36C3 preroll music Herald: Next is Bijan. Bijan. Bijan, I pronounce this. Pretty persian. Yeah. He's an attorney, ein Rechtsanwalt it is called in deutsch, and he works for the Gesellschaft für Freiheitsrechte in Berlin. If I'm right. Good. Give them a welcome. applause, please. It's early in the morning. We're going to kick back here. applause Bijan: Early in the morning, only at the Congress you can call 12:30 early in the morning, but it is. And, um, well, if you've ever sat on a plane and wondered what the person three rows behind you is eating, whether they flying alone, whether they have checked in their luggage or only hand luggage and what visa they were using when they were buying their plane ticket, then you're probably a police officer or should join the national police of any EU member state, because that is exactly what the national polices in Germany and Austria and other Europeans member states, Europe, member states of the European Union, can do. Thanks to the PNR directive, which is the topic of today's talk. And we are going to talk and explain to you what the PNR directive and the laws transposing it into national law are all about, why this is problematic and what we can do and what we are actually doing against it in order to stop it. And Walter will start off with a few infos. Walter: Yeah. Hello. So firstly, I would like to introduce into Epicenter Works, because we have already a history on bringing down data retention laws. So probably you know us from our fight against data retention in Europe when we still were called "AKA Vorrat Österreich". I am working for Epicenter Works on a voluntary basis. And I would like to mention my colleague Angelika Adensamer who did the main work on this for Epicenter Works. But she cannot be at Congress this year. So, flight data. It is said, I've heard that at any given point in time, one million people are on a plane in the skies flying around the globe. As you can see here. And today, although in times of resource exhaustion, we should talk about that anyway. I am convinced today we are talking about the data protection issue about it. A big one. And we are talking about passenger name records. So what is a passenger name record, anyway? A passenger name record, as you can see here, is a data set compiled of 19 different data fields. So you can get about up to 60 different data points on one single passenger on one single flight. So, for instance, you have data in there like the first and second name, address, but also other things, metadata. More important things, like the means of payment you made, the point in time when you booked the flight and things like that. And as a specific problem about it is that there is also a free text field so airline employees can enter data there and which we cannot control. And altogether we have a quite big data set of each passenger on each flight. So this is common in the airline industry. But in 2016, the PNR directive came about. So what is the PNR directive? It is a piece of European legislation , which was enacted in April 2016. And when we have European legislation, it's important to mention that it doesn't come out of the blue out of Brussels, but it is enacted together with from the commission, the European Parliament and the council. And the council are the governments of our member states. So we have to keep in mind that member states governments, have a big say when things like this are enacted. And it is a directive. And that means that every single member state has to transpose the content of the directive into its national law. And this had to be done until the 25th May of 2018. This was the the tenth transposition deadline. And for instance, Austria and Germany made laws to transpose that into their national law. So what had they to enact? They had to enact laws prescribing that all airlines have to transfer data of all passengers, all passenger name records of every flight, and they have to be pushed to a national police database. So unlike the telecom data retention I already mentioned, the data is not kept where it where where it is created. But it has to be pushed from the private sector, from the airlines, to police database, databases. And the data retention directive prescribes that every flight leaving or entering the European Union must be covered by that. But in addition, every single member state also covered flights within the EU. So you have we have the full take now. Flights within the EU as well as flights leaving or entering the EU. And every single record of every single passenger of every single flight is in a police database and will be compared with existing databases, for instance, of known criminals or of stolen passports and the like. And they try to find matches there. And what they are also going to do is matching with predetermined criteria. So they will come up with flight patterns of known perpetrators, for instance, when they booked a flight and so on. They will algorithmically try to find patterns there, and then they will compare your flight passenger name records with that data. And if you have a similar behavior, than a previous perpetrator, previous criminal, for instance, then you're already under suspicion. And this data in these databases are stored for five years and can be further used by different law enforcement agencies. So that data is not only compared and then deleted again. The storage time is five years and they do something called depersonalization about six months after the data was created. But this is not in any way an anonymisation, but they just remove some data and it can easily be identified again. So the person the data belongs to can easily be identified for the whole period of five years. So you probably asked yourself already: