€¦ · web viewfp7-sect-2007-217862. detecter. detection technologies, terrorism, ethics and...

FP7-SECT-2007-217862

DETECTER

Detection Technologies, Terrorism, Ethics and Human Rights

Collaborative Project

Efficient and human rights-compatible search criteria

for monitoring Internet Communications

Revision [draft]

Due date of deliverable: 31.05.10

Actual submission date: 09.08.10

Start date of project: 1.12.2008

Duration: 36 months

Lead contractor: Dr. Karol Nowak, Raoul Wallenberg Inst. of Human Rights and Humanitarian Law

Participant: Dr. Karol Nowak

Project co-funded by the European Commission within the Seventh Framework Programme (2002-2006)Dissemination Level PU PublicPP Restricted to other programme participants (including the Commission Services)RE Restricted to a group specified by the consortium (including the Commission

Services)COConfidential, only for members of the consortium (including the Commission Services)

of 56

Table of contents

Description of deliverable..................................................................................................................5

Delimitations......................................................................................................................................6

Executive summary............................................................................................................................8

Policy and law reform recommendations...........................................................................................9

1. Human rights v. efficiency: Using all available tools in the fight against terrorism.......................10

1.1 Human rights v. democracy........................................................................................................12

2. Types of terrorism in Europe........................................................................................................14

2.1 The extent of the terrorist threat in the EU................................................................................15

3. Finding terrorists online...............................................................................................................17

3.1 Unique challenges posed by the Internet...................................................................................17

3.1.1 Access to data......................................................................................................................18

3.1.2 Quality of data.....................................................................................................................19

3.2 Privacy concerns.........................................................................................................................19

3.3 Privacy analysis of information systems.....................................................................................21

3.3.1 Privacy Threshold Analysis...................................................................................................21

3.3.1 Personally Identifying Information......................................................................................22

3.3.2 Privacy Impact Assessment..................................................................................................22

3.4 Privacy handling rules in automated processing systems...........................................................23

3.4.1 Rule-based processing.........................................................................................................23

3.4.2 Proof carrying code..............................................................................................................23

3.4.3 Data labelling.......................................................................................................................24

3.4.4 Analytic filtering...................................................................................................................24

3.4.5 Selective revelation.............................................................................................................24

3.4.6 Anonymous matching..........................................................................................................24

3.4.7 Credentialing and auditing...................................................................................................25

3.5 Criticism of data mining - The example of EU data retention directive......................................25

3.5.1 Civil society criticism – An appeal to abolish data retention................................................25

3.5.2 Official criticism – Struck down by the German Federal Constitutional Court.....................28

4. Defining a terrorist...........................................................................................................................29

4. Profiling........................................................................................................................................31

of 56

4.1 Benefits of profiling....................................................................................................................32

4.1.1 Effective...............................................................................................................................33

4.1.2 Protects innocents...............................................................................................................33

4.1.3 Non invasive........................................................................................................................34

4.2 Drawbacks of profiling - At odds with human rights and democracy.........................................34

4.2.1 False positives......................................................................................................................36

4.2.2 Profiling ethnic belonging at odds with the prohibition against discrimination..................36

4.2.3 Profiling religious belonging at odds with the freedom of thought, conscience and religion................................................................................................................37

4.2.4 Profiling political beliefs at odds with the freedom of expression and information............38

4.2.5 Profiling travel- and economical patterns at odds with the freedom of movement............39

4.2.6 Cumulative effects...............................................................................................................40

4.3 Consequences of profiling and the presumption of innocence..............................................40

4.3.1 Visible to the profiled..........................................................................................................41

4.3.2 Invisible to the profiled........................................................................................................42

4.4 Search criteria.......................................................................................................................42

4.4.1 Necessary search criteria - I.................................................................................................43

4.4.2 Useful search criteria - II......................................................................................................44

4.4.3 Questionable/ Non-essential search criteria - III.................................................................44

4.4.4 Placing search criteria in applicable categories............................................................45

4.5 Vetting........................................................................................................................................46

5. Concluding remarks......................................................................................................................48

Dissemination...................................................................................................................................49

Bibliography.........................................................................................................................................50

of 56

Description of deliverableHow can Internet searches be carried out while minimizing the amount of surplus information (information collected but not relevant in the fight against terrorism) collected, i.e. without infringing the rights of innocent people? What are the problems with certain search criteria when it comes to human rights and the requirements for a pluralistic democracy and how can the risks to these values be minimized? Those are the questions that this work package tries to answer, starting with this deliverable.

Monitoring the Internet produces large quantities of surplus information that have to be checked and discarded. How this is done, and in what form, is crucial for avoiding human right infringements. Since the fight against terrorism is international, the need for common legislation and safeguards is obvious. Among the safeguards that need to be considered are: 1. Amendments to national evidence law to prevent the use of surplus information and, 2. EU legislation to the same effect, making it impossible for states to exploit national legal loopholes e.g. to make use of information collected in another member state with less stringent laws.

Fulfilment of this objective is accomplished by the production of three papers: the current paper, deliverable 15.1, on efficient and human rights-compatible search criteria for monitoring Internet communications; a subsequent paper, deliverable 15.2, on how surplus information can be vetted out before it can lead to infringements of human rights; and a paper about safeguards on the use of surplus information in legal proceedings across the EU – deliverable 15.3. This particular deliverable is therefore to be viewed as part one out of three and as the introduction and definition of the problem.

of 56

DelimitationsAn understanding of the terrorist mind-set would be both the key to understanding how and why an individual becomes a terrorist and the basis for using certain factors in a profile or Internet search, yet numerous psychologists have been unable adequately to define it. Indeed, there appears to be a general agreement among psychologists who have studied the subject that there is no single terrorist mind-set,1 which of course makes it very difficult if not impossible to use criteria based on mind-sets to identify a terrorist. Thus this paper will only focus not on psychological or social factors, but on established search criteria, which may be at odds with human rights standards and a pluralistic democracy and which are in need of further analysis.

Although international law is referenced in this paper, the main focus is on European law. This seems reasonable given the European context in which this research is done and considering that it is primarily aimed at European states.

State terrorism2 or state sponsorship of terrorism is a special case that will not be scrutinized in this paper since it is neither motivated nor carried out by individuals or small groups working independently or driven by a common ideology. Rather it is motivated by state interests quite different from those motivating the “regular” terrorists. This means that totally different search criteria to those used in the fight against “normal” terrorists will be used. Search criteria used for the purposes of monitoring the state are not as detrimental to human rights since the “terrorist” does not fight in the name of an ethnic group or religion but rather promotes the interests of a state. While it is true that states use or support non-governmental organizations to do their bidding, the motivation and the modus operandi behind states´ actions are nevertheless different and are usually not sought on-line.3

An analysis of the connection between democracy and human rights as stated in the Charter of Fundamental Rights of the European Union and the European Convention on Human Rights falls outside the scope of the paper. But the connection with democracy is briefly described in order to provide some background to the proposal of a classification system rooted in human rights law, as democracy plays a crucial role in judgments concerning partial derogations to human rights.

Getting reliable information from security services on which Internet sites are being monitored and how they are being monitored is impossible, for obvious reasons. It is similarly difficult to get permission to quote sources in such a way that they can be verified. Although specific sites that promote terrorist acts are easy to find using commercial search engines, they do not add much information to the overall conclusion or the systematization model proposed in this paper and are therefore excluded from consideration. Furthermore, there are hardly any court cases available that

1 Hudson, The sociology and psychology of terrorism: who becomes a terrorist and why? p. 30. www.loc.gov/rr/frd/pdf-files/Soc_Psych_of_Terrorism.pdf 2 State sponsorship of terrorism occurs when governments provide supplies, training, and other forms of support to non-state terrorist organizations. An example of state sponsorship is the Syrian government's support of Hamas and Hezbollah in Lebanon. On a smaller scale, the East German Stasi provided support and safe-haven to members of the Red Army Faction and neo-fascist groups that operated in West Germany. Wanted members of the RAF were found resident in East Germany after the fall of the Berlin Wall in 1989.3 See also Overview of State-Sponsored Terrorism, US state department,www.state.gov/documents/organization/31944.pdf

of 56

http://www.state.gov/documents/organization/31944.pdf

http://www.loc.gov/rr/frd/pdf-files/Soc_Psych_of_Terrorism.pdf

would shed light on Internet searches because the results of such searches are not used directly in court. This is because the evidentiary value of such searches is low or non-existent. The same cannot be said for the results of surveillance following such searches, and therefore it is this latter information that is presented as evidence in a court of law

of 56

Efficient and human rights-compatible search criteria for monitoring Internet Communications

Executive summaryThis paper analyses how profiling and Internet searches can be carried out in a way that minimizes or eliminates human rights abuses and without threatening the foundations of a pluralistic democracy. It proposes a three-tiered classification system for search criteria, which can help us decide whether a particular criterion is compatible with human rights law. The classifications are based on an assessment of the consequences for the persons targeted by the search.

The paper describes profiling and Internet searches, lists their benefits and drawbacks, and suggests a classification system for search and profiling criteria that can be used to prevent human rights abuses. The criteria are classified according to their threat to human rights and ethical norms. Such a classification can also be used in post factum controls, i.e. after a search, to control the use of e.g. discriminatory criteria that have been used carelessly or in violation of human rights law and to vet out excess information that can be harmful to the person profiled. It therefore enhances the access to justice of innocent persons.

The paper is the first of three deliverables in this work package and provides an introduction to the issues at hand, issues that will be expanded upon in the two following deliverables.

of 56


Policy and law reform recommendationsIt is recommended that profiling and search criteria are categorized both individually and in combination to make sure that that they meet human rights requirements and ethical standards.

To facilitate categorization and to make sure that no unnecessary criteria are being used routinely, the criteria should be divided into four categories: necessary, useful, non-essential and questionable/prohibited. The categorization must be carried out with human rights and the requirements of a pluralistic democracy in mind. In order to be able to undertake the categorization it is necessary that security agencies develop policies that specify both the kinds of criteria they need to use and the specific aim to which their use is put. The policy must also contain a catalogue of risks so that operators know what is at stake when it comes to human rights adherence.

For obvious reasons, policies have to be secret. That does not mean that they can go uncontrolled. To ensure that policies and human rights standards are adhered to, a supervisory body should be established by law that can be held accountable in case the agencies overstep their bounds in addition to holding the agencies responsible. Such a body could be made up of MPs, national lawyers and lawyers from the European Commission, and persons representing civil society. The latter would also serve to instil trust in the security agencies since regular citizens are not directly connected to the government. The controlling body could use the above-mentioned categorization in its supervisory activities.

of 56


1. Human rights v. efficiency: Using all available tools in the fight against terrorism

It is safe to assume that most if not all available tools will be used in the fight against terrorism. Legal lacunas will in all likelihood be exploited and legal measures stretched as far as possible. This means that there is a need for clear and comprehensive laws and governing systems.

The main reason why any means available will be exploited in the fight against terrorism is that very strong and understandable pressure is put on governments and their agencies to prevent terrorist acts and to capture terrorists. In some cases security agencies might go too far because of lack of training or ignorance. In some cases governments will knowingly set human rights aside. When the latter occurs, political pressure is needed, and there is precious little that legal and other scholars can do. When the former occurs academia has an important role to play in clarifying what is legal and within the scope of human rights and what is prohibited.

One thing must be made clear from the very beginning: human rights cannot be set aside in the name of efficiency. Even though derogation might in some cases be allowed, it is usually applied when a state is at war or when a state of emergency is in effect and thus for a limited time only. 4

Although the term “war on terror” is frequently used, there can be no doubt that in legal terms the fight against terrorism is not considered to be a war. Nor are the “war on drugs” or the “war on crime” considered wars according to international law.5 Exceptions to human rights law motivated by a state of war are impermissible in these contexts.

When specifying the legal limitations on the fight against terrorism one must also be aware of the tremendous pressure that is applied on governments by their citizens to protect them from terrorism. It is perhaps a paradox that the public expects both to be fully protected from terrorist acts and –in case they themselves should be subjected to counter-terrorism measures– to be treated according to human rights law with all that guarantees in terms of a fair trial, non-discrimination, etc. Pressure on governments might be democratic as well as strong, but it is not irresistible. On the contrary, it is in times of terrorism that the challenge of protecting human rights is most important and difficult.6 Nevertheless, public pressure is a factor that must be heeded when arguing on behalf of human rights7 since it can influence the state’s handling of its counter-terrorism efforts.

Sometimes governments might create registers that, used separately, are not a threat to human rights but used together might pose a threat. For instance, the average Swede is included in 100-150 government registers, and there are more than 400 laws governing the registers. Even though there is no reason to believe that these registers will be misused, the possibility alone gives pause for

4 See for instance Scheinin and Vermeulen in Unilateral Exceptions to International Law: Systematic legal analysis and critique of doctrines that seek to deny or reduce the applicability of human rights norms in the fight against terrorism, p. 25.5 Supra pp. 28-30.6 See generally Barak, The Judge in a Democracy.7 According to an opinion poll by Statistics Sweden (SCB), a governmental administrative agency, close to 80% of all Swedes want increased governmental control over citizens in order to fight serious crime and terrorism. 77% are prepared to accept that the integrity of innocents will be violated. Poll published in Riksdag & Departement 2007-11-01.

of 56


thought. Perhaps it is naïve to trust the state unconditionally. Every time a heinous act of terrorism takes place, the pressure to erode some human rights in order to capture terrorists increases. States may find themselves on a slippery slope. If they give in to public pressure, we may very soon be left with legal protection of human rights that is severely limited.

History teaches us valuable lessons about what happens when government is trusted too much. It also should be kept in mind that terrorism is not something new that requires extra-legal measures to combat. On the contrary, even though terrorism seems to be a more or less on-going phenomenon, the causes vary and are not usually long lived. We have seen different types of terrorism in post war Europe. Even those terrorist organisations that fit the same categories 8 have little in common other than some basic ideology. The lifespan of such groups also tends to be rather short: who today is worried about the RAF or the OAS?9

Efficiency cannot be allowed to be the overriding concern of governments, as this would lead to a totalitarian state. It can also be argued that an approach that aims to achieve a balance within human rights is much more effective than one that sets human rights aside or one that views human rights and security as inherently conflicting, because it ensures that the human rights foundation of the modern democratic state remains intact. As former Secretary-General Kofi Annan in September 2003 argues:

Upholding human rights is not at odds with battling terrorism: on the contrary, the moral vision of human rights – the deep respect for the dignity of each person – is among our most powerful weapons against it. 10

While the public clamours for action after a terrorist attack it is imperative that the government reaction is ethical and within the human rights paradigm.11 Human rights are firmly rooted in the idea of the liberal state. There are certain freedoms and rights that need to be protected if there is to be any liberal state at all. Discussion of balancing rights against efficiency cannot be accepted since it would mean sacrificing the foundation of the state in order to protect it. There is however a possibility to balance factors within the liberal state/human rights paradigm, as evidenced by i.e. the margin of appreciation for states in the European Court of Human Rights (henceforth the ECtHR case law).

