PEGA-Untersuchungsausschuss: EU-Staaten verweigern Aussage vor EU-Parlament

Der Staatstrojaner-Untersuchungsausschuss im Europaparlament wollte am 24. Januar eine Anhörung zum Thema Geheimdienste und Staatstrojaner veranstalten. Allerdings sagten alle für die Sitzung geladenen EU-Staaten ab. Der Ausschuss-Vorsitzende sagte, er hat „langsam die Nase voll von diesem Vorgehen der Mitgliedstaaten“.

Stattdessen war Mariëtte Moussault von der niederländischen „Kommission für Ermittlungsbefugnisse“ zu Gast. Diese Behörde entscheidet im Voraus, welche Überwachungsmaßnahmen mit „besonderen Mitteln“ genehmigt und welche abgelehnt werden. Staatstrojaner müssen notwendig, angemessen, gezielt und verhältnismäßig sein. Ihr Entschluss ist bindend.

Details zur eigentlichen Überwachung teilte Moussault jedoch nicht mit. Die technischen Mittel und ihr Einsatz durch Geheimdienste unterlägen gleich zweifach dem Staatsgeheimnis. Demnach ist sowohl geheim, welche Technik verwendet wird, als auch, welche Technik nicht verwendet wird. Viele Rückfragen der Abgeordneten ließ sie daher unbeantwortet.

Von der Sitzung gibt es ein Video, aber kein offizielles Transkript. Daher veröffentlichen wir ein inoffizielles Transkript.

• Date: 2023-01-24
• Institution: European Parliament
• Committee: PEGA
• Chair: Jeroen Lenaers
• Expert: Mariëtte Moussault, Chair of the Investigatory Powers Commission TIB
• Links: Video
• Note: This transcript is automated and unofficial, it will contain errors.
• Editors: Anna Seikel

Intelligence services: Netherlands

Jeroen Lenaers (Chair): Dear colleagues. Good afternoon. If we could please take our seats. I apologise for starting the meeting late. I tried to be punctual, but I just came out of another meeting that wasn’t finished yet. Also, our rapporteur, Sophie in ‚t Veld, is still stuck in that meeting, so she will also be joining us shortly. Without a doubt, we are resuming the meeting that we suspended this morning after the exchange of views on the recommendations by the rapporteur and we will start now with point five on our agenda, which is an exchange of views with Mariëtte Moussault, who is the Chair of the Investigatory Powers Commission, the Netherlands. So the Toetsingscommissie Inzet Bevoegdheden or TIB. I thank very much Ms. Moussault for her availability and her willingness to be with us this afternoon. We look forward to hear her contribution. And I pass her the floor for about 10 to 15 minutes up to your own flexibility to give us a brief introduction, and then we will open the floor for questions and answers. Thank you very much for being with us, Madame Moussault, and I pass you the floor. Thank you.

Mariëtte Moussault: Well, first of all, I would like to thank you for inviting me to appear for your committee. I understood that the purpose of this hearing is that I explain about the general legal framework in the Netherlands in regard to the oversight on the intelligence agencies. It’s my pleasure to do so.

Since I am the chair of the body that is charged with the ex ante review of special investigatory powers, the focus of my presentation will be on that part of the oversight. However, I’m afraid that there are some limits to what I can tell you. In the Netherlands, the technical means or tools of the intelligence agencies are considered state secrets in two different ways. First of all, the fact that special means are used is state secret, but also the fact that certain means are not used is considered a state secret. That maybe seems not logical, but I will explain it with an example.

Imagine there are two special tools to hack of a computer. The one with the name Neptune. And the other one which is named Caesar. Now, Neptune would be used in the Netherlands and Caesar not, and I would say, I’m sorry, I’m not allowed to say if Neptune is used in the Netherlands, but I can inform you that we do not use Caesar. It would be clear, I think, for everybody that Neptune is used in the Netherlands. This is why I cannot inform you about any means used and not used by the services. I do realise that on this point my French colleague was in the hearing with you two weeks ago had more liberties to inform you. Well, I’m sorry. There are differences between countries.

However, I can explain you about the oversight, but not about the means that are used. The powers of the intelligence and security services in the Netherlands are regulated by the Intelligence and Security Services Act 2017 or in short the ISS Act. The oversight on the intelligence services is regulated in the same act. Roughly, the oversight is divided between the three bodies. The District Court of the Hague, that is more practical. The examining magistrate, the review committee on the Intelligence and Security Services, in Dutch CTIVD. But here after the review committee. And last but not least, the Investigatory Power Commission in Dutch TIB, we call it the TIB.

