your account is under attack they can just read all of your emails? I would give that a big "no" because unless your account has 999 malicious emails in it for every benign one, they have not met the criteria.
- coldtea 3y ago
  >Does that mean that if they know your account is under attack they can just read all of your emails? If they "suspect" it is more like it in practice, suspecting also meaning "when they want to target you".
  - 13of40 3y ago
    My point is that unless they can make a case that some random email from your inbox is 99.9% likely to be malicious, then they should not be able to read it. Yes they have a button that lets them read it, but they should not press that button, and if they do they should get their ass sent to the clink.
    - coldtea 3y ago
      >but they should not press that button, and if they do they should get their ass sent to the clink They'll be the ones helping send others to the clink and being best buddies with those who do, so fat chance of that restraint or punishment getting to them.
explorer83 3y ago
So to my understanding what they are proposing is allowing you to be hacked by the government if you are a victim of hacking by another actor. I can see the value of this being able to access log files and other data that could assist in investigating the original hackers. I suppose they wouldn't want to always tip off the victim of hacking because the victim might change something that could scare aware the original hackers or delete useful metadata before the investigation could be carried out. But it essentially could become a free pass for the state to hack anybody. Because 1.) Anyone with a public facing server knows there are bot hacking attempts made against them 24/7 or 2.) Just hire a 3rd party to hack someone then you have immediate cause to get access to their data. This article didn't seem to have a definite answers what kind of protections would be put in place in these events. It sounded like they previously did try to word the law to only pertain to the original investigation but one can only wonder.
- nonethewiser 3y ago
  Yes. This simply makes it legal for the Dutch government to hack their citizens. It doesn't matter what the intentions or purported rules are, if they are self-regulating then there are no limits. The publicly stated intentions and rules only give some naive people peace of mind.
  - belter 3y ago
    Coming from the State that did not yet resolved one of the worst scandals ever...And from the Prime Minister that deleted official government data for years... "Dutch scandal serves as a warning for Europe over risks of using algorithms" - https://www.politico.eu/article/dutch-scandal-serves-as-a-warning-for-europe-over-risks-of-using-algorithms/ https://www.politico.eu/article/dutch-scandal-serves-as-a-wa... "Dutch PM has been deleting text messages daily for years: report" - https://nltimes.nl/2022/05/18/dutch-pm-deleting-text-messages-daily-years-report https://nltimes.nl/2022/05/18/dutch-pm-deleting-text-message...
    - bboygravity 3y ago
      Don't overreact, they just kidnapped a few thousand kids from their families and placed them with foster parents due to some bureaucratic hick-ups. No biggy. /s
rollulus 3y ago
The author of the article is Bert Hubert, starred frequently on HN [1] and has expertise in many fields, including the world of intelligence agencies. [1]: https://news.ycombinator.com/from?site=berthub.eu https://news.ycombinator.com/from?site=berthub.eu
- ahubert 3y ago
  Well I try to :-)
  - sam_lowry_ 3y ago
    Thank you and please keep trying, Bert!
  - rollulus 3y ago
    Now I’m star-struck. Thanks for your work.
ahubert 3y ago
Author here - I mirrored the page on https://berthub.eu/articles/posts/dutch-intel-law-about-intel/ https://berthub.eu/articles/posts/dutch-intel-law-about-inte... since y'all managed to take out the about:intel server!
- pseudotrash 3y ago
  Blimey watch what you share in your tweets man. It's not like we need to explain loud balancing to you?
greatgib 3y ago
It is really scary the accelerating trend of creating regulations to restrict or violate basic human rights on the basis of straw man national security reasons... What is nice with this law is that they can look for things not related to the hack on target devices. If they see something incriminating against you not related to the case, they can still use it against you in a new procedure. Without warrant. How convenient. In addition, I can easily guess that they don't have to prove that you were really hacked, but mere suspicion or being a potential victim of the hackers might be enough.
- varispeed 3y ago
  What makes me feel puzzled is I remember politicians were condemning these type of actions done in authoritarian countries. I now wonder whether that was a genuine concern or just a tool used for bargaining. I also find puzzling, that I remember people being outraged if country X done something and now when something like this gets done in Western countries, there is very much indifference. When I talked about this with a couple of friends, who are not interested in politics, they just shrugged it "why would anyone would be interested in spying on me. I don't do anything wrong, so they can follow me to their heart's content. That would be a waste of time." and so on. Seems like indeed, the media are powerful in regulating emotions and turning the outrage up and down. If that topic was on the front pages, using the same language as some other issues that governments are using to cover up their ineptitude (so called dead cats), then maybe people would be more aware and inclined to do something about it. But I can imagine anyone trying to run these kind of stories would be quickly shut down.
  - ecshafer 3y ago
    When a politician says a country is authoritarian, they don't really care about that. What they mean is that "this country is not friendly to our own imperial interests so they are bad". The media is owned by these same people that push these laws.
  - tome 3y ago
    > I remember politicians were condemning these type of actions done in authoritarian countries I don't remember it. Do you have some citations that would jog my memory?
Rizz 3y ago
I suspect this is also to provide a legal framework to automatically remove malware from victim's computers, as has been done before by Dutch authorities without any law permitting such actions, and removing malware is obviously good for society.
- Rizz 3y ago
  And of course it can also be used for gaining entry to hackers systems by infiltrating c&c servers on third party hardware, which also had been done before by Dutch authorities without any existing legal framework to allow this.
- sam_lowry_ 3y ago
  > automatically remove malware from victim's computers, Like uninstall Windows without permission?
- photochemsyn 3y ago
  All adblock extensions, torrent software and end-to-end-encryption systems will now be classified as 'malware'.
FpUser 3y ago
They are simply jealous of Hitler, Putin, Xi and other upstanding individuals.
akomtu 3y ago
The omitted detail is that it's "NL national security [from its people] ..." The state, and those individuals in unholy union with it, understands very well that it's different from its people and in order to defend from its people all measures are justifiable.