First, is this effective? Well, this runs already since last year, so we have some data. First, I will present to you the data from Austria. In Austria, we found out that already until the 30th of September, 2019, almost 24 passenger name records where forwarded to the passenger name unit at the Bundeskriminalamt and 11 900 000 thousand different people were subject to that. And of these, almost 24 000 000 passenger name records, the algorithms that checking against databases already brought up 190 000 matches. So every single match, every single output the algorithm has, must be checked by a human employee. So we have sitting there people who have to check. Even this is not even the data of a year. And they have to check 190 000 matches and only 280 of them are actual hits. So if a person checks what the algorithm outputs there, then only in 0.15% of the cases the policewoman or policeman come to their conclusion: This is actually relevant for us. And if you do the math, this means that only 0.001% percent of all that 24 million passenger name data, your data which is checked, actually leads to a hit. And we don't even know how many actual false positives remain in these 220. This is only what the police will inspect afterwards. So we have no numbers or results if they had actual investigative results on that. But what we can say is that there are 21 employees, qualified employees, working in the passenger name, Passenger Information Unit, and this costs almost 2 million euros per year and only for checking that data in the small country of Austria. And Bijan now will present to you the data in German. Bijan: The number, the data of the big neighbor, because you said small country Austria. In Germany the numbers are surprisingly similar. We also had - have numbers up until mid of August 2019, and we have had almost 32 million passenger name records checked, which generated automatic results of matches of about 240 000, which then were checked by 40 police officers and there remained only 910 actual hits. So the fail rate was 99.6% and 0.003% all PNRs checked led to actual hits. And even of that number, just as in Austria, we are not sure how many false positives remain. We know that there were considerably a considerable amount of false positives. We estimate them to be in the hundreds. But the law enforcement did not specify what actually, how many supposed positives remained, even among the 910. And one of the results we know is that it led to 57 arrests. We don't know for which crimes. We don't know whether these people actually committed a crime, whether they were suspected for crime, whether they were just on a watch list. But 57 arrests, assuming this is these were legitimate, this means that 0.0002% of all PNRs checked led to an arrest. And if you try to to transpose this to other situations in life, you could go to a to a market, to to some, uh, to some festival or what not, and just ask randomly people, and you would probably have with a similar probability, an arrest in the end at the end of the day. So if this holds that this whole PNR processing holds is this effectiveness is the standard that we are happy with, then you can easily take this to all other sorts of walks of life. And this is true, in our opinion, a big problem, because it will lead to a digital surveillance state, which is has come quite near with these new tools that the PNR directive provide. What we've now just shown are the the automatic is the checks against databases. That was the one thing that the PNR directive provides for. The other one is the checking against predetermined criteria. And this is where the voodoo kind of starts, because the idea that you can merely from the data that is in the PNR, in your passenger name record, derive whether you are suspicious, or dangerous even is, at least in our opinion, pretty much voodoo, and it has serious consequences. And it might lead to automatic profiling affecting hundreds of millions of people, possibly, because everybody is checked when they and when they use a plane. Everybody PNR record is checked against these automatic , against these predetermined criteria, and not just for crimes such as terrorism or organized crime, where you could maybe make a case that there exists such a thing as a pattern of movements where you can identify a terrorist suspect, but it is also used for crimes such as fraud or forgery or cyber crime where I would argue you cannot find the typical cyber criminals flight pattern, flight patterns. It's just not possible. And so but but the PNR directive itself is only the one thing. We are fighting this for reasons that go way beyond the PNR processing so the processing of PNR flight data, because it may set a dangerous precedent for other mass surveillance. Already now PNR processing is being discussed for buses that cross borders, for ships and trains. And there are some countries such as Belgium that have already enacted the very much. And why stop there, might a police officer argue. Why not include rental cars that cross borders? Why not at some point include private cars that cross borders? Why not get away with that requirement of crossing borders? Why not have everybody checked all the time, maybe via their mobile phones? So when we give way to this sort of data processing with such a low threshold of effectiveness, we open the door for all sorts of, um, of activity that at least from our point of view, is illegal. And the question you were maybe asking yourself or maybe not. Is this legal? We are convinced it is not. And luckily, we could rely on a legal opinion that the European Court of Justice ECJ has rendered a two and a half years ago. There is one PNR agreement in place between the EU and the USA, which has not been challenged