Privacy worries...

I am pretty worried lately about the various measures our democratically elected governments are taking in order to "fight terrorism". The magic words "public safety" and "terrorism" are used to push far reaching legislation through parliaments all around the globe. The Queendom of the Netherlands is no exception...

First of all the lower house of parliament recently passed a bill that forces all people in the Netherlands (aged 14 and up) to be able to identify themselves if so requested (for instance by the police). This particular piece of legislation was (I guess) a long-standing request from the police force, but was previously rejected outright because of the memory of the "ausweis" policies implemented by the German occuption forces in the second world war. However, use the magic words and our elected representatives will lie flat on their backs and say "woof".

In typical Dutch fashion there is no requirement to carry an ID, but you must be able to show one when asked. And the question how you are able to show an ID without carrying one has obviously been unanswered. Reasons for asking for an ID include such things as:

You witness a traffic accident
You faint
You decide to paint the town red and run into a police controled zone

I do however wonder how an identication obligation is going to help to make the streets of the Netherlands safer. We are part of the Schengen group of countries so basically everyone coming from a European country can get in without showing their passport. The only meaningful border control left is at the international airports, and there already was an obligation to show your passport there.

Furthermore suppose the police stop someone in the street (hopefully for a good reason, such as crossing the street in a suspicious way). How would it help if you can ask that person for his ID. You have something better: you have THE GUY (or the girl). If you suspect someone and he/she can not identify him-/herself, round 'm up and bring them to the police station for an extensive identification (including searching pockets, using fingerprints, sample DNA, the lot).

I am also afraid that it might not have occurred to our glorious leaders that terrorists seldomly walk around with passports in their true names. Neither does their ID card mention "Islamic Jihad Terrorist" under "occupation". Like many "security measures" being taken recently this one offers no real security benefits but does make some politicians look really active in protecting the motherland against the unbelievers from a neighbouring state (and please by all means look up the lyrics of Frank Zappa's "Dumb all over" to understand this reference).

Another issue that is quite hotly debated right now (albeit not as hotly as it should) is the wish of police forces to query all sorts of data related to someone's cyber existence. I am talking about Internet session information, cell phone location information, telephone calls placed/received, messages (e-mail, SMS) sent/received, chat sessions et cetera. If things go as I fear Internet & TelCo providers will have to invest in many terabytes hard disk storage to make structured data about their customers behaviour available to the police force (by the way, this is a major consultancy opportunity for my IT company, Open Solution Providers, which specialises in Unix and storage management consultancy and training). I have seen lists of what data local and international polcie forced like the Dutch KLPD and Europol want providers to keep, and these lists are quite scary (Dutch language readers might want to look up this report).

Again I have a number of reservations about these new rules.

First all it is not difficult to behave yourself in such a way that you are mostly invisible to this kind of record keeping. Messages can be encrypted, senders/receivers can be anonymous, protocols can be tunneled, cell phones can be bought anonymously (or in the names of homeless people who take the fall for a couple of Euro's) and discarded after use. It might make the lives of terrorists a bit harder, but only slightly so.

My second objection is that these massive amounts of data must be adequately protected because otherwise it becomes a major privacy liability. Who cares that I surf porn all night through my mobile phone? Well, my wife might (luckily I am not married :-), or maybe the local sexual deviancy squad? Who will have access to this data? And how will they have access? And how do we prevent that criminals buy/blackmail a sysop at the provider to launder/modify the data?

Then there are issues of data quality: one wrong SQL statement and my porn surfing habits are attributed to the prime minister! And who will audit whether the data collection and processing are done correctly?

I also see a problem in the occurrence of correlations. If you maintain excessive amounts of data, there is a higher chance of all sorts of statistical correlations appearing left and right. If you know enough about me I am almost certain to be a front-man for the Bask ETA terrorist group: I speak Spanish, travel to Spain a lot, happen to be around when bombs go off on the Spanish costa blanca in summer (Alicante, Benidorm, Gandia; all within 100km of my Spanish residence in Denia), I have been to the Pa&iaccute;s Vasco, I own a book on Bask monestaries and cooking, I have staid in the Bask parts of France and so forth... Who can possibly deny that I am a case for further investigation?

What it boils down to is that all these measures are (in my opinion) not effective and will cost everyone a lot of money. My privacy goes down the drain in return for which I get .... nothing!!!

Dutch language speakers might want to follow this link to Bits of Freedom.