210 points by pseudotrash 3y ago

It sounds really scary, but it’s so they can actually collect evidence. Now they target a hacking group but can’t break in with their targets to actually collect evidence. They still need a judge to provide a warrant, there is still oversight. In practice not much will change, except they only have to ask for 1 warrant instead of 10 like they do now.

joanne123 3y ago

[dead]

teamspirit 3y ago

I'm having issues loading the page. https://archive.is/J3ieO https://archive.is/J3ieO if it helps anyone.

deleted 3y ago

[deleted]

jacquesm 3y ago

One example of where this would apply is for instance against criminals whose medium of information exchange has been compromised. Yes, they are 'victims', but they are also perps and probably in much worse crimes than the original hack of their comms. An example of such a situation is the EncroChat hack.

daenney 3y ago
It also applies to all victims of hackers, irrespective of whether the victims themselves are supposedly criminals or not. So if you get hacked, then suddenly the government can hack you too. No amount of hypothetical "it could also be used against criminals" balances out the bonkers overreach this represents.
- jacquesm 3y ago
  In theory yes, but in practice this hasn't happened and I really don't expect it to happen. I've seen enough of LE in NL up close to have an idea of how it all hangs together and this article definitely has a point: the law should be worded more carefully but at the same time it isn't going to get out of hand the way the article would have you believe. Plenty of oversight here and judges that take conflicting laws fairly seriously (such as the GDPR, but also laws regarding the gathering of evidence and such). NL has lots of problems, but lack of judicial oversight over both the police and the intelligence services isn't one of them, in fact you could make a pretty good argument that the degree of oversight actually hinders going after tech savvy criminals. But better too much than too little. This law won't change that by much as far as I can see.
  - ar-jan 3y ago
    You say "this hasn't happened" and "plenty of oversight", but the president of the review committee just resigned because of this. And she isn't allowed to inform the public nor parliament of what has already been happening, even before this change. As in, examples of the type of surveillance already happening have been redacted from the annual report of the review committee [0]. The annual report was specifically made to omit operational details and only inform of the general picture, but parts have been declared state secret. The now ex-president of the review committee stated she could not inform parliament because she did not want to go to prison for 15 years [1]. 0: https://www.tweedekamer.nl/kamerstukken/detail?id=2023Z05165&did=2023D12102 https://www.tweedekamer.nl/kamerstukken/detail?id=2023Z05165... 1: https://debatdirect.tweedekamer.nl/2023-03-30/binnenlandse-zaken/groen-van-prinstererzaal/technische-briefing-door-ctivd-en-tib-over-de-tijdelijke-wet-cyberoperaties-17-30/video https://debatdirect.tweedekamer.nl/2023-03-30/binnenlandse-z...
  - costco 3y ago
    "Going dark" is a scam - https://crimesciencejournal.biomedcentral.com/articles/10.1186/s40163-023-00185-4 https://crimesciencejournal.biomedcentral.com/articles/10.11... for instance found that there was no difference in conviction rate for cases involving E2EE encryption vs those that didn't in the Netherlands. The government just wants the halcyon period of surveillance from late 1900s to the early 2000s back but these supposed tech savvy criminals almost never turn out to exist.
hulitu 3y ago
Another example are opposition's politicians.
radicalbyte 3y ago
The thing is, is that we've had an oversight commission who reacted quickly to decide in those cases. That worked, it provided oversight. Now they want free reign to spy on everyone.
- jacquesm 3y ago
  Wanting something and getting it aren't the same thing and it wouldn't be the first time that something like this gets enacted and then gets shut down again. My main worry would be journalists, those are at some danger from stuff like this especially when they are protecting their sources. If this ever gets abused that's where I would expect it to happen.
  - coldtea 3y ago
    That's one of the prime real uses cases they'd care about...
    - jacquesm 3y ago