yet. And another agreement was supposed to be known or was negotiated between the EU Commission and Canada, and the EU Parliament then presented the question to the ECJ whether this agreement would be violating fundamental rights of the Charter of Fundamental Rights of the European Union. And the ECJ concluded that it would, in the form that it was proposed to it, breach Article 7 and 8 of that charter's. Article 7 as the right to privacy in Article 8 is the right to have your data protected, your personal data protected. And we are, of course, relying heavily on that, on the arguments that the court developed and developing them even further, because; as you can imagine, the PNR, the agreement with Canada and the PNR directive are quite similar. So what are these arguments that we are bringing up? And we've shown already that the effectiveness is highly doubtful. And this leads us to concluding that the PNR directive is disproportionate. So it violates human fundamental rights. For several reasons. One being a point that we've both raised already that PNR processing indiscriminately affects all passengers. And this is a very important point, because it makes it shows the difference between PNR processing under the PNR directive and what was formerly the the data retention of telecommunications data. Because the latter would require a specific case, something must have had happened in order for the law enforcement to ask for the telecommunications data of the telecommunications provider. But our PNR data on flights is checked all the time, always, against databases, and even more importantly, the predetermined criteria, which we, of course, do not know nothing about. And this brings with it especially the last point, the predetermined criteria, are high risk of false accusations. We've already seen that 99.6% of data base matching, automatic data is matching is wrongful. And imagine how much higher the number would be with checking against predetermined criteria. And that the reason why we expect many false accusations, false positives, is the so-called base rate fallacy, which basically says that when you're looking for a very small amount of people in a large dataset and you have a significant fail rate, you're very likely to produce more false positives, maybe many more false positives than true positives. So actual suspects, or not suspects, but actual terrorists. So, for instance, when you if you're checking 100 million flight passengers. And you're looking for 100 terrorists, and you have even a fail rate of 0.1%, not the 99.6 that we're talking about now, but even just 0.1%, this would render this would this would render 100 000 flight passengers subject to to to being suspected terrorists. So you would have 100 000 false positives, 100 terrorists that let's assume all of them so that they had a positive success rate of 100 percent identifying positively as a terrorist suspect. Then you will have 100 000 false positives, 100 people that are correctly suspected. But everybody, of course, will be treated the same. And what I've listed here are just the obvious things, stigmatization at the airport by interrogation, searches of luggage of people and arrests, missing flights. And depending on the country you're in you may be in much more trouble after that. The second point is that the data is being stored way too long. As Walter has already mentioned 5 years. Why do you need 5 years worth of data to check a database entry or against a predetermined criteria? Of course, you don't needed it for that. Because you could do that immediately after a person has boarded. You can perform the check and then you could get rid of the data, delete it after it's being used. The reason why they're storing it so long as that law enforcement and intelligence agencies have an interest that goes beyond that checking after boarding, they want to keep the data and check it in future, criminal investigations in future, looking into a person, what where they've traveled and so on and so forth. But that has nothing to do with the original purpose of PNR, the PNR directive. And what at least everybody here will know in all data storing, so data storing is in itself a problem. It's in itself a violation of fundamental rights when there is no legitimate reason to do so. But also all data storage puts the data stored at risk. And as we've mentioned already, there's the payment data, especially there's other other sensitive data with whom you've traveled, whether you've traveled with light luggage or not, where you have gone to, via which place and so on and so forth. Another point, which is a bit more complicated is that the director does not sufficiently differentiate between crimes where automatic profiling could make sense and others. So as I have said, there may be a point in saying that the typical terrorists would fly from A to B via C without checking in luggage using this or that tourist office and so on and so forth. So maybe just assume that this is the case. This, no one can can tell me that there is a typical flight pattern of a fraudster where you could ask someone define which way a fraudster typically flies and identify such a person. So what the directive would have needed to do if they wanted had wanted to check against predetermined criteria would have been to identify for which crimes - exactly, and only for these - you can use such a voodoo miracle weapon. And finally, these are not the only arguments, but the more most important ones. We expect that the false positives especially will lead to discrimination against minorities. And one example that the German National Police, the Bundeskriminalamt has given us for a predetermined criteria are young men flying from airports from the south of Turkey to