Interception of communications is the reality in the 21st century, but there are limits that must be observed, says Rodoljub Sabic and explains how it is possible to establish a system with no unauthorised interception.
The phone hacking affair, namely taking listing of highest state officials, have actualized two important issues – control of the secret services and the police, on the one hand, and protection of communications and personal data, on the other hand.
Rodoljub Sabic, Commissioner for Information of Public Importance and Personal Data Protection, and Sasa Jankovic, Ombudsman, have been warning for years about misuses in this area and enabling assumptions for such behaviour.
*Can this affair to pave the way to the control of the safety services and protection of people at the same time?
These two issues are actually just one – protection of citizens' rights, their privacy and personal data. Over the last several years, the Commissioner and I have been warning that we have something in the field of electronic communications which we can't call a system, but a provisional arrangement with bad consequences for the national security and human rights. This case will make sense only if it is an initial trigger to finally start solving that problem.
*You proposed a package of 14 measures to solve this provisional arrangement. What is the most important?
This package is to introduce a minimum of order in the system, to introduce into correspondence with what is written in the Constitution and international documents which Serbia approved and ratified. I would not like to enumerate all these measures, those interested can find them on our websites, but, as the most important one, I would single out allocation of responsibility – all what happened cannot be the sole responsibility of the services and the police – executive and legislative powers are also responsible.
*How?
In this complex are interceptions of communications and, even more crucial, access to so-called retained data about who, when, how long, with whom and how communicated. This data can be of interest to many spheres of the society, from those dealing with anti-criminal activities, then businesses and party structures, up to organized and common crime.
The Constitution is explicit; it establishes a high standard and guarantees the confidentiality of communications that can be waived only in cases of criminal offence and threat to national safety, but such decision may be issued only by court.
In practice, however, someone has begun to make difference among interception of communication, listening to conversations either in real time or from an authorized recording and access to retained data. I have already explained what retained data is and providers keep it for 12 months. Imagine what you can find out about a person if you get complete information about when and with whom he communicated, for how long and from where, and when you cross them with other data, it is a base that tells much more than direct interception of several conversation.
*What is the basis of that difference?
Some laws contains solutions which differently treat interception and access to data, such as laws governing electronic communications, Safety Information Agency, military safety services, criminal procedure law ... For classic interception, they still ask a court decision, but to access retained data, orders of other officers, such as directors of SIA, MSS, prosecutors and unspecified persons, are also acceptable.
*Part of these provisions was challenged before the Constitutional Court.
Yes. When Draft Law on Electronic Communications appeared, a real small war began between the Protector, the Commissioner and professional community from one side, and the executive power on the other. However, the law was passed, but the President Boris Tadic, signing the ordinance, said that he shares the concerns and announced searching for a solution which will satisfy the requirements of the fight against organized crime and protection of human rights. Two years have passed since that moment, and there is still no solution. Even, in several occasions the Digital Agenda Administration proposed a rulebook that would cement that position of retained data as something special. Fortunately, the minister did not approve that rulebook.
The Protector and I, meanwhile, attacked the laws governing electronic communications and military Services – for the Law on Safety Information Agency we did not have a basis because it does not specify persons who can issue an order. The Constitutional Court upheld that retained data can not be accessed other than by a court decision. However, other laws are still in force, some authorities have continued to work in contrary to the Constitution, and it culminated with the affair of hacking Serbian President and the first Deputy Prime Minister.
*Let's back to possible benefit for the society from this affair, with the reminder that a few months ago, when you announced information on monitoring so-called ordinary citizens, there was no specific alert.
There was a lot of attention, but effects stayed away, even though such an action no one has ever done in Serbia. So, I ordered inspection supervision over observance of personal data by mobile phone providers, and we came to some disturbing data and findings, and the first is how the providers handle their own databases. Just to be clear, there are two ways to access data, the first one is electronically, that is constantly available to the intelligence services, and only one provider has activated an application to count accesses – 272 thousand accesses, it is an impressive number for much larger countries, especially if you multiply it by number of providers. Conservatively, by order, there were 4 500 accesses...
*With the court order?
And that's the problem, but it is even bigger as not only that in most cases there was no court order, but there was no basis for issuing the order. Simply, someone asks for information and gets them, which says a lot about our mentality to respect the authority, not the law.