      Yes, and clearly there should be a very pointed note about journalists in this law if it is to be put into practice. But for the likes that use(d) EncroChat I'm all for it. Btw, both lawyers and journalists have quite a few special protections under Dutch law and it isn't clear to me that this proposal would trump those protections, in fact if challenged I would expect the judiciary to affirm that those protections carry the most weight.
      - ahubert 3y ago
        Author here - the protections remain in theory, but will not longer be active beforehand. It is possible that the oversight committee finds the time to check afterwards, but they aren't obliged to do so. Also, by then the damage is done.
        jacquesm 3y ago
        Yes, that's the risk, but: similar issues have been flagged in the past and in the end oversight won out so I'm not quite as worried as you are. A typical scenario is that a hacker is using a series of nested accesses to compromised systems, if the original warrant allows for tracking the hacker on the first system then there is no time to obtain warrants for the systems that are uncloaked as the result of the investigation, this happens pretty much in real time. So this provision allows the investigation to proceed and will have a reasonable time allowed to 'catch up'. It definitely is possible that it will be abused, but that will lead to this provision being disbanded, as has happened in the past when dutch LE overstepped their authority. I'm fairly sure that those lessons - and the cases thrown out as a result - have been learned, but of course it is very well possible that we'll see a re-run. I'm on the fence on this one, I'd say let's see where it leads because it is clear to me that the digital world is moving much faster than law enforcement can normally speaking keep up with and a lot of crime is perpetrated because of that. The risk of abuse of such methods is always present, and 'protections in theory' that are abused tend to find very unsympathetic judges in this country. It's fairly clear that something will have to change if LE is to keep up with the increase in online crime, whether this overshoots the mark or not remains - in my view - to be seen. It definitely has that risk, but then again, so would every other proposal short of the status quo and that clearly isn't effective enough.

13of40 3y ago

Assuming a security analyst is allowed to look at content that's been identified as malicious beyond some threshold like 99.9%... And in order to address emerging threats, they should be able to apply their judgement based on threat indicators like known bad hashes, origin from known bad email addresses or IPs, etc. to call something malicious beyond that threshold... Does that mean that if they know your account is under attack they can just read all of your emails? I would give that a big "no" because unless your account has 999 malicious emails in it for every benign one, they have not met the criteria.

coldtea 3y ago
>Does that mean that if they know your account is under attack they can just read all of your emails? If they "suspect" it is more like it in practice, suspecting also meaning "when they want to target you".
- 13of40 3y ago
  My point is that unless they can make a case that some random email from your inbox is 99.9% likely to be malicious, then they should not be able to read it. Yes they have a button that lets them read it, but they should not press that button, and if they do they should get their ass sent to the clink.
  - coldtea 3y ago
    >but they should not press that button, and if they do they should get their ass sent to the clink They'll be the ones helping send others to the clink and being best buddies with those who do, so fat chance of that restraint or punishment getting to them.

explorer83 3y ago

So to my understanding what they are proposing is allowing you to be hacked by the government if you are a victim of hacking by another actor. I can see the value of this being able to access log files and other data that could assist in investigating the original hackers. I suppose they wouldn't want to always tip off the victim of hacking because the victim might change something that could scare aware the original hackers or delete useful metadata before the investigation could be carried out. But it essentially could become a free pass for the state to hack anybody. Because 1.) Anyone with a public facing server knows there are bot hacking attempts made against them 24/7 or 2.) Just hire a 3rd party to hack someone then you have immediate cause to get access to their data. This article didn't seem to have a definite answers what kind of protections would be put in place in these events. It sounded like they previously did try to word the law to only pertain to the original investigation but one can only wonder.