Sorell states that

the Kantian idea that citizenship is citizenship among equals also constrains counter-terrorism policy. Policies of searching every passenger at airports, or of genuinely random questioning of members of the public, satisfy this constraint; policies of searching only South Asians or only men with beards do not. That way of narrowing down a population of suspects is too open to the charge of depending on facile stereotypes. It is true that arriving and acting on these stereotypes may involve no intrusion on any individuals, but this is consistent with sheer prejudice. If stereotypes are to be used at all, one expects them to be based on evidence and tested by further enquiries at the level of the suspects they throw up. The more evidence-based, and the more they are supported by enquiries, the more they are likely to

8 European Police Office TE-SAT 2008 - EU Terrorism Situation and Trend Report 2008.9 Rote Armee Fraktion and Organisation de l'armée secrete respectively.10 As quoted from Handbook on Criminal Justice Responses to Terrorism, p 17. United Nations Office on Drugs and Crime.11 See for instance Guiora, Fundamentals of Counterterrorism, p. 92.

of 56


depend on intrusion. But the less-evidence-based, the more they are likely to violate the liberal constraint of equality before the law, as well as making too many people suspects.12

As Scheinin and Vermeulen argue in their paper on the use of exceptions in international law,

Limitations to human rights are a part of the everyday life of any human society. Most human rights are not absolute, in the sense that they permit restrictions or limitations that serve a legitimate aim, are prescribed by the law in a precise and foreseeable manner, and are both necessary and proportionate in nature. Permissible limitations may apply in respect of both treaty and customary norms of human rights law. The Universal Declaration of Human Rights includes a clause expressing the permissibility of, and even the need for, some limitations upon human rights. Many human rights treaties contain detailed clauses that, for instance, provide for exhaustive lists of what aims are regarded as legitimate for the purpose of restricting a particular right. Some human rights treaties are vaguer in their formulations of the conditions for permissible limitations. The permissibility of limitations to human rights is one of the most important, and one of the most disputed, issues of interpretation within human rights law. In order to comply in good faith with its human rights obligations, a state must see to it that any limitation upon a human rights [sic] must remain the exception and must respect the main rule that is enshrined in the treaty or customary law norm that protects the right in question.13

Even when balancing within the human rights paradigm the scope for balancing is limited by the fact that demands for the rehabilitation of a valued right will increase when it is restricted.14 The government can obviously make new laws or choose to interpret existing laws in such a way that certain rights will be limited but that does not mean that the demand for the enjoyment of those rights disappears. On the contrary, the more the government tries to set aside a right, the stronger the demand for its rehabilitation.15

Finally, one must be aware that a balanced evaluation is particularly difficult when measures taken against terrorism are secret. This difficulty persists even if there are fairly rigorous legal safeguards in place to make sure that that balancing between rights in practice is proportional, necessary and according to law, because only one side of the argument will be heard.16

1.1 Human rights v. democracyAn efficient human rights regime is dependent on democracy and an effective democracy is dependent on human rights, as is laid down in the preamble to the Charter of Fundamental Rights of the European Union (henceforth the EU charter):

…the Union is founded on the indivisible, universal values of human dignity, freedom, equality and solidarity; it is based on the principles of democracy and the rule of law. It places the individual at the heart of its activities, by establishing the citizenship of the Union and by creating an area of freedom, security and justice...

And in the preamble to the European Convention for the Protection of Human Rights and Fundamental Freedoms (henceforth the ECHR):

12 Sorell, Paper on Ethical Norms of Counterterrorism, p. 19.13 Scheinin and Vermeulen, Unilateral Exceptions to International Law: Systematic legal analysis and critique of doctrines that seek to deny or reduce the applicability of human rights norms in the fight against terrorism, p. 31.14 Alexy, Theorie der Grundrechte, p. 145.15 Nowak, Oskyldighetspresumtionen, p. 40.16 Nowak, Right to Respect for Private and Family Life: an exceptional right, pp. 191-195.

of 56


…fundamental freedoms … are the foundation of justice and peace in the world and are best maintained on the one hand by an effective political democracy and on the other by a common understanding and observance of the human rights upon which they depend…

Human rights and democracy are interdependent but the relationship is not without friction. In the field of counter-terrorism the democratic majority might sometimes insist that certain human rights be set aside in order to catch terrorists. Although this would be a perfectly understandable reaction to heinous terrorist crimes, it cannot be allowed to prevail, since human rights function to limit the power of democracy to restrict basic freedoms.

The reasoning supporting claims of interdependence states that one cannot be abolished or even limited to a too great extent without damaging the other. Although this argument can be criticised for being a kind of circular logic, historical facts such as the failure of the Weimar republic underscore the importance of recognising this interdependence.

The requirements for a functioning pluralistic democracy are firmly laid down in human rights law. They are freedom of thought, conscience and religion, freedom of expression and information, non-discrimination and freedom of assembly and association, amongst others. Without these freedoms a pluralistic democracy is, if not impossible, at least very hard to realize. Surveying the Internet in such a way that people will be afraid to exercise their rights can therefore be a threat not only to human rights but also to pluralistic democracy. When fighting terrorism it is therefore vital to keep the interdependency between human rights and democracy in mind so that these two overriding values or ideologies are not forgotten in the hunt for short-lived efficiency that might very well turn out to be a pyrrhic victory.

of 56


2. Types of terrorism in EuropeThere are different types of terrorism and different human rights issues may arise when combating them. For example, measures to combat religious-based terrorism may include the use of religious search terms on the Internet, which might infringe people’s right to freedom of religion.

Europol categorizes terrorists by their source of motivation. However, as Europol reports in its EU Terrorism Situation and Trend Report of 2008, “many groups have a mixture of motivating ideologies, although usually one ideology or motivation dominates”. 17 As the report explains, “The choice of categories used ...is pragmatic and reflects the current situation in the EU. The categories are not necessarily mutually exclusive.”18 Still, the following categorization gives an idea of the current threat against Europe and the human rights issues that might arise when combating various terrorist groups.

There are five main terrorist threats against Europe as defined by Europol in their 2008 Report. These are listed below:

1. Islamist terrorism Islamist terrorism is motivated either in whole or in part by an abusive interpretation of

Islam; the use of violence is regarded by its practitioners as a divine duty or sacramental act.19

2. Ethno-nationalist and separatist terrorist groups Ethno-nationalist and separatist terrorist groups seek international recognition and

political self-determination. They are motivated by nationalism, ethnicity and/or religion.

3. Left-wing terrorist groups Left-wing terrorist groups seek to change the entire political, social and economic system

of a state according to an extremist leftist model. Their ideology is often Marxist-Leninist. The agenda of anarchist terrorist groups is usually revolutionary, anti-capitalist and anti-authoritarian.

4. Right-wing terrorist groups Right-wing terrorist groups seek to change the entire political, social and economic system

on an extremist rightist model. The ideological roots of European right-wing terrorism can usually be traced back to National Socialism.

5. Single issue terrorism

17 European Police Office TE-SAT 2008 - EU Terrorism Situation and Trend Report 2008.p.1018 Ibid.19 Compare to Hoffman, Bruce (2006) Inside Terrorism, p.p. 83 and 89-97.

of 56


Single issue terrorism is violence committed with the desire to change a specific policy or practice within a target society. The term is generally used to describe animal rights and environmentalist terrorist groups. 20

2.1 The extent of the terrorist threat in the EUThe assessment of the extent of the threat is necessary in order to determine a proportional response. Even though there are absolute limits set by human rights hard law to what kind of response is allowed,21 there are also limits within those limits, such as those set by the ECHR as interpreted by the ECtHR. For instance, a requirement of proportionality is used when assessing whether restrictions to the rights laid down in the first paragraph of Article 8 of the ECHR (about the right to respect for private and family life, home and correspondence), may be justified and whether they meet the requirements of possible restrictions to the right in the second paragraph of Article 8.

In the “necessary in a democratic society” test, the ECtHR relies heavily upon the principle of proportionality. It enables the Court to balance all the relevant interests and factual circumstances, and take into account the severity of the infringement as well as to consider whether the essence of the right invoked has been infringed. The scale the Court utilizes seems to imply that the more far-reaching the infringement or the more essential the aspect of the right that has been interfered with, the more substantial or compelling the legitimate aims pursued must be.22

According to Europol “the number of terrorist attacks is increasing.”23 As the report describes, during 2007:

583 terrorist attacks were committed in the EU. Of these, 91 percent were perpetrated by separatist terrorists. ... The number of suspects arrested for terrorism in the EU is also increasing. The number of arrested suspects has increased from 706 in 2006 to 1044 in 2007. As for the increase in attacks, this can partly be attributed to the increased activity of Corsican and Basque separatist terrorism groups. ... The general increase in arrests can also be explained by the 30 percent increase in arrests in the UK. The vast majority of these arrests were in relation to Islamist terrorism.2425

Terrorism propaganda is also being produced and distributed on the Internet. As the Europol Report details:

[The Internet] continues to be an important tool for terrorists to attract new recruits and give logistical support. Manuals on how to build bombs, together with ideological propaganda, are increasingly found on the Internet. The al-Qaeda media campaign during 2007 produced propaganda in a number of European languages, indicating increasing efforts to reach non-Arabic speaking Europeans. Although propaganda material is available in increasing quality and quantity, there is no proof that this in itself leads to increased radicalization of the targeted audience.26

20 European Police Office TE-SAT 2008 - EU Terrorism Situation and Trend Report 2008.p.821 Supra note 3.22 Van Dijk, van Hoof, van Rijn and Zwaak (eds.). Theory and Practice of the European Convention on Human Rights, p. 747.23 Supra note 3, pp. 42-43.24 Ibid.25 See also European cooperation in penal matters: Issues and perspectives. Fijnaut p.p. 248-250. “Controlling organized crime in the European Union”.26 European Police Office TE-SAT 2008 - EU Terrorism Situation and Trend Report 2008.p.42

of 56


The political profile of terrorists is also described in the Report, which states that:

Left-wing and anarchist terrorist attacks in the EU are decreasing. Activities by right-wing terrorists and extremists in the EU are increasing. Investigations into right-wing extremist and terrorist activities have shown international contacts which indicate a European network of right-wing activists.27

27 Ibid.p.43

of 56


3. Finding terrorists online The fight against terrorism is of course also waged on the net. It can take different forms, such as shutting down sites that promote or recruit terrorists, creating websites that argue against extremism and violence, creating websites that purport to be, e.g., jihadists in order to get persons who are prone to extremism to visit them and thus be able to track them. Perhaps the most common way to use the Internet is by monitoring it in order to be able to intercept terrorist communications and to be able to stop acts of terrorism before they happen and catch those responsible, hopefully before any damage has been done.28

There is obviously a plethora of methods that can be used to search for terrorists on-line: various automated searches, manual searches, data-mining, bots, web spiders and Trojans to name but a few.29 This paper concentrates not so much on the various technological aspects per se but rather on the specific search terms that all methods use in order to narrow down the pool of suspects and to eliminate innocents from the investigation.

In order to find terrorists online one must have access to information about what is common to terrorists or potential terrorists. This information is gathered either from sources such as the US State Department's list of known terrorist groups or by using search terms that apply to most of those who have committed terrorist crimes, naturally depending on what type of terrorist one is looking for.30 This information is based upon previous experience with, e.g., terrorist communication and travel and financial patterns. It is then shared among security services and complemented within the security community.31

Searching for known keywords of several terrorist groups –for example, many jihadist sites refer to Osama bin Laden as the “Big Chief” – may also provide results as may link analysis and following links posted on terrorist sites to explore other possibly dangerous sites.32

3.1 Unique challenges posed by the InternetClearly, the Internet is yet another battlefield in the fight against terrorism.33 What makes the Internet unique is the massive amount of data available and the ease with which it can be collected, searched, and analysed, mainly using machines. The amount of information on the net is difficult to fathom and it is even more difficult to grasp the consequences of gathering that data.

As a reference portal reports, “Assessing the size of the Internet is a difficult proposition since it is a distributed body and no complete index of it exists.”34 When we ask how big the Internet is, it is

28 See e.g. Stevens, Don't blame the Internet for extremism, www.guardian.co.uk/commentisfree/2009/dec/14/Internet-extremism-jihadi-youtube 29 See for instance van der Hilst, Human Rights Risks of Selected Detection Technologies Sample Uses by Governments of Selected Detection Technologies, P.P. 12-18. DETECTER deliverable 17.1.30 See chapter 2 in this paper about Types of Terrorism in Europe.31 See for instance Keohane, The EU and counter-terrorism, p. 14.32 Groc, The Online Hunt for Terrorists, www.pcmag.com/article2/0,2817,2270962,%2000.asp02.27.0833 See, e.g., Information Operations `Blowback': Communication, Propaganda and Surveillance in the Global War on Terrorism(2008), Winseck, Dwayne; International Communication Gazette (Formerly Gazette), Dec 01, 2008; Vol. 70, No. 6, p. 419-441.34 http://www.wisegeek.com/how-big-is-the-internet.htm

of 56

http://www.pcmag.com/article2/0,2817,2270962,%2000.asp02.27.08

http://www.guardian.co.uk/commentisfree/2009/dec/14/internet-extremism-jihadi-youtube


unclear whether we mean to ask “how many people use the Internet or how many websites are on the Internet or how many bytes of data are contained on the Internet or how many distinct servers operate on the Internet or how much traffic runs through the Internet per second.”35 We can say that the Internet is widely used, for over a billion people use it.36

Often the size of the Internet is equalled to the size of bytes it takes up. Estimating that is “a difficult task”, but Eric Schmidt, the CEO of Google, estimated the size at roughly 5 million terabytes of data. That’s over 5 billion gigabytes of data. Google has indexed roughly 200 terabytes of that, or .004% of the total size.37

In addition, there are thought to be some “155 million websites on the Internet” and roughly “75 million servers worldwide”, although this number is more of a guesstimate.38

The vast amount of data available on the Internet also means that it is initially often necessary to use machines and specific programs such as bots or Trojans to gather relevant data that can later be processed by human operators, if at all. The programs used for counter-terrorism are for the most part designed to catch as many potential terrorists as possible. This suggests that there will be many false positives, which can only be vetted out using human operators. Vetting using human operators can be quite costly and is not always possible as a means of controlling the quality of the data. 39 The above raises privacy concerns, and it is debatable whether the efficiency of doing Internet data mining is proportional to the results obtained.40

3.1.1 Access to dataPerhaps the most striking feature of the Internet is the easy access it provides to tremendous amounts of data, public as well as private and semi-private. Public data is available because many governmental agencies publish their databases on-line and of course anything posted on the web becomes public if it is not password protected or encrypted, irrespective of whether it is posted by a private individual or a government. The information on sites such as Facebook can usually only be accessed by using a password and is therefore semi-private, but is still meant for general consumption.