a major European city. So they're thinking about former IS fighters, IS terrorists. And as you can easily imagine what kind of people will be sitting in in in a on a plane that's coming from the south of Turkey to Germany or to any other European country. Of course, this will affect them disproportionately, affect minorities. And it is already now highly intransparent what how these these predetermined criteria are developed. And imagine a near future where law enforcement will naturally try to involve artificial intelligence and finding patterns in the raw data of flight movements of PNR data, of the treasure they're now hoarding with a five year worth of data. And at the latest, at that point in time, it will be impossible for us to understand why a certain criterion was defined and how how to challenge it when you're in the position to be arrested at the airport, for instance. So what can we do? And that's where we come in. The two organizations that we are. We are no typical advocacy organizations, but we do strategic litigation. Because unfortunately no advocacy worked on the PNR directive. It came into force pretty much as the, um, as national law enforcement wanted it to be. And so there is one instance, one authority at the time that in Europe, in Germany, in Europe, the European Union, the courts, which can which can ideally, um, dismiss of the reasons of the motivations of law enforcement to have such a directive enforced and can try to objectively assess whether this is actually legal and should remain in force, stay in force or not. And we did this through litigation both in Germany and in Austria, and both are having the same goal, which is to present to the European Court of Justice the question whether the PNR directive and any national law that is transposing the PNR directive is in violation of the Charter of Fundamental Rights. Why do we have to go? Why is the ECJ important? Because when you have a national law that directly transposes a European law, a directive, then then only the ECJ can declare such a law void. There is no way for, for instance, in Germany, the federal constitutional court, the Bundesverfassungsgericht, to say that this law should not be applied any longer. This question must be presented to the ECJ. So how could we get to the ECJ? This actually was a process that took us quite a bit of time. It's been two years in the making. A year ago, we launched six different complaints of six different plaintiffs that are flying all over Europe, that we booked flights for them that led them to a European member states, a European Union member states and two states outside of the European Union. And we sent the complaints to three different courts. The one, two complaints were directed against the German national police and went to the administrative court in Wiesbaden, and four others were directed against the airplane airlines. So we tried to diversify as much as possible in order to find a judge that would agree with us that this is problematic and this needs checking. And we are optimistic that either the court in Wiesbaden or the court in Cologne will soon present these very questions to the court, whether the German transposition law and the PNR directive itself are violating fundamental rights after European of the Charter of the European Union. Walter: So as Bijan already mentioned, our aim is to bring our case as quick as possible to the European Court of Justice. So we had different options. And in Austria, we went a third way. We brought a case before the Austrian Data Protection Authority against the Fluggastdatenzentralstelle im Bundeskriminalamt, a passenger named unit. And we we brought several different cases and we also found out that different, smaller things which we are on. But the main thing is that this case already went as planned to the Bundesverwaltungsgericht, so the federal administrative court in Austria. And from there, we hope that is also soon forwarded to the European Court of Justice. And theoretically, it would be enough if one case hits the European Court of Justice. But practically, it is, of course, very important to have different strategies because there are different speeds and so on. So that's why we also should mention another case, the the Belgian case. So this Belgian human rights organization, they also brought the case before a Belgian court. In this case, it was directly the Belgian constitutional court. So they had a direct way to the constitutional court, unlike our cases in Austria, where this or in Germany where this was not possible. And therefore, the Belgian constitutional court already referred this case to the European Court of Justice. And we are hoping that our case will be soon or cases, or at least some of them will soon be joined with this case at the European Court of Justice, and then decided together. So to sum up, we have actually a very infringing piece of legislation the PNR directive, PNR processing, as Bijan explained to us in more detail, is extremely intrusive in all flight passengers' fundamental rights. It violates fundamental rights, especially because it is already... is also ineffective and disproportionate. So we heard about these different things. The base rate fallacy that it is ineffective and disproportionate because it is not really possible to find specific suspects in such amount of data with without having a lot, a real lot of false positives. So other arguments are that it is data retention in the first place. So also already the retention of the data of people like you and me is a big problem and unlawful. And this general suspicion it leads to. So everybody becomes a suspect and can become practically a suspect, can get problems practically from that legislation without being a criminal. And