In January, two interesting and thorough reports on expanding police and surveillance powers across Europe were published: Amnesty International published a 70 page report which summarizes its research into expanding police laws across EU and the troubling consequences to innocent citizens. It was followed up by an opinion piece in The Guardian by one of its authors, John Dalhuisen.

The second report was by Privacy International (original), and analysed the expanded surveillance and data retention powers in UK, Germany and France.

Each report paints a grim picture of the state of human rights and privacy across the EU. Overall a somber picture emerges: The liberty and freedom we have enjoyed over the last quarter of a century is eroding. Add to that the sweeping wind of right-wing nationalist politics across the continent, and the alarm bells should be ringing.

Too often, the counter-argument in this debate is "if you've got nothing to hide, you've got nothing to fear", or the corollary "I'm too boring for the state to be interested in". Glenn Greenwald does a good job of dispelling that argument in his book "No Place to Hide". He points out that surveillance stifles self-expression, creativity and experimentation. On a state level, its very purpose is to hinder deviant and radical thought and action. As such, surveillance and lack of privacy is an obstacle to political and cultural progress.

Given that mass state surveillance harms us all, our individual relation with the state authority, and whether we personally feel we have anything to hide or not, is nonessential to the debate. It is irrelevant if you yourself is involved in politics, opposition groups, and protests. Surveillance harms everybody, depriving us of freedom, and hindering political, cultural, and human progress. It makes us complacent, unable or unwilling to question authority.

Dangerously disproportionate

In their report, titled "Dangerously disproportionate", Amnesty International analyses events and laws passed in 2015 and 2016 in multiple EU member countries, including UK, Germany, France, Holland, Spain, Poland, Hungary and Austria. They look at new emergency powers; legality of laws and powers; the right to privacy; freedom of expression; right to liberty; freedom of movement; and stripping of nationality. In each section, Amnesty International specifically calls on EU member states to respect established Human Rights and the rule of law. They provide multiple examples from the various states where it is questionable whether the police and the executive branches have acted legally, against their countries laws or against basic human rights.

The report is well written, and comes with several insightful and well placed warnings. Amnesty International is ringing the alarm bells, and points out that the governments of Europe are now the biggest threats to their own nations and freedom of their people:

"Ultimately, however, the threat to the life of a nation – to social cohesion, to the functioning of democratic institutions, to respect for human rights and the rule of law – does not come from the isolated acts of a violent criminal fringe (...), but from governments and societies that are prepared to abandon their own values in confronting them."

Terms like "the enemy" and "terrorism" have always been deliberately vague. This is now causing real problems when such vague and undefined terms are used as part of laws:

Because there is no universally agreed definition of “terrorism” under international law, states and international bodies have created their own. In that process, over the years, definitions of terrorism have become ever more vague and overly broad. This lack of clarity in many counter-terrorism laws has led, in turn, to a lack of certainty regarding what precisely constitutes an act of terrorism. If people can’t tell whether their conduct would amount to a crime, they cannot adjust their behaviour to avoid criminality. The consequences can be significant, ranging from the profiling of members of certain groups thought to be more inclined toward “radicalization”, “extremism”, or criminality based on stereotypes – i.e. guilt by association – to the outright misuse by states of laws that define terrorism loosely to deliberately target political opponents, human rights defenders, journalists, environmental activists, artists, and labour leaders.

Mass surveillance is still illegal and against Human Rights:

Any communications surveillance measure used must be strictly necessary and, to the extent that it interferes with people’s rights, must be proportionate in the particular circumstances of each case. The cornerstone of lawful communications surveillance is that it is individualized and based on reasonable suspicion of wrongdoing.

Indiscriminate mass surveillance, in effect a fishing expedition and “just-in-case” retention of people’s communications and data, is the antithesis of this. States may refer to indiscriminate mass surveillance practices by other names – “bulk” rather than “mass”, “collection” or “interception” rather than “surveillance” – but linguistic gymnastics do not make the practices conform to human rights standards.