The huge amount of data available and the possibilities of doing cross-reference and advanced searches are relatively new phenomena. It can be argued that, even though data might have been available before the Internet, it was not a threat to privacy in the same way it is today simply because it was so difficult to access or to find relevant material. It could be said that that the data deluge was in itself a protection for the individual but new techniques and the EU directive on data retention, 41

35 Ibid.36 On the other hand it also means that more than 5 billion people do not use it, which also gives pause for thought in a society where Internet access is taken for granted. It also raises concerns about the efficiency of hunting for terrorists on the Internet.37 www.wisegeek.com/how-big-is-the-internet.htm38 Ibid.39 See chapter 3.1.2 below.40 Terrorism and the Proportionality of Internet Surveillance, 2009, Brown, Ian; European Journal of Criminology, Mar 01, 2009; Vol. 6, No. 2, p. 119-134.41 Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC.

of 56

http://www.wisegeek.com/how-big-is-the-internet.htm


e.g., makes sure that agencies are given plenty of tools and time to search databases a long time after a data transfer took place.

This mix of easily available public and private data is also something new that might be misused if safeguards are not in place42 as the German government witnessed when it paid for access to stolen data.43

3.1.2 Quality of dataSince the amount of data on the net is vast and since there are so many people posting all sorts of things, it is virtually impossible in many cases to know what is true, what purpose the post has, under what circumstances it was made and who it is aimed at. It is in other words very difficult or even impossible to assess the quality of the data most of the time.

In many cases posts are made without any awareness that they can be used for purposes other than those intended. In other cases posting is done with a specific aim in mind, such as recruiting new terrorists. There is also deliberate misinformation, propaganda, plain ignorance or out-dated data to deal with when assessing the value of information posted.

When it comes to assessing the quality of data, which in this context means assessing if the data is relevant in the search for terrorists, there are two things that must be considered: the accuracy of the data and evidence of criminal intent, i.e. mens rea. Establishing criminal intent entails distinguishing between somebody who may be letting off steam in the heat of the moment, exercising his or her right to freedom of speech, and a person who is a genuine threat. Establishing the reliability of the data is no less difficult. If the user doesn’t know what criteria the collector has applied to control the validity of the data when gathering the information, then they cannot assess the value of the data. Since there is no standard means of assessing the quality of information, standards may vary widely depending on what information is gathered and under what circumstances.

3.2 Privacy concernsThe Internet gives rise to obvious privacy concerns. Much of the information we use on the net, such as credit card details, social security information, etc., is sensitive and can be misused, as the many instances of credit card fraud and phishing scams44 show. It is crucial, therefore, that this information remains confidential. On the other hand, much of the information posted on the net is not, on the face of it, sensitive at all. On the contrary, we want people to access our websites, Facebook pages, etc. But even this information can be used in ways that give rise to privacy concerns, especially if it is combined or collated in ways not envisioned by the person who posted it. As Alessandro Acquisti, an

42 See chapter 3.3.43 See e.g. www.independent.co.uk/news/business/news/uproar-as-germany-pays-euro25m-for-stolen-credit-suisse-data-1891468.html “Uproar as Germany pays €2.5m for stolen Credit Suisse data” or www.nzz.ch/nachrichten/international/schweizer_konten_1.6030378.html “Steuersünder-CD führt zu Milliarden auf Schweizer Konten”. Germany's government paid an estimated €2.5m for a CD of German depositors' data illegally taken from Credit Suisse's Zurich offices. The CD's files indicate tax evasion by some 1,500 individuals amounting to €400m, the largest single case in modern German history.44 Phishing is the act of sending an e-mail to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft. The e-mail directs the user to visit a Web site where they are asked to update personal information, such as passwords and credit card, social security, and bank account numbers, that the legitimate organization already has. The Web site, however, is bogus and set up only to steal the user’s information.

of 56

http://www.nzz.ch/nachrichten/international/schweizer_konten_1.6030378.html

http://www.independent.co.uk/news/business/news/uproar-as-germany-pays-euro25m-for-stolen-credit-suisse-data-1891468.html



Associate Professor of information technology at Carnegie Mellon University, states, “you can come up with something that is much more sensitive than the individual pieces.”45 As reported in an article by Elisabeth Svoboda, he tested his idea in a study, reported earlier this year in Proceedings of the National Academy of Sciences. He took seemingly innocuous pieces of personal data that many people put online such as birthplace and date of birth, both frequently posted on social networking sites, and combined them with information from the Death Master File, a public database from the U.S. Social Security Administration. With a little clever analysis, he found he could determine, in as few as 1,000 tries, someone’s Social Security number 8.5 percent of the time. Data thieves could easily do the same thing: They could keep hitting the log-on page of a bank account until they got one right, then go on a spending spree. With an automated program, making thousands of attempts is no trouble at all.46

Since data remain online forever,47 some bit of seemingly harmless information that is posted today could easily be used in ways that might damage the poster years from now. With so much information made available online, the probability that some of it may be acquired by those who intend to misuse it, or end up in places it was not intended to be is significant.48

Information online is useful for, e.g., predictive analysis for commercial reasons—employing statistical analysis methods to analyse data that uncover significant patterns. As Svoboda argues, When you have a detailed set of information on a group of people, their political views, the kind of homes they live in, and their favourite movie genres, cluster patterns can emerge. To find these patterns, data miners ...chart their harvested facts on a scatter plot, an imaginary graph that has as many dimensions as the number of personal characteristics being evaluated, such as age, marital status, gender, and geography.49

Besides commercial use predictive analysis can also be used as a political tool. As Svoboda reports, democratic consultant Strasma devised a mathematical model that predicts the political behaviour of voters. ...[He] first randomly selected a pool of about 10,000 voters from his database, which includes demographic information on more than 100 million people. His consulting firm next conducted phone interviews with those 10,000 to learn their views on a wide range of political topics. Armed with that huge data set, Strasma started looking for clusters. He found some strange things. Gin drinkers tend to be Democrats. Military history buffs are generally conservative on social issues. Got call-waiting? You’re probably a Republican. “We come up with correlations that might not be intuitive at all,” Strasma says. “We really don’t get at the whys of it.” But really, the whys don’t matter; only the correlations do.To figure out the voting behaviour of those not surveyed, Strasma applied what is called the nearest-neighbour algorithm. This technique matches each of the 100 million eligible voters in the United States to one of the people surveyed, according to a range of demographic measures. The ‘distance’ between voters is how similar or dissimilar they are, based on

45 Elizabeth Svoboda, It May Already Be an Illusion. Discover Magazine. Your Digital Privacy? From the November 2009 issue; published online January 8, 2010. http://discovermagazine.com/2009/nov/08-your-digital-privacy-may-already-be-an-illusion/article_view?b_start:int=0&-C=46 Ibid.47 See the Internet Wayback Machine www.archive.org/web/web.php48 Note 37 ibid.49 Ibid.

of 56

http://www.archive.org/web/web.php

http://discovermagazine.com/2009/nov/08-your-digital-privacy-may-already-be-an-illusion/article_view?b_start:int=0&-C



these thousands of indicators. For instance, two voters with similar retail preferences might tend to vote the same way.50

Such methods can easily be applied in counter-terrorism to see how likely a person is to become a terrorist. The problem with the analogy with Strasma’s work is that in the latter case there is no harm when predictions are wrong- so what if somebody votes for some other party than was anticipated? But if measures are taken against a person wrongly singled out as potentially extremist or prone to violence, the consequences may be serious. To my mind there is a high risk that that person’s rights will be restricted in a way that is not in accordance with, e.g., the ECHR.51

There is vocal opposition to increased data mining, many people fear that it will infringe privacy and consequently other rights that are needed for a functioning democracy. The risk of an Orwellian state is, according to some, very real.52 States must take this worry seriously if they are to abide by human rights standards and expect the trust and cooperation of their citizens in the future. Many in the engineering community, politicians and policymakers share these fears and consequently steps have been taken to ensure that privacy infringements are kept within reasonable bounds. What counts as reasonable is of course highly debatable, since there is no concise and universally accepted definition of privacy.

There are two main methods of dealing with privacy concerns: technical and legal. In the following two chapters examples of the methods to address privacy concerns are outlined and terminology is explained.

3.3 Privacy analysis of information systemsOne way of addressing privacy concerns is to construct a model that evaluates whether an information system is invasive or not. This method can be used before or after a system has been employed and when dividing search terms into categories in order to decide their effect upon human rights.53

3.3.1 Privacy Threshold AnalysisOne such attempt is the Privacy Threshold Analysis (PTA) document used by the Department for Homeland Security in the United States.54 Privacy Threshold Analysis is a form used for all information technology systems that are going through the certification and accreditation process required under the Federal Information Security Management Act55 to determine whether they maintain personally identifiable information or personally identifying information, PII, [see below for a definition of PII].

The PTA includes a description of the system, what PII, if any, is collected or used, and from whom. The PTA is the first document completed by a Department for Homeland Security component seeking 50 Ibid.51 See chapter 1 and 4 respectively.52 See chapter 3.3.53 See chapter 4.4.54 www.dhs.gov/xlibrary/assets/privacy/DHS_PTA_Template.pdf55 The Federal Information Security Management Act of 2002 (“FISMA”, 44 U.S.C. § 3541, et seq.) is a United States federal law enacted in 2002 as Title III of the E-Government Act of 2002 (Pub.L. 107-347, 116 Stat. 2899). The act requires each federal agency to develop, document, and implement an agency-wide program to provide information security for the information and information systems that support the operations and assets of the agency.

of 56

http://www.dhs.gov/xlibrary/assets/privacy/DHS_PTA_Template.pdf


to implement a system, program, or project. The PTA identifies whether the system, program, or project is a Privacy Sensitive System i.e., a system that collects or maintains PII or otherwise impacts privacy. The PTA also identifies whether additional privacy compliance documentation is required.56

Examples of questions asked in the PTA are:

Is there a log kept of communication traffic? What type of data is recorded in the log? Could the project relate in any way to an individual? What information about individuals could be collected, generated or retained?57

After the form has been submitted to The Privacy Office of the U.S. Department of Homeland Security, a privacy threshold review is carried out by the DHS Privacy Office in order to assess whether further analysis is needed and whether the information system falls under specific laws protecting privacy.

3.3.1 Personally Identifying InformationIn information security and privacy, personally identifiable information or personally identifying information, PII, is any piece of information which can be used to uniquely identify an individual or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual, or information that can be used to distinguish or trace the individual’s identity.58

It is noted that PII has become much more important as information technology and the Internet have made it easier to collect PII, leading to a profitable market in collecting and reselling PII. PII can also be exploited by criminals to stalk or steal the identity of a person, or to plan a person's murder or a robbery, among other crimes. As a response to these threats, many website privacy policies specifically address the collection of PII, and lawmakers have enacted a series of legislation to limit the distribution and accessibility of PII.59

A number of similar definitions of PII are currently in use. The U.S. Department of Homeland Security defines personally identifiable information as:

any information that permits the identity of an individual to be directly or indirectly inferred, including any information which is linked or linkable to that individual regardless of whether the individual is a U.S. citizen, lawful permanent resident, visitor to the U.S., or employee or contractor to the Department.60

3.3.2 Privacy Impact Assessment According to the US government, a privacy impact assessment, PIA, is:

an analysis of how information is handled: (I) to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (II) to determine the risks and effects of

56 www.dhs.gov/xlibrary/assets/privacy/DHS_PTA_Template.pdf57 Ibid.58 See footnote 60 below.59 Ibid.60 DHS Privacy Office, Handbook for Safeguarding Sensitive Personally Identifiable Information at the Department of Homeland Security 4 (Oct. 31, 2008).

of 56



collecting, maintaining, and disseminating information in identifiable form in an electronic information system; and (III) to examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks.61

All of the above are tools designed to determine whether an information system is infringing privacy. When used by the government, they are applied in addition to, rather than instead of any analyses already undertaken when the system was instigated. The fact that this kind of dual control is deemed necessary is yet another proof of the acknowledged difficulties of controlling invasive information systems.

3.4 Privacy handling rules in automated processing systemsOne of the most common ways to ensure privacy is by building into the information-gathering software protective safe-guards guarding privacy. The idea is that the data collected should be modified or represented in such a way as to render it useless for those trying to infringe a person’s privacy.

3.4.1 Rule-based processingAs Tygar points out, “to the extent that privacy handling rules can be attached to data or to queries in machine readable form, it becomes possible to enforce privacy restrictions within the framework of automated processing systems.”62 Rule-based processing has, argues Taipale, two aspects. First, “to the extent that an “Intelligent agent” is used for a central query to distributed databases, that software agent must negotiate access and permitted uses with each database”. 63 Second, data items themselves “can be labelled with meta-data, data about the data, describing how that item must be processed. Thus, even if a data item is removed or copied to a central database, it retains relevant rules by which it must be processed”.64 Rule-based processing is, he continues, “dependent on research in areas such as proof carrying code, data labelling and analytic filtering tools”.65

3.4.2 Proof carrying codeTaipale claims that:

In order for intelligent prospecting agents to gain access to a distributed site, the software agent itself must be able to carry certain specifications and proof that those specifications are met. ...[T]he software agent must exhibit to the distributed database that it is seeking access pursuant to [for example] a warrant and prove that it meets the technical requirements of that warrant in its search or processing. To do so requires developing technologies called proof carrying code. Proof carrying code would allow the ... server to independently determine whether the query application complies with ...privacy ...requirements...66

3.4.3 Data labellingIn terms of data labelling, Taipale argues that:

61 Office of Management and Budget, "Memorandum M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002" (Sept. 26, 2003).62 Tygar J. D. `Technological dimensions of privacy in Asia’ Asia-Pacific Review, Volume 10, Issue 2 November 2003 , pages 120 – 145.63 Taipale, K. A., Data Mining and Domestic Security: Connecting the dots to make sense of data. The ColumbiaScience and Technology Law Review, Volume 5, 2003.p.200 www.stlr.org/html/volume5/taipale.pdf64 Ibid. p.20165 Ibid. p.20266 Ibid.

of 56

http://www.stlr.org/html/volume5/taipale.pdf

http://www.informaworld.com/smpp/title~db=all~content=g713613376

http://www.informaworld.com/smpp/title~db=all~content=t713405589


Data labelling presents structure, meta-data, and references to the processing application. Labelling... can be static, that is, permanently assigned to the object, or synthetic, that is, assigned by the server to the item when it is requested. The purpose of the label is to specify to some application the rules under which processing can occur. Encrypted wrappers can be used to maintain secrecy except under specified conditions.67

3.4.4 Analytic filteringAn example of analytic filtering technology is the Department of Justice developed DCS-1000 application, “Carnivore”. DCS-10 is an analytical filtering tool designed to scan email traffic and only pick out that material that is authorized under the particular search warrant pursuant to which it is being employed. According to the FBI website, the Carnivore device provides the FBI with a “surgical” ability to intercept and collect the communications which are the subject of the lawful order while ignoring those communications which they are not authorized to intercept.68

3.4.5 Selective revelationAs Taipale elaborates;

The goal of selective revelation is to protect against the revelation of ... personally identifying information while supporting data analysis. This approach uses an iterative, layered structure that reveals personal data partially and incrementally in order to maintain subject anonymity. Initial revelation would be based on statistical or categorical analysis... . This analysis would be applied to data that was sanitized or filtered in a way so that it did not reveal personally identifying information. Based on initial results, subsequent revelations may or may not be justified. At each step, legal and technical procedures can be built in to support particular privacy policies or other policies, such as security clearances, etc.