yeah, we have strong arguments as we showed you already, the case of the Canada PNR directive, the PNR agreement with Canada is very similar in practice to the PNR directive. So the arguments already held before the European Court of Justice. So actually, it's a shame that this was not stopped earlier. And civil rights organizations as we are have to do that. And that's what we do. And that's also why we depend on donations. So that's also important to stress that our work people having people fully employed to do things like that cost some money. And that's where you can find us. So we have a campaign website, nopnr.eu in German and English. And you can find us, of course, on our website and both websites and find ways how to join us, how to support us. And also still today, you can meet us at our assembly in the CCL building the about freedom assembly, where both the Gesellschaft für Freiheitsrechte and Epicentre Works have their desk and you can ask all the question. But first, ask all your questions now. Thank you. Applause Herald: Thank you, Walter and Bijan, for this very clarifying statements. I suppose there are quite some questions here in the audience. Only I'm looking at someone who's grabbing a microphone now. I see the signal angel. Yes. The mic is not on. Can someone help him? Signal Angel needs a mic. Yes, it's almost there. Brains are working. Signal Angel: Thank you. Is there a cheap method to spam for some trees, for example, by booking flight under a false name and then canceling the flight? Bijan: Well, I think it's it's difficult to say. I didn't get the very first words. Sorry. Signal Angel: Yes, the very first one was: is there a cheap method to spam, to spam for some trees? Bijan: Yeah. Theoretically, I don't think that anything could speak against that. Yeah, but the problem is that you would need to cancel very late because, um, I think the first time they push the data, the airlines are pushing the data to the national police is, 48 hours before the before boarding. So that might come to become a bit expensive. Laughter Walter: I would want to make a general remark also on that. Of course, here, especially here, thoughts like that, how to hack the system are very important and can help. But our general approach is to take legal action to protect all people at the same way, and not only those who who are able to protect themselves or hack the system or whatever. So that's the reason why we both go this general way to bring that down. Completely. Herald: And other question here. Yes. Sorry, sir. Please. Q: What do you expect as a result of your litigation if you are successful in court? Will ... do you expect the courts to strike down the directive entirely, or do you expect another legislative process to do the same thing again or to fix, quote unquote, the directive in very small ways just to to drag out this battle and continue the practice. What do you think the effects will be? Bijan: Well, we think that the European Court of Justice, if it follows our argument, our reasoning, it should it will strike down the PNR directive entirely, because the way it is set up is fundamentally not in in accordance with what it earlier ruled so far. Unless it will change its its entire history of ruling on data retention and so on and so forth. But of course, we will expect the member states to push for another legislation that may be similar, but not the exact same thing. So I can imagine something of a of the sort of data retention of telecommunications, as it were, and with airlines retaining the data and keeping it for a shorter period of time and only giving it out when there is a specific request with, where there is a specific reason for law enforcement to ask for the data. I could imagine such a thing coming up again and then we would need to check whether this is illegal or not. And maybe go through the whole procedure as well. But it is it would be an immense success if the PNR directive as it stands would be void. Declared void. Herald: Thank you. Someone else has a question. I see the person here. Microphone one, please. Q: Hel-lo, yeah. Okay, so you had the agreement that, uh, there are a lot of false positives when they checked up PNR data. Um, do we have any information how long it takes for them to react on the PNR data if they get a positive hit? So maybe they won't react after the person has landed and already, uh, is in the country? Bijan: They claim that they can act immediately, but we can't know that for sure. So the fact that they had 57 arrests at the airports signals that at least that in some respects this is true. But we cannot know for sure how much, how quickly they they they kind of react. And keep in mind, this is only the start. So, so far in Germany, right up until the point where this the data that I presented for Germany came about, there were only 9 airlines, I think, that were linked to the system. So expect there to be much more data coming in. And once they start with a predetermined criteria thing, this will multiply probably. Um, even so, I cannot imagine unless they they ... have this new, um, thing with hundreds of people involved that they can act immediately in each and every case. Herald: Thank you. There is a question again on the Internet. Yes. Signal Angel: Yes. How come, you haven't tried voiding the local at one provisions that this PNR there for intra EU flights? (???) That seems most likely against Schengen provisions. Bijan: We have addressed that as well. We have picked intra-EU flights also. We have not just picked flights that go extra EU, but, we've also made the point about the the violation of Schengen criteria. But that is not so much that is not the focus of our argument because they are, in our opinion, much stronger