When laws are vaguely defined and the state can monitor everybody all the time, this is causing a chilling effect on freedom of speech, thought and expression. Simply clicking on the wrong link can be enough to land somebody in trouble. The report points out how musicians and other artists have already been the target of discrimination and "terrorist" laws.

The right to freedom of expression has been under direct and sustained assault across Europe in recent years. Measures that seek to curb speech and other forms of expression, taken cumulatively, reflect a landscape where freedom to access information, offer opinions, exchange ideas, and engage in robust and challenging debate - publicly or online - is in rapid decline. The risk that a person could be labelled a security threat or “extremist” has had very real consequences for some people as the examples below illustrate, while the “chilling effect” that such measures creates has left the public space for free expression smaller and more impoverished than it has been in decades.

Finally, the report discusses freedom of movement, and the dangerous trend towards "preventive measures” and "pre-crime" initiatives without the rule of law:

Indeed the extent of the remove can be seen from the fact that states are criminalizing not just the preparatory act of travelling abroad with the purpose of committing a terrorist offence, but also acts preparatory to the preparatory act of travelling abroad with this purpose. The problem here is that acts such as browsing “extremist” websites and looking up the price of flights to Istanbul can all render people liable to prosecution, long before individuals may have made up their minds to commit a terrorist offence, or without their ever even having contemplated it in the first place.

Mass Surveillance in Europe

The Privacy International report is shorter, but just as interesting and worrying. It covers the British "Snoopers Charter" or Investigatory Powers Act (IPA); the German Communications Intelligence Gathering Act ("Ausland-Fernmeldeaufklärung des Bundes-nachrichtendienstes"); and the French International Electronic Communications Law ("mesures de surveillance des communications électroniques internationales"). For each law, the authorized powers, oversight, and power over privileged communication is examined.

Although the terrorist attacks in these countries over the last years are driving forces, many of the laws being passed now seems to have at least some relation to the EU Data Retention Directive, issued a decade ago, in 2006. Although that was annulled by the EU Court of Justice in 2014 for "violating fundamental rights". Still, similar and broader laws are now in place in many EU member states.

The report concludes:

The leaders of Germany, France and the UK are setting a dangerous precedent which echoes within the European Community and far beyond it: Mass surveillance by governments has become the new normal.

No sanctuary in Switzerland?

Upon till recently, Switzerland was a sanctuary of privacy and secrecy of private information and financial information. The latter was shattered a few years back, when the US threatened to throw out the Swiss banks if they did not disclose account details on what US citizens held. The former came under attack in 2015 and 2016 when two separate data retention and surveillance laws were enacted and passed. The BÜPF - "Überwachung des Post und Fernmeldeverkehrs" ("Monitoring of post and telecommunications") and the NDG - "Nachrichtendienstgesetz", an extension to the existing national intelligence law. There's a discussion of both here, and more details by ProtonMail.

The laws call for all communication channels and services to retain certain metadata about the communication for a year, which apparently includes any open wifi hotspots; IRC chat rooms; email and chat services; message boards and so on. Again, similar laws which were declared illegal for violating fundamental rights by EU Court of Justice in 2014 have become national law. Furthermore, the laws make state hacking and wiretapping legal.

Even though Switzerland is neutral, they maintain close ties to the US, including data sharing agreements through the Privacy Shield Framework, like the other EU countries. (The double-speak has really gone far when "privacy shield" is a name for business and government information sharing). Furthermore, regarding financial details, Switzerland is taking part in the Automatic exchange of information (AEOI) program, under the guise of detecting tax evasion.

An interesting note about the "Nachrichtendienstgesetz" extension is that it met strong resistance, and ProtonMail were amongst activists who gathered enough signatures for the 2015 proposal to go through a national referendum, as is required in Switzerland. The only problem: they lost. On 25 September 2016, the vast majority at 65.5% voted in favour of the law. Although only about 43% of eligible voters cast their vote, the outcome was similar across all cantons, and therefore we must assume representative of the opinion of the population as a whole. It goes to show, that even in Switzerland when the choice stands between privacy and security, people will give up their privacy.