For example, a directed link analysis based on characteristics of several known terrorists might produce a pattern or reveal additional relationships that appear relevant. A specific query could then be run using the pattern, for example, “search for other occurrences of large quantity chemical purchases and truck rentals.” The algorithm would respond by confirming or denying that such other patterns exist without revealing personal identifying information of the transactions.69

3.4.6 Anonymous matching“Anonymous matching”, explains Taipale is:

A technology that can match data between separate databases without revealing the data itself... using one-way hash functions to convert data into unique but unreadable character strings allows these technologies to compare and update data without revealing the data itself. Thus, two databases e.g., a government watch list and a corporate database, can be compared without exchanging actual data. Only the one-way hash functions are compared and the result is a match without revealing the data.70

3.4.7 Credentialing and auditingTaipale argues further that:

67 Ibid. 68 Ibid. See also Congress Clamps Down On Carnivore http://usgovinfo.about.com/library/weekly/aa080601a.htm69 Note 63.70 Ibid.

of 56

http://usgovinfo.about.com/library/weekly/aa080601a.htm


To protect against abuse by insiders (and to identify and track attacks by outsiders), strong tamper-proof audit mechanisms must be built into the architecture. Audit trails must span many distributed databases so technology must be developed to make these logs not only tamper resistant, but also encrypted so that they themselves do not become subject to attack or inadvertent disclosure.71

3.5 Criticism of data mining - The example of EU data retention directiveDespite the many safeguards against abuse of databases, critique of the increased use of and control over databases by governments persist. The critique is based on fears that any safeguards can be overcome and that the monitoring of the internet and databases is at odds with human rights. Perhaps the best example at the moment of the critique is that levied against the EU data retention act.

On 15 March 2006 the European Union formally adopted Directive 2006/24/EC, on “the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC”.72 The EU directive was seen as central in the fight against terrorism.

The Directive “requires Member States to ensure that communications providers must retain, for a period of between 6 months and 2 years, necessary data as specified in the Directive to;

trace and identify the source of a communication; trace and identify the destination of a communication; identify the date, time and duration of a communication; identify the type of communication; identify the communication device; identify the location of mobile communication equipment

The data is required to be available to competent national authorities in specific cases, “for the purpose of the investigation, detection and prosecution of serious crime, as defined by each Member State in its national law”.73 Needless to say this directive has come under a lot of criticism, official as well as from civil society.

3.5.1 Civil society criticism – An appeal to abolish data retentionThe directive was met with strong criticism across the EU.74 In Germany the directive was met with particular scepticism, perhaps because of the country’s historical background and strong constitution.

Forty-eight German organizations and associations asked the Federal Minister of Justice to “push for the abolition of EU telecommunications data retention requirements” which compel phone and Internet companies to collect data about their customers communications. As the European Digital Rights group note, According to the letter, data retention puts confidential activity and contacts, for example to journalists, crisis lines and business partners, at risk of disclosure by way of data leaks

71 Ibid.72 Note 34 ibid.73 Directive 2006/24/EC, on "the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC".74 See below in this chapter.

of 56

http://en.wikipedia.org/wiki/Directive_2006/24/EC


and abuses. It is expensive and damages the freedom of communication. Among the signatories of the letter were German civil liberties, data protection and human rights associations as well as crisis line and emergency call operators, professional associations of journalists, jurists and doctors, major trade unions, the Federation of German Consumer Organizations and the eco - Association of the German Internet Industry.

As EDR report, The EU-wide requirement to retain the entire population's communications data, introduced in 2005, is out-dated”, said Patrick Breyer of the German Working Group on Data Retention, a civil liberties NGO.

Blanket data retention has proven to be superfluous, harmful and unconstitutional in many states across Europe, such as Germany, Austria, Belgium, Greece, Romania and Sweden. These states prosecute crime just as effectively using targeted instruments, such as the internationally agreed Convention on Cybercrime.75 Where data retention has been implemented, the crime clearance rate has not increased. For example in North Rhine-Westphalia, the most populated state of Germany, 85% of all reported Internet crime was cleared in 200776 before the introduction of data retention legislation, but only 77% was cleared in 200877 and in 200978 after the implementation of data retention. The EU regulations must now be made more flexible to allow for alternative procedures that work more intelligently than an untargeted stockpiling of data.

About 70% of all Germans are opposed to a recording of their contacts and location in the absence of any suspicion”,79 says Florian Altherr of the Working Group. “They want to be sure that their private and business contacts to marital crisis lines, lawyers, journalists and others cannot fall into the wrong hands or erroneously make them a suspect in the eyes of law enforcement authorities. The countless number of data scandals such as the systematic abuse of communications data at Deutsche Telekom has taught us that only erased data is safe data.80

Across Europe the data retention directive has been criticised for being ill-conceived, dangerous a violation of human rights and expensive, among other things. More than 100 organisations from 23 European countries asked EU Commissioners Cecilia Malmström, European Commissioner for Home Affairs, Viviane Reding, European Commission Vice-President with responsibility for Justice, Fundamental Rights and Citizenship and Neelie Kroes, European Commission Vice-President with responsibility for the Digital Agenda, in a joint letter to “propose the repeal of the EU requirements regarding data retention in favour of a system of expedited preservation and targeted collection of traffic data.81

75 Council of Europe, Convention on Cybercrime CETS No.: 185.76 Kriminalitätsentwicklung im Land Nordrhein-Westfalen Jahr 2007, p. 58. www.polizei-nrw.de/lka/stepone/data/downloads/08/01/00/kriminalitaetsentwicklung_pks_nrw_2007.pdf77 Kriminalitätsentwicklung im Land Nordrhein-Westfalen Jahr 2008, p. 69. www.polizei-nrw.de/lka/stepone/data/downloads/45/01/00/pks-nrw-jahresbericht-2008.pdf78 Kriminalitätsentwicklung im Land Nordrhein-Westfalen 2009, p. 69. www.polizei-nrw.de/lka/stepone/data/downloads/6a/01/00/pks-jahresbericht2009.pdf79 DFG-Projekt ”Der ’überwachte’ Bürger zwischen Apathie und Protest - Zur Genese neuer staatlicherKontrolltechnologien und ihren Effekten auf Einstellungen und Verhalten der Bevölkerung”. Institut für Sicherheits- und Präventionsforschung e.V. (ISIP) Hamburg, p. 3. www.vorratsdatenspeicherung.de/images/infas-umfrage.pdf80 Note 59 ibid.81 Full text of the letter: www.privacyinternational.org/article.shtml?cmd[347]=x-347-566461

of 56

http://www.privacyinternational.org/article.shtml?cmd%5B347%5D=x-347-566461

http://www.vorratsdatenspeicherung.de/images/infas-umfrage.pdf

http://www.polizei-nrw.de/lka/stepone/data/downloads/6a/01/00/pks-jahresbericht2009.pdf

http://www.polizei-nrw.de/lka/stepone/data/downloads/45/01/00/pks-nrw-jahresbericht-2008.pdf

http://www.polizei-nrw.de/lka/stepone/data/downloads/08/01/00/kriminalitaetsentwicklung_pks_nrw_2007.pdf


As Privacy International reports, among the signatories are civil liberties, data protection and human rights associations as well as crisis line and emergency call operators, professional associations of journalists, jurists and doctors, trade unions, consumer organisations and industry associations.82

The signatories claim that although the data retention directive was ostensibly created to reduce barriers to the single market, the directive was proposed as a measure aimed at facilitating criminal investigations. The directive creates a process for recording details of who communicated with whom via various electronic communications systems. In the case of mobile phone calls and SMS messages, the respective location of the users is also recorded. In combination with other data, Internet usage is also to be made traceable.83

The signatories believe that such invasive surveillance of the entire population is unacceptable. With a data retention regime in place, sensitive information about social contacts, including business contacts, movements and the private lives e.g. contacts with physicians, lawyers, workers councils, psychologists, helplines, etc., of 500 million Europeans is collected in the absence of any suspicion. Telecommunications data retention undermines professional confidentiality, creating a permanent risk of data losses and data abuses and deters citizens from making confidential communications via electronic communication networks. According to the signatories it undermines the protection of journalistic sources and thus compromises the freedom of the press. Overall it damages preconditions of our open and democratic society. In the absence of a financial compensation scheme in most countries, the enormous costs of a telecommunications data retention regime must be borne by the thousands of affected telecommunications providers. This leads to price increases as well as the discontinuation of services, and indirectly burdens consumers.84

The signatories further allege that studies prove that the communications data available without data retention are generally sufficient for effective criminal investigations. Blanket data retention has proven to be superfluous, harmful or even unconstitutional in many states across Europe, such as Austria, Belgium, Germany, Greece, Romania and Sweden. These states prosecute crime just as effectively using targeted instruments, such as the data preservation regime agreed in the Council of Europe Convention on Cybercrime. There is no proof that telecommunications data retention provides for better protection against crime. On the other hand, it costs billions of euros, puts the privacy of innocent people at risk, disrupts confidential communications and paves the way for an ever-increasing mass accumulation of information about the entire population.85

The signatories also claim that retention of telecommunications data in the absence of any suspicion is incompatible with the EU Charter of Fundamental Rights as witnessed in the European Court of Human Rights’ Marper judgement86 and by the Constitutional Court of Romania.87

82 Ibid.83 Ibid.84 Ibid.85 Ibid.86 Case of s. and Marper v. the United Kingdom (Applications nos. 30562/04 and 30566/04), Judgment4 December 2008.87 Romanian Constitutional Court decision against data retention, published in the Official Monitor on 23 November 2009. www.ccr.ro/decisions/pdf/ro/2009/D1258_09.pdf

of 56

http://www.ccr.ro/decisions/pdf/ro/2009/D1258_09.pdf


3.5.2 Official criticism – Struck down by the German Federal Constitutional CourtAs reported in the EU Observer, on March 2, 2010 Germany’s highest constitutional court ruled that the German data-retention law arising from the EU directive contravened Germany’s constitution. 88

The 2008 law required telecommunications companies to retain all citizens’ telephone and Internet data for six months. The court ordered the data retention from phones and the Internet to be stopped immediately.89

The law caused outrage among German citizens, concerned at breaches of privacy and civil liberty rights.90 A complaint was brought by 35,000 citizens, the largest number of plaintiffs ever associated with one case. The constitutional court found in their favour, ruling that the national law breached Germany's basic law on privacy grounds, although it did not call into question the original EU law, which provides for member states storing telephone and Internet data for up to 24 months.91

The court ruled that all data stored until now must be deleted and no more data may be held until the national law is revised to conform with the country´s basic law. They found that the law failed to set the barrier high enough for allowing investigators access to the data and failed to ensure sufficient data encryption should the information be stolen.”92 In addition, “the disputed instructions neither provided a sufficient level of data security, nor sufficiently limited the possible uses of the data,” the court said. It also noted that “such retention represents an especially grave intrusion.93

88 BVerfG, 1 BvR 256/08 vom 2.3.2010, Absatz-Nr. (1 - 345).89 ‘German court strikes blow against EU data-retention regime’ by Honor Mahoney, EU Observer, 03.03.2010, http://euobserver.com/9/29595 90 See note 81 above.91 “German court strikes blow against EU data-retention regime”, as above, note 81.92 Ibid.93 Ibid.

of 56

http://euobserver.com/9/29595


4. Defining a terrorist In order to catch terrorists one must first define who is a terrorist. The first international anti-terrorist measures were adopted in the framework of the United Nations, where around a dozen conventions have been adopted to combat different aspects of terrorism.94 In Europe however, the most significant effort was the signing of a Council of Europe Convention in 1977, in which for the first time terrorism was treated generically, in the sense that it provided for a list of concrete terrorist acts.95

European Convention on the Suppression of Terrorism, article 1

For the purposes of extradition between Contracting States, none of the following offences shall be regarded as a political offence or as an offence connected with a political offence or as an offence inspired by political motives:

a. an offence within the scope of the Convention for the Suppression of Unlawful Seizure of Aircraft, signed at The Hague on 16 December 1970;

b. an offence within the scope of the Convention for the Suppression of Unlawful Acts against the Safety of Civil Aviation, signed at Montreal on 23 September 1971;

c. a serious offence involving an attack against the life, physical integrity or liberty of internationally protected persons, including diplomatic agents;

d. an offence involving kidnapping, the taking of a hostage or serious unlawful detention; e. an offence involving the use of a bomb, grenade, rocket, automatic firearm or letter or

parcel bomb if this use endangers persons; f. an attempt to commit any of the foregoing offences or participation as an accomplice

of a person who commits or attempts to commit such an offence.

The European Council also adopted a Convention on the Prevention of Terrorism.96 The purpose of the Convention is to “enhance the efforts of parties in preventing terrorism and its negative effects on the full enjoyment of human rights, in particular the right to life, both by measures to be taken at national level and through international co-operation”. This is supposed to be accomplished by exchanging information, improving the physical protection of persons and facilities and enhancing training and coordination plans for civil emergencies. Each party to the convention is also required to adopt measures to establish public provocation to commit terrorist offences, training for terrorism and recruitment for terrorism as a criminal offence under its domestic law in order to highlight the gravity of the offence.

The European Union adopted in 2002 a framework decision to fight terrorism more efficiently.97

According to the EUROPA website, it contains a definition of terrorist offences, defines infringements

94 For an overview of UN Conventions dealing with terrorism, see Legislative Guide to the Universal Anti-Terrorism Conventions and Protocols by the United Nations Office on Drugs and Crime. www.unodc.org/pdf/crime/terrorism/explanatory_english2.pdf95 European Convention on the Suppression of Terrorism, Strasbourg, 27.I.1977.96 Convention on the Prevention of Terrorism, Council of Europe Treaty Series – No. 196.97 Council Framework decision of 13 June 2002 on combating terrorism (2002/475/JHA)

of 56

http://www.unodc.org/pdf/crime/terrorism/explanatory_english2.pdf


linked to terrorist acts, covers behaviours which may contribute to such acts, approximates the level of sanctions between Member States and explicitly guarantees the respect for fundamental rights.98

The framework decision on combating terrorism “contains a definition of terrorist offences that combines two elements:

Objective, as it draws a list of serious offences such as attacks upon a person's life or physical integrity, kidnapping or hostage taking, seizure of aircrafts, etc.

