Europol reform – but who polices the police?

Robert Wainwright, the current director of Europol. [European Parliament]

A Europol reform is on the cards – confidential documents have shown that Europol’s internet surveillance capacity could be greatly expanded. EURACTIV’s partner Tagesspiegel reports.

On 29 September 2015, the Luxembourg presidency of the Council sent a confidential letter to the three parties that are concerned with the reform of the European Police Authority, Europol: the European Parliament, the governments of the member states and the European Commission.

The Council presidency reported on a meeting with Europol representatives and their wish that Europol should be given more rights to monitor the internet, through its so-called European Union Internet Referral Unit (EU IRU).

Luxembourg also reported that Europol thought it to be “imperative” that the authority have a direct “dialogue” with the internet companies in the future. More data is urgently needed, in order for Europol to deal with the cases being brought by the member states.

This would include more tracking-data from Facebook, as well as data from Facebook users, which the social-media giant collects even when the user is logged off, much to the chagrin of many consumer advisors. These internet profiles, which are extensively used to tailor advertising to specific users, can also be an invaluable source of data on potential criminal activity.

Europol “Likes” Facebook’s tracking-data

The Luxembourgish presidency seems to be sympathetic to Europol’s requests and have suggested that several articles of the current Europol reform could be amended to increase its ability to gather information from internet companies.

The Luxembourg communication is part of a series of documents seen by Tagesspiegel. These include a number of papers from the EU anti-terror coordinator, Gilles de Kerchove, as well as an unpublished answer from the German interior ministry to a question from the German politician, Andrej Hunko.

Parts of the documents have also been published by the British non-profit organisation Statewatch. The momentum for providing Europol with more responsibility and increased power has built since the Paris attacks in January and the Thalys-incident in August.

>>Read: Investigation launched against Facebook over hate speech

The documents also show that the further development of Europol is, in several respects, quite problematic.

Firstly, Europol already has quasi-enforcement powers that are not provided for in its statutes. Secondly, Europol is a preventative police agency; it monitors the internet activity of people and decides whether to sanction them or not, without judicial decisions. In many cases, it is Europol itself that decides what is good and bad internet content.

Europol’s future

– Europol should directly “receive” data from internet companies, not just from member states, as before,

– Europol should pass data that it already has on to internet companies, so that known IP addresses can be identified, and

– Europol should target traffickers in particular. A data-exchange agreement with the European border agency Frontex is currently being negotiated, with a trial period due to begin in early-2016.

Additionally, Europol should find and delete social-media content that promotes or supports people smuggling.

Data “super agency”

This development seems quite daring, given the criticism the authority has received from observers who claim that Europol has grown uncontrollably out of the public eye. “With its new centres and competencies, Europol is well on its way to becoming a super authority,” said Andrej Hunko, who has been pursuing the matter for a number of years.

This year, Europol has prioritised the establishment of the IRU, meaning that even discounting the changes it wants to implement, it could already be considered a super authority.

>>Read: Oettinger: Deal on cybersecurity directive close

According to the Council’s Decision, The Hague authority helps national authorities “reduce and prevent” organised crime, terrorism and other forms of serious crime, through the collection and analysis of information.

How Europol deletes internet content

In the era of Big Data, Europol has taken steps to legitimise its existence through preventative policing, including the removal of unacceptable content, such as Islamic State videos, and the identification of potential future offenders, through the mass analysis of internet data and the monitoring of social-media accounts.

Europol’s existing powers

The more Europol’s competencies increase, the more questions arise as to whether the police authority exercises actual executive power.

Since 1 August, the EU IRU has been operational. Europol tasked it with three objectives; first, to identify internet content from terrorists or violent extremists; request internet companies to delete such content from their servers; and to support national authorities through data analysis.

Europol says that it cannot directly receive personal data from individuals or companies; member states must act as a middle-man. However, in the documents seen by Tagesspiegel, it is stated that Europol already carries out monitoring of social media seven days a week, particularly of content related to “the smuggling of illegal immigrants”.

Europol proceeds with content-deletion as follows: the IRU informs the designated contact-point of a member state, requesting the responsible company to delete the content and giving the member state a deadline to object.

>>Read: Berlin to combat violence with extra resources

The member states, therefore, have little to actually do other than let this deadline expire, practically granting the IRU a great deal of autonomy. An EU anti-terror commission paper, from the beginning of November, showed that the IRU had been successful in 90% of its 500 deletion requests.

Should the Luxembourg presidency’s proposal be successful, it is possible that similar measures relating to data storage and analysis could be introduced. Europol would not be able to request the data itself, but, it is possible that companies would contact Europol themselves or that the authority would draw upon arrangements it has with authorities in third-countries.

Since 2014, for example, Europol has had a partnership with the FBI. On Thursday (5 November), Tagesspiegel asked Europol to explain how it receives data and the legal basis behind its data-exchanges, but the authority failed to provide a response before publication of this article.

The documents clearly show that the Luxembourg presidency also shares the view that executive powers for Europol would not be politically enforceable.

German lawyer and academic Niko Härting, who is a specialist in internet law and the security services, warned that, “Should Europol get its own investigatory powers, it would completely change the nature of the beast. If Europol could request data itself, it would be a massive upgrade for the authority. I cannot imagine that this would please the European Court of Justice.”

Judge, Jury, Executioner

There is a very sensitive issue regarding who is affected when Europol deletes content that supports “people smuggling”. Many refugees exchange views on Facebook regarding the best routes to take into Europe, as well as the obstacles they might face. Is it fair that such content could be earmarked for deletion?

It is, of course, hard to deny that the obscene videos created by IS are potentially dangerous. It is difficult to decide where the line lies between fair and radical content. Andrej Hunko asked the German interior ministry whether hate-speech, racism and xenophobia should be considered to be “violent expressions” and, therefore, candidates for deletion by Europol. The answer was long and convoluted, but, essentially, ‘yes’. Despite its main remit being serious crimes, Europol is able to involve itself in hate speech on internet forums.

Weak parliamentary scrutiny

Parliamentary controls regarding Europol are currently quite rudimentary. “Unfortunately, the current parliamentary controls are ill-equipped to the new competencies that have been requested,” said Hunko. Many in the European Parliament see it the same way. In June, Cornelia Ernst MEP (Lefts) asked the Commission which national authorities were in Europol’s “Internet analysis groups”. In September, she was finally told that it was confidential information.

Politically feasible proposals?

The European Parliament, in particular, has expressed deep concerns about the Luxembourg presidency’s proposals.

The German government, however, is committed to this direction, backing the removal of internet content through the EU IRU. The development of Europol into a data super agency has taken place away from public scrutiny, whether it continues this way remains to be seen.

This article was previously published by EURACTIV Germany.

Subscribe to our newsletters