Sursa foto: Safetech Innovations / Facebook
The Cîțu government passed a bill just three days before it was due to be dismissed that allows authorities to intercept the “content of encrypted communications”, i.e. those made via platforms such as Skype, WhatsApp, Facebook Messanger, Signal, Wire or Telegram, says the Association for Technology and the Internet (APTI).
Meanwhile, the bill has already been adopted by the Chamber of Deputies, but still awaits debate and vote in the Senate, the decision-making chamber.
The draft law was intended to transpose EU Directive 2018/1972 (European Communications Code) into Romanian law. It was launched for public debate by the Ministry of Transport and Communications in October 2020.
Recomandări Video
Articolul continuă mai jos
“Although the directive was supposed to be transposed by 21 December 2020, it was left somewhere in the Government for almost a year until USR left the coalition. Then, just 3 days before being dismissed (coincidence or not?!?), the Câțu government suddenly adopted it in the last government meeting. It then enters the parliamentary circuit, and passes through the Chamber of Deputies like cheese and is adopted on 7 December 2021.
Only that between the version in public debate and the one adopted by the government there is a new addition in the motivation called “Legislative changes relevant to the field of national security”, two definitions (obviously written by people who have not worked in the field, after the absolutely improper formulations) and art 10^2 inserted in an area that has nothing to do with the subject of the other 299 pages”, says the executive director of the Association for Technology and Internet, Bogdan Manolea.
What Article 10^2 says about interception of communications:
Art.10^2. – (1) Providers of electronic hosting services with IP resources and providers of interpersonal communication services that are not based on numbers are obliged to support law enforcement bodies and bodies with powers in the field of national security, within the limits of their competences, for the implementation of technical surveillance methods or authorization acts ordered in accordance with the provisions of Law no. 135/2010 on the Code of Criminal Procedure, as amended and supplemented, and Law no. 51/1991 on national security, republished, as amended and supplemented, respectively:
(a) to enable lawful interception of communications, including bearing the costs thereof;
(b) to grant access to the content of encrypted communications transmitted over its networks;
(c) provide the information retained or stored relating to traffic data, subscriber or customer identification data, payment methods and access history with the related time stamps;
(d) allow, in the case of providers of electronic hosting services with IP resources, access to their own computer systems in order to copy or extract existing data.
(2) The obligations laid down in paragraph 2 shall (1)(a) to (c) shall also apply to providers of electronic communications networks or services.”
The ATI Director then explains a few terms:
“Providers of electronic hosting services with IP resources” – are in fact the same as web hosting providers (in fact, already regulated in Law 365/2002), who provide services “on the territory of Romania” according to the newly invented definition in Art 4(1), new point 9^5.
“Interpersonal communication service not based on numbers” – is what used to be called “instant messaging or chat messaging” a few years ago and basically falls into this category Skype, WhatsApp, Facebook Messanger, Signal, Wire, Telegram or for the more nostalgic Yahoo Messanger, AIM, ICQ or even IRC. (..) Mind you, these are not only those who offer services “on the territory of Romania”. (keyword- hint: “transited”)
“National security bodies”- this is the same vague terminology already declared unconstitutional in 2008 (and other decisions). Anyway no one is able to list them, let alone the exact powers, the 1991 law find just as vague today.”
Bogdan Manolea therefore argues that the new provisions were introduced by the Cîțu government in addition to the original draft and do not respect either the obligations to transpose the directive or constitutional rules. “The aspects related to the lawful interception of communications, with all the necessary safeguards (well, until further decisions of unconstitutionality, I say that the 2016 decision is only the first in a series if some substantive issues are not resolved) are provided for in the Code of Criminal Procedure (CPP). Logically, if there were any problem or need to update them it would still be done through an amendment to this code. (Hint: it’s an organic law, hard to amend). Except that beyond imposing similar obligations on other categories of providers (who are not related to ANCOM anyway) on where they walk in 2021 content and legal and illegal. (perhaps debatable, but then it should be in the CPP and not on the hush), the text greatly broadens the spectrum of interception and access actions, which the CPP does not provide for”, says the representative of the Association for Technology and Internet.