Subjective, as these acts will only be considered as terrorist offences when intentionally committed with a specific terrorist aim, as described in the framework decision.”99

The framework decision

defines infringements linked to terrorist activities such as theft, forged documents, extortion of funds, etc., and offences related to terrorist groups such as directing a terrorist group or participating in its activities, including by funding them in any way.100

It also

explicitly guarantees respect for fundamental rights such as the freedom of assembly, of association and of expression. It approximates the level of sanctions between member states according to the principle that sentences have to be both proportional and dissuasive. To this end, different minimum maximum sentences have been set up, depending on the gravity of the offence. It contains provisions for the protection of victims of terrorist acts as well.101

In November 2004, United Nations Secretary General Kofi Annan described terrorism as:

Any act intended to cause death or serious bodily harm to civilians or non-combatants with the purpose of intimidating a population or compelling a government or an international organization to do or abstain from doing any act.102

The Secretary Generals definition deals with the results of terrorism. It is used by intelligence services and police since it avoids discussions about political motivation, struggle for independence etc. and focuses on civilian victims of terrorism. For these reasons it is also the definition of terrorism used in this paper and makes sure that the does not contain any exceptions or excuses to terrorism.

98 http://ec.europa.eu/justice_home/fsj/criminal/terrorism/fsj_criminal_terrorism_en.htm 99 Ibid.100 Ibid.101 Ibid.102 http://web.archive.org/web/20070427012107/http://www.un.org/unifeed/script.asp?scriptId=73

of 56

http://web.archive.org/web/20070427012107/http://www.un.org/unifeed/script.asp?scriptId=73

http://ec.europa.eu/justice_home/fsj/criminal/terrorism/fsj_criminal_terrorism_en.htm


4. ProfilingProfiling • n. the analysis of a person's psychological and behavioural characteristics, so as to assess or predict their capabilities or to identify subgroups of people.103

The above definition is the classic definition of profiling.104 In counter-terrorism, however, it must be supplemented by adding criteria such as racial or ethnic characteristics, because of the nature of specific terrorist threats based on religious and ethnic conflicts.

Profiling is not something new or even out of the ordinary. On the contrary, it is widely used for commercial purposes by companies looking for potential buyers who can be targeted with specially made advertising such as direct mail and special offers tailored to suit an individual customer.

Commercial profiling is not without its problems but it is not nearly as contested as profiling used for finding terrorists. Even though the mapping of shopping habits might in some cases be considered an infringement of a person’s right to privacy, the fact remains that our shopping habits are often not as private or important as our political and religious beliefs.

The main difference between fighting crime and fighting terrorism with computer searches and profiling is that political and religious beliefs play a very minor role, if any, in the fight against crime while they play a major role in the fight against terrorism. Nevertheless some of the components and the methodology of criminal profiling are also used in the hunt for terrorists, therefore I will now discuss criminal profiling in more detail.

Criminal profiling is used mostly by behavioural scientists and the police to narrow down an investigation to those suspects who possess certain behavioural and personality features that are revealed by the way a crime was committed. As the Swiss portal on criminal profiling reports, a

major source of research and development on criminal profiling is the Investigative Support Unit of the Federal Bureau of Investigation in the United States that started out as the Behavioral Science Unit in the late 1950s. Now a part of the National Center for the Analysis of Violent Crime, which is one of the major components of the Critical Incident Response Group, it consists of agents and professionals with training in behavioural or forensic science as well as consultants from the mental-health professions.105106

This unit has

amassed large amounts of data on the backgrounds, family characteristics, current behaviours and psychological traits of various types of criminal offenders, partly obtained from interviews with dozens of convicted criminals such as serial murderers.107

103 Concise Oxford English Dictionary, 11th Edition Revised104 There are of course more specific definitions of criminal profiling such as that found in Brent E. Turveys´ Criminal Profiling – an introduction to behavioral evidence analysis, but they do not necessarily fit here since terrorism is a crime that in many ways differ from regular crimes.105 See www.fbi.gov/hq/isd/cirg/ncavc.htm#bau 106 Swiss portal on Criminal Profiling Research ’General Use of Criminal Profiling in Praxis” http://www.criminalprofiling.ch/use.html107 Ibid.

of 56

http://www.fbi.gov/hq/isd/cirg/ncavc.htm#bau


The portal further reports that on March 1993, INTERPOL established a

fully operational crime analysis capability at the General Secretariat - the Analytical Criminal Intelligence Unit, which according to INTERPOL had a significant and positive impact on the level of assistance INTERPOL was able to provide to its member countries in combating crime. 108109 The advantage of crime analysis is that it has introduced structures, methods and a uniform set of techniques, e.g. an assessment of the scale and nature of high-volume crime such as burglary, numerous varied activities of an organized crime group such as the Mafia, or the identification of a lone serial killer. “Crime analysis is”, according to INTERPOL’s understanding, “a combination of uniform techniques focusing on the development of hypotheses, reconstructing the course of individual criminal incidents, identifying a series of related crimes, understanding criminal networks and analysing the scope of and patterns in criminal activity.”110

The profiling process, irrespective of whether it aims to find terrorists or regular criminals, usually contains the following steps:111

1. It describes the class of person, instances of which the security organization wishes to locate.2. It uses existing experience to define a profile of that class of person. 3. The profile is formally expressed, perhaps including the use of weightings to reflect the

degree of correlation between the characteristic and the target, thresholds below which the correlation is low and above which it is high, and complex conditional relationships among the factors.

4. Data is acquired concerning a relevant population5. The data is searched for individuals whose characteristics comply with the profile. This is

highly likely to involve computer support, especially where the data-set is large, the processing complex, or the time available short.

6. Action is taken in relation to those individuals identified such as increased surveillance.

4.1 Benefits of profilingProfiling is considered to be an important tool in law enforcement and, in all probability, is here to stay. Several reasons for this are outlined below but perhaps the most important reason is that there are no real cost-effective alternatives for preventive action or that the alternatives are worse. It is, for example, theoretically possible to construct a state that knows almost everything about its citizens.112 Such a state would have little or no use for profiling but would of course be totalitarian.

Profiling has become a staple tool for combating terrorism. The United States, e.g., has implemented airline security measures to replace mandatory screening of air travellers from certain countries. The measures significantly reduce the number of passengers pulled aside for additional screening and are not based on nationality or passport, but on characteristics pulled together by intelligence agencies. The system is tailored after a certain profile. The measures require a traveller to undergo additional

108 Ibid.109 See for example ICPO-Interpol - General Assembly 65th Session - Antalya - 23rd-29th October 1996.110 Quoted in Meyer, Das Täterprofil aus interdisziplinärer Sicht, unter besonderer Berücksichtigung des Strafprozessrechts. www.criminalprofiling.ch/aufsatz.html 111 See for instance Clarke, Profiling: A Hidden Challenge to the Regulation of Data Surveillance. Published in the Journal of Law and Information Science 4, 2 (December 1993). See also www.rogerclarke.com/DV/PaperProfiling.html#Techn112 The number of methods states have at their disposal to control citizens is mind boggling, see for instance Moeckli and Thurman, Survey of Counter-Terrorism Data Mining and Related Programmes.

of 56

http://www.rogerclarke.com/DV/PaperProfiling.html#Techn

http://www.criminalprofiling.ch/aufsatz.html


screening if they match information about terrorism suspects gathered by intelligence agencies, such as a physical description, partial name or travel pattern.113

Terrorists themselves also frequently make use of the Internet to communicate and for propaganda, and therefore it is logical that those communications are used by the security services to get an idea of who will be likely to carry out the next attack. A successful profile can be used proactively to prevent an attack before it happens and save lives. It also gives information on what turns people into terrorists, thus making it possible to try to counteract some of those factors and prevent the making of new terrorists. Finally it is important not to forget the victims of terrorism and their relatives. They demand and deserve that the government does everything in its power to punish those responsible, which is also a clear obligation of the EU member states.

4.1.1 EffectiveWhen assessing whether profiling is effective or not one has to take into account costs, both human and monetary, leads gathered, the budget allocated and the alternatives to profiling.

Whether the costs are worthwhile in view of the result will always be a subjective matter. Comparisons with other crime fighting methods are not always relevant because of political reasons, i.e. how the public perceives the terrorist threat compared to the threat from regular crime. Fighting terrorism is usually perceived as a more pressing need than fighting ordinary crime, even though the damage caused by terrorism when counted in material and human lives might be less than that caused by ordinary crime. It can also be argued that allocating fewer resources to the fight against terrorism would in the long run cost more than trying to nip it in the bud, and that the need to protect the democratic foundations of the state is an overriding concern no matter the costs.

However one chooses to prioritize, the benefits of profiling remain in that it is relatively cheap, it is relatively unintrusive, it can be done mainly by computers, it is quick, and it can easily be modified using existing profiles to suit new or altered needs. It is also a proven method that, albeit arguably, produces results and saves lives, time and money.

There are, at the moment, no real cost-effective or less intrusive alternatives to profiling, and it would be unwise to assume that profiling is used merely to feed the malicious intent of the security services. It is true that few profiles lead to direct arrests but profiling nevertheless narrows down the pool of suspects and gives rise to leads that can be followed up using more traditional surveillance methods that are, arguably, more intrusive. While it is true that the costs of getting information are high, it can be argued that those costs will be incurred anyway. Information is gathered all the time for various reasons and profiling only, or mainly, uses what is already available.

4.1.2 Protects innocentsThe idea of profiling is to analyse a person's characteristics, so as to assess or predict their capabilities or to identify subgroups of people, in this case terrorists. This means that profiling narrows down the pool of suspects and excludes as many people as possible from that pool.

The main benefit from the perspective of law enforcement is that resources can be concentrated on likely suspects and not wasted on people that are in all likelihood innocent. It also means that the response to terrorism can be tailored and thus more effective, i.e. arresting certain key people,

113 Zakaria, www.reuters.com/article/idUSTRE6310E120100402

of 56

http://www.reuters.com/article/idUSTRE6310E120100402


stopping transport, monitoring financial transactions etc. This applies to both post investigations and pre-emptive controls.

The main benefit of profiling from an individual standpoint is more or less the same as the one for security services but from a different perspective. Profiling, when it’s working properly, is a tool that ensures that innocents will not be targeted by law enforcement agencies, not searched baselessly, not asked questions that might be perceived as invasive, not singled out because of their religion in public, etc. Profiling might in this respect be likened to a pre-trial investigation in which potential suspects are eliminated until only the most likely perpetrator remains.

4.1.3 Non invasiveProfiling is usually done in secrecy for obvious reasons. If specific profiling criteria were to become known, all terrorists would have to do to avoid being profiled would be to avoid displaying the profiling criteria. Although general profiling criteria such as religion or ethnic background are a given, the more specific ones, the ones that make profiling more effective, are not typically made public.

Most persons, who might fit one or several criteria of the profile but not all, never know that they have been profiled and eliminated as suspects. The infringement of privacy in this case is therefore small, at least as far as the person profiled is concerned provided that the information collected will not be used in a harmful way against him or her, especially since the initial profiling probably is done by computers. Even if a person fits several criteria and as a result will be of interest to human agents, he or she still can be eliminated as a suspect before any real harm is done and before the person in question becomes aware of having been profiled or suspected.

It could even be argued that profiling puts the person in question in a better position than before the profiling occurred, since he or she will have been investigated and found innocent and therefore will not be harassed later on. This of course presupposes a proper vetting procedure and good record keeping and record sharing that does not allow irrelevant profiling results to linger and later be used in another context to harm the profiled person.114

4.2 Drawbacks of profiling - At odds with human rights and democracyThere are several drawbacks to profiling. Perhaps some of the most obvious legal ones, and the ones examined in this paper, are those connected with profiling criteria that limit individual freedoms laid down in human rights law and those that might be detrimental to a well-functioning pluralistic democracy. General arguments against profiling also exist. Sorell describes profiling as “a stereotype of a possible offender, and this stereotype can inherit content from stereotypes of groups against which there is popular prejudice.”115

The negative consequences of profiling are neither new nor unique to profiling as such. They can be found in most coercive measures limiting the freedom of individuals in the name of security and are accepted by human rights instruments as necessary in a democratic society as evidenced by the numerous exceptions in article 8 of the ECHR to the right to respect for private and family life, home and correspondence. What sets profiling apart is that quite a few of the rights necessary to uphold a democratic society are being, if not limited, at least controlled in a way that arguably is at odds with some of the requirements of a functioning democracy.

114 See chapter 4.3.115 Sorell, Paper on Ethical Norms of Counterterrorism, DETECTER Deliverable 5.1 p. 17.

of 56


According to the ECHR democracy is a prerequisite for human rights adherence which means that limiting these freedoms is not unproblematic. The right to keep one’s political and religious preferences to oneself and to express them if one so wishes, is a vital part of a functioning pluralistic democracy. The historical consequences of mapping people’s religious and political beliefs have proven to be horrendous. Even though the proponents of profiling argue that it is necessary to use it in order to preserve human rights and democracy, the drawbacks must nevertheless be thoroughly understood and discussed before embarking on a journey that might end in disaster.

The ECHR and the EU Charter rights are especially important to highlight in this regard, because they might limit democracy if restricted. These rights are articulated in the EU Charter article 10 Freedom of thought, conscience and religion, article 11 Freedom of expression and information, article 12 Freedom of assembly and of association, article 21 Non-discrimination and article 48 (1) Presumption of innocence and right of defence. In the ECHR the relevant articles are article 6 (2) Right to a fair trial and the right to be presumed innocent until proved guilty according to law, article 9 Freedom of thought, conscience and religion, article 10 Freedom of expression, article 11 Freedom of assembly and association,116 article 14 Prohibition of discrimination.

The above articles guarantee freedoms that are necessary in order to have a functioning pluralistic democracy.117 If they are limited, the fundamentals of democracy might be in jeopardy. On the other hand, it might be argued that democracy is best protected by controlling those who want to destroy it. This is an accepted and reasonable point of view. For instance, steps may be taken against political parties endangering fundamental freedoms. In Germany according to Article 21 of the German Constitution, when a party's aim or the behaviour of its members threatens to disrupt or overthrow the free, democratic constitutional order, it may be banned. Under the Article 4 of the French Constitution, political parties are required to respect democracy. In Poland, according to article 13 of the Polish Constitution, the parties banned are those with programmes based on the totalitarian methods and procedures of Nazism, fascism and communism, and those whose programmes or activities are based on racial or nationalistic hatred.

