Ireland proposes new law allowing police to use spyware

Ireland is considering new legislation to give law enforcement agencies more surveillance powers, including allowing their use spyware.

Irish Government announced this week the introduction of the Communications (Interception and Lawful Access) Bill, which will regulate the use of so-called lawful interception, the industry term for surveillance technology, including spyware made by companies such as Intellexa, NSO groupand Paragon Solutions.

“There is an urgent need for a new legal framework for lawful interception that can be used to deal with serious crime and security threats,” said Jim O’Callaghan, Ireland’s minister for justice, housing and migration.

“The new law will also include strong legal safeguards to ensure that the use of force is necessary and proportionate,” O’Callaghan said.

The main driver for this new law is a 1993 Irish law that regulates the use of legitimate interception tools ahead of the most modern means of communication, such as messages and calls made with end-to-end encryption applications. Communications encrypted in this way are generally only accessible if authorities hack into the target device, either using government-level spyware, or locally. using forensic technology like the Cellebrite device.

The announcement specifically stated that the new law would cover “all forms of communications, whether encrypted or not,” and could be used to obtain communications and related content. metadata.

The Irish government also promised that the powers of surveillance will come with “privacy, encryption and the necessary digital security protection,” including judicial authority and the requirement to be used “in specific cases and only in circumstances that meet the necessary and proportional test to address problems related to serious crimes or threats to the security of the State.”

The announcement lacked specifics on how these new powers would be implemented, as the law has yet to be written. But there is a certain section that mentions the need for “a new legal basis for the use of covert surveillance software as an alternative means of legal interception to gain access to electronic devices” – a clear reference to computer and mobile spyware – to investigate serious crimes.

The spyware situation in Europe

Ireland’s offer to allow law enforcement to use spyware comes as government spyware continues to grow, including across Europe, despite recent abuses that highlight how spyware is being used to violate human rights.

While a decade ago, spyware scandals were generally limited to countries in the Middle East and South America, where human rights standards differ, there have been several cases of spyware abuse in Europe in recent years, including in Greece, Hungary, Italyand Poland.

However, spyware has been used in Europe for more than twenty years.

In 2004, in what may be the first documented sale of government spyware, the Italian cybercrime unit Polizia Postale signed its first contract with Team Hacking, a small cybersecurity startup in Milan, whose name would become synonymous with the data breach that led to the company’s closure.

In 2007, Jörg Zierckethe, head of Germany’s federal criminal police office, the Bundeskriminalamt (or BKA), to a local magazine if his agency uses computer spyware. Then in 2008, WikiLeaks revealed the existence of DigiTask, a company that sold spyware to German authorities to intercept Skype calls.

In 2011, hackers in Germany’s Chaos Computer Club find spyware samples on the computer of the businessman through the Munich airport customs, which they attributed to the German police. The hackers called the malware Bundestrojaner, which is German for “federal trojan.”

At the time, it was a story that didn’t get much public attention. A few years later, when security researchers began to document the abuse of European-made spyware in countries like Egypt, Ethiopia, Mexico, Morocco, the United Arab Emirates, and several others, spyware became mainstream, and is now a relatively normal technology.

While some countries like Italy have laws regulating the use of spyware, the European Union has begun try to set common standards to use this type of technology in response to scandals on the continent.