Europol wants to drop privacy protections for mobile roaming

The solutions the agency is proposing would see the removal of Privacy Enhancing Technologies (PET) either by default for all users or by individual requests.

Mobile roaming, also known as home routing, is the technology that enables telecom operators to carry on delivering network services to end users while they are abroad (either through roaming agreements or via the provider’s own network in the destination country).

But as the communications abroad are still processed by the home network rather than the destination country, operators cannot share communication data with law enforcements. According to Europol that is the case even through a judicial request, so long as the domestic service has PET enabled. This, the agency says, creates a loophole for criminals.

Europol says that once a user is roaming, “any suspect using a foreign SIM card can no longer be intercepted. This problem occurs both when a foreign national uses their own (foreign) SIM card in another country, and when citizens or residents use a foreign SIM card in their own country.

“The only current exception for this is when a domestic service provider (to whom domestic interception orders can be sent) has in place a cooperation agreement which disables PET in Home Routing with the service provider of another country.”

As a result, the agency is seeking a solution to the challenges it faces and its position paper aims to highlight these to legislators, national authorities, as well as telecom operators. It makes recommendations to maintain “investigatory powers”.

PETs are described as technologies that embody the fundamental data protection principles. In this context, the PET feature that is causing Europol (and perhaps others) challenges is the service-level encryption that is turned on when users are roaming. While law enforcement is able to see that a suspect is communicating, they are unable to gather any evidence from the device used.

The Europol paper proposes two solutions.

In the first, PETs would be legally disabled for everyone while roaming (i.e. by default). The agency argues that when abroad users do not benefit from the encryption layer (PET) anyway as they roam on a different service provider’s network. It says “the communication is encrypted at the same level as communication via national SIM cards”.

This seems to be alluding to a fact that warrants or court orders are not needed in order for an operator to intercept communication and while this is the case for instance in the UK under its Telecommunications Act (now a non-EU country), it is not true across all EU member states. In Germany for instance, telecommunication surveillance by the police and law enforcement authorities are indeed subject to a judge’s authorisation (i.e. a warrant).

The second alternative – somewhat more sensible than removing privacy protection technologies by default for all and data ending up subject to abuse – is the ability to request the interception of a suspect’s communication data while abroad. Presumably this would rely on a mandatory agreement between member states and perhaps for the data to be intercepted (one would hope) only upon a legal request. It seems this solution would retain PETs for all other users.

Plainly speaking, the agency is seeking amendment to legislation (potentially the European Investigation Order) that would enable it and other law enforcement agencies to circumvent current privacy protection laws and technologies. It is unclear how the proposed solutions would play out in countries that do require a court order under their national legislation to intercept communication.

In addition, the current socio-political climate between citizens and law enforcement is increasingly one of lacking trust and as human rights and freedoms of speech continue to be under attack across the political spectrum from left to right in many European states, such a legal change may be one hard to swallow.