"US-Aktivist: Berlin tut gar nichts"

I was interviewed for a feature this past weekend in the Neue Osnabrücker Zeitung newspaper in Gernany, “Für deutsches Datenrecht” — US-Aktivist: Berlin tut gar nichts (by Waltraud Messmann, 21 December 2013).

The full interview (in German translation) ran in the print edition. But since only the introduction seems to be available online, and the subject may be of interest to those who don’t read German, I’m posting the original interview (which was conducted in English) below:

Neue Osnabrücker Zeitung: Have you been surprised by what has been uncovered by former NSA employee Edward Snowden?

Edward Hasbrouck: No, I have not been surprised. Snowden has provided more proof, and more details. But everything he has revealed was already suspected.

NOZ: Do you think his revelations to date are only the tip of the iceberg?

EH: I don’t know. How much worse can it get?

NOZ: What else do you expect to come up in the future?

I think we have a good picture now of the NSA panopticon. Maybe there is still more to learn about how this information was “shared” with U.S. government agencies outside the NSA, or other countries. For example, what role does information from NSA spying play in “no-fly” decisions, in the U.S. or in other countries that rely on the U.S. “no-fly” list?

NOZ: Does the Snowden affair impact the attitude of the American public towards data security?

EH: In the U.S., there is a big difference between attitudes toward big government and big corporations. I think “l’affaire Snowden” has changed the attitude of the American people toward the government’s post 9/11 spying the way Daniel Ellsberg’s leak of the Pentagon Papers, the publication of documents stolen from the FBI that revealed Cointelpro, and then Watergate changed attitudes toward government temporarily.

I don’t know how much this has changed attitudes toward the corporations that collaborate with and enable government spying, or that carry out their own corporate spying on individuals for their profit (which is legal because there is no general data protection law in the U.S.).

The big questions are whether the public will insist on changes in government practices, and whether those will also affect commercial “big data”.

NOZ: You warned the European Parliament years ago that DHS has “root access” to the worldwide “Computerized Reservation Systems”. Has your suspicion been confirmed?

EH: This was confirmed in 2007 with some of the first responses to our requests for DHS dossiers about individual travellers. There is information in these DHS records regarding journeys within Europe, not to or from the U.S., that would not be accessible without root access. See the examples in these slides, especially p. 23.

NOZ: Did Brussels react to your warning?

EH: No. Neither the European Commission nor any national data protection authority has taken any action against the CRSs or against companies that collect personal data in the EU but store it with CRSs in the U.S.

NOZ: What role, do you think, is the German government playing in this game?

EH: The role of the German government is passive: It does nothing, even when German companies (and other companies that operate in Germany) violate German data protection law. [I discussed this issue with the German Minister of Justice during a private meeting in Berlin in October 2011, although I forgot to mention this in the interview with the NOZ.] And the German government allows the DHS to operate in Germany.

NOZ: Have you any hint that European or German authorities support NSA or DHS in spying on airline passengers? If yes, how?

EH: I don’t know about the NSA. But the German government definitely works with the DHS. DHS “advisors” stationed at Frankfurt Airport in Germany make “recommendations” to German and foreign airlines, and the German government, about which German and foreign citizens to refuse to allow to board flights. Airlines and the German government follow these U.S. “recommendations”, even when the U.S. keeps secret the reasons (if any) for these recommendations, which may be arbitrary or based on false allegations which the traveller does not know and cannot rebut. This was confirmed by Andrej Hunko in 2011.

These DHS advisors include the “Immigration Advisory Program” (IAP), which was discussed in the recent (27 November 2013) report on U.S. compliance with the PNR agreement.

The role of U.S. “advisors” was also discussed this month in the first trial in a lawsuit in U.S. court challenging a “no-fly” order. (More on this very strange trial.)

We know that these U.S. “advisors” are given some access to non-U.S. PNR data. We don’t know the extent of this access, or the exact access method.

NOZ: What practical consequences can that have for the traveller?

EH: You can be denied boarding on a flight on a non-U.S. airline, between places outside the U.S. — even a flight within Europe on a European airline — on the basis of a “recommendation” from the U.S. government. That recommendation can be based on your PNR data and on secret
evidence. The U.S. does not provide any process for a judicial review of this “recommendation”.

NOZ: You went to court against Lufthansa: Why? Has there been any judgment until now?

EH: In 2010, I brought a formal complaint against Lufthansa with the “Landesbeauftragter fur Datenschutz und Informationsfreiheit Nordrhein-Westfalen”.

The basis for my complaint is that Lufthansa (1) did not control, and kept no record of, who accessed PNR data and other records about me, and (2) appointed and authorized agents to act on its behalf, but did not require them to comply with German data protection law.

I was told I was dealing with Lufthansa. I provided information to Lufthansa, Lufthansa charged my credit card, and Lufthansa issued my ticket. But Lufthansa claimed that it was not
responsible for the actions of its agents or contractors, and refused to tell me how the information about me had been used by Lufthansa’s agents and contractors.

The LDI-NRW rejected my complaint.

I believe that this was legally incorrect, according to both German and EU law. But I have not had enough money to hire a German lawyer to bring a legal case in German court against Lufthansa and/or the LDI-NRW. (In the U.S., we have many legal NGOs that bring public interest lawsuits like this “pro bono”, but I have been told that this is not allowed in Germany.)