*So, what is the solution?
The Government should propose a series of legislative amendments, and the Assembly to adopt them. In addition, the control is necessary as well.
*Civil control of the services? Is there any progress with that?
There is, just try to remember what the situation several years ago was when the BIA (Safety information agency) and other services did not even respond to calls to disclose information about their work. Our focus is now moving to personal data protection, but the executive and legislative powers have a key role. I understand that the interception of communications as a measure is the reality in 21st century and all services fighting against terrorism and crime have competences and it needs to be provided to them in the most comfortable manner. But, with the limit – someone cannot be allowed who needs a departure from the constitutional guarantee to make a decision about it by himself, the court has to make such decisions, and, finally, a third party should control whether the procedure has been performed in compliance with the court order.
It must be also known who has authorities; it cannot be performed by five services. This is primarily a legal question, not cosmetic solutions, but good solutions that apply.
*You have been already suspected that you want to control this type of communication.
A Commissioner is not the controller of the secret services – my job is: are they dealing with your data in the manner as it is prescribed or they violate your rights. It is about the control of legality of their work, and the Parliament is in charge to control the services. But we need to know that this type of control more and more requires also high expert knowledge which costs and there is no much in our state institutions.
*The opposition recently criticized the Government for the competent parliamentary committee being headed by the deputy who is already in charge of control over the security services.
I would not enter into a political assessment – such remark might mean something, but not necessarily. Of course it is a symbol of power if you entrust that kind of control to the opposition, but personnel arrangements are less important, I always insist on established rules and elimination of improvisations or bringing them to a minimum.
*Interception is interesting, but the misuse of personal data, especially sensitive one, is of greater concern. How satisfied are you with, so to speak, convalescence of both the state and the citizens?
We are prisoners of the old mentality that believes that the state may dispose with your data as it wants, but also everyone else who has some power. It goes so far that you are asked in a chemical cleaning shop to give a copy of your ID, not to mention the availability of sensitive data such as religion, ethnicity, sexual orientation, health status. The law states that these are protected information, but there is no by-law that precisely regulates this area, and there are no control mechanisms as well.
Education is also of greatest importance, in some countries as early as in elementary school children learn what information not to give.
Like an English grass
*It is the eighth year you have been in charge for access to information of public importance. Have public authorities realized that their duty is to provide requested information?
Perhaps it is firstly important to tell you that the Law on Access to Information is the only Serbian's law which was declared best in the world by world experts' analysis. It sounds good, but when Swedish law states that the Commissioner's decisions shall be final and enforceable – it is adhered to. In Serbia it is only on paper...
*It is like with „English grass" from the joke – it takes time to become – English.....
Exactly, but joking aside, there is really a step forward. People of different profiles, journalists and citizens, even authorities which is nonsense, intervene with the Commissioner to obtain information from other authority. However, we have no reasons to be satisfied, twenty thousand cases is a lot of work, but I insist on proactive attitude – that public authorities inform the public with updated Information booklets about the work done, especially spending from the budget.
I will tell you something else - it is a great result that more than 90 percent of the Commissioner's orders have been complied with, but the problem is those nine percent. There is, often, nonsense, for example when it turns out that the requested document was accidentally burned, but there is also deliberate concealment of information from various motives. The Parliament should deal with this because it is about the responsibility, which I will repeat in this year's report. The situation that an authority does not want to follow the law, is quiet an interesting, not to use a more serious word. And why not? It does not afraid of consequences. Last year, several thousand violations were made, and do you know how many proceedings were initiated? None. It looks like an invitation to violate the law.
*Recent deprivation of the Anti Corruption Agency director drew public attention to independent institutions. Is there in Serbia an environment for development of this type of government control or you continue to be an ulcer of Serbian society?
It is not grateful to comment such movements, but you are right, this has attracted attention and, the data that the Board's decision was unanimous speaks for itself. This withdrawal has opened more issues about the Agency itself, and it should stop dealing with itself and starts performing its duties.
Another important thing is the reason of deprivation – the Government's Decree according to which civil servants and officers are entitled to special settlement of housing question. Naturally, an independent body may not use such possibility, but it is equally important question why civil servants and officers have privilege over employees in private sector and other citizens? It would be good that the Government withdraws such Decree.