First of all, it is important to mention that in general the services can only act within their legal task and their task is described in the acts I just mentioned. The tasks of the general services are to conduct investigations with regard to organisations and persons who give cause for serious suspicion that they pose a threat to the continued existence of the democratic legal order, or to the security or to other vital interests of the state. That is the main task, and the main task of the military services is to conduct investigations into the potential and the armed forces of other powers for the purpose of a balanced composition and effective use of power. So the Dutch Armed forces. The exercise of special investi–

Jeroen Lenaers (Chair): The connection with Madame Moussault will be refreshed. It seemed like we had a good connection going before, so we’ll give it a moment to make sure we can reconnect.

Mariëtte Moussault: I’m sorry. There was a connection problem.

Jeroen Lenaers (Chair): Yes. Yes, we lost you, but we found you. So please, please pick up where you left. Thank you.

Mariëtte Moussault: I’m glad to be back. Okay. The exercise of special investigatory powers needs an ex ante review. And for special investigatory powers, not for all investigatory powers, the services need the minister’s authorisation. Special powers are, for example, intercepting telephone communication, hacking and the interception of satellite or cable communication. The Investigatory Powers Commission is charged with reviewing the lawfulness of the authorisation granted by the Minister. The exercise of a special investigatory power against a journalist or a lawyer or if it concerns opening a letter is permitted only if the District Court of The Hague has granted authorisation.

There is also general oversight on the services, and the review committee is charged with general oversight on the lawfulness of actions of the services. Their task is not limited to special investigatory powers. The review committee has access to all documents, all information systems, etc. of the services. However, their oversight is not binding. Part of the review committee is the complaint department, and the judgement of the complaint department are, unlike to the review committee, binding.

Now back to the Investigatory Powers Commissions. This commission has three members of whom at least two need to have six or more years experience in the judiciary. The third member does not have to meet these requirements. The ISS Act offers room to appoint a member with technical expertise and technical expertise has proved to be very important. The Investigatory Powers Commission performs an ex ante review of the lawfulness of the authorisation to use special powers that are granted by the Minister to the Services. The Commission is an independent commission. And equally important, the rule is binding. That means that if the Investigatory Powers Commission rules and authorisation to be unlawful, that special power may not be used. The Minister’s authorisation is based on a written request, and the request comes from the services. So in practice, the Investigatory Powers Commission refused the written request from the services. Their request should contain all relevant information to review the granted authorisation. The Investigatory Powers Commission does not have access to the information system of the services to obtain additional information. However, the Commission can ask additional questions and in that way obtain all the required information.

The review of the Investigatory Powers Commission is not a marginal test. I will subsequently discuss four elements that are considered in the Investigative Investigatory Powers Commission’s assessment. Each assessment. First of all, is a necessity. A request must substantiate the necessity to use an investigatory power. The Commission does not make its own evaluation of a presented threat, but reviews whether the threat that is presented in the request has been sufficiently substantiated and forms a reason to use the requested investigatory powers. Secondly is subsidiarity. As you all know, subsidiarity means reviewing whether the least invasive investigatory power is used to attain the aims. In more complex operations, particularly in hacking operations, technical expertise is frequently required to be able to review if the least invasive means will be used. Fortunately, we have this expertise in our commission. Thirdly, is the element as targeted as possible? The criterion itself is stated but not explained in the ISS Act. So the Commission had to define this criterion in practice and we defined it as follows: „The extent to which the acquisition of information that is not strictly necessary for the investigation is restricted to a minimum. Given the technical and operational circumstances of the case.“ Some people may argue that this criterion is redundant, given the test of necessity and proportionality and subsidiarity. But that’s a separate discussion altogether. And that brings me to the last element of our assessment, which is proportionality.

Jeroen Lenaers (Chair): The quality of the collection seems to have deteriorated slightly. There is some lists of disturbance on the on the line. Could you maybe try again?

Mariëtte Moussault: I – is it better?

Jeroen Lenaers (Chair): Not. Not really. No, I’m not sure. I’m sure. I’m looking at the interpreters to see if this is a no. I going to no for the possibility to interpret this. We can hear it in English, but very difficult. We should we should try once more to. To refresh, we will refresh the connection from here. And then we try again. Apologies for the inconvenience.

Mariëtte Moussault: Okay.

Jeroen Lenaers (Chair): Okay. We see you again. Can we check the sound quality?

Mariëtte Moussault: Is this better now?

Jeroen Lenaers (Chair): Yes, much better. Thank you.

Mariëtte Moussault: Okay, then. Can I continue or should I resume some more?

Jeroen Lenaers (Chair): No, no, you can continue with. It was still hearable.

