New Law on Electronic Communication: Does it allow for more surveillance? #
- The article debunks claims that a new Polish law (PKE) on electronic communication grants wider surveillance powers to authorities.
- The law requires telecommunication companies to provide technical means for storing and accessing user data, including "electronic communication."
- This is not a new concept and has been practiced in the current telecommunication law under a different terminology.
- The Ministry of National Defence (MON) attempted to expand the scope of the law to include data from email providers and communication app producers, but their amendment was rejected.
- While the law doesn't offer greater surveillance potential than the existing telecommunication law, it still lacks proper controls on the authorities' use of "operational control."
"The law creates a system and you can't read a single provision in isolation from the others. Don't confuse the obligations imposed on companies under the Electronic Communication Law with the powers held by the authorities. The provisions of so-called "competency acts" (e.g., the Police Act) remain unchanged, which define the rules governing how the authorities can access content. A court will still have to approve access to content." - Wojciech Klicki, Panoptykon
"The law does not allow for more surveillance than was possible before." - Wojciech Klicki, Panoptykon
The Reality of Surveillance: #
- Even if the law required operators to record communication app traffic, end-to-end encryption would prevent authorities from accessing the actual conversations.
- Authorities can still access metadata associated with communication app use, revealing details like the time, duration, and recipients of communication.
- It's crucial to choose communication apps that offer metadata protection and to enable features like automatic message deletion for enhanced privacy.
Key Takeaways: #
- Despite some media reports, the new law on electronic communication doesn't grant authorities new or expanded surveillance powers.
- The law primarily mandates technical capabilities for authorities to access data, but access remains contingent on court approval.
- The law's limitation lies not in the extent of surveillance but in the lack of effective control mechanisms on the authorities' use of surveillance.
Other Relevant Information: #
- The article shares the author's opinion that the issue of uncontrolled authorities applies to both the new and the existing telecommunication law.
- The article mentions a recent European Court of Human Rights ruling that criticized the lack of actual judicial control over authorities' actions.
- The author emphasizes the importance of choosing communication apps that offer enhanced privacy features and protecting personal data.
- The author promotes their own cybersecurity training course, encouraging readers to attend for practical advice on protecting themselves online.