Fostering discrimination, hatred or violence may also lead to the prohibition of a party. In France parties may be banned for fostering discrimination, hatred or violence towards a person or group of persons because of their origins or the fact that they do not belong to a particular ethnic group, nation, race or religion, or for spreading ideas or theories which justify or encourage such discrimination, hatred or violence. The Danish and Portuguese Constitutions, Sections 78 and Article 46 respectively, permit the prohibition of parties which resort to or encourage violence, even if it is not subversive or racist. In some countries, such as Germany, the law prohibits political parties which are a threat to the existence of the state.118

However, it can also be argued that democratic freedoms are necessary to combat groups such as Al-Qaeda in order to limit their support. No terrorist organization can function without a number of supporters. Defeating, e.g., Al-Qaeda therefore involves winning over, through political dialogue, those who are contemplating joining the organization to joining democratic organizations instead by

116 Freedom of assembly and of association is not highlighted in this text in a separate chapter as it is considered part of freedom of thought, conscience and religion and freedom of expression.117 The presumption of innocence is a special case in this regard in that that it provides a guarantee that information that is not tried in court is not allowed to harm the person that the information concerns.118 European commission for democracy through law (Venice commission), pp 16-17.

of 56


showing that pluralism and dialogue is more beneficial than violence.119 There is a clear contradiction in using un-democratic means to protect democracy. Even if some limitations on freedoms might be necessary it is a slippery slope and human rights can never be infringed no matter what greater good is alleged from those doing the infringement.

4.2.1 False positivesIn order to start a search that will fit a profile, it is necessary to cast a wide net in order to make sure that the initial search captures as many potential terrorists as possible. Although it is also necessary to try to avoid false positives, at the initial stage there will nevertheless be many false positives that later have to be eliminated using additional search criteria, other surveillance and manual vetting.

No matter how thorough the profiling, there still will be two negative consequences from profiling that are difficult to avoid. Firstly, there will almost certainly be false positives that will result in consequences for those singled out. Profiling is not an exact science, nor does anybody pretend that it is. On the contrary, it is a very general method of narrowing down the pool of suspects which will inevitably lead to false positives. It must be remembered that we are dealing with a tremendous amount of data, more often than not collected by machines and then analysed by human operators. Even if machines are doing the initial search the amount of data left for human operators is still very large, which means that mistakes will occur. “What information consumes is rather obvious: it consumes the attention of its recipients,” wrote Herbert Simon in 1971, “hence a wealth of information creates a poverty of attention.”120

Secondly, there will be a grey area in which persons profiled, who are no longer of interest for the on-going investigation, still will have information about them collected and stored. The information gathered can be deemed as possibly useful in the future and therefore saved. This practice is understandable from a law enforcement point of view: why throw away potentially useful information? But it also creates a grey area that allows suspicions that the profiled person is not aware of to linger, and gives the profiled person no chance of rectifying inaccuracies or clearing his or her name. In addition, while the profiled person is not tried in a court of law, the fact that they have been profiled still might have serious implications for them.121

4.2.2 Profiling ethnic belonging at odds with the prohibition against discriminationWhen using profiling criteria dealing with a person’s ethnicity there is an automatic discrimination in that the security services are initially looking at who a person is rather than at what they have done. This is the classic definition of discrimination and is prohibited in the EU Charter as well as in the ECHR, amongst others. Discrimination is, shortly put, an anathema to human rights. The prohibition against discrimination can be found, among other laws, in the following European statutes:

The EU Charter article 21, Non-discrimination

1. Any discrimination based on grounds such as sex, race, colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation shall be prohibited.

119 Maskaliunaitè, Dirty War, or: How Democracies Can Lose in the Fight against Terrorism p.p. 440-441.120 As quoted from the Economist, February 27th – March 5th 2010. See also van der Hilst, Human Rights Risks of Selected Detection Technologies - Sample Uses by Governments of Selected Detection Technologies, DETECTER Deliverable 17.1 p. 21.121 See chapter 4.3 Consequences of profiling and the presumption of innocence.

of 56


2. Within the scope of application of the Treaties and without prejudice to any of their specific provisions, any discrimination on grounds of nationality shall be prohibited.

and in ECHR article 14, Prohibition of discrimination

The enjoyment of the rights and freedoms set forth in this Convention shall be secured without discrimination on any ground such as sex, race, colour, language, religion, political or other opinion, national or social origin, association with a national minority, property, birth or other status.

and Protocol No. 12 to the ECHR article 1, General prohibition of discrimination

1 The enjoyment of any right set forth by law shall be secured without discrimination on any ground such as sex, race, colour, language, religion, political or other opinion, national or social origin, association with a national minority, property, birth or other status.

2 No one shall be discriminated against by any public authority on any ground such as those mentioned in paragraph 1.

Ethnicity is probably a necessary profiling criterion,122 especially when it comes to ethno-nationalist and separatist terrorist groups. Experience has shown that it also might be useful when targeting religious fundamentalists, since some of those tend to be recruited from specific geographical areas.123

Profiling can stigmatize a whole ethnic group if it becomes known that security agencies are looking for terrorists among that particular group. Even though it might be obvious to most that some terrorist groups have their main recruitment base among specific ethnic groups, it renders a kind of legitimacy to suspecting people from that group if the government targets them in a search or profile. This suspicion might in turn lead to people belonging to targeted ethnic groups shying away from public life and not partaking in the democratic process thus being isolated even further and becoming more likely candidates for recruitment by terrorist groups.

4.2.3 Profiling religious belonging at odds with the freedom of thought, conscience and religion The argument against profiling religious affiliation is much the same as that against ethnic profiling, but with the added element of Europe’s horrifying history when it comes to religious persecution. Investigating persons because of their religious beliefs is something that needs to be carefully considered if it is to be done at all. To use religion as a profiling criterion stigmatizes whole groups as prone to violence, unreliable, and dangerous. The underlying presumption is that they are not like the rest of us, but are an anomaly in society. This is hardly beneficial for a pluralistic democratic society. There is also a very real danger that persons of a certain faith become especially reluctant to exercise their rights in public because of the risk of being profiled. This is contrary to regulations in both the EU charter and the ECHR:

The EU Charter article 10, Freedom of thought, conscience and religion

122 See chapter 4.4.1.123 See for instance Afghanistan and Pakistan regional stabilization strategy, U.S. State department. www.state.gov/documents/organization/135728.pdf

of 56



1. Everyone has the right to freedom of thought, conscience and religion. This right includes freedom to change religion or belief and freedom, either alone or in community with others and in public or in private, to manifest religion or belief, in worship, teaching, practice and observance.

2. The right to conscientious objection is recognised, in accordance with the national laws governing the exercise of this right.

and ECHR article 9, Freedom of thought, conscience and religion

1 Everyone has the right to freedom of thought, conscience and religion; this right includes freedom to change his religion or belief and freedom, either alone or in community with others and in public or private, to manifest his religion or belief, in worship, teaching, practice and observance.

2 Freedom to manifest one’s religion or beliefs shall be subject only to such limitations as are prescribed by law and are necessary in a democratic society in the interests of public safety, for the protection of public order, health or morals, or for the protection of the rights and freedoms of others.

Although there are restrictions or limitations on freedom of thought, conscience and religion, particularly in the ECHR article 9 (2), they only apply to individuals abusing the right. They cannot be interpreted as applicable to a religion as a whole since that would in effect mean the abolition of freedom of religion. It is an unsettled question whether this is in effect, at least to some extent, something that occurs already when profiling using religious belonging.

4.2.4 Profiling political beliefs at odds with the freedom of expression and informationThe right to freedom of expression and information is fundamental for a functioning pluralistic democracy. It is enshrined in the below articles:

The EU Charter article 11, Freedom of expression and information

1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers.

2. The freedom and pluralism of the media shall be respected.

and in the ECHR article 10, Freedom of expression

1 Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises.

2 The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.

of 56


Ideas need to able to be spread freely in order to have a functioning pluralistic democracy. That goes for ideas that are shocking or disturbing, too, as is formulated by the ECtHR below:

“The Court’s supervisory functions oblige it to pay the utmost attention to the principles characterising a “democratic society”. Freedom of expression constitutes one of the essential foundations of such a society, one of the basic conditions for its progress and for the development of every man. Subject to paragraph 2 of Article 10 (art. 10-2), it is applicable not only to “information” or “ideas” that are favourably received or regarded as inoffensive or as a matter of indifference, but also to those that offend, shock or disturb the State or any sector of the population. Such are the demands of that pluralism, tolerance and broadmindedness without which there is no “democratic society”. This means, amongst other things, that every “formality”, “condition”, “restriction” or “penalty” imposed in this sphere must be proportionate to the legitimate aim pursued.”124

The Court makes it clear that we have to accept even those ideas that question a pluralistic democracy. However, the promotion of ideas that encourage violence can be restricted. 125 The problem is that it is very difficult to know which ideas will lead to violence since the receptors of these ideas draw their own conclusions about what to do with them.

A situation in which two persons listen to the same speech but draw radically different conclusions is not at all unimaginable. Let’s say that those same two persons listen to a priest or an Imam promoting the religious state. They both take this message to heart. One of them assumes that this should be done within the democratic framework and joins a democratic religious party. The other person decides that gods’ word is not open to debate and goes on a crusade or jihad. The problem when trying to profile in this instance is that it is very difficult or even impossible to know how a person will react. Therefore profiling may include everybody who listens to or puts forward this kind of message.

4.2.5 Profiling travel and economical patterns at odds with the freedom of movementTo use a person’s travel and financial behaviour in a profile has several potential drawbacks, not all of them directly, but possibly indirectly, relevant for human rights. There is a risk that in order to avoid being profiled a person will refrain from travelling to and from and investing in countries that are suspected as potential hotbeds for terrorists. This not only restricts the freedom of movement of the individual, it also hinders progress and development in the areas that would need it the most in order to limit the number of potential terrorists recruited from those areas.

Profiling might lead to a de facto travel ban to certain areas with varying consequences for different European states depending on how many people have their roots in the “restricted” areas. To travel regularly to the tribal areas in Pakistan and Afghanistan will arouse suspicion and such a travel pattern will in all probability be used in a profile. In countries like Sweden, where immigrants from Pakistan are relatively few, it can be argued that such a profiling criterion is of little significance. But in countries such as the UK and Norway, in which Pakistanis are substantial minorities, many people run the risk of being profiled. To de facto diminish their right to travel is not only at odds with the following statutes:

The EU Charter article 45, Freedom of movement and of residence

124 § 49, Case of Handyside v. the United Kingdom, judgment 7 December 1976.125 See e.g. Case of Zana v. Turkey, judgment 25 November 1997.

of 56


1. Every citizen of the Union has the right to move and reside freely within the territory of the Member States.

2. Freedom of movement and residence may be granted, in accordance with the Treaties, to nationals of third countries legally resident in the territory of a Member State.

and ECHR article 2, Freedom of movement

1 Everyone lawfully within the territory of a State shall, within that territory, have the right to liberty of movement and freedom to choose his residence.

2 Everyone shall be free to leave any country, including his own.

3 No restrictions shall be placed on the exercise of these rights other than such as are in accordance with law and are necessary in a democratic society in the interests of national security or public safety, for the maintenance of ordre public, for the prevention of crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

It also carries economic risks, as mentioned above. Perhaps above all it is problematic because it may prevent emigrants of totalitarian states returning to their home countries and speaking positively about their experience of life in a democratic state. This kind of positive propaganda can help overturn misconceptions about democracy and show an alternative way to violence. There is a no more effective way of doing this than by word of mouth from people that actually have experienced both worlds and that are trusted relatives and friends.

4.2.6 Cumulative effectsOur survey of some of the risks of profiling might seem alarmist, the risks overstated and the need for protection against terrorist attacks underestimated. However, I would like to argue that even though individual rights might be infringed in an acceptable way according to the ECtHR, the great danger lies in the cumulative effects of many small or not so small infringements.

Taken one by one, the limits imposed on freedoms might not seem very significant. However, when used together they might be considered by those profiled or running the risk of being profiled as very limiting, even forming a kind of prison. It doesn’t matter whether this prison is imagined or not, the consequences are the same with people applying a kind of self-censorship on their behaviour in a way that is contrary to human rights and freedoms. There is a very real danger that a climate of fear is created that breeds mistrust and may possibly even lead to violence rather than hindering it by creating tensions that can erupt in violence.

4.3 Consequences of profiling and the presumption of innocenceThe presumption of innocence is first and foremost a procedural right. However, it is applicable in this context as well since profiling can have consequences for the profiled even in the absence of a confirmed terrorist suspicion. Those consequences can be tantamount to a criminal punishment even though there has been no fair trial in which evidence has been tried and the accused found guilty. The presumption of innocence is enshrined in:

The EU Charter article 48, Presumption of innocence and right of defence

1. Everyone who has been charged shall be presumed innocent until proved guilty according to law.

of 56


and in ECHR article 6, Right to a fair trial

2 Everyone charged with a criminal offence shall be presumed innocent until proved guilty according to law.

A sanction that is formally regarded in national law as an administrative sanction can under certain circumstances be regarded as a de facto criminal punishment. The decisive factor is what effect it has on the person in question.126 If it is far-reaching and harsh enough, it is considered to be a de facto criminal punishment. If that is the case, it follows that there has been a de facto criminal charge, which in turn means that the right to a fair trial and the presumption of innocence must be respected.127 Sanctions can be applied to a person as a consequence of profiling even if they are found to be innocent, see chapter 4.3.2 below, and they can be very far reaching indeed.

Another problem is that casting a wide net, as is done when profiling, means that a lot of information will be gathered that has no bearing on the fight against terrorism but can be useful when fighting crime in general. This kind of information is called surplus information. A specific problem in this context is that the search for terrorists more often than not is being done using extraordinary powers that are not readily available when fighting regular crimes. It can thus be argued that the use of surplus information is illegal, because the consequences of the law used to obtain permission to gather such information are not foreseeable, as the permission was given to combat terrorism, not regular crime.128 If the decision indicates that a person is suspected of terrorism but the only proof that comes out of the wiretap is of theft that has nothing to do with terrorism, it might be questionable whether this information can be used by law enforcement at all.129

Another risk is that although the ECHR requires states to ensure judicial control over surveillance methods, this control is not, and cannot be, very effective since only one side of the argument can be heard when granting or refusing a request for, e.g., permission to wiretap.130 There can be no real adversarial process as required, e.g., by ECHR article 6 (3).

The main problem with surplus information (or even information that is hearsay or is based on inferences from other information, or information that has come from dubious sources) is that it will not be heard in a court of law in a terrorist trial but can nevertheless have consequences for the person profiled. This is compounded by the fact that the person profiled has no real possibility of being made aware of the information or being able to challenge it if it is not put forward in a court of law.131

4.3.1 Visible to the profiledThere are many ways in which a person can be made aware of the fact that he or she has been the target of a terrorist investigation. Some of them are the same as those that alert people to their being suspected of a regular crime, e.g., being questioned, having property seized, etc.