Mariëtte Moussault: Okay. Then I get to the fourth element that is assessed by the commission, which is proportionality. In the case of proportionality, the importance of the investigatory power to be used is considered against the detriment the use will cause to the parties involved. Most often, the latter relates to the infringement of privacy. The Investigatory Powers Commission is of the opinion that everything that is known contributes to the balancing of these interests must be considered in the proportionality test. That means, for example, that in the case of a large threat, the use of more invasive investigatory powers is more likely to be justified than in the case of a lesser threat. But on the other hand, everything that contributes to the infringement of privacy must also be taken into consideration.

These four elements necessity, subsidiarity, as targeted as possible, and proportionality, are elements that are reviewed on each request. Also on request considering hacking. Now hacking is a special investigatory power that is allowed by the Intelligence and Security Services Act. The website of the General Intelligence and Security Service explicitly states that hacking is one of the special investigatory powers. So this is not a secret. It states that the service can hack a computer or smartphone or any digital device to gather information for their investigation. If one of the services want to hack a target, they have to address a request to the minister. If authorisation is granted by the minister, that is followed by a review by the Investigatory Powers Commission. There is general oversight by the review committee. This committee can, for instance, check whether the information provided to the Minister and the Investigatory Powers Commission was adequate or can check whether the better information was stored securely.

Now, what does hacking include? I must warn you, the article considering hacking itself covers two full pages. So I’m afraid that is too many details for this hearing. What is important is that the power shall also include the power to penetrate any security features to introduce technical provisions in order to undo the encryption of data stored or processed in the automatic information systems. And it also can introduce technical provisions in connection with the actual exercise of the power referred to in other articles with other means, and to copy data stored or processed in the automated information system. Now, unfortunately, I have to return to my introduction. In the Netherlands, the technical means or tools of the intelligent agencies are considered a state secret, so I cannot tell you that much more about hacking. And I do have to end my presentation here. Thank you for your attention.

Jeroen Lenaers (Chair): Well, thank you very much, Ms. Moussault, for the detailed explanation of the framework in which you operate. I’m sure there are many questions that might also try to extract a little bit more information even from you. And we start with our rapporteur, Sophie in ‚t Veld.

Sophie in ’t Veld (Renew): Yes. Thank you, Chair. And thank you, Madam Moussault, for being with us. I think we are generally grateful, but the more so as other member states have largely declined to cooperate with us, with some exceptions close. A couple of questions.

First of all, you say that logically, the operation of the secret services is secret, and therefore you cannot elaborate on any concrete cases. However, I believe it was last summer that a story broke in the Volkskrant, a Dutch daily, citing four sources in AIVD, the Dutch secret services, the intelligence services, who testified that spyware had been used to track down Ridouan Taghi. One of the worst criminals in the Netherlands who was wanted by the police. But the intelligence services had helped out. And they had used Pegasus or other spyware. I believe it was Pegasus. So can you explain how that works? How does it get out into the media? And if you consider that that is a state secret that had been leaked to the newspaper by no less than four sources? Would you then consider that these people have committed a very serious crime? And can you then confirm that such a crime is investigated and prosecuted? Because we heard nothing about that?

And then secondly, if I understand correctly, there are some legislative changes, policy changes forthcoming, which mean that the ex ante control, ex ante verification is going to be replaced by ex-post verification. And we know that there are some people in the, let’s say, in circles of oversight bodies who have publicly protested against that and said that it will basically make oversight ineffective or in any case, very, very difficult. And given that we are that we are talking about very invasive spyware, how would you assess that legislative change?

And a final question is, I understand that the Dutch authorities, the police and I assume also the intelligence community, will only use spyware products or brands of spyware which are not being sold to oppressive regimes. That’s one of the one of the criteria applied by the Dutch government. However, we know that some of the brands, which I believe are also being used by the Dutch authorities, are also being sold to oppressive regimes. So can you explain to us how the test is done? How do the Dutch authorities verify whether the companies that they are buying the product from are not also selling the stuff to oppressive regimes? Thank you.

Jeroen Lenaers (Chair): Thank you very much. Ms. Moussault.

Mariëtte Moussault: I will try to give some answers, but I’m afraid I’ll have to disappoint you on most of the answers. First of all, about –

Jeroen Lenaers (Chair): So there’s a recurring issue with the with the sound. It’s the iPad, apparently. I’m not sure if there’s something we can do on your end to there. There seems to be a disturbance with the iPad. Could we try again maybe?

Mariëtte Moussault: Yes, does. Is it better now?

Jeroen Lenaers (Chair): No, there is the same creaky, disturbing sound. We will refresh once more. Apologies for the inconvenience, but thanks to the fact that many other member states have refused to come, we have some time today. Welcome back and I hope it works.