nonethewiser 3y ago
Yes. This simply makes it legal for the Dutch government to hack their citizens. It doesn't matter what the intentions or purported rules are, if they are self-regulating then there are no limits. The publicly stated intentions and rules only give some naive people peace of mind.
- belter 3y ago
  Coming from the State that did not yet resolved one of the worst scandals ever...And from the Prime Minister that deleted official government data for years... "Dutch scandal serves as a warning for Europe over risks of using algorithms" - https://www.politico.eu/article/dutch-scandal-serves-as-a-warning-for-europe-over-risks-of-using-algorithms/ https://www.politico.eu/article/dutch-scandal-serves-as-a-wa... "Dutch PM has been deleting text messages daily for years: report" - https://nltimes.nl/2022/05/18/dutch-pm-deleting-text-messages-daily-years-report https://nltimes.nl/2022/05/18/dutch-pm-deleting-text-message...
  - bboygravity 3y ago
    Don't overreact, they just kidnapped a few thousand kids from their families and placed them with foster parents due to some bureaucratic hick-ups. No biggy. /s

rollulus 3y ago

The author of the article is Bert Hubert, starred frequently on HN [1] and has expertise in many fields, including the world of intelligence agencies. [1]: https://news.ycombinator.com/from?site=berthub.eu https://news.ycombinator.com/from?site=berthub.eu

ahubert 3y ago
Well I try to :-)
- sam_lowry_ 3y ago
  Thank you and please keep trying, Bert!
- rollulus 3y ago
  Now I’m star-struck. Thanks for your work.

ahubert 3y ago

Author here - I mirrored the page on https://berthub.eu/articles/posts/dutch-intel-law-about-intel/ https://berthub.eu/articles/posts/dutch-intel-law-about-inte... since y'all managed to take out the about:intel server!

pseudotrash 3y ago
Blimey watch what you share in your tweets man. It's not like we need to explain loud balancing to you?

greatgib 3y ago

It is really scary the accelerating trend of creating regulations to restrict or violate basic human rights on the basis of straw man national security reasons... What is nice with this law is that they can look for things not related to the hack on target devices. If they see something incriminating against you not related to the case, they can still use it against you in a new procedure. Without warrant. How convenient. In addition, I can easily guess that they don't have to prove that you were really hacked, but mere suspicion or being a potential victim of the hackers might be enough.

varispeed 3y ago
What makes me feel puzzled is I remember politicians were condemning these type of actions done in authoritarian countries. I now wonder whether that was a genuine concern or just a tool used for bargaining. I also find puzzling, that I remember people being outraged if country X done something and now when something like this gets done in Western countries, there is very much indifference. When I talked about this with a couple of friends, who are not interested in politics, they just shrugged it "why would anyone would be interested in spying on me. I don't do anything wrong, so they can follow me to their heart's content. That would be a waste of time." and so on. Seems like indeed, the media are powerful in regulating emotions and turning the outrage up and down. If that topic was on the front pages, using the same language as some other issues that governments are using to cover up their ineptitude (so called dead cats), then maybe people would be more aware and inclined to do something about it. But I can imagine anyone trying to run these kind of stories would be quickly shut down.
- ecshafer 3y ago
  When a politician says a country is authoritarian, they don't really care about that. What they mean is that "this country is not friendly to our own imperial interests so they are bad". The media is owned by these same people that push these laws.
- tome 3y ago
  > I remember politicians were condemning these type of actions done in authoritarian countries I don't remember it. Do you have some citations that would jog my memory?

Rizz 3y ago

I suspect this is also to provide a legal framework to automatically remove malware from victim's computers, as has been done before by Dutch authorities without any law permitting such actions, and removing malware is obviously good for society.

Rizz 3y ago
And of course it can also be used for gaining entry to hackers systems by infiltrating c&c servers on third party hardware, which also had been done before by Dutch authorities without any existing legal framework to allow this.
sam_lowry_ 3y ago
> automatically remove malware from victim's computers, Like uninstall Windows without permission?
photochemsyn 3y ago
All adblock extensions, torrent software and end-to-end-encryption systems will now be classified as 'malware'.

FpUser 3y ago

They are simply jealous of Hitler, Putin, Xi and other upstanding individuals.

akomtu 3y ago

The omitted detail is that it's "NL national security [from its people] ..." The state, and those individuals in unholy union with it, understands very well that it's different from its people and in order to defend from its people all measures are justifiable.