126 Case of Engel and others v. the Netherlands, § 81, judgment 8 June 1976. 127 Nowak: Oskyldighetspresumtionen, p.p. 126-135.128 ECtHR case of Amann v. Switzerland, §§ 55-67, judgment 16 February 2000.129 See, e.g. ECtHR case of Doerga v. the Netherlands, 27 April 2004.130 Nowak: Right to Respect for Private and Family Life: an exceptional right, pp. 198-199. 131 See e.g., ECtHR case of Leander v. Sweden, judgment 26 March 1987 and case of Segerstedt-Wiberg and others v. Sweden, judgment 6 June 2006.

of 56


These measures are usually not problematic since they can normally be challenged in a court of law in which the suspect has a chance to clear his name and in any case is aware of the suspicion and can hire legal counsel. Although it has to be said that many countries have special laws dealing with terrorist crimes that sometimes approach the line of what is permissible when it comes to the right of a fair trial and, arguably, sometimes overstep it.132 The main hurdle is access to information on the same basis as the prosecution as laid down by the adversarial principle in ECHR article 6 (3), amongst others.

4.3.2 Invisible to the profiled If a person is found to fit a terrorist profile but no evidence is found that would be sufficient for a conviction in a court of law proving that he or she actually is a terrorist, the profiling might still have extensive consequences for him or her. In such a case it is highly likely that the state takes precautions in order to keep an eye on the suspect to make sure that he or she cannot come into a position where they could inflict harm if they were proven to be terrorists in the future. The main argument seems to be that it is better to be safe than sorry.

The measures taken against a person who fits a terrorist profile vary. They might involve denial of a travelling visa, a loan application turned down, a job application that was not considered, etc. Since these measures are a result of information from national security services they are extremely difficult to control because of the secrecy involved. The evidence may not be strong enough to hold up in a court, in which it could be controlled, but is still deemed to be sufficient for using de facto sanctions.133 To make things even more difficult, the reasons why a person is denied a visa or a job, etc., might very well be reasonable and not the result of a terrorist profile. The person in question is therefore left to guess whether he or she is the target of suspicion or not.

It goes without saying that such a situation is highly undesirable and in direct conflict with Articles 47, Right to an effective remedy and to a fair trial, and 48, Presumption of innocence and right of defence, of the EU charter as well as with Articles 6, Right to a fair trial, and 13, Right to an effective remedy, of the ECHR.

In criminal law one is either guilty or innocent; one cannot be semi-guilty or semi-innocent. This is a customary rule that is taken for granted in modern law to prevent individuals finding themselves in a Kafkaesque situation. Moreover it is also highly questionable from a purely rational point of view to use these kinds of in-between categories. If a person is in fact guilty, should they really be allowed to walk around as they please, perhaps planning terrorist acts? The correct thing to do in such a case would be to mount a proper investigation that would produce evidence that could stand up in a court of law. And, if they are innocent, how can we justify destroying people’s lives on a suspicion only? It makes a mockery of the right to a fair trial.

4.4 Search criteriaThe previous chapters have described the targets in the hunt for terrorists as well as the human rights implications when searching using the Internet and profiling. The question that needs to be addressed is what kind of search criteria can be used without running the risk of human rights abuses

132 See, e.g., Pati: Due Process and International Terrorism – An International Legal analysis, p.p. 386-414.133 An absurd situation occurred in the Case Kadi v Commission (Case T-85/09) in which a group of individual found themselves targets of various sanctions as terrorist suspects but were not afforded the right to a fair trial.

of 56


or threatening democracy? Can profiling be used at all, do we need to abandon it altogether, or it is perhaps necessary to modify human rights law?

To abandon profiling is not realistic: it is a vital tool for intelligence agencies and it can protect innocents from being suspected and put through various ordeals in relation to the suspicion. To change hard human rights law is not realistic either. To make changes in the face of a probably short-lived threat with limited consequences for European democracies is neither rational nor desirable. While it is true that some allowances have been made in practice to accommodate the wishes of the security services, they have yet to erode the core values in human rights law.

Is there perhaps a third alternative that ensures that counter-terrorism profiling is carried out with adequate regard for human rights? The question is difficult to answer but hopefully the answer is yes, it is possible. The police already have at their disposal various methods that limit a range of freedoms but that are deemed acceptable in order to fight regular crime. What sets the hunt for terrorists apart is that it is mainly done by security agencies that are less than forthcoming about their methods. The necessary secrecy makes them more difficult to control, at least by public scrutiny, than the regular police. However, there is no reason to believe that, given enough transparency and knowledge, even secret services cannot behave acceptably.

One thing is immediately clear: that it is necessary to have knowledge of what is at stake and a coherent system to handle profiling and search criteria. As a start I am proposing a systematization of search criteria into four groups in order to facilitate control over which criteria can be used or should/must be avoided.

For obvious reasons it is impossible to get complete access to information about the kinds of specific search criteria different European security agencies are using. Security services also use criteria that differ depending on what kind of terrorists the agencies are looking for. Nevertheless, the proposed classification will make it possible to create an overview of the criteria used in order to facilitate a critical outlook on the impact they might have on human rights and democracy and create an awareness of potential grey areas so that they may be avoided altogether or justifications for their used be conceptualized.

I am proposing the following classification of search criteria:

1. Necessary search criteria,2. Useful search criteria,3. Questionable/ Non-essential search criteria

Why three criteria? Dividing the criteria into three levels serves several purposes: it is both easy to understand and usable for lawyers and non-lawyers alike; it gives an overview of the problem; and it facilitates recommendations based upon a relatively simple schematic.

4.4.1 Necessary search criteria - INecessary search criteria are those that are indispensable for the search or profiling to be effective in a meaningful manner. Without them the search will be ineffective or useless. These criteria could also be called core-criteria. Such criteria could be “Islam” and/or “Al-Qaeda” if the search is for Islamist terrorists with affiliation to Osama bin Laden. If the search targets ethno-nationalist and

of 56


separatist terrorist groups it is likely to contain search terms such as the name of the contested region and the ethnicity of those wanting separation.

If a criterion is found to be in this category and in category IV: Questionable/prohibited search criteria, then the profiling should not be carried out at all if the criteria is prohibited or should be carried out with the utmost care if it is found to be questionable.

4.4.2 Useful search criteria - IIUseful search criteria are criteria that are not absolutely necessary but helpful when doing a search or profile by adding to or subtracting from the scope of the necessary search criteria. This category includes search criteria that increase the effectiveness of the search or the profiling, but that might not be strictly necessary for it to be effective.

Useful search criteria can complement necessary search criteria in order to make the search more specific or can extend the necessary search criteria by adding a factor and thus ensuring that the profile initially will fit a larger part of the targeted population. For instance, when searching for a branch of Al-Qaeda Islamist terrorists that are only active in a specific part of Iraq, it might be useful to narrow down the search to that limited geographic area and certain family names in order to limit false positives.

This category is included in order to be able to grade available criteria. The idea is to create a hierarchy so that criteria will be properly analysed before use and not used in a casual manner just because it is possible to do so. Perhaps, this way, superfluous criteria can be vetted out or at least their potential impact on human rights might be thoroughly discussed and analysed before they are used with unwelcome consequences such as false positives or discrimination.

4.4.3 Questionable/ Non-essential search criteria - IIIQuestionable and non-essential search criteria are grouped together under the same heading because they both fall into a grey area in which it is not clear whether they are prohibited or not. When it comes to law generally this is an unhappy state of affairs, when it comes to human rights law it is unacceptable. As a rule grey areas must be avoided when it comes to human rights. If there is any doubt whether a criterion is in accordance with human rights law, it should not be used.

When a criterion is found to be questionable it is done so according to human rights law in the sense that the inclusion of the criterion would mean risk of abusing a human right. It can also be that the criterion limits a human right in a way that in practice diminishes or even violates that right. Examples of such criteria are dependent on the context in which they are used, but we can say that a profile including a limited group of family names together; a specific denomination; and a political affiliation is highly questionable when it comes to both freedom of expression and information and freedom of religion.

Non-essential search criteria are those that are subsidiary to other criteria or that are used without much thought. They are often brought in since they are simple to include because of the availability of information or ease of programming. If the search, e.g., is for left-wing terrorists it would probably contain a list of sites visited by persons on the far left by monitoring those visiting such sites but it could also easily contain, should the search be done nationally, search criteria dealing with education, income, etc. Such criteria are not necessary to find left-wing terrorists but very easy to include in a search. It might also be tempting to use additional criteria in order to paint a picture of

of 56


who is a left-wing terrorist, should the search prove effective, in order to make future searches more effective. But such a general profiling of large parts of the population is highly questionable, if not directly in violation of human rights law.

The risks here are in the results that such carelessly used criteria might produce. Seemingly innocent search criteria can result in severe consequences for the person profiled and must therefore be avoided. Again, the idea is to create a hierarchy so that criteria will be properly analysed before use and not used in a casual manner just because it is possible to do so. This enables criteria to be removed or replaced by other more efficient and hopefully less problematic criteria if necessary. This category makes it possible to evaluate and remove criteria that could be potentially harmful and that are inefficient.

4.4.4 Placing search criteria in applicable categories When placing search criteria in their respective categories, it is natural to start with category one: Necessary search criteria. These criteria are necessary for a search or profile to be effective and if they cannot be used because of human rights constraints the search cannot be done in any meaningful manner.

After determining what criteria are necessary, a check must be done to determine whether any of the necessary criteria also are in category three, Questionable/ non-essential criteria. If the search criteria used are found to be in category three, it is recommended that they are taken out of the search in order to minimize the risk of human rights abuses.

Determining what criteria should be considered as category three criteria must be done using human rights law. The interpretation of the content of human rights law in this context must be extensive since the searches are a blunt instrument and initially encompass a large number of people. As a result it is difficult at the start to have a clear picture of the consequences. In other words it is better to err on the side of caution.

When deciding if a criterion is at odds with human rights and therefore should be regarded as a category three criterion, it is imperative that one does not only look at the law but also considers in which context the criterion will be used and what likely effects it might have. If the search is done using religious profiling, the impact can be very different when searching for persons belonging to a national majority compared to a minority. To search for Protestants or Catholics in Germany would be relatively uncontroversial since they together make up approximately 67 % of the German population.134 But searching for Jews in Germany has to be considered much more questionable mainly because of historical reasons but also because Jews as a small minority – approximately one thousandth of the population in Germany135 -- run much greater risks of being stigmatized by a search. Although it might seem odd to accept the search for one religion but not for the other, the fact still remains that it is the impact on the persons targeted that is important and it differs depending on which religious affiliation one has. Another example is using political criteria in a search. To be profiled as a Tory supporter in the UK is in all probability uncontroversial but to be pegged as a supporter of the British National Party is in all likelihood not and might have consequences for the individual so described.

134 www.remid.de/remid_info_zahlen.htm 135 Ibid.

of 56

http://www.remid.de/remid_info_zahlen.htm


4.5 VettingThere are no provisions for setting human rights aside when fighting terrorism using the Internet, nor should there be. There must be safeguards in place to make sure that Internet searches are in accordance with human rights, hopefully before they are used but sometimes even after they have been used. It is of course doubtful whether such post factum reparation is enough to ensure human rights adherence, but it can be argued that sometimes that is all that one can hope for. It is a fact that states submit people to close scrutiny in order to combat terrorism and that this scrutiny sometimes goes further than that targeted at regular criminals, even to the point of infringing human rights. In this reality there must be access to justice for those who are falsely targeted and surplus information must be vetted out.

Vetting is also useful to ensure that if a search is used that is contrary to human rights, the results will not have any consequences for the profiled person or at least minimal consequences. Access to justice in this context means that a person will both be granted access to information about him or her that has proved not to be relevant in the hunt for terrorists and have the possibility to demand that it be vetted out.

The fear of an all-seeing Orwellian state is a real one and information can be used in circumstances that were not foreseen when it was gathered. During the invasion of France the German troops rushed to the French ministries in order to get information about Jews, anti-Nazis and German refugees before such information could be destroyed.

In Sweden the so-called PKU-register136 which contains DNA-samples of every child born in Sweden since 1975 and which was supposed to be used only for medical purposes to diagnose inheritable diseases has been used to fight crime since the murder of the Swedish foreign minister. It is a typical example of mission creep that takes on a life of its own. Although persons can ask to be removed from the register, the police have argued that many people who do so are criminals fearing to be caught.137

In order to minimize risks it is vital to have a clear and efficient vetting procedure that allows for vetting of material that might have, at the time it was collected, been seen as important but that has since proven to be irrelevant.

In order to have effective safeguards against human rights abuses, both proactive and reactive, it is important to:

1. Define and categorize search criteria according to human rights law in order to minimize the risk of abuse.

2. Have proper vetting procedures for information that has been proven irrelevant, e.g., in cases where the person profiled has turned out not to be a suspect or when the search has amassed information that is not relevant for the purpose of the search.

These two requirements are closely interlinked. There are vetting procedures already in place in other fields which very possibly can be useful in counter-terrorism as well. Those vetting procedures will be discussed further in upcoming deliverables in the DETECTER project. 136 www.karolinska.se/Karolinska-Universitetslaboratoriet/Kliniker/CMMS/PKU-laboratoriet/Information-om-PKU-biobanken137 www.dn.se/nyheter/sverige/bovar-begar-uttrade-ur-blodregister-1.564878

of 56

http://www.dn.se/nyheter/sverige/bovar-begar-uttrade-ur-blodregister-1.564878

http://www.karolinska.se/Karolinska-Universitetslaboratoriet/Kliniker/CMMS/PKU-laboratoriet/Information-om-PKU-biobanken



5. Concluding remarksEuropean states have an obligation to combat terrorism and at the same time protect human rights and democracy. This equation is not always easy to solve because of political pressure and natural and understandable concern for the victims of terrorist crimes. Sometimes it seems that those who favour a no-holds barred approach in the fight against terrorism have the upper hand and those that argue for the protection of human rights and democratic values such as free speech are fighting an uphill battle.

In this climate it is imperative that all measures adopted by the state be scrutinized to make sure that they follow human rights law and that the consequences of not doing so or venturing into grey areas are clearly understood. In order for the control of human rights adherence to be effective, it is necessary to have a coherent system in place for analysis and control so that misunderstandings, grey areas, and even foul play can be detected and avoided.

The field of counter-terrorism spans many areas of law; a comprehensible strategy is needed in order to get an overview of what is at stake for both citizens and law enforcement alike. It needs to be simple and its foundations must be both accepted by most and impossible or at least very difficult to question. Human rights provide a foundation upon which such a strategy can be built. A systematisation based on human rights and applied to search criteria and profiling is also a step towards a comprehensible strategy to make sure that European democracies do not throw out the baby with the bathwater when trying to protect human rights and democracy against attacks from terrorists.