Mariëtte Moussault: Okay. Can you hear me now?

Jeroen Lenaers (Chair): It’s much better now. Again, thank you.

Mariëtte Moussault: Then I’ll try it again.

Jeroen Lenaers (Chair): I apologise for the inconvenience. I know it’s very disturbing, but we’ll try to make it work.

Mariëtte Moussault: If this can happen, it’s technical. It’s not perfect. I will try to answer the questions, but I’m afraid I’ll have to disappoint a little bit. As far as the article that was in the paper last summer, I cannot react on articles in papers. If people leaked state secret or not, that is not my responsibility. That is the responsibility of the secret services. So I’m really not the person that can elaborate on that, unfortunately.

About the new law that might be coming or not. I know that there’s been a lot going on. There has been a lot of criticism. But so far, I am confident that also in the new law, there will be an ex-ante proportionality check and I cannot see what the future will bring. There is still a long way to go, but for now there is no reason to think that there will not be a proportionality check by the Investigatory Powers Commission ex-ante.

And the last question was about the idea that only a brand should be used that are not selling to oppressive regimes, how tests are done. I’m sorry, I cannot answer to that either. That is not at all to the competence of the Investigatory Powers Commission. So I’m sorry.

Jeroen Lenaers (Chair): Thank you. We don’t have a representative of the EPP present, so I passed the floor Thijs Reuten on behalf of the S&D.

Thijs Reuten (Socialists and Democrats): Thank you so much, Chair, and thank you, Michel, for being with us. I had a slightly different question because some say that at least elements of the Dutch oversight system could prove to be a best practice. Now, I don’t know if that’s the case, because I’m not aware of all the details of oversight in all the other member states. But do you have some kind of, do you have some kind of a discussions with your peers in other countries exchanging on what could be also improvements or lessons that you could learn from one another in terms of organising the oversight?

And my second question would be, yes, I understood your explanation on the state secrets and calling in the secret as a reason for not providing us with that information. But how is this this argument being used internally in the committee? Because during our investigations we have heard also many occasions being used, this argument being used also as a reason to get out of any sort of difficult question or requests for information. So, can you provide us with some additional insights on that? Thank you.

Jeroen Lenaers (Chair): Thank you. Ms. Moussault.

Mariëtte Moussault: Okay. About the first question about best practice. Yes, we do have some discussions with other oversight bodies. We try to meet on more or less regular basis at least once a year. What is a little bit difficult is that also among oversight bodies, we cannot leak state secrets. So even if we are talking to other oversight bodies, we are limited in the information that we can share. Of course, we can talk about the law, we can talk about practices, etc. and that is something we do. About the second question, I’m afraid I really cannot help you there. I cannot leak state secrets. I cannot tell you what tools are used. And it’s not an argument just used not to answer your question, but I cannot break Dutch law, so I cannot say more than that.

Jeroen Lenaers (Chair): Thank you very much. Róża Thun for Renew. (…) Make sure we have the interpretation also for the for the speaker. Do you have the interpretation, Ms Moussault?

Mariëtte Moussault: I can hear enough.

Jeroen Lenaers (Chair): Okay. Excellent.

Róża Thun und Hohenstein (Renew Europe): So I can speak Polish? Yes.

Jeroen Lenaers (Chair): You can.

Róża Thun und Hohenstein (Renew Europe): (Polish, no translation)

Jeroen Lenaers (Chair): Thank you. Ms. Moussault.

Mariëtte Moussault: Okay. I’ll try to elaborate a little bit more.

Jeroen Lenaers (Chair): I’m sorry. I just I really, really do apologise. But every time we seem to have a little break in the proceeding, when the connection comes back, there is a disturbance. I suggest before we move on, I suggest we refresh again, and then we get into the answer to. To Ms. Thun just to avoid any unnecessary delays.

Welcome back.

Mariëtte Moussault: Can you hear me now?

Jeroen Lenaers (Chair): Is crystal clear again. So please continue with your answer to Róża Thun.

Mariëtte Moussault: Okay. Well, thank you for the question. More practically, the surface will do a request to the minister. In general, this will be a written request with all the arguments, etc.. And if the minister grants authorisation the Investigatory Power Commission will be informed. Now, we will not get each single authorisation, but in general, on Friday or Monday we get a whole batch of, well, it depends a little bit, but more or less 50 authorisations with all the full written requests, with any information that was also presented to the Minister. Now, the Tib of the Investigatory Powers Commission has meetings on Wednesday and Friday, and we also have a staff of lawyers and technical experts, and they prepare all the revisions. So we get together on Wednesday and Friday. And in general, I can say that 98% of all the authorisations are reviewed by our commission at the latest on Friday. Now, in some cases, things are more urgent and in that case, we get a phone call or we get an email, please, in this case, we need a little bit more hurry. And in those cases, we try to decide as soon as possible.