ones. Because with Schengen you would need to argue that it's practically impossible to enter the country without being held up and you're not being held up in a physical form, at least not in general, generally. And so this argument is a bit more difficult than having an actual border checking of people. But we're making this point, of course. And but we rely on other points that we think are stronger. Herald: Okay. Please. Microphone number one, please. Q: Is there also data being collected on flights inside a country. So, for example, from Munich to Berlin. Bijan: Not yet. Not under the directive. And theoretically, of course, that the German legislator or any other legislator could decide to include that as well, but not so far. Herald: Number two, please. Microphone. Yeah. Q: I was wondering how much, uh, false negatives are in there. You know, that, like, uh, these big databases. If I don't act like a normal terrorist or something than I am? Bijan: We don't we don't know, unfortunately, not yet. Um, I did. I think it would be very interesting, especially for the predetermined criteria , to see how many they miss. Um, but yeah. No, not nothing at. Herald: Yeah, and there is no undo button, I think. No. No. No undo. That's always the thing that I that I'm worried about, you know. Then you have an announcement about France's data that go out and then you can't have an undo. So what do we do then? It's always new. Yeah, you can keep this for five years now. But who says it's there for five years and what kind of interpretation to get out of it for five years? After five years? Bijan: You can't know in which database you will be transferred in the meantime, because law enforcement can access the data of that very data set and forth for that data and the PNR data set and put it in another data set because they have whatever reason to do so. And then these are again enlarged and enlarged. And then you will find another reason why they should remain in there for a longer time. So, yeah. That's why we're fighting this now and hoping to change the future. Herald: How do you see your chances? Actually, uh, a long term or short term chances to get to that point is that? Bijan: We are very convinced that we will be successful, because otherwise we wouldn't have started this. This is one of our principles. We only do things that we are convinced of being able to win and we think that we will win this. And what will come out of it? Referring to the I think the second and the second question earlier. And what will be happening in the future with other legislation? I can't know. But one argument the police is always making or in private, at least to me, are is that they're saying, well, people will get used to it and it won't be in in five or 10 years. Nobody's gonna be wondering about things like this. And this is exactly what we are working against, that this never becomes normal, because if this becomes normal, as I've argued before, applause Herald: needs an applause Yes. Bijan: If it becomes normal, as I've argued before, it is easy to extend it to all sorts of life and ways of life and walks of life. And this then would be in a surveillance state par excellence. Herald: We were very close there. So we need to support them really hard. There is one last question I suggest. No. There is two questions. Number two. Yes. Q: Does the PNR directive apply only for regular scheduled flights? So does it also apply for private flights? The general aviation business flights, etc.? Bijan: Good question. I don't know. Actually, I look into that and. Write me! Come, come here later and I'll check and I'll give you an answer. Herald: Then there is one at number one. Q: I just wanted to ask a question in response to the idea that this is becoming very normal, because one thing that I think has become very normal that hasn't been mentioned explicitly is the idea that people can be essentially put on a watch list as being a potential criminal in the absence of a crime. And we have these terrorist watch lists all over the world now. That is now the new normal. And I think that's very problematic. And can you just maybe talk about: Do we, do you see a future where we can actually get back to, you know, only arresting or investigating people because of probable cause, for example? Bijan: Oh, I hope that this will be our future. But, uh, about that point, that very point, I'm not too optimistic, to be honest. I am optimistic about one other one. Another thing that is that these instruments that are now being created will prove to be highly ineffective, as we've so now see now already with checking against databases, that is already a lot of work and very tedious work. But with the idea that you can define criteria for people that that are legitimately to be suspected of committing a crime in the future, I think it will prove, at least for the next few decades, to be quite impossible. And this is I don't know if this came across correctly sufficiently, but this is really the core issue that we have with the PNR directive. They are claiming that they can find suspects of crimes or future crimes. Imagine! Not not someone that has committed a crime or that will definitely commit a crime, but that can reasonably be suspected of committing a crime in the future, and then act upon that. And that is really a huge step into what I called voodoo, about the expectation that you can take data and prevent crime. Minority Report times. Yeah. To the power five. I don't know. Herald: Sit back and relax. Thank you Bijan and thank you, Walter, for this fantastic lecture. Please support them at noPNR dot EU, go to their booth as well. And thank you all. 36C3 postroll music Subtitles created by c3subtitles.de in the year 2021. Join, and help us!