IP: More on EU may investigate U.S. spy network

[Dave Farber <farber () cis upenn edu>]

Date: Thu, 12 Nov 1998 14:01:05 -0500
From: "K. N. Cukier" <100736.3602 () compuserve com>
To: "farber () cis upenn edu" <farber () cis upenn edu>


Dave,

There's a lot of mis-reporting about the US-UK listening station ECHELON
and Europe's reaction to it. In the recent article you sent out, "European
Union may investigate U.S. global spy computer network" by Daniel Verton of
FCW Government Technology Group, there are a few inaccuracies and important
nuances that ought be made. 

For one thing, the STOA (Scientific and Technological Options Assessment)
unit is a part of the European Parliament and cannot be considered to speak
for the European Union. While the latter has far-reaching powers via the
European Commission (as MCI WorldCom and U.S. companies who fall under the
EC data protection directive have learned), the Parliament is an impotent
forum with no policy-making powers. For instance, in 1995 the European
Parliament passed a resolution to ban all crypto without law enforcement
access -- a toothless and immature declaration that was completely
overturned in October 1997 when the Commission released its "Communication"
calling for "effective and proportionate" crypto policies.

Additionally, the article does not at all substantiate its claim that the
EU -- or the Parliament for that matter -- is, as the piece states:
"considering launching a full-scale investigation" to see if the NSA spies
on "government and private groups around the world." On the contrary, it's
important to remember that despite the EC's broad commercial powers, it is
specifically prohibited from treating the issue of national security.
(That's one reason why all the crypto politics in Brussels have centered on
the commercial implications of key recovery, not privacy or spying issues.)

Some history is useful: The STOA report, written for STOA by the U.K. human
rights group Omega Foundation, was published in January 1998 as preliminary
findings. (At the time, you sent to the IP list Bruno Giussani's excellent
article in the NYT's CyberTimes of February 24.) An updated report to the
January report, clarifying aspects of ECHELON, was released in September.
(You sent out the summary and URL to the IP list.) Another, fuller study is
expected next year, to quantify the degree of the problem, as I report in
the article below.

Yet I suspect that neither the EP or EC will actually set formal
recommendations or policies on the matter. The EP is useful for symbolic
sabre-rattling and getting some of the groundwork research out into the
public realm. But once it gets too close to the really salacious stuff, the
national governments will ice it, preferring to address the issue
privately, and perhaps via bilateral rather than multilateral dialogue.

Cheers,

Kenn

________________________________________

Below is an excerpt from a long article I wrote on the matter in
Communications Week International, 2 November 1998.

"[...] The information about ECHELON ... startled European business
executives, galvanized European officials, and led, according to one person
close to the European Commission, to a memo sent to all EC Commissioners to
be aware that their phone, fax and e-mail communications may be monitored
by the U.S. and U.K. governments.

The U.S. does not deny the existence of international listening stations,
but claims they are not used to provide commercial information to U.S.
firms. [...]

Glyn Ford, a U.K. Labour Party member of the European Parliament, notes
that "the allegations made in the report are serious but not proven." Yet
he adds: "We have no reason to believe [the report] is fundamentally wrong.
There's some kind of system there and it seems to imply that companies
should not use [voice] telecoms, faxes and e-mails that use communication
satellites."

Meanwhile, a senior official at the German Ministry of Economics is
reluctant to accept the STOA report immediately, but adds that they take
the allegations seriously. "We do feel it is necessary to distinguish
between the pure facts and fiction -- there's a lot of fiction around this
affair," he says. "I don't believe we have a stable ground" to set policy
yet, he adds.

Dick Holdsworth, the head of the STOA unit, admits the report's findings
lack concrete data on the extent, and cost, of the problem. "We want to
take the analysis one step deeper and prioritize the economic aspects," he
says. A further study that seeks to quantify the problem will begin before
year's end and is due in mid-1999.

Since STOA simply advises the Parliament, explains Holdsworth, the report's
goal is to "provide a range of options from which our political masters [at
the Parliament] can select on the basis of their political judgments." The
Parliament, however, has no formal powers to set policies; instead, its
resolutions can be used by the European Commission or national governments
to set policy.
[...]
Yet one U.S. citizen living in Europe with close ties to U.S. intelligence
agencies snickered at the public outcry. "This [ECHELON program] has all
been known for a long time," he told CWI. "Where were these people?" 

Two officials at France's Service Central de la Securite des Systemes
d'Informations (SCSSI), the country's cryptography intelligence agency,
claim that all countries, including the United States, practice some degree
of economic espionage. And they say the practice is increasing swiftly due
to the Internet, an inherently public and "open" system that makes it
vulnerable to attack.

Yet a former senior NSA official interviewed for this article douses the
allegations that U.S. commercial spying is as widespread as some make out.
"This flap shows how much the European governments don't 'get it.' They
think it takes a government role to enhance competitivity, when it is
exactly the lack of a government role that is best," he says. "The notion
that government should get involved in commercial espionage assumes that
government can do it well," he adds.

He calls the idea a "profoundly European" perspective, because that is how
European governments would try to help their industries. [...]"


NNNNNNNN