Róża Thun und Hohenstein (Renew Europe): Can I just clarify a little?

Jeroen Lenaers (Chair): Yes, of course. Please.

Róża Thun und Hohenstein (Renew Europe): Excuse me. I just want to know the judge who takes this last decision. You said it’s the district court of Hague. What information does he or she have?

Mariëtte Moussault: The judge, the District Court of the Hague only decides in cases where a lawyer is involved or a journalist, or when it has to be the opening of a letter. So an old fashioned handwritten letter or a parcel, and that is only a few cases a year. I don’t know exactly that you have to ask to the District Court of The Hague, but I think 99% of all the requests are reviewed by the Investigatory Powers Commission. Thank you very much.

Róża Thun und Hohenstein (Renew Europe): Thank you very much.

Jeroen Lenaers (Chair): Thank you. Your microphone is still on, Róża.

Róża Thun und Hohenstein (Renew Europe): Sorry.

Jeroen Lenaers (Chair): Thank you very much.

Katharina Barley (Socialists and Democrats): May I just add a short question? Because you mentioned now only lawyers and journalists. Usually there are others like priests, for example, or politicians that also fall in other countries under this scope of ethics exceptions, is it really only lawyers and journalists?

Mariëtte Moussault: That’s correct, according to the Dutch law only journalists and lawyers are referred to by the court and all the other cases are reviewed by the Investigatory Powers Commission. Well, I guess that’s one of the reason in Investigatory Power commissions, there are at least two persons with at a minimum six years of legal experience.

Jeroen Lenaers (Chair): It just shows you the precarious position we are in as politicians in the Netherlands. Thank you very much. Is there anybody else who would like to take the floor at this point in time? There is not. Then I thank very much, Madame Moussault, for being with us today. I understand it’s not easy to appear in front of a committee like ours. Also, with the restrictions on what you can inform us about them that you naturally have. So. Oh, there is one. There is one more additional question. My apologies.

Katharina Barley (Socialists and Democrats): Sorry. It might be a stupid question, but we were discussing. The criteria are the same for the decision of the judge or your decision, right, if to grant the use?

Mariëtte Moussault: The judge also will review the necessity to subsidiarity, as targeted as possible and proportionality. These criteria are in the Dutch law. The difference is that the judge does the review by him or herself and the Investigatory Powers Commission is a review by a committee. We are three.

Jeroen Lenaers (Chair): Okay. There are no further questions. Then we can close this point here. Once again, thank you very much, Ms. Moussault, for your willingness to join us this afternoon. And please do keep a close eye also on the and the further work of a committee and the recommendations that we will publish later. Thank you very much.

Mariëtte Moussault: Bye.

Jeroen Lenaers (Chair): We come to the end of this point before I will move to point six of our agenda, which is the chair’s announcements. The only announcement that I have is that we had a coordinators meeting this afternoon or this morning actually, where the coordinators made a number of decisions that I would like to inform you about.

One, that the draft programme for our mission to Hungary was approved. Second, that I would request authorisation for a mission to Madrid in Spain on the 20th and 21st of March 2022. Third, to request authorisation to hold a hearing on spyware and telecommunications companies. Fourth, to hold an exchange of views with Executive Vice President of the European Commission, Valdis Dombrovskis, on the topic of the dual use regulation. Fifth, to invite Mr. Rammos of the ADAE and Mr. Menoudakos, who is the Greek Data Protection Authority for an exchange of views in the committee. Six, to devote one panel during the hearing on Geopolitics of Spyware on the 9th of February 2022 to Morocco. Now, these are the six decisions made.

I received the information from the ECR group that they would like to contest the decision the coordinators took to ask the chair to request authorisation for a mission to Madrid in Spain on the 20th and 21st of March 2022. And of course, when one of the political groups decides to contest a decision made by the coordinators it is common practice that we should have a vote on this in our committee at the next available option. So. Okay. I think we’ve indicated 4:00 for this point on the agenda. So if nobody objects, we will wait for another 2 minutes. So members who would like to vote on this particular point also have the opportunity to vote. I will remind you that in order to vote, we need to have a quorum that reflects one fourth of the members of our committee, which in our case is 9.25. So we’ll rounded up to ten members necessary and it can be members or substitutes of the PEGA committee or other members, if they are so indicated to the chair before the start of the voting session. So far I have received no such indications. Yes.