New and efficient computer-based searches that include more and more databases and registers also demand a broader outlook since not only do traditional human rights come into play (such as the right to freedom of thought, conscience and religion) but also new rights such as the protection of personal data as stated in, e.g., the EU Charter. Article 8 of the EU charter states that everyone has the right to the protection of personal data concerning him or her and that such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. It also states that everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. This is something that is hard to accomplish when searching for terrorists because of the necessary secrecy.

Article 8 also states that compliance with these rules shall be subject to control by an independent authority. This demand too can be difficult to fulfil since the control must be done in secrecy and is therefore not open to public scrutiny, hence not as inspiring of trust as it could be.

To sum up it is necessary in order to have efficient control over profiling and searches to have a coherent system in place that can be used as a baseline to check human rights adherence. The system needs to be simple, easy to use and understand and flexible in the sense that it allows for efficient counter-terrorism methods and protects human rights at the same time.

of 56


DisseminationThis paper is written to make sure that law enforcement agencies are made aware of the legal limits and necessary ethical considerations of Internet searches and profiling and the dangers they pose to human rights and pluralistic democracy. It is therefore recommended that it mainly be presented at police academies, court authorities, to prosecutorial services and the like.

Since it also raises questions of interaction between human rights and democracy it also could be discussed by a broader audience in academia and the press to gather a necessary understanding of what is at stake when fighting terrorism.

of 56


Bibliography

DETECTER DeliverablesAhumada-Jaidi, Audelina: Border control and internal security in the European Union – information, technology and human rights implications for third-country nationals

Moeckli, Daniel and Thurman, James: Survey of Counter-Terrorism Data Mining and Related Programmes

Scheinin, Martin and Vermeulen, Mathias: Unilateral Exceptions to International Law: Systematic legal analysis and critique of doctrines that seek to deny or reduce the applicability of human rights norms in the fight against terrorism

Sorell, Tom: Paper on Ethical Norms of Counterterrorism

van der Hilst, Rozemarijn: Human Rights Risks of Selected Detection Technologies Sample Uses by Governments of Selected Detection Technologies

Books and articlesArjona, Juan Carlos., Hardaga, Cristina (Eds.): Terrorismo y derechos humanos. : Nowak, Karol: Right to Respect for Private and Family Life: an exceptional right. – Mexico City : Fontamara, 2008.

Alexy, Robert: Theorie der juristischen Argumentation. – Frankfurt am Main : Suhrkamp, 1978.

Barak, Aharon: The Judge in a Democracy. - New Jersey : Princeton University Press, 2006.

Bassiouni, M. Cherif,.Militello, V., Stzger, H. (Eds.): European Cooperation in Penal Matters. – Padova : Wolters Kluwer, 2008.

Brown, Ian: Terrorism and the Proportionality of Internet Surveillance, European Journal of Criminology, Mar 01, 2009; Vol. 6, No. 2, p. 119-134.

Danelius, Hans: Mänskliga rättigheter i europeisk praxis. – Stockholm : Norstedts juridik, 2007.

Guiora, Amos N.: Global Perspectives on Counterterrorism. – Aspen : Wolters Kluwer, 2007.

Guiora, Amos N.: Fundamentals of Counterterrorism. – Aspen : Wolters Kluwer, 2008.

Keohane, Daniel: The EU and counter-terrorism. CER Working Paper, May 2005.

Meyer, C. B.: Das Täterprofil aus interdisziplinärer Sicht, unter besonderer Berücksichtigung des Strafprozessrechts : Cottier M./Rüetschi D./Sahlfeld K. W. (Hrsg.), Information und Recht. - Basel : Helbing & Lichtenhahn, 2002.

of 56


Moir, Lindsay: Reappraising the Resort to Force : International Law, Jus ad Bellum and the War on Terror. - Oxford : Hart Publishing, 2010.

Pati, Roza: Due Process and International Terrorism. – Leiden : Martinus Nijhoff, 2009.

Nowak, Karol: Oskyldighetspresumtionen. – Stockholm : Norstedts Juridik, 2003.

Nowak, Manfred: Introduction to the International Human Rights Regime. – Leiden : Martinus Nijhoff, 2003.

Nowak, Manfred: U.N. Covenant on Civil and Political Rights – CCPR Commentary. 2:nd ed. – Kehl : N.P. Engel, 2005.

Sottiaux, Stefan: Terrorism and the Limitations of Rights. – Oxford : Hart Publishing, 2008.

Svoboda Elizabeth: Your Digital Privacy? It May Already Be an Illusion. Discover Magazine. From the November 2009 issue; published online January 8, 2010.

http://discovermagazine.com/2009/nov/08-your-digital-privacy-may-already-be-an-illusion/article_view?b_start:int=0&-C=

Taipale, K. A.: Data Mining and Domestic Security : Connecting the dots to make sense of data. The Columbia Science and Technology Law Review, Volume 5, 2003.

www.stlr.org/html/volume5/taipale.pdf

Turvey, Brent E. : Criminal profiling : an introduction to behavioral evidence analysis, 3rd ed. London : Academic, 2008.

Tygar J. D. :Technological dimensions of privacy in Asia Asia-Pacific Review, Volume 10, Issue 2 November 2003 , pages 120 – 145.

van Baarda, Th.A., Verweij, D.E.M (eds.): The Moral Dimension of Asymmetrical Warfare, Counter-terrorism, Democratic Values and Military Ethics. : Maskaliunaitè, Asta: Dirty War, or: How Democracies Can Lose in the Fight against Terrorism. – Leiden : Martinus Nijhoff, 2009.

Van Dijk, Pieter., van Hoof, Fried,. Van Rijn, Arjen., Zwaak, Leo. (eds.): Theory and Practice of the European Convention on Human Rights, 4:th. ed. – Antwerpen – Oxford, Intersentia, 2006.

Winseck, Dwayne: Information Operations `Blowback': Communication, Propaganda and Surveillance in the Global War on Terrorism(2008); International Communication Gazette (Formerly Gazette), Dec 01, 2008; Vol. 70, No. 6, p. 419-441.

Internet links All links last visited 2010-07-21

Clarke, Profiling: A Hidden Challenge to the Regulation of Data Surveillance. Published in the Journal of Law and Information Science 4, 2 (December 1993).

of 56

http://www.stlr.org/html/volume5/taipale.pdf




www.rogerclarke.com/DV/PaperProfiling.html#Techn

Meyer, C.B. : Das Täterprofil aus interdisziplinärer Sicht, unter besonderer Berücksichtigung des Strafprozessrechts

www.criminalprofiling.ch/aufsatz.html

Stevens, Tim : Don't blame the Internet for extremism.

www.guardian.co.uk/commentisfree/2009/dec/14/Internet-extremism-jihadi-youtube

Tabassum Zakaria : New airline security measures announced

www.reuters.com/article/idUSTRE6310E120100402

Overview of State-Sponsored Terrorism

www.state.gov/documents/organization/31944.pdf

The Online Hunt for Terrorists

www.pcmag.com/article2/0,2817,2270962,%2000.asp02.27.08

Legislative Guide to the Universal Anti-Terrorism Conventions and Protocols by the United Nations Office on Drugs and Crime

www.unodc.org/pdf/crime/terrorism/explanatory_english2.pdf

European Commission, Justice and Home affairs, Terrorism


United Nations Web archive, Secretary General Kofi Annan


Investigative Programs Critical Incident Response Group, National Center for the Analysis of Violent Crime

www.fbi.gov/hq/isd/cirg/ncavc.htm#bau

U.S. State department, Afghanistan and Pakistan regional stabilization strategy

www.state.gov/documents/organization/135728.pdf

Information om PKU-biobanken (Information about the PKU Bio register)

www.karolinska.se/Karolinska-Universitetslaboratoriet/Kliniker/CMMS/PKU-laboratoriet/Information-om-PKU-biobanken

“Bovar begär utträde ur blodregister” (Crooks ask to be removed from register)

www.dn.se/nyheter/sverige/bovar-begar-uttrade-ur-blodregister-1.564878

of 56

http://www.dn.se/nyheter/sverige/bovar-begar-uttrade-ur-blodregister-1.564878




http://www.fbi.gov/hq/isd/cirg/ncavc.htm#bau



http://www.unodc.org/pdf/crime/terrorism/explanatory_english2.pdf

http://www.pcmag.com/article2/0,2817,2270962,%2000.asp02.27.08


http://www.reuters.com/article/idUSTRE6310E120100402

http://www.guardian.co.uk/commentisfree/2009/dec/14/internet-extremism-jihadi-youtube

http://www.criminalprofiling.ch/aufsatz.html

http://www.rogerclarke.com/DV/PaperProfiling.html#Techn


Hudson, The sociology and psychology of terrorism: who becomes a terrorist and why?

www.loc.gov/rr/frd/pdf-files/Soc_Psych_of_Terrorism.pdf

Religionswissenschaftlicher Medien- und Informationsdienst e. V. : Religionen in Deutschland: Mitgliederzahlen


How big is the internet?

www.wisegeek.com/how-big-is-the-internet.htm

“Uproar as Germany pays €2.5m for stolen Credit Suisse data”

www.independent.co.uk/news/business/news/uproar-as-germany-pays-euro25m-for-stolen-credit-suisse-data-1891468.html

“Steuersünder-CD führt zu Milliarden auf Schweizer Konten”

www.nzz.ch/nachrichten/international/schweizer_konten_1.6030378.html

The Internet Wayback Machine

www.archive.org/web/web.php

The Department for Homeland Security Privacy Threshold analysis

www.dhs.gov/xlibrary/assets/privacy/DHS_PTA_Template.pdf

“Congress Clamps Down On Carnivore”


German civil society calls for a definitive end to telecommunications data retention (20 Apr 2010).

www.vorratsdatenspeicherung.de/content/view/362/79/lang,en

Kriminalitätsentwicklung im Land Nordrhein-Westfalen Jahr 2007.

www.polizei-nrw.de/lka/stepone/data/downloads/08/01/00/kriminalitaetsentwicklung_pks_nrw_2007.pdf

Kriminalitätsentwicklung im Land Nordrhein-Westfalen Jahr 2008

www.polizei-nrw.de/lka/stepone/data/downloads/45/01/00/pks-nrw-jahresbericht-2008.pdf

Kriminalitätsentwicklung im Land Nordrhein-Westfalen 2009.

www.polizei-nrw.de/lka/stepone/data/downloads/6a/01/00/pks-jahresbericht2009.pdf

of 56

http://www.polizei-nrw.de/lka/stepone/data/downloads/6a/01/00/pks-jahresbericht2009.pdf

http://www.polizei-nrw.de/lka/stepone/data/downloads/45/01/00/pks-nrw-jahresbericht-2008.pdf



http://www.vorratsdatenspeicherung.de/content/view/362/79/lang,en



http://www.archive.org/web/web.php

http://www.nzz.ch/nachrichten/international/schweizer_konten_1.6030378.html



http://www.wisegeek.com/how-big-is-the-internet.htm


http://www.loc.gov/rr/frd/pdf-files/Soc_Psych_of_Terrorism.pdf


DFG-Projekt ”Der ’überwachte’ Bürger zwischen Apathie und Protest - Zur Genese neuer staatlicher Kontrolltechnologien und ihren Effekten auf Einstellungen und Verhalten der Bevölkerung”. Institut für Sicherheits- und Präventionsforschung e.V. (ISIP) Hamburg.

www.vorratsdatenspeicherung.de/images/infas-umfrage.pdf

Civil society critique of The EU data retention directive

www.privacyinternational.org/article.shtml?cmd[347]=x-347-566461

“German court strikes blow against EU data-retention regime”


Court Cases

European Court of Human RightsAmann v. Switzerland judgment 16 February 2000

Doerga v. the Netherlands judgment 27 April 2004

Engel and others v. the Netherlands judgment 8 June 1976

Handyside v. the United Kingdom judgment 7 December 1976

Leander v. Sweden judgment 26 March 1987

S. and Marper v. the United Kingdom Judgment 4 December 2008.

Segerstedt-Wiberg and others v. Sweden judgment 6 June 2006

Zana v. Turkey, judgment 25 November 1997

European Court of JusticeKadi v Commission Case T-85/09

German Constitutional CourtBVerfG, 1 BvR 256/08 vom 2.3.2010, Absatz-Nr. (1 - 345)

Romanian Constitutional CourtRomanian Constitutional Court decision against data retention, published in the Official Monitor on 23 November 2009.

www.ccr.ro/decisions/pdf/ro/2009/D1258_09.pdf

Official publications and resolutions

United NationsThe United Nations Global Counter-Terrorism Strategy. Resolution adopted by the General Assembly 62/272.

of 56

http://www.ccr.ro/decisions/pdf/ro/2009/D1258_09.pdf


http://www.privacyinternational.org/article.shtml?cmd%5B347%5D=x-347-566461

http://www.vorratsdatenspeicherung.de/images/infas-umfrage.pdf


Handbook on Criminal Justice Response to Terrorism. Criminal Handbook series. – New York, 2009.

Twelfth United Nations Congress on Crime Prevention and Criminal Justice – Provision of technical assistance to facilitate the ratification and implementation of international instruments related to the prevention and suppression of terrorism. – Salvador, Brazil, 2010

Council of EuropeEuropean Commission for Democracy through Law: Guidelines on prohibition and dissolution of political parties and analogous measures. Adopted by the Venice Commission at its 41st plenary session (Venice, 10 – 11 December, 1999)

EuropolEuropean Police Office p. 8. te-sat 2008 - EU Terrorism Situation and Trend Report 2008.

Swedish governmentSvenskarna positiva till mer övervakning. (Swedes positive to more surveillance) : Riksdag & Departement, 11. 1. 2007

United StatesThe Federal Information Security Management Act of 2002 (“FISMA”, 44 U.S.C. § 3541, et seq.)

DHS Privacy Office, Handbook for Safeguarding Sensitive Personally Identifiable Information at the Department of Homeland Security 4 (Oct. 31, 2008).

Office of Management and Budget, "Memorandum M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002" (Sept. 26, 2003).

Conventions, Charters, EU directives and framework decisionsCharter of Fundamental Rights of the European Union (2010/C 83/02)

(European) Convention for the Protection of

Human Rights and Fundamental Freedoms Rome, 4.XI.1950

European Convention on the Suppression of Terrorism Strasbourg, 27.I.1977

Convention on the Prevention of Terrorism Council of Europe Treaty Series – No. 196.

Convention for the Suppression of Unlawful Seizure

of Aircraft The Hague, 16 December 1970

Convention for the Suppression of Unlawful Acts against

the Safety of Civil Aviation Montreal, 23 September 1971

Council Framework decision of 13 June 2002 on

combating terrorism (2002/475/JHA)

of 56


Council of Europe, Convention on Cybercrime CETS No.: 185. 23/11/2001

Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC.

of 56


of 56

€¦ · web viewfp7-sect-2007-217862. detecter. detection technologies, terrorism, ethics and...

Documents